diff --git a/dependency-check-cli/src/main/java/org/owasp/dependencycheck/App.java b/dependency-check-cli/src/main/java/org/owasp/dependencycheck/App.java index e842264eb..7e5f33a9a 100644 --- a/dependency-check-cli/src/main/java/org/owasp/dependencycheck/App.java +++ b/dependency-check-cli/src/main/java/org/owasp/dependencycheck/App.java @@ -253,6 +253,10 @@ public class App { final String suppressionFile = cli.getSuppressionFile(); final boolean jarDisabled = cli.isJarDisabled(); final boolean archiveDisabled = cli.isArchiveDisabled(); + final boolean pyDistDisabled = cli.isPythonDistributionDisabled(); + final boolean cMakeDisabled = cli.isCmakeDisabled(); + final boolean pyPkgDisabled = cli.isPythonPackageDisabled(); + final boolean autoconfDisabled = cli.isAutoconfDisabled(); final boolean assemblyDisabled = cli.isAssemblyDisabled(); final boolean nuspecDisabled = cli.isNuspecDisabled(); final boolean centralDisabled = cli.isCentralDisabled(); @@ -320,9 +324,10 @@ public class App { //File Type Analyzer Settings Settings.setBoolean(Settings.KEYS.ANALYZER_JAR_ENABLED, !jarDisabled); Settings.setBoolean(Settings.KEYS.ANALYZER_ARCHIVE_ENABLED, !archiveDisabled); - Settings.setBoolean(Settings.KEYS.ANALYZER_PYTHON_DISTRIBUTION_ENABLED, !cli.isPythonDistributionDisabled()); - Settings.setBoolean(Settings.KEYS.ANALYZER_PYTHON_PACKAGE_ENABLED, !cli.isPythonPackageDisabled()); - Settings.setBoolean(Settings.KEYS.ANALYZER_AUTOCONF_ENABLED, !cli.isAutoconfDisabled()); + Settings.setBoolean(Settings.KEYS.ANALYZER_PYTHON_DISTRIBUTION_ENABLED, !pyDistDisabled); + Settings.setBoolean(Settings.KEYS.ANALYZER_PYTHON_PACKAGE_ENABLED, !pyPkgDisabled); + Settings.setBoolean(Settings.KEYS.ANALYZER_AUTOCONF_ENABLED, !autoconfDisabled); + Settings.setBoolean(Settings.KEYS.ANALYZER_CMAKE_ENABLED, !cMakeDisabled); Settings.setBoolean(Settings.KEYS.ANALYZER_NUSPEC_ENABLED, !nuspecDisabled); Settings.setBoolean(Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED, !assemblyDisabled); Settings.setBoolean(Settings.KEYS.ANALYZER_OPENSSL_ENABLED, !cli.isOpenSSLDisabled()); diff --git a/dependency-check-cli/src/main/java/org/owasp/dependencycheck/CliParser.java b/dependency-check-cli/src/main/java/org/owasp/dependencycheck/CliParser.java index ade1bec72..504e60f90 100644 --- a/dependency-check-cli/src/main/java/org/owasp/dependencycheck/CliParser.java +++ b/dependency-check-cli/src/main/java/org/owasp/dependencycheck/CliParser.java @@ -384,6 +384,8 @@ public final class CliParser { final Option disableOpenSSLAnalyzer = OptionBuilder.withLongOpt(ARGUMENT.DISABLE_OPENSSL) .withDescription("Disable the OpenSSL Analyzer.").create(); + final Option disableCmakeAnalyzer = OptionBuilder.withLongOpt(ARGUMENT.DISABLE_CMAKE). + withDescription("Disable the Cmake Analyzer.").create(); final Option disableCentralAnalyzer = OptionBuilder.withLongOpt(ARGUMENT.DISABLE_CENTRAL) .withDescription("Disable the Central Analyzer. If this analyzer is disabled it is likely you also want to disable " @@ -412,6 +414,7 @@ public final class CliParser { .addOption(disableArchiveAnalyzer) .addOption(disableAssemblyAnalyzer) .addOption(disablePythonDistributionAnalyzer) + .addOption(disableCmakeAnalyzer) .addOption(disablePythonPackageAnalyzer) .addOption(disableAutoconfAnalyzer) .addOption(disableOpenSSLAnalyzer) @@ -431,7 +434,7 @@ public final class CliParser { * @param options a collection of command line arguments * @throws IllegalArgumentException thrown if there is an exception */ - @SuppressWarnings("static-access") + @SuppressWarnings({"static-access", "deprecation"}) private void addDeprecatedOptions(final Options options) throws IllegalArgumentException { final Option proxyServer = OptionBuilder.withArgName("url").hasArg().withLongOpt(ARGUMENT.PROXY_URL) @@ -540,6 +543,15 @@ public final class CliParser { return (line != null) && line.hasOption(ARGUMENT.DISABLE_PY_PKG); } + /** + * Returns true if the disableCmake command line argument was specified. + * + * @return true if the disableCmake command line argument was specified; otherwise false + */ + public boolean isCmakeDisabled() { + return (line != null) && line.hasOption(ARGUMENT.DISABLE_CMAKE); + } + /** * Returns true if the disableAutoconf command line argument was specified. * @@ -735,6 +747,7 @@ public final class CliParser { * * @return the proxy server */ + @SuppressWarnings("deprecation") public String getProxyServer() { String server = line.getOptionValue(ARGUMENT.PROXY_SERVER); @@ -979,7 +992,7 @@ public final class CliParser { /** * The CLI argument name indicating the proxy url. * - * @deprecated use {@link org.owasp.dependencycheck.cli.CliParser.ArgumentName#PROXY_SERVER} instead + * @deprecated use {@link #PROXY_SERVER} instead */ @Deprecated public static final String PROXY_URL = "proxyurl"; @@ -1068,6 +1081,10 @@ public final class CliParser { * Disables the Autoconf Analyzer. */ public static final String DISABLE_AUTOCONF = "disableAutoconf"; + /** + * Disables the Cmake Analyzer. + */ + public static final String DISABLE_CMAKE = "disableCmake"; /** * Disables the Assembly Analyzer. */ diff --git a/dependency-check-cli/src/site/markdown/arguments.md b/dependency-check-cli/src/site/markdown/arguments.md index c0889b864..15a1248cc 100644 --- a/dependency-check-cli/src/site/markdown/arguments.md +++ b/dependency-check-cli/src/site/markdown/arguments.md @@ -32,6 +32,7 @@ Short | Argument Name        | Paramete | \-\-disablePyPkg | | Sets whether the Python Package Analyzer will be used. | false | \-\-disableAutoconf | | Sets whether the Autoconf Analyzer will be used. | false | \-\-disableOpenSSL | | Sets whether the OpenSSL Analyzer will be used. | false + | \-\-disableCmake | | Sets whether the Cmake Analyzer will be used. | false | \-\-disableArchive | | Sets whether the Archive Analyzer will be used. | false | \-\-zipExtensions | \ | A comma-separated list of additional file extensions to be treated like a ZIP file, the contents will be extracted and analyzed. |   | \-\-disableJar | | Sets whether the Jar Analyzer will be used. | false diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/CMakeAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/CMakeAnalyzer.java new file mode 100644 index 000000000..0d6dd7457 --- /dev/null +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/CMakeAnalyzer.java @@ -0,0 +1,211 @@ +/* + * This file is part of dependency-check-core. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * Copyright (c) 2015 Institute for Defense Analyses. All Rights Reserved. + */ +package org.owasp.dependencycheck.analyzer; + +import org.apache.commons.io.FileUtils; +import org.apache.commons.lang.StringUtils; +import org.owasp.dependencycheck.Engine; +import org.owasp.dependencycheck.analyzer.exception.AnalysisException; +import org.owasp.dependencycheck.dependency.Confidence; +import org.owasp.dependencycheck.dependency.Dependency; +import org.owasp.dependencycheck.utils.Checksum; +import org.owasp.dependencycheck.utils.FileFilterBuilder; +import org.owasp.dependencycheck.utils.Settings; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import java.io.File; +import java.io.FileFilter; +import java.io.IOException; +import java.security.MessageDigest; +import java.security.NoSuchAlgorithmException; +import java.util.regex.Matcher; +import java.util.regex.Pattern; + +/** + *

Used to analyze CMake build files, and collect information that can be used to + * determine the associated CPE.

+ *

+ *

Note: This analyzer catches straightforward invocations of the project command, plus some other observed + * patterns of version inclusion in real CMake projects. Many projects make use of older versions of CMake and/or + * use custom "homebrew" ways to insert version information. Hopefully as the newer CMake call pattern grows in usage, + * this analyzer allow more CPEs to be identified.

+ * + * @author Dale Visser + */ +public class CMakeAnalyzer extends AbstractFileTypeAnalyzer { + + /** + * The logger. + */ + private static final Logger LOGGER = LoggerFactory.getLogger(CMakeAnalyzer.class); + + /** + * Used when compiling file scanning regex patterns. + */ + private static final int REGEX_OPTIONS = Pattern.DOTALL + | Pattern.CASE_INSENSITIVE | Pattern.MULTILINE; + + private static final Pattern PROJECT = Pattern.compile( + "^ *project *\\([ \\n]*(\\w+)[ \\n]*.*?\\)", REGEX_OPTIONS); + + // Group 1: Product + // Group 2: Version + private static final Pattern SET_VERSION = Pattern + .compile( + "^ *set\\s*\\(\\s*(\\w+)_version\\s+\"?(\\d+(?:\\.\\d+)+)[\\s\"]?\\)", + REGEX_OPTIONS); + + /** + * Detects files that can be analyzed. + */ + private static final FileFilter FILTER = FileFilterBuilder.newInstance().addExtensions(".cmake") + .addFilenames("CMakeLists.txt").build(); + + private static MessageDigest sha1 = null; + + static { + try { + sha1 = MessageDigest.getInstance("SHA1"); + } catch (NoSuchAlgorithmException e) { + LOGGER.error(e.getMessage()); + } + } + + /** + * Returns the name of the CMake analyzer. + * + * @return the name of the analyzer + **/ + @Override + public String getName() { + return "CMake Analyzer"; + } + + /** + * Tell that we are used for information collection. + * + * @return INFORMATION_COLLECTION + */ + @Override + public AnalysisPhase getAnalysisPhase() { + return AnalysisPhase.INFORMATION_COLLECTION; + } + + /** + * Returns the set of supported file extensions. + * + * @return the set of supported file extensions + */ + @Override + protected FileFilter getFileFilter() { + return FILTER; + } + + /** + * No-op initializer implementation. + * + * @throws Exception never thrown + */ + @Override + protected void initializeFileTypeAnalyzer() throws Exception { + // Nothing to do here. + } + + /** + * Analyzes python packages and adds evidence to the dependency. + * + * @param dependency the dependency being analyzed + * @param engine the engine being used to perform the scan + * @throws AnalysisException thrown if there is an unrecoverable error analyzing the + * dependency + */ + @Override + protected void analyzeFileType(Dependency dependency, Engine engine) + throws AnalysisException { + final File file = dependency.getActualFile(); + final String parentName = file.getParentFile().getName(); + final String name = file.getName(); + dependency.setDisplayFileName(String.format("%s%c%s", parentName, File.separatorChar, name)); + String contents; + try { + contents = FileUtils.readFileToString(file).trim(); + } catch (IOException e) { + throw new AnalysisException( + "Problem occurred while reading dependency file.", e); + } + + if (StringUtils.isNotBlank(contents)) { + Matcher m = PROJECT.matcher(contents); + int count = 0; + while (m.find()) { + count++; + LOGGER.debug(String.format( + "Found project command match with %d groups: %s", + m.groupCount(), m.group(0))); + final String group = m.group(1); + LOGGER.debug("Group 1: " + group); + dependency.getProductEvidence().addEvidence(name, "Project", + group, Confidence.HIGH); + } + LOGGER.debug(String.format("Found %d matches.", count)); + analyzeSetVersionCommand(dependency, engine, contents); + } + } + + private void analyzeSetVersionCommand(Dependency dependency, Engine engine, String contents) { + final Dependency orig = dependency; + Matcher m = SET_VERSION.matcher(contents); + int count = 0; + while (m.find()) { + count++; + LOGGER.debug(String.format( + "Found project command match with %d groups: %s", + m.groupCount(), m.group(0))); + String product = m.group(1); + final String version = m.group(2); + LOGGER.debug("Group 1: " + product); + LOGGER.debug("Group 2: " + version); + final String alias_prefix = "ALIASOF_"; + if (product.startsWith(alias_prefix)) { + product = product.replaceFirst(alias_prefix, ""); + } + if (count > 1) { + dependency = new Dependency(orig.getActualFile()); + dependency.setDisplayFileName(String.format("%s:%s", orig.getDisplayFileName(), product)); + final String filePath = String.format("%s:%s", orig.getFilePath(), product); + dependency.setFilePath(filePath); + + // prevents coalescing into the dependency provided by engine + dependency.setSha1sum(Checksum.getHex(sha1.digest(filePath.getBytes()))); + engine.getDependencies().add(dependency); + } + final String source = dependency.getDisplayFileName(); + dependency.getProductEvidence().addEvidence(source, "Product", + product, Confidence.MEDIUM); + dependency.getVersionEvidence().addEvidence(source, "Version", + version, Confidence.MEDIUM); + } + LOGGER.debug(String.format("Found %d matches.", count)); + } + + @Override + protected String getAnalyzerEnabledSettingKey() { + return Settings.KEYS.ANALYZER_CMAKE_ENABLED; + } +} diff --git a/dependency-check-core/src/main/resources/META-INF/services/org.owasp.dependencycheck.analyzer.Analyzer b/dependency-check-core/src/main/resources/META-INF/services/org.owasp.dependencycheck.analyzer.Analyzer index 31a22eb0f..84d9863df 100644 --- a/dependency-check-core/src/main/resources/META-INF/services/org.owasp.dependencycheck.analyzer.Analyzer +++ b/dependency-check-core/src/main/resources/META-INF/services/org.owasp.dependencycheck.analyzer.Analyzer @@ -15,4 +15,5 @@ org.owasp.dependencycheck.analyzer.AssemblyAnalyzer org.owasp.dependencycheck.analyzer.PythonDistributionAnalyzer org.owasp.dependencycheck.analyzer.PythonPackageAnalyzer org.owasp.dependencycheck.analyzer.AutoconfAnalyzer -org.owasp.dependencycheck.analyzer.OpenSSLAnalyzer \ No newline at end of file +org.owasp.dependencycheck.analyzer.OpenSSLAnalyzer +org.owasp.dependencycheck.analyzer.CMakeAnalyzer \ No newline at end of file diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/BaseTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/BaseTest.java index 50df38596..1b6a7b4cb 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/BaseTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/BaseTest.java @@ -35,6 +35,15 @@ public class BaseTest { @AfterClass public static void tearDownClass() throws Exception { + File f = new File("./target/data/dc.h2.db"); + if (f.exists() && f.isFile() && f.length() < 71680) { + System.err.println("------------------------------------------------"); + System.err.println("------------------------------------------------"); + System.err.println("I broke the build"); + System.err.println("------------------------------------------------"); + System.err.println("------------------------------------------------"); + } + Settings.cleanup(true); } diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/CMakeAnalyzerTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/CMakeAnalyzerTest.java new file mode 100644 index 000000000..1d5186c39 --- /dev/null +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/CMakeAnalyzerTest.java @@ -0,0 +1,152 @@ +/* + * This file is part of dependency-check-core. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * Copyright (c) 2015 Institute for Defense Analyses. All Rights Reserved. + */ +package org.owasp.dependencycheck.analyzer; + +import org.junit.After; +import org.junit.Before; +import org.junit.Test; +import org.owasp.dependencycheck.BaseTest; +import org.owasp.dependencycheck.Engine; +import org.owasp.dependencycheck.analyzer.exception.AnalysisException; +import org.owasp.dependencycheck.data.nvdcve.DatabaseException; +import org.owasp.dependencycheck.dependency.Dependency; + +import java.io.File; +import java.util.List; +import java.util.regex.Pattern; + +import static org.hamcrest.CoreMatchers.equalTo; +import static org.hamcrest.CoreMatchers.is; +import static org.junit.Assert.*; +import org.owasp.dependencycheck.data.nvdcve.BaseDBTestCase; + +/** + * Unit tests for CmakeAnalyzer. + * + * @author Dale Visser + */ +public class CMakeAnalyzerTest extends BaseDBTestCase { + + /** + * The package analyzer to test. + */ + CMakeAnalyzer analyzer; + + /** + * Setup the CmakeAnalyzer. + * + * @throws Exception if there is a problem + */ + @Before + public void setUp() throws Exception { + super.setUp(); + analyzer = new CMakeAnalyzer(); + analyzer.setFilesMatched(true); + analyzer.initialize(); + } + + /** + * Cleanup any resources used. + * + * @throws Exception if there is a problem + */ + @After + public void tearDown() throws Exception { + analyzer.close(); + analyzer = null; + } + + /** + * Test of getName method, of class PythonPackageAnalyzer. + */ + @Test + public void testGetName() { + assertThat(analyzer.getName(), is(equalTo("CMake Analyzer"))); + } + + /** + * Test of supportsExtension method, of class PythonPackageAnalyzer. + */ + @Test + public void testAccept() { + assertTrue("Should support \"CMakeLists.txt\" name.", + analyzer.accept(new File("CMakeLists.txt"))); + assertTrue("Should support \"cmake\" extension.", + analyzer.accept(new File("test.cmake"))); + } + + /** + * Test whether expected evidence is gathered from OpenCV's CMakeLists.txt. + * + * @throws AnalysisException is thrown when an exception occurs. + */ + @Test + public void testAnalyzeCMakeListsOpenCV() throws AnalysisException { + final Dependency result = new Dependency(BaseTest.getResourceAsFile( + this, "cmake/opencv/CMakeLists.txt")); + analyzer.analyze(result, null); + final String product = "OpenCV"; + assertProductEvidence(result, product); + } + + /** + * Test whether expected evidence is gathered from OpenCV's CMakeLists.txt. + * + * @throws AnalysisException is thrown when an exception occurs. + */ + @Test + public void testAnalyzeCMakeListsZlib() throws AnalysisException { + final Dependency result = new Dependency(BaseTest.getResourceAsFile( + this, "cmake/zlib/CMakeLists.txt")); + analyzer.analyze(result, null); + final String product = "zlib"; + assertProductEvidence(result, product); + } + + private void assertProductEvidence(Dependency result, String product) { + assertTrue("Expected product evidence to contain \"" + product + "\".", + result.getProductEvidence().toString().contains(product)); + } + + /** + * Test whether expected version evidence is gathered from OpenCV's third party cmake files. + * + * @throws AnalysisException is thrown when an exception occurs. + */ + @Test + public void testAnalyzeCMakeListsOpenCV3rdParty() throws AnalysisException, DatabaseException { + final Dependency result = new Dependency(BaseTest.getResourceAsFile( + this, "cmake/opencv/3rdparty/ffmpeg/ffmpeg_version.cmake")); + final Engine engine = new Engine(); + analyzer.analyze(result, engine); + assertProductEvidence(result, "libavcodec"); + assertVersionEvidence(result, "55.18.102"); + assertFalse("ALIASOF_ prefix shouldn't be present.", + Pattern.compile("\\bALIASOF_\\w+").matcher(result.getProductEvidence().toString()).find()); + final List dependencies = engine.getDependencies(); + assertEquals("Number of additional dependencies should be 4.", 4, dependencies.size()); + final Dependency last = dependencies.get(3); + assertProductEvidence(last, "libavresample"); + assertVersionEvidence(last, "1.0.1"); + } + + private void assertVersionEvidence(Dependency result, String version) { + assertTrue("Expected version evidence to contain \"" + version + "\".", + result.getVersionEvidence().toString().contains(version)); + } +} diff --git a/dependency-check-core/src/test/resources/cmake/README.md b/dependency-check-core/src/test/resources/cmake/README.md new file mode 100644 index 000000000..26db88075 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/README.md @@ -0,0 +1,12 @@ +CMakeAnalyzer Test Resources README +=================================== + +opencv/ +------- + +Origin: https://github.com/Itseez/opencv/ + +zlib/ +----- + +Origin: https://github.com/madler/zlib \ No newline at end of file diff --git a/dependency-check-core/src/test/resources/cmake/opencv/3rdparty/ffmpeg/ffmpeg_version.cmake b/dependency-check-core/src/test/resources/cmake/opencv/3rdparty/ffmpeg/ffmpeg_version.cmake new file mode 100644 index 000000000..48fba2b91 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/3rdparty/ffmpeg/ffmpeg_version.cmake @@ -0,0 +1,13 @@ +set(HAVE_FFMPEG 1) +set(HAVE_FFMPEG_CODEC 1) +set(HAVE_FFMPEG_FORMAT 1) +set(HAVE_FFMPEG_UTIL 1) +set(HAVE_FFMPEG_SWSCALE 1) +set(HAVE_FFMPEG_RESAMPLE 0) +set(HAVE_GENTOO_FFMPEG 1) + +set(ALIASOF_libavcodec_VERSION 55.18.102) +set(ALIASOF_libavformat_VERSION 55.12.100) +set(ALIASOF_libavutil_VERSION 52.38.100) +set(ALIASOF_libswscale_VERSION 2.3.100) +set(ALIASOF_libavresample_VERSION 1.0.1) \ No newline at end of file diff --git a/dependency-check-core/src/test/resources/cmake/opencv/CMakeLists.txt b/dependency-check-core/src/test/resources/cmake/opencv/CMakeLists.txt new file mode 100644 index 000000000..d9a17b382 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/CMakeLists.txt @@ -0,0 +1,1185 @@ +# ---------------------------------------------------------------------------- +# Root CMake file for OpenCV +# +# From the off-tree build directory, invoke: +# $ cmake +# +# ---------------------------------------------------------------------------- + + + +include(cmake/OpenCVMinDepVersions.cmake) + +if(CMAKE_GENERATOR MATCHES Xcode AND XCODE_VERSION VERSION_GREATER 4.3) + cmake_minimum_required(VERSION 2.8.8 FATAL_ERROR) +elseif(CMAKE_SYSTEM_NAME MATCHES WindowsPhone OR CMAKE_SYSTEM_NAME MATCHES WindowsStore) + cmake_minimum_required(VERSION 3.1 FATAL_ERROR) + #Required to resolve linker error issues due to incompatibility with CMake v3.0+ policies. + #CMake fails to find _fseeko() which leads to subsequent linker error. + #See details here: http://www.cmake.org/Wiki/CMake/Policies + cmake_policy(VERSION 2.8) +else() + cmake_minimum_required(VERSION "${MIN_VER_CMAKE}" FATAL_ERROR) +endif() + +# Following block can broke build in case of cross-compilng +# but CMAKE_CROSSCOMPILING variable will be set only on project(OpenCV) command +# so we will try to detect crosscompiling by presense of CMAKE_TOOLCHAIN_FILE +if(NOT CMAKE_TOOLCHAIN_FILE) + # it _must_ go before project(OpenCV) in order to work + if(WIN32) + set(CMAKE_INSTALL_PREFIX "${CMAKE_BINARY_DIR}/install" CACHE PATH "Installation Directory") + else() + set(CMAKE_INSTALL_PREFIX "/usr/local" CACHE PATH "Installation Directory") + endif() +else(NOT CMAKE_TOOLCHAIN_FILE) + #Android: set output folder to ${CMAKE_BINARY_DIR} + set( LIBRARY_OUTPUT_PATH_ROOT ${CMAKE_BINARY_DIR} CACHE PATH "root for library output, set this to change where android libs are compiled to" ) + # any crosscompiling + set(CMAKE_INSTALL_PREFIX "${CMAKE_BINARY_DIR}/install" CACHE PATH "Installation Directory") +endif(NOT CMAKE_TOOLCHAIN_FILE) + +if(CMAKE_SYSTEM_NAME MATCHES WindowsPhone OR CMAKE_SYSTEM_NAME MATCHES WindowsStore) + set(WINRT TRUE) +endif(CMAKE_SYSTEM_NAME MATCHES WindowsPhone OR CMAKE_SYSTEM_NAME MATCHES WindowsStore) + +if(WINRT) + add_definitions(-DWINRT -DNO_GETENV) + + # Making definitions available to other configurations and + # to filter dependency restrictions at compile time. + if(CMAKE_SYSTEM_NAME MATCHES WindowsPhone) + set(WINRT_PHONE TRUE) + add_definitions(-DWINRT_PHONE) + elseif(CMAKE_SYSTEM_NAME MATCHES WindowsStore) + set(WINRT_STORE TRUE) + add_definitions(-DWINRT_STORE) + endif() + + if(CMAKE_SYSTEM_VERSION MATCHES 8.1) + set(WINRT_8_1 TRUE) + add_definitions(-DWINRT_8_1) + elseif(CMAKE_SYSTEM_VERSION MATCHES 8.0) + set(WINRT_8_0 TRUE) + add_definitions(-DWINRT_8_0) + endif() +endif() + +if(POLICY CMP0022) + cmake_policy(SET CMP0022 OLD) +endif() + +if(POLICY CMP0026) + # silence cmake 3.0+ warnings about reading LOCATION attribute + cmake_policy(SET CMP0026 OLD) +endif() + +if (POLICY CMP0042) + # silence cmake 3.0+ warnings about MACOSX_RPATH + cmake_policy(SET CMP0042 OLD) +endif() + +# must go before the project command +set(CMAKE_CONFIGURATION_TYPES "Debug;Release" CACHE STRING "Configs" FORCE) +if(DEFINED CMAKE_BUILD_TYPE) + set_property( CACHE CMAKE_BUILD_TYPE PROPERTY STRINGS ${CMAKE_CONFIGURATION_TYPES} ) +endif() + +project(OpenCV CXX C) + +if(MSVC) + set(CMAKE_USE_RELATIVE_PATHS ON CACHE INTERNAL "" FORCE) +endif() + +include(cmake/OpenCVUtils.cmake) + +ocv_clear_vars(OpenCVModules_TARGETS) + +# ---------------------------------------------------------------------------- +# Break in case of popular CMake configuration mistakes +# ---------------------------------------------------------------------------- +if(NOT CMAKE_SIZEOF_VOID_P GREATER 0) + message(FATAL_ERROR "CMake fails to deterimine the bitness of target platform. + Please check your CMake and compiler installation. If you are crosscompiling then ensure that your CMake toolchain file correctly sets the compiler details.") +endif() + +# ---------------------------------------------------------------------------- +# Detect compiler and target platform architecture +# ---------------------------------------------------------------------------- +include(cmake/OpenCVDetectCXXCompiler.cmake) + +# Add these standard paths to the search paths for FIND_LIBRARY +# to find libraries from these locations first +if(UNIX AND NOT ANDROID) + if(X86_64 OR CMAKE_SIZEOF_VOID_P EQUAL 8) + if(EXISTS /lib64) + list(APPEND CMAKE_LIBRARY_PATH /lib64) + else() + list(APPEND CMAKE_LIBRARY_PATH /lib) + endif() + if(EXISTS /usr/lib64) + list(APPEND CMAKE_LIBRARY_PATH /usr/lib64) + else() + list(APPEND CMAKE_LIBRARY_PATH /usr/lib) + endif() + elseif(X86 OR CMAKE_SIZEOF_VOID_P EQUAL 4) + if(EXISTS /lib32) + list(APPEND CMAKE_LIBRARY_PATH /lib32) + else() + list(APPEND CMAKE_LIBRARY_PATH /lib) + endif() + if(EXISTS /usr/lib32) + list(APPEND CMAKE_LIBRARY_PATH /usr/lib32) + else() + list(APPEND CMAKE_LIBRARY_PATH /usr/lib) + endif() + endif() +endif() + +# Add these standard paths to the search paths for FIND_PATH +# to find include files from these locations first +if(MINGW) + if(EXISTS /mingw) + list(APPEND CMAKE_INCLUDE_PATH /mingw) + endif() + if(EXISTS /mingw32) + list(APPEND CMAKE_INCLUDE_PATH /mingw32) + endif() + if(EXISTS /mingw64) + list(APPEND CMAKE_INCLUDE_PATH /mingw64) + endif() +endif() + +# ---------------------------------------------------------------------------- +# OpenCV cmake options +# ---------------------------------------------------------------------------- + +# Optional 3rd party components +# =================================================== +OCV_OPTION(WITH_1394 "Include IEEE1394 support" ON IF (NOT ANDROID AND NOT IOS AND NOT WINRT) ) +OCV_OPTION(WITH_AVFOUNDATION "Use AVFoundation for Video I/O" ON IF IOS) +OCV_OPTION(WITH_CARBON "Use Carbon for UI instead of Cocoa" OFF IF APPLE ) +OCV_OPTION(WITH_VTK "Include VTK library support (and build opencv_viz module eiher)" ON IF (NOT ANDROID AND NOT IOS AND NOT WINRT) ) +OCV_OPTION(WITH_CUDA "Include NVidia Cuda Runtime support" ON IF (NOT IOS AND NOT WINRT) ) +OCV_OPTION(WITH_CUFFT "Include NVidia Cuda Fast Fourier Transform (FFT) library support" ON IF (NOT IOS AND NOT WINRT) ) +OCV_OPTION(WITH_CUBLAS "Include NVidia Cuda Basic Linear Algebra Subprograms (BLAS) library support" OFF IF (NOT IOS AND NOT WINRT) ) +OCV_OPTION(WITH_NVCUVID "Include NVidia Video Decoding library support" OFF IF (NOT IOS AND NOT APPLE) ) +OCV_OPTION(WITH_EIGEN "Include Eigen2/Eigen3 support" ON IF (NOT WINRT) ) +OCV_OPTION(WITH_VFW "Include Video for Windows support" ON IF WIN32 ) +OCV_OPTION(WITH_FFMPEG "Include FFMPEG support" ON IF (NOT ANDROID AND NOT IOS AND NOT WINRT) ) +OCV_OPTION(WITH_GSTREAMER "Include Gstreamer support" ON IF (UNIX AND NOT ANDROID) ) +OCV_OPTION(WITH_GSTREAMER_0_10 "Enable Gstreamer 0.10 support (instead of 1.x)" OFF ) +OCV_OPTION(WITH_GTK "Include GTK support" ON IF (UNIX AND NOT APPLE AND NOT ANDROID) ) +OCV_OPTION(WITH_GTK_2_X "Use GTK version 2" OFF IF (UNIX AND NOT APPLE AND NOT ANDROID) ) +OCV_OPTION(WITH_IPP "Include Intel IPP support" ON IF (X86_64 OR X86) AND NOT WINRT) +OCV_OPTION(WITH_JASPER "Include JPEG2K support" ON IF (NOT IOS) ) +OCV_OPTION(WITH_JPEG "Include JPEG support" ON) +OCV_OPTION(WITH_WEBP "Include WebP support" ON IF (NOT IOS AND NOT WINRT) ) +OCV_OPTION(WITH_OPENEXR "Include ILM support via OpenEXR" ON IF (NOT IOS AND NOT WINRT) ) +OCV_OPTION(WITH_OPENGL "Include OpenGL support" OFF IF (NOT ANDROID AND NOT WINRT) ) +OCV_OPTION(WITH_OPENNI "Include OpenNI support" OFF IF (NOT ANDROID AND NOT IOS AND NOT WINRT) ) +OCV_OPTION(WITH_OPENNI2 "Include OpenNI2 support" OFF IF (NOT ANDROID AND NOT IOS AND NOT WINRT) ) +OCV_OPTION(WITH_PNG "Include PNG support" ON) +OCV_OPTION(WITH_PVAPI "Include Prosilica GigE support" ON IF (NOT ANDROID AND NOT IOS AND NOT WINRT) ) +OCV_OPTION(WITH_GIGEAPI "Include Smartek GigE support" ON IF (NOT ANDROID AND NOT IOS AND NOT WINRT) ) +OCV_OPTION(WITH_QT "Build with Qt Backend support" OFF IF (NOT ANDROID AND NOT IOS AND NOT WINRT) ) +OCV_OPTION(WITH_WIN32UI "Build with Win32 UI Backend support" ON IF WIN32 AND NOT WINRT) +OCV_OPTION(WITH_QUICKTIME "Use QuickTime for Video I/O insted of QTKit" OFF IF APPLE ) +OCV_OPTION(WITH_TBB "Include Intel TBB support" OFF IF (NOT IOS AND NOT WINRT) ) +OCV_OPTION(WITH_OPENMP "Include OpenMP support" OFF) +OCV_OPTION(WITH_CSTRIPES "Include C= support" OFF IF (WIN32 AND NOT WINRT) ) +OCV_OPTION(WITH_PTHREADS_PF "Use pthreads-based parallel_for" OFF IF (NOT WIN32) ) +OCV_OPTION(WITH_TIFF "Include TIFF support" ON IF (NOT IOS) ) +OCV_OPTION(WITH_UNICAP "Include Unicap support (GPL)" OFF IF (UNIX AND NOT APPLE AND NOT ANDROID) ) +OCV_OPTION(WITH_V4L "Include Video 4 Linux support" ON IF (UNIX AND NOT ANDROID) ) +OCV_OPTION(WITH_LIBV4L "Use libv4l for Video 4 Linux support" ON IF (UNIX AND NOT ANDROID) ) +OCV_OPTION(WITH_DSHOW "Build VideoIO with DirectShow support" ON IF (WIN32 AND NOT ARM AND NOT WINRT) ) +OCV_OPTION(WITH_MSMF "Build VideoIO with Media Foundation support" OFF IF WIN32 ) +OCV_OPTION(WITH_XIMEA "Include XIMEA cameras support" OFF IF (NOT ANDROID AND NOT WINRT) ) +OCV_OPTION(WITH_XINE "Include Xine support (GPL)" OFF IF (UNIX AND NOT APPLE AND NOT ANDROID) ) +OCV_OPTION(WITH_CLP "Include Clp support (EPL)" OFF) +OCV_OPTION(WITH_OPENCL "Include OpenCL Runtime support" NOT ANDROID IF (NOT IOS AND NOT WINRT) ) +OCV_OPTION(WITH_OPENCL_SVM "Include OpenCL Shared Virtual Memory support" OFF ) # experimental +OCV_OPTION(WITH_OPENCLAMDFFT "Include AMD OpenCL FFT library support" ON IF (NOT ANDROID AND NOT IOS AND NOT WINRT) ) +OCV_OPTION(WITH_OPENCLAMDBLAS "Include AMD OpenCL BLAS library support" ON IF (NOT ANDROID AND NOT IOS AND NOT WINRT) ) +OCV_OPTION(WITH_DIRECTX "Include DirectX support" ON IF (WIN32 AND NOT WINRT) ) +OCV_OPTION(WITH_INTELPERC "Include Intel Perceptual Computing support" OFF IF (WIN32 AND NOT WINRT) ) +OCV_OPTION(WITH_IPP_A "Include Intel IPP_A support" OFF IF (MSVC OR X86 OR X86_64) ) +OCV_OPTION(WITH_GDAL "Include GDAL Support" OFF IF (NOT ANDROID AND NOT IOS AND NOT WINRT) ) +OCV_OPTION(WITH_GPHOTO2 "Include gPhoto2 library support" ON IF (UNIX AND NOT ANDROID) ) + +# OpenCV build components +# =================================================== +OCV_OPTION(BUILD_SHARED_LIBS "Build shared libraries (.dll/.so) instead of static ones (.lib/.a)" NOT (ANDROID OR IOS) ) +OCV_OPTION(BUILD_opencv_apps "Build utility applications (used for example to train classifiers)" (NOT ANDROID AND NOT WINRT) IF (NOT IOS) ) +OCV_OPTION(BUILD_ANDROID_EXAMPLES "Build examples for Android platform" ON IF ANDROID ) +OCV_OPTION(BUILD_DOCS "Create build rules for OpenCV Documentation" ON IF NOT WINRT) +OCV_OPTION(BUILD_EXAMPLES "Build all examples" OFF ) +OCV_OPTION(BUILD_PACKAGE "Enables 'make package_source' command" ON IF NOT WINRT) +OCV_OPTION(BUILD_PERF_TESTS "Build performance tests" ON IF (NOT IOS AND NOT WINRT) ) +OCV_OPTION(BUILD_TESTS "Build accuracy & regression tests" ON IF (NOT IOS AND NOT WINRT) ) +OCV_OPTION(BUILD_WITH_DEBUG_INFO "Include debug info into debug libs (not MSCV only)" ON ) +OCV_OPTION(BUILD_WITH_STATIC_CRT "Enables use of staticaly linked CRT for staticaly linked OpenCV" ON IF MSVC ) +OCV_OPTION(BUILD_WITH_DYNAMIC_IPP "Enables dynamic linking of IPP (only for standalone IPP)" OFF ) +OCV_OPTION(BUILD_FAT_JAVA_LIB "Create fat java wrapper containing the whole OpenCV library" ON IF NOT BUILD_SHARED_LIBS AND CMAKE_COMPILER_IS_GNUCXX ) +OCV_OPTION(BUILD_ANDROID_SERVICE "Build OpenCV Manager for Google Play" OFF IF ANDROID ) +OCV_OPTION(BUILD_CUDA_STUBS "Build CUDA modules stubs when no CUDA SDK" OFF IF (NOT IOS) ) + +# 3rd party libs +OCV_OPTION(BUILD_ZLIB "Build zlib from source" WIN32 OR APPLE ) +OCV_OPTION(BUILD_TIFF "Build libtiff from source" WIN32 OR ANDROID OR APPLE ) +OCV_OPTION(BUILD_JASPER "Build libjasper from source" WIN32 OR ANDROID OR APPLE ) +OCV_OPTION(BUILD_JPEG "Build libjpeg from source" WIN32 OR ANDROID OR APPLE ) +OCV_OPTION(BUILD_PNG "Build libpng from source" WIN32 OR ANDROID OR APPLE ) +OCV_OPTION(BUILD_OPENEXR "Build openexr from source" (WIN32 OR ANDROID OR APPLE) AND NOT WINRT) +OCV_OPTION(BUILD_TBB "Download and build TBB from source" ANDROID ) + +# OpenCV installation options +# =================================================== +OCV_OPTION(INSTALL_CREATE_DISTRIB "Change install rules to build the distribution package" OFF ) +OCV_OPTION(INSTALL_C_EXAMPLES "Install C examples" OFF ) +OCV_OPTION(INSTALL_PYTHON_EXAMPLES "Install Python examples" OFF ) +OCV_OPTION(INSTALL_ANDROID_EXAMPLES "Install Android examples" OFF IF ANDROID ) +OCV_OPTION(INSTALL_TO_MANGLED_PATHS "Enables mangled install paths, that help with side by side installs." OFF IF (UNIX AND NOT ANDROID AND NOT IOS AND BUILD_SHARED_LIBS) ) +OCV_OPTION(INSTALL_TESTS "Install accuracy and performance test binaries and test data" OFF) + +# OpenCV build options +# =================================================== +OCV_OPTION(ENABLE_PRECOMPILED_HEADERS "Use precompiled headers" ON IF (NOT IOS) ) +OCV_OPTION(ENABLE_SOLUTION_FOLDERS "Solution folder in Visual Studio or in other IDEs" (MSVC_IDE OR CMAKE_GENERATOR MATCHES Xcode) ) +OCV_OPTION(ENABLE_PROFILING "Enable profiling in the GCC compiler (Add flags: -g -pg)" OFF IF CMAKE_COMPILER_IS_GNUCXX ) +OCV_OPTION(ENABLE_COVERAGE "Enable coverage collection with GCov" OFF IF CMAKE_COMPILER_IS_GNUCXX ) +OCV_OPTION(ENABLE_OMIT_FRAME_POINTER "Enable -fomit-frame-pointer for GCC" ON IF CMAKE_COMPILER_IS_GNUCXX AND NOT (APPLE AND CMAKE_COMPILER_IS_CLANGCXX) ) +OCV_OPTION(ENABLE_POWERPC "Enable PowerPC for GCC" ON IF (CMAKE_COMPILER_IS_GNUCXX AND CMAKE_SYSTEM_PROCESSOR MATCHES powerpc.*) ) +OCV_OPTION(ENABLE_FAST_MATH "Enable -ffast-math (not recommended for GCC 4.6.x)" OFF IF (CMAKE_COMPILER_IS_GNUCXX AND (X86 OR X86_64)) ) +OCV_OPTION(ENABLE_SSE "Enable SSE instructions" ON IF ((MSVC OR CMAKE_COMPILER_IS_GNUCXX) AND (X86 OR X86_64)) ) +OCV_OPTION(ENABLE_SSE2 "Enable SSE2 instructions" ON IF ((MSVC OR CMAKE_COMPILER_IS_GNUCXX) AND (X86 OR X86_64)) ) +OCV_OPTION(ENABLE_SSE3 "Enable SSE3 instructions" ON IF ((MSVC OR CMAKE_COMPILER_IS_GNUCXX OR CV_ICC) AND (X86 OR X86_64)) ) +OCV_OPTION(ENABLE_SSSE3 "Enable SSSE3 instructions" OFF IF ((MSVC OR CMAKE_COMPILER_IS_GNUCXX) AND (X86 OR X86_64)) ) +OCV_OPTION(ENABLE_SSE41 "Enable SSE4.1 instructions" OFF IF ((MSVC OR CMAKE_COMPILER_IS_GNUCXX OR CV_ICC) AND (X86 OR X86_64)) ) +OCV_OPTION(ENABLE_SSE42 "Enable SSE4.2 instructions" OFF IF ((MSVC OR CMAKE_COMPILER_IS_GNUCXX) AND (X86 OR X86_64)) ) +OCV_OPTION(ENABLE_POPCNT "Enable POPCNT instructions" OFF IF ((MSVC OR CMAKE_COMPILER_IS_GNUCXX) AND (X86 OR X86_64)) ) +OCV_OPTION(ENABLE_AVX "Enable AVX instructions" OFF IF ((MSVC OR CMAKE_COMPILER_IS_GNUCXX) AND (X86 OR X86_64)) ) +OCV_OPTION(ENABLE_AVX2 "Enable AVX2 instructions" OFF IF ((MSVC OR CMAKE_COMPILER_IS_GNUCXX) AND (X86 OR X86_64)) ) +OCV_OPTION(ENABLE_FMA3 "Enable FMA3 instructions" OFF IF ((MSVC OR CMAKE_COMPILER_IS_GNUCXX) AND (X86 OR X86_64)) ) +OCV_OPTION(ENABLE_NEON "Enable NEON instructions" OFF IF CMAKE_COMPILER_IS_GNUCXX AND (ARM OR AARCH64 OR IOS) ) +OCV_OPTION(ENABLE_VFPV3 "Enable VFPv3-D32 instructions" OFF IF CMAKE_COMPILER_IS_GNUCXX AND (ARM OR AARCH64 OR IOS) ) +OCV_OPTION(ENABLE_NOISY_WARNINGS "Show all warnings even if they are too noisy" OFF ) +OCV_OPTION(OPENCV_WARNINGS_ARE_ERRORS "Treat warnings as errors" OFF ) +OCV_OPTION(ANDROID_EXAMPLES_WITH_LIBS "Build binaries of Android examples with native libraries" OFF IF ANDROID ) +OCV_OPTION(ENABLE_IMPL_COLLECTION "Collect implementation data on function call" OFF ) +OCV_OPTION(GENERATE_ABI_DESCRIPTOR "Generate XML file for abi_compliance_checker tool" OFF IF UNIX) + +if(ENABLE_IMPL_COLLECTION) + add_definitions(-DCV_COLLECT_IMPL_DATA) +endif() + + +# ---------------------------------------------------------------------------- +# Get actual OpenCV version number from sources +# ---------------------------------------------------------------------------- +include(cmake/OpenCVVersion.cmake) + + +# ---------------------------------------------------------------------------- +# Build & install layouts +# ---------------------------------------------------------------------------- + +# Save libs and executables in the same place +set(EXECUTABLE_OUTPUT_PATH "${CMAKE_BINARY_DIR}/bin" CACHE PATH "Output directory for applications" ) + +if (ANDROID) + if (ANDROID_ABI MATCHES "NEON") + set(ENABLE_NEON ON) + endif() + if (ANDROID_ABI MATCHES "VFPV3") + set(ENABLE_VFPV3 ON) + endif() +endif() + +if(ANDROID OR WIN32) + set(OPENCV_DOC_INSTALL_PATH doc) +else() + set(OPENCV_DOC_INSTALL_PATH share/OpenCV/doc) +endif() + +if(WIN32 AND CMAKE_HOST_SYSTEM_NAME MATCHES Windows) + if(DEFINED OpenCV_RUNTIME AND DEFINED OpenCV_ARCH) + set(OpenCV_INSTALL_BINARIES_PREFIX "${OpenCV_ARCH}/${OpenCV_RUNTIME}/") + else() + message(STATUS "Can't detect runtime and/or arch") + set(OpenCV_INSTALL_BINARIES_PREFIX "") + endif() +elseif(ANDROID) + set(OpenCV_INSTALL_BINARIES_PREFIX "sdk/native/") +else() + set(OpenCV_INSTALL_BINARIES_PREFIX "") +endif() + +if(ANDROID) + set(OPENCV_SAMPLES_BIN_INSTALL_PATH "${OpenCV_INSTALL_BINARIES_PREFIX}samples/${ANDROID_NDK_ABI_NAME}") +else() + set(OPENCV_SAMPLES_BIN_INSTALL_PATH "${OpenCV_INSTALL_BINARIES_PREFIX}samples") +endif() + +if(ANDROID) + set(OPENCV_BIN_INSTALL_PATH "${OpenCV_INSTALL_BINARIES_PREFIX}bin/${ANDROID_NDK_ABI_NAME}") +else() + set(OPENCV_BIN_INSTALL_PATH "${OpenCV_INSTALL_BINARIES_PREFIX}bin") +endif() + +if(NOT OPENCV_TEST_INSTALL_PATH) + set(OPENCV_TEST_INSTALL_PATH "${OPENCV_BIN_INSTALL_PATH}") +endif() + +if (OPENCV_TEST_DATA_PATH) + get_filename_component(OPENCV_TEST_DATA_PATH ${OPENCV_TEST_DATA_PATH} ABSOLUTE) +endif() + +if(OPENCV_TEST_DATA_PATH AND NOT OPENCV_TEST_DATA_INSTALL_PATH) + if(ANDROID) + set(OPENCV_TEST_DATA_INSTALL_PATH "sdk/etc/testdata") + elseif(WIN32) + set(OPENCV_TEST_DATA_INSTALL_PATH "testdata") + else() + set(OPENCV_TEST_DATA_INSTALL_PATH "share/OpenCV/testdata") + endif() +endif() + +if(ANDROID) + set(LIBRARY_OUTPUT_PATH "${OpenCV_BINARY_DIR}/lib/${ANDROID_NDK_ABI_NAME}") + set(3P_LIBRARY_OUTPUT_PATH "${OpenCV_BINARY_DIR}/3rdparty/lib/${ANDROID_NDK_ABI_NAME}") + set(OPENCV_LIB_INSTALL_PATH sdk/native/libs/${ANDROID_NDK_ABI_NAME}) + set(OPENCV_3P_LIB_INSTALL_PATH sdk/native/3rdparty/libs/${ANDROID_NDK_ABI_NAME}) + set(OPENCV_CONFIG_INSTALL_PATH sdk/native/jni) + set(OPENCV_INCLUDE_INSTALL_PATH sdk/native/jni/include) + set(OPENCV_SAMPLES_SRC_INSTALL_PATH samples/native) + set(OPENCV_OTHER_INSTALL_PATH sdk/etc) +else() + set(LIBRARY_OUTPUT_PATH "${OpenCV_BINARY_DIR}/lib") + set(3P_LIBRARY_OUTPUT_PATH "${OpenCV_BINARY_DIR}/3rdparty/lib${LIB_SUFFIX}") + + if(WIN32 AND CMAKE_HOST_SYSTEM_NAME MATCHES Windows) + if(OpenCV_STATIC) + set(OPENCV_LIB_INSTALL_PATH "${OpenCV_INSTALL_BINARIES_PREFIX}staticlib${LIB_SUFFIX}") + else() + set(OPENCV_LIB_INSTALL_PATH "${OpenCV_INSTALL_BINARIES_PREFIX}lib${LIB_SUFFIX}") + endif() + set(OPENCV_3P_LIB_INSTALL_PATH "${OpenCV_INSTALL_BINARIES_PREFIX}staticlib${LIB_SUFFIX}") + set(OPENCV_SAMPLES_SRC_INSTALL_PATH samples/native) + set(OPENCV_JAR_INSTALL_PATH java) + set(OPENCV_OTHER_INSTALL_PATH etc) + else() + set(OPENCV_LIB_INSTALL_PATH lib${LIB_SUFFIX}) + set(OPENCV_3P_LIB_INSTALL_PATH share/OpenCV/3rdparty/${OPENCV_LIB_INSTALL_PATH}) + set(OPENCV_SAMPLES_SRC_INSTALL_PATH share/OpenCV/samples) + set(OPENCV_JAR_INSTALL_PATH share/OpenCV/java) + set(OPENCV_OTHER_INSTALL_PATH share/OpenCV) + endif() + set(OPENCV_INCLUDE_INSTALL_PATH "include") + + math(EXPR SIZEOF_VOID_P_BITS "8 * ${CMAKE_SIZEOF_VOID_P}") + if(LIB_SUFFIX AND NOT SIZEOF_VOID_P_BITS EQUAL LIB_SUFFIX) + set(OPENCV_CONFIG_INSTALL_PATH lib${LIB_SUFFIX}/cmake/opencv) + else() + set(OPENCV_CONFIG_INSTALL_PATH share/OpenCV) + endif() +endif() + +set(CMAKE_INSTALL_RPATH "${CMAKE_INSTALL_PREFIX}/${OPENCV_LIB_INSTALL_PATH}") +set(CMAKE_INSTALL_RPATH_USE_LINK_PATH TRUE) + +if(INSTALL_TO_MANGLED_PATHS) + set(OPENCV_INCLUDE_INSTALL_PATH ${OPENCV_INCLUDE_INSTALL_PATH}/opencv-${OPENCV_VERSION}) + string(REPLACE "OpenCV" "OpenCV-${OPENCV_VERSION}" OPENCV_3P_LIB_INSTALL_PATH "${OPENCV_3P_LIB_INSTALL_PATH}") + string(REPLACE "OpenCV" "OpenCV-${OPENCV_VERSION}" OPENCV_SAMPLES_SRC_INSTALL_PATH "${OPENCV_SAMPLES_SRC_INSTALL_PATH}") + string(REPLACE "OpenCV" "OpenCV-${OPENCV_VERSION}" OPENCV_CONFIG_INSTALL_PATH "${OPENCV_CONFIG_INSTALL_PATH}") + string(REPLACE "OpenCV" "OpenCV-${OPENCV_VERSION}" OPENCV_DOC_INSTALL_PATH "${OPENCV_DOC_INSTALL_PATH}") + string(REPLACE "OpenCV" "OpenCV-${OPENCV_VERSION}" OPENCV_JAR_INSTALL_PATH "${OPENCV_JAR_INSTALL_PATH}") + string(REPLACE "OpenCV" "OpenCV-${OPENCV_VERSION}" OPENCV_TEST_DATA_INSTALL_PATH "${OPENCV_TEST_DATA_INSTALL_PATH}") + string(REPLACE "OpenCV" "OpenCV-${OPENCV_VERSION}" OPENCV_OTHER_INSTALL_PATH "${OPENCV_OTHER_INSTALL_PATH}") +endif() + + +if(WIN32) + # Postfix of DLLs: + set(OPENCV_DLLVERSION "${OPENCV_VERSION_MAJOR}${OPENCV_VERSION_MINOR}${OPENCV_VERSION_PATCH}") + set(OPENCV_DEBUG_POSTFIX d) +else() + # Postfix of so's: + set(OPENCV_DLLVERSION "") + set(OPENCV_DEBUG_POSTFIX "") +endif() + +if(DEFINED CMAKE_DEBUG_POSTFIX) + set(OPENCV_DEBUG_POSTFIX "${CMAKE_DEBUG_POSTFIX}") +endif() + +if(INSTALL_CREATE_DISTRIB AND BUILD_SHARED_LIBS AND NOT DEFINED BUILD_opencv_world) + set(BUILD_opencv_world ON CACHE INTERNAL "") +endif() + +# ---------------------------------------------------------------------------- +# Path for build/platform -specific headers +# ---------------------------------------------------------------------------- +set(OPENCV_CONFIG_FILE_INCLUDE_DIR "${CMAKE_BINARY_DIR}/" CACHE PATH "Where to create the platform-dependant cvconfig.h") +ocv_include_directories(${OPENCV_CONFIG_FILE_INCLUDE_DIR}) + +# ---------------------------------------------------------------------------- +# Path for additional modules +# ---------------------------------------------------------------------------- +set(OPENCV_EXTRA_MODULES_PATH "" CACHE PATH "Where to look for additional OpenCV modules") + +# ---------------------------------------------------------------------------- +# Autodetect if we are in a GIT repository +# ---------------------------------------------------------------------------- +find_host_package(Git QUIET) + +if(GIT_FOUND) + execute_process(COMMAND "${GIT_EXECUTABLE}" describe --tags --always --dirty --match "[0-9].[0-9].[0-9]*" + WORKING_DIRECTORY "${OpenCV_SOURCE_DIR}" + OUTPUT_VARIABLE OPENCV_VCSVERSION + RESULT_VARIABLE GIT_RESULT + ERROR_QUIET + OUTPUT_STRIP_TRAILING_WHITESPACE + ) + if(NOT GIT_RESULT EQUAL 0) + set(OPENCV_VCSVERSION "unknown") + endif() +else() + # We don't have git: + set(OPENCV_VCSVERSION "unknown") +endif() + + +# ---------------------------------------------------------------------------- +# OpenCV compiler and linker options +# ---------------------------------------------------------------------------- +# In case of Makefiles if the user does not setup CMAKE_BUILD_TYPE, assume it's Release: +if(CMAKE_GENERATOR MATCHES "Makefiles|Ninja" AND "${CMAKE_BUILD_TYPE}" STREQUAL "") + set(CMAKE_BUILD_TYPE Release) +endif() + +include(cmake/OpenCVCompilerOptions.cmake) + + +# ---------------------------------------------------------------------------- +# Use statically or dynamically linked CRT? +# Default: dynamic +# ---------------------------------------------------------------------------- +if(MSVC) + include(cmake/OpenCVCRTLinkage.cmake) +endif(MSVC) + +if(WIN32 AND NOT MINGW) + add_definitions(-D_VARIADIC_MAX=10) +endif(WIN32 AND NOT MINGW) + + +# ---------------------------------------------------------------------------- +# CHECK FOR SYSTEM LIBRARIES, OPTIONS, ETC.. +# ---------------------------------------------------------------------------- +if(UNIX) + find_package(PkgConfig QUIET) + include(CheckFunctionExists) + include(CheckIncludeFile) + + if(NOT APPLE) + CHECK_INCLUDE_FILE(pthread.h HAVE_LIBPTHREAD) + if(ANDROID) + set(OPENCV_LINKER_LIBS ${OPENCV_LINKER_LIBS} dl m log) + elseif(${CMAKE_SYSTEM_NAME} MATCHES "FreeBSD|NetBSD|DragonFly") + set(OPENCV_LINKER_LIBS ${OPENCV_LINKER_LIBS} m pthread) + elseif(EMSCRIPTEN) + # no need to link to system libs with emscripten + else() + set(OPENCV_LINKER_LIBS ${OPENCV_LINKER_LIBS} dl m pthread rt) + endif() + else() + set(HAVE_LIBPTHREAD YES) + endif() +endif() + +include(cmake/OpenCVPCHSupport.cmake) +include(cmake/OpenCVModule.cmake) + +# ---------------------------------------------------------------------------- +# Detect endianness of build platform +# ---------------------------------------------------------------------------- + +if(IOS) + # test_big_endian needs try_compile, which doesn't work for iOS + # http://public.kitware.com/Bug/view.php?id=12288 + set(WORDS_BIGENDIAN 0) +else() + include(TestBigEndian) + test_big_endian(WORDS_BIGENDIAN) +endif() + +# ---------------------------------------------------------------------------- +# Detect 3rd-party libraries +# ---------------------------------------------------------------------------- + +include(cmake/OpenCVFindLibsGrfmt.cmake) +include(cmake/OpenCVFindLibsGUI.cmake) +include(cmake/OpenCVFindLibsVideo.cmake) +include(cmake/OpenCVFindLibsPerf.cmake) + +# ---------------------------------------------------------------------------- +# Detect other 3rd-party libraries/tools +# ---------------------------------------------------------------------------- + +# --- Doxygen and PlantUML for documentation --- +unset(DOXYGEN_FOUND CACHE) +if(BUILD_DOCS) + find_package(Doxygen) + if (PLANTUML_JAR) + message(STATUS "Using PlantUML path from command line: ${PLANTUML_JAR}") + elseif(DEFINED ENV{PLANTUML_JAR}) + set(PLANTUML_JAR $ENV{PLANTUML_JAR}) + message(STATUS "Using PLantUML path from environment: ${PLANTUML_JAR}") + else() + message(STATUS "To enable PlantUML support, set PLANTUML_JAR environment variable or pass -DPLANTUML_JAR= option to cmake") + endif() + if (PLANTUML_JAR AND DOXYGEN_VERSION VERSION_LESS 1.8.8) + message(STATUS "You need Doxygen version 1.8.8 or later to use PlantUML") + unset(PLANTUML_JAR) + endif() +endif(BUILD_DOCS) + +# --- Python Support --- +include(cmake/OpenCVDetectPython.cmake) + +# --- Java Support --- +include(cmake/OpenCVDetectApacheAnt.cmake) +if(ANDROID) + include(cmake/OpenCVDetectAndroidSDK.cmake) + + if(NOT ANDROID_TOOLS_Pkg_Revision GREATER 13) + message(WARNING "OpenCV requires Android SDK tools revision 14 or newer. Otherwise tests and samples will no be compiled.") + endif() +else() + find_package(JNI) +endif() + +if(ANDROID AND ANDROID_EXECUTABLE AND ANT_EXECUTABLE AND (ANT_VERSION VERSION_GREATER 1.7) AND (ANDROID_TOOLS_Pkg_Revision GREATER 13)) + SET(CAN_BUILD_ANDROID_PROJECTS TRUE) +else() + SET(CAN_BUILD_ANDROID_PROJECTS FALSE) +endif() + +# --- OpenCL --- +if(WITH_OPENCL) + include(cmake/OpenCVDetectOpenCL.cmake) +endif() + +# --- DirectX --- +if(WITH_DIRECTX) + include(cmake/OpenCVDetectDirectX.cmake) +endif() + +# --- Matlab/Octave --- +include(cmake/OpenCVFindMatlab.cmake) + +include(cmake/OpenCVDetectVTK.cmake) + +# ---------------------------------------------------------------------------- +# Add CUDA libraries (needed for apps/tools, samples) +# ---------------------------------------------------------------------------- +if(HAVE_CUDA) + set(OPENCV_LINKER_LIBS ${OPENCV_LINKER_LIBS} ${CUDA_LIBRARIES} ${CUDA_npp_LIBRARY}) + if(HAVE_CUBLAS) + set(OPENCV_LINKER_LIBS ${OPENCV_LINKER_LIBS} ${CUDA_cublas_LIBRARY}) + endif() + if(HAVE_CUFFT) + set(OPENCV_LINKER_LIBS ${OPENCV_LINKER_LIBS} ${CUDA_cufft_LIBRARY}) + endif() +endif() +# ---------------------------------------------------------------------------- +# Solution folders: +# ---------------------------------------------------------------------------- +if(ENABLE_SOLUTION_FOLDERS) + set_property(GLOBAL PROPERTY USE_FOLDERS ON) + set_property(GLOBAL PROPERTY PREDEFINED_TARGETS_FOLDER "CMakeTargets") +endif() + +# Extra OpenCV targets: uninstall, package_source, perf, etc. +include(cmake/OpenCVExtraTargets.cmake) + + +# ---------------------------------------------------------------------------- +# Process subdirectories +# ---------------------------------------------------------------------------- + +# opencv.hpp and legacy headers +add_subdirectory(include) + +# OpenCV modules +add_subdirectory(modules) + +# Generate targets for documentation +add_subdirectory(doc) + +# various data that is used by cv libraries and/or demo applications. +add_subdirectory(data) + +# extra applications +if(BUILD_opencv_apps) + add_subdirectory(apps) +endif() + +# examples +if(BUILD_EXAMPLES OR BUILD_ANDROID_EXAMPLES OR INSTALL_PYTHON_EXAMPLES) + add_subdirectory(samples) +endif() + +if(ANDROID) + add_subdirectory(platforms/android/service) +endif() + +# ---------------------------------------------------------------------------- +# Finalization: generate configuration-based files +# ---------------------------------------------------------------------------- + +# Generate platform-dependent and configuration-dependent headers +include(cmake/OpenCVGenHeaders.cmake) + +# Generate opencv.pc for pkg-config command +include(cmake/OpenCVGenPkgconfig.cmake) + +# Generate OpenCV.mk for ndk-build (Android build tool) +include(cmake/OpenCVGenAndroidMK.cmake) + +# Generate OpenCVŠ”onfig.cmake and OpenCVConfig-version.cmake for cmake projects +include(cmake/OpenCVGenConfig.cmake) + +# Generate Info.plist for the IOS framework +include(cmake/OpenCVGenInfoPlist.cmake) + +# Generate ABI descriptor +include(cmake/OpenCVGenABI.cmake) + +# Generate environment setup file +if(INSTALL_TESTS AND OPENCV_TEST_DATA_PATH) + if(ANDROID) + get_filename_component(TEST_PATH ${OPENCV_TEST_INSTALL_PATH} DIRECTORY) + configure_file("${CMAKE_CURRENT_SOURCE_DIR}/cmake/templates/opencv_run_all_tests_android.sh.in" + "${CMAKE_BINARY_DIR}/unix-install/opencv_run_all_tests.sh" @ONLY) + install(PROGRAMS "${CMAKE_BINARY_DIR}/unix-install/opencv_run_all_tests.sh" + DESTINATION ${CMAKE_INSTALL_PREFIX} COMPONENT tests) + elseif(WIN32) + configure_file("${CMAKE_CURRENT_SOURCE_DIR}/cmake/templates/opencv_run_all_tests_windows.cmd.in" + "${CMAKE_BINARY_DIR}/win-install/opencv_run_all_tests.cmd" @ONLY) + install(PROGRAMS "${CMAKE_BINARY_DIR}/win-install/opencv_run_all_tests.cmd" + DESTINATION ${OPENCV_TEST_INSTALL_PATH} COMPONENT tests) + elseif(UNIX) + configure_file("${CMAKE_CURRENT_SOURCE_DIR}/cmake/templates/opencv_run_all_tests_unix.sh.in" + "${CMAKE_BINARY_DIR}/unix-install/opencv_run_all_tests.sh" @ONLY) + install(PROGRAMS "${CMAKE_BINARY_DIR}/unix-install/opencv_run_all_tests.sh" + DESTINATION ${OPENCV_TEST_INSTALL_PATH} COMPONENT tests) + endif() +endif() + +if(NOT OPENCV_README_FILE) + if(ANDROID) + set(OPENCV_README_FILE ${CMAKE_CURRENT_SOURCE_DIR}/platforms/android/README.android) + endif() +endif() + +if(NOT OPENCV_LICENSE_FILE) + set(OPENCV_LICENSE_FILE ${CMAKE_CURRENT_SOURCE_DIR}/LICENSE) +endif() + +# for UNIX it does not make sense as LICENSE and readme will be part of the package automatically +if(ANDROID OR NOT UNIX) + install(FILES ${OPENCV_LICENSE_FILE} + PERMISSIONS OWNER_READ GROUP_READ WORLD_READ + DESTINATION ${CMAKE_INSTALL_PREFIX} COMPONENT libs) + if(OPENCV_README_FILE) + install(FILES ${OPENCV_README_FILE} + PERMISSIONS OWNER_READ GROUP_READ WORLD_READ + DESTINATION ${CMAKE_INSTALL_PREFIX} COMPONENT libs) + endif() +endif() + +# ---------------------------------------------------------------------------- +# Summary: +# ---------------------------------------------------------------------------- +status("") +status("General configuration for OpenCV ${OPENCV_VERSION} =====================================") +if(OPENCV_VCSVERSION) + status(" Version control:" ${OPENCV_VCSVERSION}) +endif() + +# ========================== build platform ========================== +status("") +status(" Platform:") +status(" Host:" ${CMAKE_HOST_SYSTEM_NAME} ${CMAKE_HOST_SYSTEM_VERSION} ${CMAKE_HOST_SYSTEM_PROCESSOR}) +if(CMAKE_CROSSCOMPILING) + status(" Target:" ${CMAKE_SYSTEM_NAME} ${CMAKE_SYSTEM_VERSION} ${CMAKE_SYSTEM_PROCESSOR}) +endif() +status(" CMake:" ${CMAKE_VERSION}) +status(" CMake generator:" ${CMAKE_GENERATOR}) +status(" CMake build tool:" ${CMAKE_BUILD_TOOL}) +if(MSVC) + status(" MSVC:" ${MSVC_VERSION}) +endif() +if(CMAKE_GENERATOR MATCHES Xcode) + status(" Xcode:" ${XCODE_VERSION}) +endif() +if(NOT CMAKE_GENERATOR MATCHES "Xcode|Visual Studio") + status(" Configuration:" ${CMAKE_BUILD_TYPE}) +endif() + +# ========================== C/C++ options ========================== +if(CMAKE_CXX_COMPILER_VERSION) + set(OPENCV_COMPILER_STR "${CMAKE_CXX_COMPILER} ${CMAKE_CXX_COMPILER_ARG1} (ver ${CMAKE_CXX_COMPILER_VERSION})") +elseif(CMAKE_COMPILER_IS_CLANGCXX) + set(OPENCV_COMPILER_STR "${CMAKE_CXX_COMPILER} ${CMAKE_CXX_COMPILER_ARG1} (ver ${CMAKE_CLANG_REGEX_VERSION})") +elseif(CMAKE_COMPILER_IS_GNUCXX) + set(OPENCV_COMPILER_STR "${CMAKE_CXX_COMPILER} ${CMAKE_CXX_COMPILER_ARG1} (ver ${CMAKE_GCC_REGEX_VERSION})") +else() + set(OPENCV_COMPILER_STR "${CMAKE_CXX_COMPILER} ${CMAKE_CXX_COMPILER_ARG1}") +endif() +string(STRIP "${OPENCV_COMPILER_STR}" OPENCV_COMPILER_STR) + +status("") +status(" C/C++:") +status(" Built as dynamic libs?:" BUILD_SHARED_LIBS THEN YES ELSE NO) +status(" C++ Compiler:" ${OPENCV_COMPILER_STR}) +status(" C++ flags (Release):" ${CMAKE_CXX_FLAGS} ${CMAKE_CXX_FLAGS_RELEASE}) +status(" C++ flags (Debug):" ${CMAKE_CXX_FLAGS} ${CMAKE_CXX_FLAGS_DEBUG}) +status(" C Compiler:" ${CMAKE_C_COMPILER} ${CMAKE_C_COMPILER_ARG1}) +status(" C flags (Release):" ${CMAKE_C_FLAGS} ${CMAKE_C_FLAGS_RELEASE}) +status(" C flags (Debug):" ${CMAKE_C_FLAGS} ${CMAKE_C_FLAGS_DEBUG}) +if(WIN32) + status(" Linker flags (Release):" ${CMAKE_EXE_LINKER_FLAGS} ${CMAKE_EXE_LINKER_FLAGS_RELEASE}) + status(" Linker flags (Debug):" ${CMAKE_EXE_LINKER_FLAGS} ${CMAKE_EXE_LINKER_FLAGS_DEBUG}) +else() + status(" Linker flags (Release):" ${CMAKE_SHARED_LINKER_FLAGS} ${CMAKE_SHARED_LINKER_FLAGS_RELEASE}) + status(" Linker flags (Debug):" ${CMAKE_SHARED_LINKER_FLAGS} ${CMAKE_SHARED_LINKER_FLAGS_DEBUG}) +endif() +status(" Precompiled headers:" PCHSupport_FOUND AND ENABLE_PRECOMPILED_HEADERS THEN YES ELSE NO) + +# ========================== Dependencies ============================ +ocv_get_all_libs(deps_modules deps_extra deps_3rdparty) +status(" Extra dependencies:" ${deps_extra}) +status(" 3rdparty dependencies:" ${deps_3rdparty}) + +# ========================== OpenCV modules ========================== +status("") +status(" OpenCV modules:") +string(REPLACE "opencv_" "" OPENCV_MODULES_BUILD_ST "${OPENCV_MODULES_BUILD}") +string(REPLACE "opencv_" "" OPENCV_MODULES_DISABLED_USER_ST "${OPENCV_MODULES_DISABLED_USER}") +string(REPLACE "opencv_" "" OPENCV_MODULES_DISABLED_FORCE_ST "${OPENCV_MODULES_DISABLED_FORCE}") +set(OPENCV_MODULES_DISABLED_AUTO_ST "") +foreach(m ${OPENCV_MODULES_DISABLED_AUTO}) + set(__mdeps "") + foreach(d ${OPENCV_MODULE_${m}_DEPS}) + if(d MATCHES "^opencv_" AND NOT HAVE_${d}) + list(APPEND __mdeps ${d}) + endif() + endforeach() + if(__mdeps) + list(APPEND OPENCV_MODULES_DISABLED_AUTO_ST "${m}(deps: ${__mdeps})") + else() + list(APPEND OPENCV_MODULES_DISABLED_AUTO_ST "${m}") + endif() +endforeach() +string(REPLACE "opencv_" "" OPENCV_MODULES_DISABLED_AUTO_ST "${OPENCV_MODULES_DISABLED_AUTO_ST}") + +status(" To be built:" OPENCV_MODULES_BUILD THEN ${OPENCV_MODULES_BUILD_ST} ELSE "-") +status(" Disabled:" OPENCV_MODULES_DISABLED_USER THEN ${OPENCV_MODULES_DISABLED_USER_ST} ELSE "-") +status(" Disabled by dependency:" OPENCV_MODULES_DISABLED_AUTO THEN ${OPENCV_MODULES_DISABLED_AUTO_ST} ELSE "-") +status(" Unavailable:" OPENCV_MODULES_DISABLED_FORCE THEN ${OPENCV_MODULES_DISABLED_FORCE_ST} ELSE "-") + +# ========================== Android details ========================== +if(ANDROID) + status("") + status(" Android: ") + status(" Android ABI:" ${ANDROID_ABI}) + status(" STL type:" ${ANDROID_STL}) + status(" Native API level:" android-${ANDROID_NATIVE_API_LEVEL}) + android_get_compatible_target(android_sdk_target_status ${ANDROID_NATIVE_API_LEVEL} ${ANDROID_SDK_TARGET} 11) + status(" SDK target:" "${android_sdk_target_status}") + if(BUILD_WITH_ANDROID_NDK) + status(" Android NDK:" "${ANDROID_NDK} (toolchain: ${ANDROID_TOOLCHAIN_NAME})") + elseif(BUILD_WITH_STANDALONE_TOOLCHAIN) + status(" Android toolchain:" "${ANDROID_STANDALONE_TOOLCHAIN}") + endif() + status(" android tool:" ANDROID_EXECUTABLE THEN "${ANDROID_EXECUTABLE} (${ANDROID_TOOLS_Pkg_Desc})" ELSE NO) + status(" Google Play manager:" BUILD_ANDROID_SERVICE THEN YES ELSE NO) + status(" Android examples:" BUILD_ANDROID_EXAMPLES AND CAN_BUILD_ANDROID_PROJECTS THEN YES ELSE NO) +endif() + +# ================== Windows RT features ================== +if(WIN32) +status("") +status(" Windows RT support:" WINRT THEN YES ELSE NO) + if(WINRT) + status(" Building for Microsoft platform: " ${CMAKE_SYSTEM_NAME}) + status(" Building for architectures: " ${CMAKE_VS_EFFECTIVE_PLATFORMS}) + status(" Building for version: " ${CMAKE_SYSTEM_VERSION}) + endif() +endif(WIN32) + +# ========================== GUI ========================== +status("") +status(" GUI: ") + +if(HAVE_QT5) + status(" QT 5.x:" HAVE_QT THEN "YES (ver ${Qt5Core_VERSION_STRING})" ELSE NO) + status(" QT OpenGL support:" HAVE_QT_OPENGL THEN "YES (${Qt5OpenGL_LIBRARIES} ${Qt5OpenGL_VERSION_STRING})" ELSE NO) +elseif(HAVE_QT) + status(" QT 4.x:" HAVE_QT THEN "YES (ver ${QT_VERSION_MAJOR}.${QT_VERSION_MINOR}.${QT_VERSION_PATCH} ${QT_EDITION})" ELSE NO) + status(" QT OpenGL support:" HAVE_QT_OPENGL THEN "YES (${QT_QTOPENGL_LIBRARY})" ELSE NO) +else() + if(DEFINED WITH_QT) + status(" QT:" NO) + endif() + if(DEFINED WITH_WIN32UI) + status(" Win32 UI:" HAVE_WIN32UI THEN YES ELSE NO) + else() + if(APPLE) + if(WITH_CARBON) + status(" Carbon:" YES) + else() + status(" Cocoa:" YES) + endif() + else() + if(HAVE_GTK3) + status(" GTK+ 3.x:" HAVE_GTK THEN "YES (ver ${ALIASOF_gtk+-3.0_VERSION})" ELSE NO) + elseif(HAVE_GTK) + status(" GTK+ 2.x:" HAVE_GTK THEN "YES (ver ${ALIASOF_gtk+-2.0_VERSION})" ELSE NO) + else() + status(" GTK+:" NO) + endif() + status(" GThread :" HAVE_GTHREAD THEN "YES (ver ${ALIASOF_gthread-2.0_VERSION})" ELSE NO) + status(" GtkGlExt:" HAVE_GTKGLEXT THEN "YES (ver ${ALIASOF_gtkglext-1.0_VERSION})" ELSE NO) + endif() + endif() +endif() + +status(" OpenGL support:" HAVE_OPENGL THEN "YES (${OPENGL_LIBRARIES})" ELSE NO) +status(" VTK support:" HAVE_VTK THEN "YES (ver ${VTK_VERSION})" ELSE NO) + +# ========================== MEDIA IO ========================== +status("") +status(" Media I/O: ") +status(" ZLib:" BUILD_ZLIB THEN "build (ver ${ZLIB_VERSION_STRING})" ELSE "${ZLIB_LIBRARIES} (ver ${ZLIB_VERSION_STRING})") + +if(WITH_JPEG) + status(" JPEG:" JPEG_FOUND THEN "${JPEG_LIBRARY} (ver ${JPEG_LIB_VERSION})" ELSE "build (ver ${JPEG_LIB_VERSION})") +else() + status(" JPEG:" "NO") +endif() + +if(WITH_WEBP) + status(" WEBP:" WEBP_FOUND THEN "${WEBP_LIBRARY} (ver ${WEBP_VERSION})" ELSE "build (ver ${WEBP_VERSION})") +else() + status(" WEBP:" "NO") +endif() + +if(WITH_PNG) + status(" PNG:" PNG_FOUND THEN "${PNG_LIBRARY} (ver ${PNG_VERSION})" ELSE "build (ver ${PNG_VERSION})") +else() + status(" PNG:" "NO") +endif() +if(WITH_TIFF) + if(TIFF_VERSION_STRING AND TIFF_FOUND) + status(" TIFF:" "${TIFF_LIBRARY} (ver ${TIFF_VERSION} - ${TIFF_VERSION_STRING})") + else() + status(" TIFF:" TIFF_FOUND THEN "${TIFF_LIBRARY} (ver ${TIFF_VERSION})" ELSE "build (ver ${TIFF_VERSION} - ${TIFF_VERSION_STRING})") + endif() +else() + status(" TIFF:" "NO") +endif() +if(WITH_JASPER) + status(" JPEG 2000:" JASPER_FOUND THEN "${JASPER_LIBRARY} (ver ${JASPER_VERSION_STRING})" ELSE "build (ver ${JASPER_VERSION_STRING})") +else() + status(" JPEG 2000:" "NO") +endif() +if(WITH_OPENEXR) + status(" OpenEXR:" OPENEXR_FOUND THEN "${OPENEXR_LIBRARIES} (ver ${OPENEXR_VERSION})" ELSE "build (ver ${OPENEXR_VERSION})") +else() + status(" OpenEXR:" "NO") +endif() + +if( WITH_GDAL ) + status(" GDAL:" GDAL_FOUND THEN "${GDAL_LIBRARY}" ELSE "NO") +else() + status(" GDAL:" "NO") +endif() + +# ========================== VIDEO IO ========================== +status("") +status(" Video I/O:") + +if (DEFINED WITH_VFW) + status(" Video for Windows:" HAVE_VFW THEN YES ELSE NO) +endif(DEFINED WITH_VFW) + +if(DEFINED WITH_1394) + status(" DC1394 1.x:" HAVE_DC1394 THEN "YES (ver ${ALIASOF_libdc1394_VERSION})" ELSE NO) + status(" DC1394 2.x:" HAVE_DC1394_2 THEN "YES (ver ${ALIASOF_libdc1394-2_VERSION})" ELSE NO) +endif(DEFINED WITH_1394) + +if(DEFINED WITH_AVFOUNDATION) + status(" AVFoundation:" WITH_AVFOUNDATION THEN YES ELSE NO) +endif(DEFINED WITH_AVFOUNDATION) + +if(DEFINED WITH_FFMPEG) + if(WIN32) + status(" FFMPEG:" WITH_FFMPEG THEN "YES (prebuilt binaries)" ELSE NO) + else() + status(" FFMPEG:" HAVE_FFMPEG THEN YES ELSE NO) + endif() + status(" codec:" HAVE_FFMPEG_CODEC THEN "YES (ver ${ALIASOF_libavcodec_VERSION})" ELSE NO) + status(" format:" HAVE_FFMPEG_FORMAT THEN "YES (ver ${ALIASOF_libavformat_VERSION})" ELSE NO) + status(" util:" HAVE_FFMPEG_UTIL THEN "YES (ver ${ALIASOF_libavutil_VERSION})" ELSE NO) + status(" swscale:" HAVE_FFMPEG_SWSCALE THEN "YES (ver ${ALIASOF_libswscale_VERSION})" ELSE NO) + status(" resample:" HAVE_FFMPEG_RESAMPLE THEN "YES (ver ${ALIASOF_libavresample_VERSION})" ELSE NO) + status(" gentoo-style:" HAVE_GENTOO_FFMPEG THEN YES ELSE NO) +endif(DEFINED WITH_FFMPEG) + +if(DEFINED WITH_GSTREAMER) + status(" GStreamer:" HAVE_GSTREAMER THEN "" ELSE NO) + if(HAVE_GSTREAMER) + status(" base:" "YES (ver ${GSTREAMER_BASE_VERSION})") + status(" video:" "YES (ver ${GSTREAMER_VIDEO_VERSION})") + status(" app:" "YES (ver ${GSTREAMER_APP_VERSION})") + status(" riff:" "YES (ver ${GSTREAMER_RIFF_VERSION})") + status(" pbutils:" "YES (ver ${GSTREAMER_PBUTILS_VERSION})") + endif(HAVE_GSTREAMER) +endif(DEFINED WITH_GSTREAMER) + +if(DEFINED WITH_OPENNI) + status(" OpenNI:" HAVE_OPENNI THEN "YES (ver ${OPENNI_VERSION_STRING}, build ${OPENNI_VERSION_BUILD})" + ELSE NO) + status(" OpenNI PrimeSensor Modules:" HAVE_OPENNI_PRIME_SENSOR_MODULE + THEN "YES (${OPENNI_PRIME_SENSOR_MODULE})" ELSE NO) +endif(DEFINED WITH_OPENNI) + +if(DEFINED WITH_OPENNI2) + status(" OpenNI2:" HAVE_OPENNI2 THEN "YES (ver ${OPENNI2_VERSION_STRING}, build ${OPENNI2_VERSION_BUILD})" + ELSE NO) +endif(DEFINED WITH_OPENNI2) + +if(DEFINED WITH_PVAPI) + status(" PvAPI:" HAVE_PVAPI THEN YES ELSE NO) +endif(DEFINED WITH_PVAPI) + +if(DEFINED WITH_GIGEAPI) + status(" GigEVisionSDK:" HAVE_GIGE_API THEN YES ELSE NO) +endif(DEFINED WITH_GIGEAPI) + +if(DEFINED WITH_QUICKTIME) + status(" QuickTime:" HAVE_QUICKTIME THEN YES ELSE NO) + status(" QTKit:" HAVE_QTKIT THEN YES ELSE NO) +endif(DEFINED WITH_QUICKTIME) + +if(DEFINED WITH_UNICAP) + status(" UniCap:" HAVE_UNICAP THEN "YES (ver ${ALIASOF_libunicap_VERSION})" ELSE NO) + status(" UniCap ucil:" HAVE_UNICAP_UCIL THEN "YES (ver ${ALIASOF_libucil_VERSION})" ELSE NO) +endif(DEFINED WITH_UNICAP) + +if(DEFINED WITH_V4L) + if(HAVE_CAMV4L) + set(HAVE_CAMV4L_STR "YES") + else() + set(HAVE_CAMV4L_STR "NO") + endif() + if(HAVE_CAMV4L2) + set(HAVE_CAMV4L2_STR "YES") + elseif(HAVE_VIDEOIO) + set(HAVE_CAMV4L2_STR "YES(videoio)") + else() + set(HAVE_CAMV4L2_STR "NO") + endif() + status(" V4L/V4L2:" HAVE_LIBV4L + THEN "Using libv4l1 (ver ${ALIASOF_libv4l1_VERSION}) / libv4l2 (ver ${ALIASOF_libv4l2_VERSION})" + ELSE "${HAVE_CAMV4L_STR}/${HAVE_CAMV4L2_STR}") +endif(DEFINED WITH_V4L) + +if(DEFINED WITH_DSHOW) + status(" DirectShow:" HAVE_DSHOW THEN YES ELSE NO) +endif(DEFINED WITH_DSHOW) + +if(DEFINED WITH_MSMF) + status(" Media Foundation:" HAVE_MSMF THEN YES ELSE NO) +endif(DEFINED WITH_MSMF) + +if(DEFINED WITH_XIMEA) + status(" XIMEA:" HAVE_XIMEA THEN YES ELSE NO) +endif(DEFINED WITH_XIMEA) + +if(DEFINED WITH_XINE) + status(" Xine:" HAVE_XINE THEN "YES (ver ${ALIASOF_libxine_VERSION})" ELSE NO) +endif(DEFINED WITH_XINE) + +if(DEFINED WITH_INTELPERC) + status(" Intel PerC:" HAVE_INTELPERC THEN "YES" ELSE NO) +endif(DEFINED WITH_INTELPERC) + +if(DEFINED WITH_GPHOTO2) + status(" gPhoto2:" HAVE_GPHOTO2 THEN "YES" ELSE NO) +endif(DEFINED WITH_GPHOTO2) + + +# ========================== Other third-party libraries ========================== +status("") +status(" Other third-party libraries:") + +if(WITH_IPP AND HAVE_IPP) + status(" Use IPP:" "${IPP_VERSION_STR} [${IPP_VERSION_MAJOR}.${IPP_VERSION_MINOR}.${IPP_VERSION_BUILD}]") + status(" at:" "${IPP_ROOT_DIR}") + if(NOT HAVE_IPP_ICV_ONLY) + status(" linked:" BUILD_WITH_DYNAMIC_IPP THEN "dynamic" ELSE "static") + endif() +else() + status(" Use IPP:" WITH_IPP AND NOT HAVE_IPP THEN "IPP not found or implicitly disabled" ELSE NO) +endif() + +if(DEFINED WITH_IPP_A) +status(" Use IPP Async:" HAVE_IPP_A THEN "YES" ELSE NO) +endif(DEFINED WITH_IPP_A) + +status(" Use Eigen:" HAVE_EIGEN THEN "YES (ver ${EIGEN_WORLD_VERSION}.${EIGEN_MAJOR_VERSION}.${EIGEN_MINOR_VERSION})" ELSE NO) +status(" Use TBB:" HAVE_TBB THEN "YES (ver ${TBB_VERSION_MAJOR}.${TBB_VERSION_MINOR} interface ${TBB_INTERFACE_VERSION})" ELSE NO) +status(" Use OpenMP:" HAVE_OPENMP THEN YES ELSE NO) +status(" Use GCD" HAVE_GCD THEN YES ELSE NO) +status(" Use Concurrency" HAVE_CONCURRENCY THEN YES ELSE NO) +status(" Use C=:" HAVE_CSTRIPES THEN YES ELSE NO) +status(" Use pthreads for parallel for:" HAVE_PTHREADS_PF THEN YES ELSE NO) +status(" Use Cuda:" HAVE_CUDA THEN "YES (ver ${CUDA_VERSION_STRING})" ELSE NO) +status(" Use OpenCL:" HAVE_OPENCL THEN YES ELSE NO) + +if(HAVE_CUDA) + status("") + status(" NVIDIA CUDA") + + status(" Use CUFFT:" HAVE_CUFFT THEN YES ELSE NO) + status(" Use CUBLAS:" HAVE_CUBLAS THEN YES ELSE NO) + status(" USE NVCUVID:" HAVE_NVCUVID THEN YES ELSE NO) + status(" NVIDIA GPU arch:" ${OPENCV_CUDA_ARCH_BIN}) + status(" NVIDIA PTX archs:" ${OPENCV_CUDA_ARCH_PTX}) + status(" Use fast math:" CUDA_FAST_MATH THEN YES ELSE NO) +endif() + +if(HAVE_OPENCL) + status("") + status(" OpenCL:") + if(HAVE_OPENCL_STATIC) + set(__opencl_ver "static") + else() + set(__opencl_ver "dynamic") + endif() + status(" Version:" ${__opencl_ver}) + if(OPENCL_INCLUDE_DIR) + status(" Include path:" ${OPENCL_INCLUDE_DIRS}) + endif() + if(OPENCL_LIBRARIES) + set(__libs "") + foreach(l ${OPENCL_LIBRARIES}) + if(TARGET ${l}) + get_target_property(p ${l} LOCATION) + if(p MATCHES NOTFOUND) + list(APPEND __libs "${l}") + else() + list(APPEND __libs "${p}") + endif() + else() + list(APPEND __libs "${l}") + endif() + endforeach() + status(" libraries:" ${__libs}) + endif() + status(" Use AMDFFT:" HAVE_CLAMDFFT THEN YES ELSE NO) + status(" Use AMDBLAS:" HAVE_CLAMDBLAS THEN YES ELSE NO) +endif() + +# ========================== python ========================== +status("") +status(" Python 2:") +status(" Interpreter:" PYTHON2INTERP_FOUND THEN "${PYTHON2_EXECUTABLE} (ver ${PYTHON2_VERSION_STRING})" ELSE NO) +if(BUILD_opencv_python2) + if(PYTHON2LIBS_VERSION_STRING) + status(" Libraries:" HAVE_opencv_python2 THEN "${PYTHON2_LIBRARIES} (ver ${PYTHON2LIBS_VERSION_STRING})" ELSE NO) + else() + status(" Libraries:" HAVE_opencv_python2 THEN "${PYTHON2_LIBRARIES}" ELSE NO) + endif() + status(" numpy:" PYTHON2_NUMPY_INCLUDE_DIRS THEN "${PYTHON2_NUMPY_INCLUDE_DIRS} (ver ${PYTHON2_NUMPY_VERSION})" ELSE "NO (Python wrappers can not be generated)") + status(" packages path:" PYTHON2_EXECUTABLE THEN "${PYTHON2_PACKAGES_PATH}" ELSE "-") +endif() + +status("") +status(" Python 3:") +status(" Interpreter:" PYTHON3INTERP_FOUND THEN "${PYTHON3_EXECUTABLE} (ver ${PYTHON3_VERSION_STRING})" ELSE NO) +if(BUILD_opencv_python3) + if(PYTHON3LIBS_VERSION_STRING) + status(" Libraries:" HAVE_opencv_python3 THEN "${PYTHON3_LIBRARIES} (ver ${PYTHON3LIBS_VERSION_STRING})" ELSE NO) + else() + status(" Libraries:" HAVE_opencv_python3 THEN "${PYTHON3_LIBRARIES}" ELSE NO) + endif() + status(" numpy:" PYTHON3_NUMPY_INCLUDE_DIRS THEN "${PYTHON3_NUMPY_INCLUDE_DIRS} (ver ${PYTHON3_NUMPY_VERSION})" ELSE "NO (Python3 wrappers can not be generated)") + status(" packages path:" PYTHON3_EXECUTABLE THEN "${PYTHON3_PACKAGES_PATH}" ELSE "-") +endif() + +status("") +status(" Python (for build):" PYTHON_DEFAULT_AVAILABLE THEN "${PYTHON_DEFAULT_EXECUTABLE}" ELSE NO) + +# ========================== java ========================== +status("") +status(" Java:") +status(" ant:" ANT_EXECUTABLE THEN "${ANT_EXECUTABLE} (ver ${ANT_VERSION})" ELSE NO) +if(NOT ANDROID) + status(" JNI:" JNI_INCLUDE_DIRS THEN "${JNI_INCLUDE_DIRS}" ELSE NO) +endif() +status(" Java wrappers:" HAVE_opencv_java THEN YES ELSE NO) +status(" Java tests:" BUILD_TESTS AND opencv_test_java_BINARY_DIR THEN YES ELSE NO) + +# ========================= matlab ========================= +status("") +status(" Matlab:") +status(" mex:" MATLAB_MEX_SCRIPT THEN "${MATLAB_MEX_SCRIPT}" ELSE NO) +if (MATLAB_FOUND) + status(" Compiler/generator:" MEX_WORKS THEN "Working" ELSE "Not working (bindings will not be generated)") +endif() + +# ========================== documentation ========================== +if(BUILD_DOCS) + status("") + status(" Documentation:") + status(" Doxygen:" DOXYGEN_FOUND THEN "${DOXYGEN_EXECUTABLE} (ver ${DOXYGEN_VERSION})" ELSE NO) + status(" PlantUML:" PLANTUML_JAR THEN "${PLANTUML_JAR}" ELSE NO) +endif() + +# ========================== samples and tests ========================== +status("") +status(" Tests and samples:") +status(" Tests:" BUILD_TESTS AND HAVE_opencv_ts THEN YES ELSE NO) +status(" Performance tests:" BUILD_PERF_TESTS AND HAVE_opencv_ts THEN YES ELSE NO) +status(" C/C++ Examples:" BUILD_EXAMPLES THEN YES ELSE NO) + +# ========================== auxiliary ========================== +status("") +status(" Install path:" "${CMAKE_INSTALL_PREFIX}") +status("") +status(" cvconfig.h is in:" "${OPENCV_CONFIG_FILE_INCLUDE_DIR}") +status("-----------------------------------------------------------------") +status("") + +ocv_finalize_status() + +# ---------------------------------------------------------------------------- +# Warn in the case of in-source build +# ---------------------------------------------------------------------------- +if("${CMAKE_CURRENT_SOURCE_DIR}" STREQUAL "${CMAKE_CURRENT_BINARY_DIR}") + message(WARNING "The source directory is the same as binary directory. \"make clean\" may damage the source tree") +endif() + +# ---------------------------------------------------------------------------- +# CPack stuff +# ---------------------------------------------------------------------------- + +include(cmake/OpenCVPackaging.cmake) diff --git a/dependency-check-core/src/test/resources/cmake/opencv/LICENSE b/dependency-check-core/src/test/resources/cmake/opencv/LICENSE new file mode 100644 index 000000000..ab58eebca --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/LICENSE @@ -0,0 +1,41 @@ +By downloading, copying, installing or using the software you agree to this license. +If you do not agree to this license, do not download, install, +copy or use the software. + + + License Agreement + For Open Source Computer Vision Library + (3-clause BSD License) + +Copyright (C) 2000-2015, Intel Corporation, all rights reserved. +Copyright (C) 2009-2011, Willow Garage Inc., all rights reserved. +Copyright (C) 2009-2015, NVIDIA Corporation, all rights reserved. +Copyright (C) 2010-2013, Advanced Micro Devices, Inc., all rights reserved. +Copyright (C) 2015, OpenCV Foundation, all rights reserved. +Copyright (C) 2015, Itseez Inc., all rights reserved. +Third party copyrights are property of their respective owners. + +Redistribution and use in source and binary forms, with or without modification, +are permitted provided that the following conditions are met: + + * Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + * Redistributions in binary form must reproduce the above copyright notice, + this list of conditions and the following disclaimer in the documentation + and/or other materials provided with the distribution. + + * Neither the names of the copyright holders nor the names of the contributors + may be used to endorse or promote products derived from this software + without specific prior written permission. + +This software is provided by the copyright holders and contributors "as is" and +any express or implied warranties, including, but not limited to, the implied +warranties of merchantability and fitness for a particular purpose are disclaimed. +In no event shall copyright holders or contributors be liable for any direct, +indirect, incidental, special, exemplary, or consequential damages +(including, but not limited to, procurement of substitute goods or services; +loss of use, data, or profits; or business interruption) however caused +and on any theory of liability, whether in contract, strict liability, +or tort (including negligence or otherwise) arising in any way out of +the use of this software, even if advised of the possibility of such damage. diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/FindCUDA.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/FindCUDA.cmake new file mode 100644 index 000000000..5efd36c4e --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/FindCUDA.cmake @@ -0,0 +1,1715 @@ +#.rst: +# FindCUDA +# -------- +# +# Tools for building CUDA C files: libraries and build dependencies. +# +# This script locates the NVIDIA CUDA C tools. It should work on linux, +# windows, and mac and should be reasonably up to date with CUDA C +# releases. +# +# This script makes use of the standard find_package arguments of +# , REQUIRED and QUIET. CUDA_FOUND will report if an +# acceptable version of CUDA was found. +# +# The script will prompt the user to specify CUDA_TOOLKIT_ROOT_DIR if +# the prefix cannot be determined by the location of nvcc in the system +# path and REQUIRED is specified to find_package(). To use a different +# installed version of the toolkit set the environment variable +# CUDA_BIN_PATH before running cmake (e.g. +# CUDA_BIN_PATH=/usr/local/cuda1.0 instead of the default +# /usr/local/cuda) or set CUDA_TOOLKIT_ROOT_DIR after configuring. If +# you change the value of CUDA_TOOLKIT_ROOT_DIR, various components that +# depend on the path will be relocated. +# +# It might be necessary to set CUDA_TOOLKIT_ROOT_DIR manually on certain +# platforms, or to use a cuda runtime not installed in the default +# location. In newer versions of the toolkit the cuda library is +# included with the graphics driver- be sure that the driver version +# matches what is needed by the cuda runtime version. +# +# The following variables affect the behavior of the macros in the +# script (in alphebetical order). Note that any of these flags can be +# changed multiple times in the same directory before calling +# CUDA_ADD_EXECUTABLE, CUDA_ADD_LIBRARY, CUDA_COMPILE, CUDA_COMPILE_PTX, +# CUDA_COMPILE_FATBIN, CUDA_COMPILE_CUBIN or CUDA_WRAP_SRCS:: +# +# CUDA_64_BIT_DEVICE_CODE (Default matches host bit size) +# -- Set to ON to compile for 64 bit device code, OFF for 32 bit device code. +# Note that making this different from the host code when generating object +# or C files from CUDA code just won't work, because size_t gets defined by +# nvcc in the generated source. If you compile to PTX and then load the +# file yourself, you can mix bit sizes between device and host. +# +# CUDA_ATTACH_VS_BUILD_RULE_TO_CUDA_FILE (Default ON) +# -- Set to ON if you want the custom build rule to be attached to the source +# file in Visual Studio. Turn OFF if you add the same cuda file to multiple +# targets. +# +# This allows the user to build the target from the CUDA file; however, bad +# things can happen if the CUDA source file is added to multiple targets. +# When performing parallel builds it is possible for the custom build +# command to be run more than once and in parallel causing cryptic build +# errors. VS runs the rules for every source file in the target, and a +# source can have only one rule no matter how many projects it is added to. +# When the rule is run from multiple targets race conditions can occur on +# the generated file. Eventually everything will get built, but if the user +# is unaware of this behavior, there may be confusion. It would be nice if +# this script could detect the reuse of source files across multiple targets +# and turn the option off for the user, but no good solution could be found. +# +# CUDA_BUILD_CUBIN (Default OFF) +# -- Set to ON to enable and extra compilation pass with the -cubin option in +# Device mode. The output is parsed and register, shared memory usage is +# printed during build. +# +# CUDA_BUILD_EMULATION (Default OFF for device mode) +# -- Set to ON for Emulation mode. -D_DEVICEEMU is defined for CUDA C files +# when CUDA_BUILD_EMULATION is TRUE. +# +# CUDA_GENERATED_OUTPUT_DIR (Default CMAKE_CURRENT_BINARY_DIR) +# -- Set to the path you wish to have the generated files placed. If it is +# blank output files will be placed in CMAKE_CURRENT_BINARY_DIR. +# Intermediate files will always be placed in +# CMAKE_CURRENT_BINARY_DIR/CMakeFiles. +# +# CUDA_HOST_COMPILATION_CPP (Default ON) +# -- Set to OFF for C compilation of host code. +# +# CUDA_HOST_COMPILER (Default CMAKE_C_COMPILER, $(VCInstallDir)/bin for VS) +# -- Set the host compiler to be used by nvcc. Ignored if -ccbin or +# --compiler-bindir is already present in the CUDA_NVCC_FLAGS or +# CUDA_NVCC_FLAGS_ variables. For Visual Studio targets +# $(VCInstallDir)/bin is a special value that expands out to the path when +# the command is run from withing VS. +# +# CUDA_NVCC_FLAGS +# CUDA_NVCC_FLAGS_ +# -- Additional NVCC command line arguments. NOTE: multiple arguments must be +# semi-colon delimited (e.g. --compiler-options;-Wall) +# +# CUDA_PROPAGATE_HOST_FLAGS (Default ON) +# -- Set to ON to propagate CMAKE_{C,CXX}_FLAGS and their configuration +# dependent counterparts (e.g. CMAKE_C_FLAGS_DEBUG) automatically to the +# host compiler through nvcc's -Xcompiler flag. This helps make the +# generated host code match the rest of the system better. Sometimes +# certain flags give nvcc problems, and this will help you turn the flag +# propagation off. This does not affect the flags supplied directly to nvcc +# via CUDA_NVCC_FLAGS or through the OPTION flags specified through +# CUDA_ADD_LIBRARY, CUDA_ADD_EXECUTABLE, or CUDA_WRAP_SRCS. Flags used for +# shared library compilation are not affected by this flag. +# +# CUDA_SEPARABLE_COMPILATION (Default OFF) +# -- If set this will enable separable compilation for all CUDA runtime object +# files. If used outside of CUDA_ADD_EXECUTABLE and CUDA_ADD_LIBRARY +# (e.g. calling CUDA_WRAP_SRCS directly), +# CUDA_COMPUTE_SEPARABLE_COMPILATION_OBJECT_FILE_NAME and +# CUDA_LINK_SEPARABLE_COMPILATION_OBJECTS should be called. +# +# CUDA_VERBOSE_BUILD (Default OFF) +# -- Set to ON to see all the commands used when building the CUDA file. When +# using a Makefile generator the value defaults to VERBOSE (run make +# VERBOSE=1 to see output), although setting CUDA_VERBOSE_BUILD to ON will +# always print the output. +# +# The script creates the following macros (in alphebetical order):: +# +# CUDA_ADD_CUFFT_TO_TARGET( cuda_target ) +# -- Adds the cufft library to the target (can be any target). Handles whether +# you are in emulation mode or not. +# +# CUDA_ADD_CUBLAS_TO_TARGET( cuda_target ) +# -- Adds the cublas library to the target (can be any target). Handles +# whether you are in emulation mode or not. +# +# CUDA_ADD_EXECUTABLE( cuda_target file0 file1 ... +# [WIN32] [MACOSX_BUNDLE] [EXCLUDE_FROM_ALL] [OPTIONS ...] ) +# -- Creates an executable "cuda_target" which is made up of the files +# specified. All of the non CUDA C files are compiled using the standard +# build rules specified by CMAKE and the cuda files are compiled to object +# files using nvcc and the host compiler. In addition CUDA_INCLUDE_DIRS is +# added automatically to include_directories(). Some standard CMake target +# calls can be used on the target after calling this macro +# (e.g. set_target_properties and target_link_libraries), but setting +# properties that adjust compilation flags will not affect code compiled by +# nvcc. Such flags should be modified before calling CUDA_ADD_EXECUTABLE, +# CUDA_ADD_LIBRARY or CUDA_WRAP_SRCS. +# +# CUDA_ADD_LIBRARY( cuda_target file0 file1 ... +# [STATIC | SHARED | MODULE] [EXCLUDE_FROM_ALL] [OPTIONS ...] ) +# -- Same as CUDA_ADD_EXECUTABLE except that a library is created. +# +# CUDA_BUILD_CLEAN_TARGET() +# -- Creates a convience target that deletes all the dependency files +# generated. You should make clean after running this target to ensure the +# dependency files get regenerated. +# +# CUDA_COMPILE( generated_files file0 file1 ... [STATIC | SHARED | MODULE] +# [OPTIONS ...] ) +# -- Returns a list of generated files from the input source files to be used +# with ADD_LIBRARY or ADD_EXECUTABLE. +# +# CUDA_COMPILE_PTX( generated_files file0 file1 ... [OPTIONS ...] ) +# -- Returns a list of PTX files generated from the input source files. +# +# CUDA_COMPILE_FATBIN( generated_files file0 file1 ... [OPTIONS ...] ) +# -- Returns a list of FATBIN files generated from the input source files. +# +# CUDA_COMPILE_CUBIN( generated_files file0 file1 ... [OPTIONS ...] ) +# -- Returns a list of CUBIN files generated from the input source files. +# +# CUDA_COMPUTE_SEPARABLE_COMPILATION_OBJECT_FILE_NAME( output_file_var +# cuda_target +# object_files ) +# -- Compute the name of the intermediate link file used for separable +# compilation. This file name is typically passed into +# CUDA_LINK_SEPARABLE_COMPILATION_OBJECTS. output_file_var is produced +# based on cuda_target the list of objects files that need separable +# compilation as specified by object_files. If the object_files list is +# empty, then output_file_var will be empty. This function is called +# automatically for CUDA_ADD_LIBRARY and CUDA_ADD_EXECUTABLE. Note that +# this is a function and not a macro. +# +# CUDA_INCLUDE_DIRECTORIES( path0 path1 ... ) +# -- Sets the directories that should be passed to nvcc +# (e.g. nvcc -Ipath0 -Ipath1 ... ). These paths usually contain other .cu +# files. +# +# +# +# CUDA_LINK_SEPARABLE_COMPILATION_OBJECTS( output_file_var cuda_target +# nvcc_flags object_files) +# +# -- Generates the link object required by separable compilation from the given +# object files. This is called automatically for CUDA_ADD_EXECUTABLE and +# CUDA_ADD_LIBRARY, but can be called manually when using CUDA_WRAP_SRCS +# directly. When called from CUDA_ADD_LIBRARY or CUDA_ADD_EXECUTABLE the +# nvcc_flags passed in are the same as the flags passed in via the OPTIONS +# argument. The only nvcc flag added automatically is the bitness flag as +# specified by CUDA_64_BIT_DEVICE_CODE. Note that this is a function +# instead of a macro. +# +# CUDA_WRAP_SRCS ( cuda_target format generated_files file0 file1 ... +# [STATIC | SHARED | MODULE] [OPTIONS ...] ) +# -- This is where all the magic happens. CUDA_ADD_EXECUTABLE, +# CUDA_ADD_LIBRARY, CUDA_COMPILE, and CUDA_COMPILE_PTX all call this +# function under the hood. +# +# Given the list of files (file0 file1 ... fileN) this macro generates +# custom commands that generate either PTX or linkable objects (use "PTX" or +# "OBJ" for the format argument to switch). Files that don't end with .cu +# or have the HEADER_FILE_ONLY property are ignored. +# +# The arguments passed in after OPTIONS are extra command line options to +# give to nvcc. You can also specify per configuration options by +# specifying the name of the configuration followed by the options. General +# options must preceed configuration specific options. Not all +# configurations need to be specified, only the ones provided will be used. +# +# OPTIONS -DFLAG=2 "-DFLAG_OTHER=space in flag" +# DEBUG -g +# RELEASE --use_fast_math +# RELWITHDEBINFO --use_fast_math;-g +# MINSIZEREL --use_fast_math +# +# For certain configurations (namely VS generating object files with +# CUDA_ATTACH_VS_BUILD_RULE_TO_CUDA_FILE set to ON), no generated file will +# be produced for the given cuda file. This is because when you add the +# cuda file to Visual Studio it knows that this file produces an object file +# and will link in the resulting object file automatically. +# +# This script will also generate a separate cmake script that is used at +# build time to invoke nvcc. This is for several reasons. +# +# 1. nvcc can return negative numbers as return values which confuses +# Visual Studio into thinking that the command succeeded. The script now +# checks the error codes and produces errors when there was a problem. +# +# 2. nvcc has been known to not delete incomplete results when it +# encounters problems. This confuses build systems into thinking the +# target was generated when in fact an unusable file exists. The script +# now deletes the output files if there was an error. +# +# 3. By putting all the options that affect the build into a file and then +# make the build rule dependent on the file, the output files will be +# regenerated when the options change. +# +# This script also looks at optional arguments STATIC, SHARED, or MODULE to +# determine when to target the object compilation for a shared library. +# BUILD_SHARED_LIBS is ignored in CUDA_WRAP_SRCS, but it is respected in +# CUDA_ADD_LIBRARY. On some systems special flags are added for building +# objects intended for shared libraries. A preprocessor macro, +# _EXPORTS is defined when a shared library compilation is +# detected. +# +# Flags passed into add_definitions with -D or /D are passed along to nvcc. +# +# +# +# The script defines the following variables:: +# +# CUDA_VERSION_MAJOR -- The major version of cuda as reported by nvcc. +# CUDA_VERSION_MINOR -- The minor version. +# CUDA_VERSION +# CUDA_VERSION_STRING -- CUDA_VERSION_MAJOR.CUDA_VERSION_MINOR +# +# CUDA_TOOLKIT_ROOT_DIR -- Path to the CUDA Toolkit (defined if not set). +# CUDA_SDK_ROOT_DIR -- Path to the CUDA SDK. Use this to find files in the +# SDK. This script will not directly support finding +# specific libraries or headers, as that isn't +# supported by NVIDIA. If you want to change +# libraries when the path changes see the +# FindCUDA.cmake script for an example of how to clear +# these variables. There are also examples of how to +# use the CUDA_SDK_ROOT_DIR to locate headers or +# libraries, if you so choose (at your own risk). +# CUDA_INCLUDE_DIRS -- Include directory for cuda headers. Added automatically +# for CUDA_ADD_EXECUTABLE and CUDA_ADD_LIBRARY. +# CUDA_LIBRARIES -- Cuda RT library. +# CUDA_CUFFT_LIBRARIES -- Device or emulation library for the Cuda FFT +# implementation (alternative to: +# CUDA_ADD_CUFFT_TO_TARGET macro) +# CUDA_CUBLAS_LIBRARIES -- Device or emulation library for the Cuda BLAS +# implementation (alterative to: +# CUDA_ADD_CUBLAS_TO_TARGET macro). +# CUDA_cupti_LIBRARY -- CUDA Profiling Tools Interface library. +# Only available for CUDA version 4.0+. +# CUDA_curand_LIBRARY -- CUDA Random Number Generation library. +# Only available for CUDA version 3.2+. +# CUDA_cusparse_LIBRARY -- CUDA Sparse Matrix library. +# Only available for CUDA version 3.2+. +# CUDA_npp_LIBRARY -- NVIDIA Performance Primitives lib. +# Only available for CUDA version 4.0+. +# CUDA_nppc_LIBRARY -- NVIDIA Performance Primitives lib (core). +# Only available for CUDA version 5.5+. +# CUDA_nppi_LIBRARY -- NVIDIA Performance Primitives lib (image processing). +# Only available for CUDA version 5.5+. +# CUDA_npps_LIBRARY -- NVIDIA Performance Primitives lib (signal processing). +# Only available for CUDA version 5.5+. +# CUDA_nvcuvenc_LIBRARY -- CUDA Video Encoder library. +# Only available for CUDA version 3.2+. +# Windows only. +# CUDA_nvcuvid_LIBRARY -- CUDA Video Decoder library. +# Only available for CUDA version 3.2+. +# Windows only. +# + +# James Bigler, NVIDIA Corp (nvidia.com - jbigler) +# Abe Stephens, SCI Institute -- http://www.sci.utah.edu/~abe/FindCuda.html +# +# Copyright (c) 2008 - 2009 NVIDIA Corporation. All rights reserved. +# +# Copyright (c) 2007-2009 +# Scientific Computing and Imaging Institute, University of Utah +# +# This code is licensed under the MIT License. See the FindCUDA.cmake script +# for the text of the license. + +# The MIT License +# +# License for the specific language governing rights and limitations under +# Permission is hereby granted, free of charge, to any person obtaining a +# copy of this software and associated documentation files (the "Software"), +# to deal in the Software without restriction, including without limitation +# the rights to use, copy, modify, merge, publish, distribute, sublicense, +# and/or sell copies of the Software, and to permit persons to whom the +# Software is furnished to do so, subject to the following conditions: +# +# The above copyright notice and this permission notice shall be included +# in all copies or substantial portions of the Software. +# +# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS +# OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL +# THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING +# FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER +# DEALINGS IN THE SOFTWARE. +# +############################################################################### + +# FindCUDA.cmake + +# This macro helps us find the location of helper files we will need the full path to +macro(CUDA_FIND_HELPER_FILE _name _extension) + set(_full_name "${_name}.${_extension}") + # CMAKE_CURRENT_LIST_FILE contains the full path to the file currently being + # processed. Using this variable, we can pull out the current path, and + # provide a way to get access to the other files we need local to here. + get_filename_component(CMAKE_CURRENT_LIST_DIR "${CMAKE_CURRENT_LIST_FILE}" PATH) + set(CUDA_${_name} "${CMAKE_CURRENT_LIST_DIR}/FindCUDA/${_full_name}") + if(NOT EXISTS "${CUDA_${_name}}") + set(error_message "${_full_name} not found in ${CMAKE_CURRENT_LIST_DIR}/FindCUDA") + if(CUDA_FIND_REQUIRED) + message(FATAL_ERROR "${error_message}") + else() + if(NOT CUDA_FIND_QUIETLY) + message(STATUS "${error_message}") + endif() + endif() + endif() + # Set this variable as internal, so the user isn't bugged with it. + set(CUDA_${_name} ${CUDA_${_name}} CACHE INTERNAL "Location of ${_full_name}" FORCE) +endmacro() + +##################################################################### +## CUDA_INCLUDE_NVCC_DEPENDENCIES +## + +# So we want to try and include the dependency file if it exists. If +# it doesn't exist then we need to create an empty one, so we can +# include it. + +# If it does exist, then we need to check to see if all the files it +# depends on exist. If they don't then we should clear the dependency +# file and regenerate it later. This covers the case where a header +# file has disappeared or moved. + +macro(CUDA_INCLUDE_NVCC_DEPENDENCIES dependency_file) + set(CUDA_NVCC_DEPEND) + set(CUDA_NVCC_DEPEND_REGENERATE FALSE) + + + # Include the dependency file. Create it first if it doesn't exist . The + # INCLUDE puts a dependency that will force CMake to rerun and bring in the + # new info when it changes. DO NOT REMOVE THIS (as I did and spent a few + # hours figuring out why it didn't work. + if(NOT EXISTS ${dependency_file}) + file(WRITE ${dependency_file} "#FindCUDA.cmake generated file. Do not edit.\n") + endif() + # Always include this file to force CMake to run again next + # invocation and rebuild the dependencies. + #message("including dependency_file = ${dependency_file}") + include(${dependency_file}) + + # Now we need to verify the existence of all the included files + # here. If they aren't there we need to just blank this variable and + # make the file regenerate again. +# if(DEFINED CUDA_NVCC_DEPEND) +# message("CUDA_NVCC_DEPEND set") +# else() +# message("CUDA_NVCC_DEPEND NOT set") +# endif() + if(CUDA_NVCC_DEPEND) + #message("CUDA_NVCC_DEPEND found") + foreach(f ${CUDA_NVCC_DEPEND}) + # message("searching for ${f}") + if(NOT EXISTS ${f}) + #message("file ${f} not found") + set(CUDA_NVCC_DEPEND_REGENERATE TRUE) + endif() + endforeach() + else() + #message("CUDA_NVCC_DEPEND false") + # No dependencies, so regenerate the file. + set(CUDA_NVCC_DEPEND_REGENERATE TRUE) + endif() + + #message("CUDA_NVCC_DEPEND_REGENERATE = ${CUDA_NVCC_DEPEND_REGENERATE}") + # No incoming dependencies, so we need to generate them. Make the + # output depend on the dependency file itself, which should cause the + # rule to re-run. + if(CUDA_NVCC_DEPEND_REGENERATE) + set(CUDA_NVCC_DEPEND ${dependency_file}) + #message("Generating an empty dependency_file: ${dependency_file}") + file(WRITE ${dependency_file} "#FindCUDA.cmake generated file. Do not edit.\n") + endif() + +endmacro() + +############################################################################### +############################################################################### +# Setup variables' defaults +############################################################################### +############################################################################### + +# Allow the user to specify if the device code is supposed to be 32 or 64 bit. +if(CMAKE_SIZEOF_VOID_P EQUAL 8) + set(CUDA_64_BIT_DEVICE_CODE_DEFAULT ON) +else() + set(CUDA_64_BIT_DEVICE_CODE_DEFAULT OFF) +endif() +option(CUDA_64_BIT_DEVICE_CODE "Compile device code in 64 bit mode" ${CUDA_64_BIT_DEVICE_CODE_DEFAULT}) + +# Attach the build rule to the source file in VS. This option +option(CUDA_ATTACH_VS_BUILD_RULE_TO_CUDA_FILE "Attach the build rule to the CUDA source file. Enable only when the CUDA source file is added to at most one target." ON) + +# Prints out extra information about the cuda file during compilation +option(CUDA_BUILD_CUBIN "Generate and parse .cubin files in Device mode." OFF) + +# Set whether we are using emulation or device mode. +option(CUDA_BUILD_EMULATION "Build in Emulation mode" OFF) + +# Where to put the generated output. +set(CUDA_GENERATED_OUTPUT_DIR "" CACHE PATH "Directory to put all the output files. If blank it will default to the CMAKE_CURRENT_BINARY_DIR") + +# Parse HOST_COMPILATION mode. +option(CUDA_HOST_COMPILATION_CPP "Generated file extension" ON) + +# Extra user settable flags +set(CUDA_NVCC_FLAGS "" CACHE STRING "Semi-colon delimit multiple arguments.") + +if(CMAKE_GENERATOR MATCHES "Visual Studio") + set(CUDA_HOST_COMPILER "$(VCInstallDir)bin" CACHE FILEPATH "Host side compiler used by NVCC") +else() + # Using cc which is symlink to clang may let NVCC think it is GCC and issue + # unhandled -dumpspecs option to clang. Also in case neither + # CMAKE_C_COMPILER is defined (project does not use C language) nor + # CUDA_HOST_COMPILER is specified manually we should skip -ccbin and let + # nvcc use its own default C compiler. + if(DEFINED CMAKE_C_COMPILER AND NOT DEFINED CUDA_HOST_COMPILER) + get_filename_component(c_compiler_realpath "${CMAKE_C_COMPILER}" REALPATH) + else() + set(c_compiler_realpath "") + endif() + set(CUDA_HOST_COMPILER "${c_compiler_realpath}" CACHE FILEPATH "Host side compiler used by NVCC") +endif() + +# Propagate the host flags to the host compiler via -Xcompiler +option(CUDA_PROPAGATE_HOST_FLAGS "Propage C/CXX_FLAGS and friends to the host compiler via -Xcompile" ON) + +# Enable CUDA_SEPARABLE_COMPILATION +option(CUDA_SEPARABLE_COMPILATION "Compile CUDA objects with separable compilation enabled. Requires CUDA 5.0+" OFF) + +# Specifies whether the commands used when compiling the .cu file will be printed out. +option(CUDA_VERBOSE_BUILD "Print out the commands run while compiling the CUDA source file. With the Makefile generator this defaults to VERBOSE variable specified on the command line, but can be forced on with this option." OFF) + +mark_as_advanced( + CUDA_64_BIT_DEVICE_CODE + CUDA_ATTACH_VS_BUILD_RULE_TO_CUDA_FILE + CUDA_GENERATED_OUTPUT_DIR + CUDA_HOST_COMPILATION_CPP + CUDA_NVCC_FLAGS + CUDA_PROPAGATE_HOST_FLAGS + ) + +# Makefile and similar generators don't define CMAKE_CONFIGURATION_TYPES, so we +# need to add another entry for the CMAKE_BUILD_TYPE. We also need to add the +# standerd set of 4 build types (Debug, MinSizeRel, Release, and RelWithDebInfo) +# for completeness. We need run this loop in order to accomodate the addition +# of extra configuration types. Duplicate entries will be removed by +# REMOVE_DUPLICATES. +set(CUDA_configuration_types ${CMAKE_CONFIGURATION_TYPES} ${CMAKE_BUILD_TYPE} Debug MinSizeRel Release RelWithDebInfo) +list(REMOVE_DUPLICATES CUDA_configuration_types) +foreach(config ${CUDA_configuration_types}) + string(TOUPPER ${config} config_upper) + set(CUDA_NVCC_FLAGS_${config_upper} "" CACHE STRING "Semi-colon delimit multiple arguments.") + mark_as_advanced(CUDA_NVCC_FLAGS_${config_upper}) +endforeach() + +############################################################################### +############################################################################### +# Locate CUDA, Set Build Type, etc. +############################################################################### +############################################################################### + +macro(cuda_unset_include_and_libraries) + unset(CUDA_TOOLKIT_INCLUDE CACHE) + unset(CUDA_CUDART_LIBRARY CACHE) + unset(CUDA_CUDA_LIBRARY CACHE) + # Make sure you run this before you unset CUDA_VERSION. + if(CUDA_VERSION VERSION_EQUAL "3.0") + # This only existed in the 3.0 version of the CUDA toolkit + unset(CUDA_CUDARTEMU_LIBRARY CACHE) + endif() + unset(CUDA_cupti_LIBRARY CACHE) + unset(CUDA_cublas_LIBRARY CACHE) + unset(CUDA_cublasemu_LIBRARY CACHE) + unset(CUDA_cufft_LIBRARY CACHE) + unset(CUDA_cufftemu_LIBRARY CACHE) + unset(CUDA_curand_LIBRARY CACHE) + unset(CUDA_cusparse_LIBRARY CACHE) + unset(CUDA_npp_LIBRARY CACHE) + unset(CUDA_nppc_LIBRARY CACHE) + unset(CUDA_nppi_LIBRARY CACHE) + unset(CUDA_npps_LIBRARY CACHE) + unset(CUDA_nvcuvenc_LIBRARY CACHE) + unset(CUDA_nvcuvid_LIBRARY CACHE) +endmacro() + +# Check to see if the CUDA_TOOLKIT_ROOT_DIR and CUDA_SDK_ROOT_DIR have changed, +# if they have then clear the cache variables, so that will be detected again. +if(DEFINED CUDA_TOOLKIT_ROOT_DIR_INTERNAL AND (NOT "${CUDA_TOOLKIT_ROOT_DIR}" STREQUAL "${CUDA_TOOLKIT_ROOT_DIR_INTERNAL}")) + unset(CUDA_TARGET_TRIPLET CACHE) + unset(CUDA_TOOLKIT_TARGET_DIR CACHE) + unset(CUDA_NVCC_EXECUTABLE CACHE) + unset(CUDA_VERSION CACHE) + cuda_unset_include_and_libraries() +endif() + +if(DEFINED CUDA_TARGET_TRIPLET_INTERNAL AND (NOT "${CUDA_TARGET_TRIPLET}" STREQUAL "${CUDA_TARGET_TRIPLET_INTERNAL}") OR + (DEFINED CUDA_TOOLKIT_TARGET_DIR AND DEFINED CUDA_TOOLKIT_TARGET_DIR_INTERNAL AND NOT "${CUDA_TOOLKIT_TARGET_DIR}" STREQUAL "${CUDA_TOOLKIT_TARGET_DIR_INTERNAL}")) + cuda_unset_include_and_libraries() +endif() + +if(NOT "${CUDA_SDK_ROOT_DIR}" STREQUAL "${CUDA_SDK_ROOT_DIR_INTERNAL}") + # No specific variables to catch. Use this kind of code before calling + # find_package(CUDA) to clean up any variables that may depend on this path. + + # unset(MY_SPECIAL_CUDA_SDK_INCLUDE_DIR CACHE) + # unset(MY_SPECIAL_CUDA_SDK_LIBRARY CACHE) +endif() + +# Search for the cuda distribution. +if(NOT CUDA_TOOLKIT_ROOT_DIR) + + # Search in the CUDA_BIN_PATH first. + find_path(CUDA_TOOLKIT_ROOT_DIR + NAMES nvcc nvcc.exe + PATHS + ENV CUDA_PATH + ENV CUDA_BIN_PATH + PATH_SUFFIXES bin bin64 + DOC "Toolkit location." + NO_DEFAULT_PATH + ) + # Now search default paths + find_path(CUDA_TOOLKIT_ROOT_DIR + NAMES nvcc nvcc.exe + PATHS /usr/local/bin + /usr/local/cuda/bin + DOC "Toolkit location." + ) + + if (CUDA_TOOLKIT_ROOT_DIR) + string(REGEX REPLACE "[/\\\\]?bin[64]*[/\\\\]?$" "" CUDA_TOOLKIT_ROOT_DIR ${CUDA_TOOLKIT_ROOT_DIR}) + # We need to force this back into the cache. + set(CUDA_TOOLKIT_ROOT_DIR ${CUDA_TOOLKIT_ROOT_DIR} CACHE PATH "Toolkit location." FORCE) + endif() + if (NOT EXISTS ${CUDA_TOOLKIT_ROOT_DIR}) + if(CUDA_FIND_REQUIRED) + message(FATAL_ERROR "Specify CUDA_TOOLKIT_ROOT_DIR") + elseif(NOT CUDA_FIND_QUIETLY) + message("CUDA_TOOLKIT_ROOT_DIR not found or specified") + endif() + endif () +endif () + +# CUDA_NVCC_EXECUTABLE +find_program(CUDA_NVCC_EXECUTABLE + NAMES nvcc + PATHS "${CUDA_TOOLKIT_ROOT_DIR}" + ENV CUDA_PATH + ENV CUDA_BIN_PATH + PATH_SUFFIXES bin bin64 + NO_DEFAULT_PATH + ) +# Search default search paths, after we search our own set of paths. +find_program(CUDA_NVCC_EXECUTABLE nvcc) +mark_as_advanced(CUDA_NVCC_EXECUTABLE) + +if(CUDA_NVCC_EXECUTABLE AND NOT CUDA_VERSION) + # Compute the version. + execute_process (COMMAND ${CUDA_NVCC_EXECUTABLE} "--version" OUTPUT_VARIABLE NVCC_OUT) + string(REGEX REPLACE ".*release ([0-9]+)\\.([0-9]+).*" "\\1" CUDA_VERSION_MAJOR ${NVCC_OUT}) + string(REGEX REPLACE ".*release ([0-9]+)\\.([0-9]+).*" "\\2" CUDA_VERSION_MINOR ${NVCC_OUT}) + set(CUDA_VERSION "${CUDA_VERSION_MAJOR}.${CUDA_VERSION_MINOR}" CACHE STRING "Version of CUDA as computed from nvcc.") + mark_as_advanced(CUDA_VERSION) +else() + # Need to set these based off of the cached value + string(REGEX REPLACE "([0-9]+)\\.([0-9]+).*" "\\1" CUDA_VERSION_MAJOR "${CUDA_VERSION}") + string(REGEX REPLACE "([0-9]+)\\.([0-9]+).*" "\\2" CUDA_VERSION_MINOR "${CUDA_VERSION}") +endif() + +# Always set this convenience variable +set(CUDA_VERSION_STRING "${CUDA_VERSION}") + +# Target CPU architecture +if(DEFINED CUDA_TARGET_CPU_ARCH) + set(_cuda_target_cpu_arch_initial "${CUDA_TARGET_CPU_ARCH}") +elseif(CUDA_VERSION VERSION_GREATER "5.0" AND CMAKE_CROSSCOMPILING AND CMAKE_SYSTEM_PROCESSOR MATCHES "^(arm|ARM)") + set(_cuda_target_cpu_arch_initial "ARM") +elseif(CUDA_VERSION VERSION_GREATER "6.5" AND CMAKE_CROSSCOMPILING AND CMAKE_SYSTEM_PROCESSOR MATCHES "^(aarch64|AARCH64)") + set(_cuda_target_cpu_arch_initial "AARCH64") +else() + set(_cuda_target_cpu_arch_initial "") +endif() +set(CUDA_TARGET_CPU_ARCH "${_cuda_target_cpu_arch_initial}" CACHE STRING "Specify the name of the class of CPU architecture for which the input files must be compiled.") +mark_as_advanced(CUDA_TARGET_CPU_ARCH) + +# Target OS variant +if(DEFINED CUDA_TARGET_OS_VARIANT) + set(_cuda_target_os_variant_initial "${CUDA_TARGET_OS_VARIANT}") +else() + set(_cuda_target_os_variant_initial "") +endif() +set(CUDA_TARGET_OS_VARIANT "${_cuda_target_os_variant_initial}" CACHE STRING "Specify the name of the class of OS for which the input files must be compiled.") +mark_as_advanced(CUDA_TARGET_OS_VARIANT) + +# Target triplet +if(DEFINED CUDA_TARGET_TRIPLET) + set(_cuda_target_triplet_initial "${CUDA_TARGET_TRIPLET}") +elseif(CUDA_VERSION VERSION_GREATER "5.0" AND CMAKE_CROSSCOMPILING AND "${CUDA_TARGET_CPU_ARCH}" STREQUAL "ARM") + if("${CUDA_TARGET_OS_VARIANT}" STREQUAL "Android" AND EXISTS "${CUDA_TOOLKIT_ROOT_DIR}/targets/armv7-linux-androideabi") + set(_cuda_target_triplet_initial "armv7-linux-androideabi") + elseif(EXISTS "${CUDA_TOOLKIT_ROOT_DIR}/targets/armv7-linux-gnueabihf") + set(_cuda_target_triplet_initial "armv7-linux-gnueabihf") + endif() +elseif(CUDA_VERSION VERSION_GREATER "6.5" AND CMAKE_CROSSCOMPILING AND "${CUDA_TARGET_CPU_ARCH}" STREQUAL "AARCH64") + if("${CUDA_TARGET_OS_VARIANT}" STREQUAL "Android" AND EXISTS "${CUDA_TOOLKIT_ROOT_DIR}/targets/aarch64-linux-androideabi") + set(_cuda_target_triplet_initial "aarch64-linux-androideabi") + elseif(EXISTS "${CUDA_TOOLKIT_ROOT_DIR}/targets/aarch64-linux-gnueabihf") + set(_cuda_target_triplet_initial "aarch64-linux-gnueabihf") + endif() +endif() +set(CUDA_TARGET_TRIPLET "${_cuda_target_triplet_initial}" CACHE STRING "Specify the target triplet for which the input files must be compiled.") +file(GLOB __cuda_available_target_tiplets RELATIVE "${CUDA_TOOLKIT_ROOT_DIR}/targets" "${CUDA_TOOLKIT_ROOT_DIR}/targets/*" ) +set_property(CACHE CUDA_TARGET_TRIPLET PROPERTY STRINGS ${__cuda_available_target_tiplets}) +mark_as_advanced(CUDA_TARGET_TRIPLET) + +# Target directory +if(NOT DEFINED CUDA_TOOLKIT_TARGET_DIR AND CUDA_TARGET_TRIPLET AND EXISTS "${CUDA_TOOLKIT_ROOT_DIR}/targets/${CUDA_TARGET_TRIPLET}") + set(CUDA_TOOLKIT_TARGET_DIR "${CUDA_TOOLKIT_ROOT_DIR}/targets/${CUDA_TARGET_TRIPLET}") +endif() + +# CUDA_TOOLKIT_INCLUDE +find_path(CUDA_TOOLKIT_INCLUDE + device_functions.h # Header included in toolkit + PATHS "${CUDA_TOOLKIT_TARGET_DIR}" "${CUDA_TOOLKIT_ROOT_DIR}" + ENV CUDA_PATH + ENV CUDA_INC_PATH + PATH_SUFFIXES include + NO_DEFAULT_PATH + ) +# Search default search paths, after we search our own set of paths. +find_path(CUDA_TOOLKIT_INCLUDE device_functions.h) +mark_as_advanced(CUDA_TOOLKIT_INCLUDE) + +# Set the user list of include dir to nothing to initialize it. +set (CUDA_NVCC_INCLUDE_ARGS_USER "") +set (CUDA_INCLUDE_DIRS ${CUDA_TOOLKIT_INCLUDE}) + +macro(cuda_find_library_local_first_with_path_ext _var _names _doc _path_ext ) + if(CMAKE_SIZEOF_VOID_P EQUAL 8) + # CUDA 3.2+ on Windows moved the library directories, so we need the new + # and old paths. + set(_cuda_64bit_lib_dir "${_path_ext}lib/x64" "${_path_ext}lib64" "${_path_ext}libx64" ) + endif() + if(CUDA_VERSION VERSION_GREATER "6.0") + set(_cuda_static_lib_names "") + foreach(name ${_names}) + list(APPEND _cuda_static_lib_names "${name}_static") + endforeach() + endif() + # CUDA 3.2+ on Windows moved the library directories, so we need to new + # (lib/Win32) and the old path (lib). + find_library(${_var} + NAMES ${_names} ${_cuda_static_lib_names} + PATHS "${CUDA_TOOLKIT_TARGET_DIR}" "${CUDA_TOOLKIT_ROOT_DIR}" + ENV CUDA_PATH + ENV CUDA_LIB_PATH + PATH_SUFFIXES ${_cuda_64bit_lib_dir} "${_path_ext}lib/Win32" "${_path_ext}lib" "${_path_ext}libWin32" + DOC ${_doc} + NO_DEFAULT_PATH + ) + # Search default search paths, after we search our own set of paths. + find_library(${_var} + NAMES ${_names} ${_cuda_static_lib_names} + PATHS "/usr/lib/nvidia-current" + DOC ${_doc} + ) +endmacro() + +macro(cuda_find_library_local_first _var _names _doc) + cuda_find_library_local_first_with_path_ext( "${_var}" "${_names}" "${_doc}" "" ) +endmacro() + +macro(find_library_local_first _var _names _doc ) + cuda_find_library_local_first( "${_var}" "${_names}" "${_doc}" "" ) +endmacro() + + +# CUDA_LIBRARIES +cuda_find_library_local_first(CUDA_CUDART_LIBRARY cudart "\"cudart\" library") +if(CUDA_VERSION VERSION_EQUAL "3.0") + # The cudartemu library only existed for the 3.0 version of CUDA. + cuda_find_library_local_first(CUDA_CUDARTEMU_LIBRARY cudartemu "\"cudartemu\" library") + mark_as_advanced( + CUDA_CUDARTEMU_LIBRARY + ) +endif() + +# CUPTI library showed up in cuda toolkit 4.0 +if(NOT CUDA_VERSION VERSION_LESS "4.0") + cuda_find_library_local_first_with_path_ext(CUDA_cupti_LIBRARY cupti "\"cupti\" library" "extras/CUPTI/") + mark_as_advanced(CUDA_cupti_LIBRARY) +endif() + +# If we are using emulation mode and we found the cudartemu library then use +# that one instead of cudart. +if(CUDA_BUILD_EMULATION AND CUDA_CUDARTEMU_LIBRARY) + set(CUDA_LIBRARIES ${CUDA_CUDARTEMU_LIBRARY}) +else() + set(CUDA_LIBRARIES ${CUDA_CUDART_LIBRARY}) +endif() + +# 1.1 toolkit on linux doesn't appear to have a separate library on +# some platforms. +cuda_find_library_local_first(CUDA_CUDA_LIBRARY cuda "\"cuda\" library (older versions only).") + +mark_as_advanced( + CUDA_CUDA_LIBRARY + CUDA_CUDART_LIBRARY + ) + +####################### +# Look for some of the toolkit helper libraries +macro(FIND_CUDA_HELPER_LIBS _name) + cuda_find_library_local_first(CUDA_${_name}_LIBRARY ${_name} "\"${_name}\" library") + mark_as_advanced(CUDA_${_name}_LIBRARY) +endmacro() + +####################### +# Disable emulation for v3.1 onward +if(CUDA_VERSION VERSION_GREATER "3.0") + if(CUDA_BUILD_EMULATION) + message(FATAL_ERROR "CUDA_BUILD_EMULATION is not supported in version 3.1 and onwards. You must disable it to proceed. You have version ${CUDA_VERSION}.") + endif() +endif() + +# Search for additional CUDA toolkit libraries. +if(CUDA_VERSION VERSION_LESS "3.1") + # Emulation libraries aren't available in version 3.1 onward. + find_cuda_helper_libs(cufftemu) + find_cuda_helper_libs(cublasemu) +endif() +find_cuda_helper_libs(cufft) +find_cuda_helper_libs(cublas) +if(NOT CUDA_VERSION VERSION_LESS "3.2") + # cusparse showed up in version 3.2 + find_cuda_helper_libs(cusparse) + find_cuda_helper_libs(curand) + if (WIN32) + find_cuda_helper_libs(nvcuvenc) + find_cuda_helper_libs(nvcuvid) + endif() +endif() +if(CUDA_VERSION VERSION_GREATER "5.0") + # In CUDA 5.5 NPP was splitted onto 3 separate libraries. + find_cuda_helper_libs(nppc) + find_cuda_helper_libs(nppi) + find_cuda_helper_libs(npps) + set(CUDA_npp_LIBRARY "${CUDA_nppc_LIBRARY};${CUDA_nppi_LIBRARY};${CUDA_npps_LIBRARY}") +elseif(NOT CUDA_VERSION VERSION_LESS "4.0") + find_cuda_helper_libs(npp) +endif() + +if (CUDA_BUILD_EMULATION) + set(CUDA_CUFFT_LIBRARIES ${CUDA_cufftemu_LIBRARY}) + set(CUDA_CUBLAS_LIBRARIES ${CUDA_cublasemu_LIBRARY}) +else() + set(CUDA_CUFFT_LIBRARIES ${CUDA_cufft_LIBRARY}) + set(CUDA_CUBLAS_LIBRARIES ${CUDA_cublas_LIBRARY}) +endif() + +######################## +# Look for the SDK stuff. As of CUDA 3.0 NVSDKCUDA_ROOT has been replaced with +# NVSDKCOMPUTE_ROOT with the old CUDA C contents moved into the C subdirectory +find_path(CUDA_SDK_ROOT_DIR common/inc/cutil.h + HINTS + "$ENV{NVSDKCOMPUTE_ROOT}/C" + ENV NVSDKCUDA_ROOT + "[HKEY_LOCAL_MACHINE\\SOFTWARE\\NVIDIA Corporation\\Installed Products\\NVIDIA SDK 10\\Compute;InstallDir]" + PATHS + "/Developer/GPU\ Computing/C" + ) + +# Keep the CUDA_SDK_ROOT_DIR first in order to be able to override the +# environment variables. +set(CUDA_SDK_SEARCH_PATH + "${CUDA_SDK_ROOT_DIR}" + "${CUDA_TOOLKIT_ROOT_DIR}/local/NVSDK0.2" + "${CUDA_TOOLKIT_ROOT_DIR}/NVSDK0.2" + "${CUDA_TOOLKIT_ROOT_DIR}/NV_CUDA_SDK" + "$ENV{HOME}/NVIDIA_CUDA_SDK" + "$ENV{HOME}/NVIDIA_CUDA_SDK_MACOSX" + "/Developer/CUDA" + ) + +# Example of how to find an include file from the CUDA_SDK_ROOT_DIR + +# find_path(CUDA_CUT_INCLUDE_DIR +# cutil.h +# PATHS ${CUDA_SDK_SEARCH_PATH} +# PATH_SUFFIXES "common/inc" +# DOC "Location of cutil.h" +# NO_DEFAULT_PATH +# ) +# # Now search system paths +# find_path(CUDA_CUT_INCLUDE_DIR cutil.h DOC "Location of cutil.h") + +# mark_as_advanced(CUDA_CUT_INCLUDE_DIR) + + +# Example of how to find a library in the CUDA_SDK_ROOT_DIR + +# # cutil library is called cutil64 for 64 bit builds on windows. We don't want +# # to get these confused, so we are setting the name based on the word size of +# # the build. + +# if(CMAKE_SIZEOF_VOID_P EQUAL 8) +# set(cuda_cutil_name cutil64) +# else() +# set(cuda_cutil_name cutil32) +# endif() + +# find_library(CUDA_CUT_LIBRARY +# NAMES cutil ${cuda_cutil_name} +# PATHS ${CUDA_SDK_SEARCH_PATH} +# # The new version of the sdk shows up in common/lib, but the old one is in lib +# PATH_SUFFIXES "common/lib" "lib" +# DOC "Location of cutil library" +# NO_DEFAULT_PATH +# ) +# # Now search system paths +# find_library(CUDA_CUT_LIBRARY NAMES cutil ${cuda_cutil_name} DOC "Location of cutil library") +# mark_as_advanced(CUDA_CUT_LIBRARY) +# set(CUDA_CUT_LIBRARIES ${CUDA_CUT_LIBRARY}) + + + +############################# +# Check for required components +set(CUDA_FOUND TRUE) + +set(CUDA_TOOLKIT_ROOT_DIR_INTERNAL "${CUDA_TOOLKIT_ROOT_DIR}" CACHE INTERNAL + "This is the value of the last time CUDA_TOOLKIT_ROOT_DIR was set successfully." FORCE) +set(CUDA_TARGET_TRIPLET_INTERNAL "${CUDA_TARGET_TRIPLET}" CACHE INTERNAL + "This is the value of the last time CUDA_TARGET_TRIPLET was set successfully." FORCE) +set(CUDA_TOOLKIT_TARGET_DIR_INTERNAL "${CUDA_TOOLKIT_TARGET_DIR}" CACHE INTERNAL + "This is the value of the last time CUDA_TOOLKIT_TARGET_DIR was set successfully." FORCE) +set(CUDA_SDK_ROOT_DIR_INTERNAL "${CUDA_SDK_ROOT_DIR}" CACHE INTERNAL + "This is the value of the last time CUDA_SDK_ROOT_DIR was set successfully." FORCE) + +include(FindPackageHandleStandardArgs) +find_package_handle_standard_args(CUDA + REQUIRED_VARS + CUDA_TOOLKIT_ROOT_DIR + CUDA_NVCC_EXECUTABLE + CUDA_INCLUDE_DIRS + CUDA_CUDART_LIBRARY + VERSION_VAR + CUDA_VERSION + ) + + + +############################################################################### +############################################################################### +# Macros +############################################################################### +############################################################################### + +############################################################################### +# Add include directories to pass to the nvcc command. +macro(CUDA_INCLUDE_DIRECTORIES) + foreach(dir ${ARGN}) + list(APPEND CUDA_NVCC_INCLUDE_ARGS_USER -I${dir}) + endforeach() +endmacro() + + +############################################################################## +cuda_find_helper_file(parse_cubin cmake) +cuda_find_helper_file(make2cmake cmake) +cuda_find_helper_file(run_nvcc cmake) + +############################################################################## +# Separate the OPTIONS out from the sources +# +macro(CUDA_GET_SOURCES_AND_OPTIONS _sources _cmake_options _options) + set( ${_sources} ) + set( ${_cmake_options} ) + set( ${_options} ) + set( _found_options FALSE ) + foreach(arg ${ARGN}) + if("x${arg}" STREQUAL "xOPTIONS") + set( _found_options TRUE ) + elseif( + "x${arg}" STREQUAL "xWIN32" OR + "x${arg}" STREQUAL "xMACOSX_BUNDLE" OR + "x${arg}" STREQUAL "xEXCLUDE_FROM_ALL" OR + "x${arg}" STREQUAL "xSTATIC" OR + "x${arg}" STREQUAL "xSHARED" OR + "x${arg}" STREQUAL "xMODULE" + ) + list(APPEND ${_cmake_options} ${arg}) + else() + if ( _found_options ) + list(APPEND ${_options} ${arg}) + else() + # Assume this is a file + list(APPEND ${_sources} ${arg}) + endif() + endif() + endforeach() +endmacro() + +############################################################################## +# Parse the OPTIONS from ARGN and set the variables prefixed by _option_prefix +# +macro(CUDA_PARSE_NVCC_OPTIONS _option_prefix) + set( _found_config ) + foreach(arg ${ARGN}) + # Determine if we are dealing with a perconfiguration flag + foreach(config ${CUDA_configuration_types}) + string(TOUPPER ${config} config_upper) + if (arg STREQUAL "${config_upper}") + set( _found_config _${arg}) + # Set arg to nothing to keep it from being processed further + set( arg ) + endif() + endforeach() + + if ( arg ) + list(APPEND ${_option_prefix}${_found_config} "${arg}") + endif() + endforeach() +endmacro() + +############################################################################## +# Helper to add the include directory for CUDA only once +function(CUDA_ADD_CUDA_INCLUDE_ONCE) + get_directory_property(_include_directories INCLUDE_DIRECTORIES) + set(_add TRUE) + if(_include_directories) + foreach(dir ${_include_directories}) + if("${dir}" STREQUAL "${CUDA_INCLUDE_DIRS}") + set(_add FALSE) + endif() + endforeach() + endif() + if(_add) + include_directories(${CUDA_INCLUDE_DIRS}) + endif() +endfunction() + +function(CUDA_BUILD_SHARED_LIBRARY shared_flag) + set(cmake_args ${ARGN}) + # If SHARED, MODULE, or STATIC aren't already in the list of arguments, then + # add SHARED or STATIC based on the value of BUILD_SHARED_LIBS. + list(FIND cmake_args SHARED _cuda_found_SHARED) + list(FIND cmake_args MODULE _cuda_found_MODULE) + list(FIND cmake_args STATIC _cuda_found_STATIC) + if( _cuda_found_SHARED GREATER -1 OR + _cuda_found_MODULE GREATER -1 OR + _cuda_found_STATIC GREATER -1) + set(_cuda_build_shared_libs) + else() + if (BUILD_SHARED_LIBS) + set(_cuda_build_shared_libs SHARED) + else() + set(_cuda_build_shared_libs STATIC) + endif() + endif() + set(${shared_flag} ${_cuda_build_shared_libs} PARENT_SCOPE) +endfunction() + +############################################################################## +# Helper to avoid clashes of files with the same basename but different paths. +# This doesn't attempt to do exactly what CMake internals do, which is to only +# add this path when there is a conflict, since by the time a second collision +# in names is detected it's already too late to fix the first one. For +# consistency sake the relative path will be added to all files. +function(CUDA_COMPUTE_BUILD_PATH path build_path) + #message("CUDA_COMPUTE_BUILD_PATH([${path}] ${build_path})") + # Only deal with CMake style paths from here on out + file(TO_CMAKE_PATH "${path}" bpath) + if (IS_ABSOLUTE "${bpath}") + # Absolute paths are generally unnessary, especially if something like + # file(GLOB_RECURSE) is used to pick up the files. + + string(FIND "${bpath}" "${CMAKE_CURRENT_BINARY_DIR}" _binary_dir_pos) + if (_binary_dir_pos EQUAL 0) + file(RELATIVE_PATH bpath "${CMAKE_CURRENT_BINARY_DIR}" "${bpath}") + else() + file(RELATIVE_PATH bpath "${CMAKE_CURRENT_SOURCE_DIR}" "${bpath}") + endif() + endif() + + # This recipe is from cmLocalGenerator::CreateSafeUniqueObjectFileName in the + # CMake source. + + # Remove leading / + string(REGEX REPLACE "^[/]+" "" bpath "${bpath}") + # Avoid absolute paths by removing ':' + string(REPLACE ":" "_" bpath "${bpath}") + # Avoid relative paths that go up the tree + string(REPLACE "../" "__/" bpath "${bpath}") + # Avoid spaces + string(REPLACE " " "_" bpath "${bpath}") + + # Strip off the filename. I wait until here to do it, since removin the + # basename can make a path that looked like path/../basename turn into + # path/.. (notice the trailing slash). + get_filename_component(bpath "${bpath}" PATH) + + set(${build_path} "${bpath}" PARENT_SCOPE) + #message("${build_path} = ${bpath}") +endfunction() + +############################################################################## +# This helper macro populates the following variables and setups up custom +# commands and targets to invoke the nvcc compiler to generate C or PTX source +# dependent upon the format parameter. The compiler is invoked once with -M +# to generate a dependency file and a second time with -cuda or -ptx to generate +# a .cpp or .ptx file. +# INPUT: +# cuda_target - Target name +# format - PTX, CUBIN, FATBIN or OBJ +# FILE1 .. FILEN - The remaining arguments are the sources to be wrapped. +# OPTIONS - Extra options to NVCC +# OUTPUT: +# generated_files - List of generated files +############################################################################## +############################################################################## + +macro(CUDA_WRAP_SRCS cuda_target format generated_files) + + # If CMake doesn't support separable compilation, complain + if(CUDA_SEPARABLE_COMPILATION AND CMAKE_VERSION VERSION_LESS "2.8.10.1") + message(SEND_ERROR "CUDA_SEPARABLE_COMPILATION isn't supported for CMake versions less than 2.8.10.1") + endif() + + # Set up all the command line flags here, so that they can be overridden on a per target basis. + + set(nvcc_flags "") + + # Emulation if the card isn't present. + if (CUDA_BUILD_EMULATION) + # Emulation. + set(nvcc_flags ${nvcc_flags} --device-emulation -D_DEVICEEMU -g) + else() + # Device mode. No flags necessary. + endif() + + if(CUDA_HOST_COMPILATION_CPP) + set(CUDA_C_OR_CXX CXX) + else() + if(CUDA_VERSION VERSION_LESS "3.0") + set(nvcc_flags ${nvcc_flags} --host-compilation C) + else() + message(WARNING "--host-compilation flag is deprecated in CUDA version >= 3.0. Removing --host-compilation C flag" ) + endif() + set(CUDA_C_OR_CXX C) + endif() + + set(generated_extension ${CMAKE_${CUDA_C_OR_CXX}_OUTPUT_EXTENSION}) + + if(CUDA_64_BIT_DEVICE_CODE) + set(nvcc_flags ${nvcc_flags} -m64) + else() + set(nvcc_flags ${nvcc_flags} -m32) + endif() + + if(CUDA_TARGET_CPU_ARCH AND CUDA_VERSION VERSION_LESS "7.0") + # CPU architecture is either ARM or X86. Patch AARCH64 to be ARM + string(REPLACE "AARCH64" "ARM" CUDA_TARGET_CPU_ARCH_patched ${CUDA_TARGET_CPU_ARCH}) + set(nvcc_flags ${nvcc_flags} "--target-cpu-architecture=${CUDA_TARGET_CPU_ARCH_patched}") + endif() + + if(CUDA_TARGET_OS_VARIANT AND CUDA_VERSION VERSION_LESS "7.0") + set(nvcc_flags ${nvcc_flags} "-target-os-variant=${CUDA_TARGET_OS_VARIANT}") + endif() + + # This needs to be passed in at this stage, because VS needs to fill out the + # value of VCInstallDir from within VS. Note that CCBIN is only used if + # -ccbin or --compiler-bindir isn't used and CUDA_HOST_COMPILER matches + # $(VCInstallDir)/bin. + if(CMAKE_GENERATOR MATCHES "Visual Studio") + set(ccbin_flags -D "\"CCBIN:PATH=$(VCInstallDir)bin\"" ) + else() + set(ccbin_flags) + endif() + + # Figure out which configure we will use and pass that in as an argument to + # the script. We need to defer the decision until compilation time, because + # for VS projects we won't know if we are making a debug or release build + # until build time. + if(CMAKE_GENERATOR MATCHES "Visual Studio") + set( CUDA_build_configuration "$(ConfigurationName)" ) + else() + set( CUDA_build_configuration "${CMAKE_BUILD_TYPE}") + endif() + + # Initialize our list of includes with the user ones followed by the CUDA system ones. + set(CUDA_NVCC_INCLUDE_ARGS ${CUDA_NVCC_INCLUDE_ARGS_USER} "-I${CUDA_INCLUDE_DIRS}") + # Get the include directories for this directory and use them for our nvcc command. + # Remove duplicate entries which may be present since include_directories + # in CMake >= 2.8.8 does not remove them. + get_directory_property(CUDA_NVCC_INCLUDE_DIRECTORIES INCLUDE_DIRECTORIES) + list(REMOVE_DUPLICATES CUDA_NVCC_INCLUDE_DIRECTORIES) + if(CUDA_NVCC_INCLUDE_DIRECTORIES) + foreach(dir ${CUDA_NVCC_INCLUDE_DIRECTORIES}) + list(APPEND CUDA_NVCC_INCLUDE_ARGS -I${dir}) + endforeach() + endif() + + # Reset these variables + set(CUDA_WRAP_OPTION_NVCC_FLAGS) + foreach(config ${CUDA_configuration_types}) + string(TOUPPER ${config} config_upper) + set(CUDA_WRAP_OPTION_NVCC_FLAGS_${config_upper}) + endforeach() + + CUDA_GET_SOURCES_AND_OPTIONS(_cuda_wrap_sources _cuda_wrap_cmake_options _cuda_wrap_options ${ARGN}) + CUDA_PARSE_NVCC_OPTIONS(CUDA_WRAP_OPTION_NVCC_FLAGS ${_cuda_wrap_options}) + + # Figure out if we are building a shared library. BUILD_SHARED_LIBS is + # respected in CUDA_ADD_LIBRARY. + set(_cuda_build_shared_libs FALSE) + # SHARED, MODULE + list(FIND _cuda_wrap_cmake_options SHARED _cuda_found_SHARED) + list(FIND _cuda_wrap_cmake_options MODULE _cuda_found_MODULE) + if(_cuda_found_SHARED GREATER -1 OR _cuda_found_MODULE GREATER -1) + set(_cuda_build_shared_libs TRUE) + endif() + # STATIC + list(FIND _cuda_wrap_cmake_options STATIC _cuda_found_STATIC) + if(_cuda_found_STATIC GREATER -1) + set(_cuda_build_shared_libs FALSE) + endif() + + # CUDA_HOST_FLAGS + if(_cuda_build_shared_libs) + # If we are setting up code for a shared library, then we need to add extra flags for + # compiling objects for shared libraries. + set(CUDA_HOST_SHARED_FLAGS ${CMAKE_SHARED_LIBRARY_${CUDA_C_OR_CXX}_FLAGS}) + else() + set(CUDA_HOST_SHARED_FLAGS) + endif() + # Only add the CMAKE_{C,CXX}_FLAGS if we are propagating host flags. We + # always need to set the SHARED_FLAGS, though. + if(CUDA_PROPAGATE_HOST_FLAGS) + set(_cuda_host_flags "set(CMAKE_HOST_FLAGS ${CMAKE_${CUDA_C_OR_CXX}_FLAGS} ${CUDA_HOST_SHARED_FLAGS})") + else() + set(_cuda_host_flags "set(CMAKE_HOST_FLAGS ${CUDA_HOST_SHARED_FLAGS})") + endif() + + set(_cuda_nvcc_flags_config "# Build specific configuration flags") + # Loop over all the configuration types to generate appropriate flags for run_nvcc.cmake + foreach(config ${CUDA_configuration_types}) + string(TOUPPER ${config} config_upper) + # CMAKE_FLAGS are strings and not lists. By not putting quotes around CMAKE_FLAGS + # we convert the strings to lists (like we want). + + if(CUDA_PROPAGATE_HOST_FLAGS) + # nvcc chokes on -g3 in versions previous to 3.0, so replace it with -g + set(_cuda_fix_g3 FALSE) + + if(CMAKE_COMPILER_IS_GNUCC) + if (CUDA_VERSION VERSION_LESS "3.0" OR + CUDA_VERSION VERSION_EQUAL "4.1" OR + CUDA_VERSION VERSION_EQUAL "4.2" + ) + set(_cuda_fix_g3 TRUE) + endif() + endif() + if(_cuda_fix_g3) + string(REPLACE "-g3" "-g" _cuda_C_FLAGS "${CMAKE_${CUDA_C_OR_CXX}_FLAGS_${config_upper}}") + else() + set(_cuda_C_FLAGS "${CMAKE_${CUDA_C_OR_CXX}_FLAGS_${config_upper}}") + endif() + + set(_cuda_host_flags "${_cuda_host_flags}\nset(CMAKE_HOST_FLAGS_${config_upper} ${_cuda_C_FLAGS})") + endif() + + # Note that if we ever want CUDA_NVCC_FLAGS_ to be string (instead of a list + # like it is currently), we can remove the quotes around the + # ${CUDA_NVCC_FLAGS_${config_upper}} variable like the CMAKE_HOST_FLAGS_ variable. + set(_cuda_nvcc_flags_config "${_cuda_nvcc_flags_config}\nset(CUDA_NVCC_FLAGS_${config_upper} ${CUDA_NVCC_FLAGS_${config_upper}} ;; ${CUDA_WRAP_OPTION_NVCC_FLAGS_${config_upper}})") + endforeach() + + # Get the list of definitions from the directory property + get_directory_property(CUDA_NVCC_DEFINITIONS COMPILE_DEFINITIONS) + if(CUDA_NVCC_DEFINITIONS) + foreach(_definition ${CUDA_NVCC_DEFINITIONS}) + list(APPEND nvcc_flags "-D${_definition}") + endforeach() + endif() + + if(_cuda_build_shared_libs) + list(APPEND nvcc_flags "-D${cuda_target}_EXPORTS") + endif() + + # Reset the output variable + set(_cuda_wrap_generated_files "") + + # Iterate over the macro arguments and create custom + # commands for all the .cu files. + foreach(file ${ARGN}) + # Ignore any file marked as a HEADER_FILE_ONLY + get_source_file_property(_is_header ${file} HEADER_FILE_ONLY) + if(${file} MATCHES "\\.cu$" AND NOT _is_header) + + # Allow per source file overrides of the format. + get_source_file_property(_cuda_source_format ${file} CUDA_SOURCE_PROPERTY_FORMAT) + if(NOT _cuda_source_format) + set(_cuda_source_format ${format}) + endif() + + if( ${_cuda_source_format} MATCHES "OBJ") + set( cuda_compile_to_external_module OFF ) + else() + set( cuda_compile_to_external_module ON ) + if( ${_cuda_source_format} MATCHES "PTX" ) + set( cuda_compile_to_external_module_type "ptx" ) + elseif( ${_cuda_source_format} MATCHES "CUBIN") + set( cuda_compile_to_external_module_type "cubin" ) + elseif( ${_cuda_source_format} MATCHES "FATBIN") + set( cuda_compile_to_external_module_type "fatbin" ) + else() + message( FATAL_ERROR "Invalid format flag passed to CUDA_WRAP_SRCS for file '${file}': '${_cuda_source_format}'. Use OBJ, PTX, CUBIN or FATBIN.") + endif() + endif() + + if(cuda_compile_to_external_module) + # Don't use any of the host compilation flags for PTX targets. + set(CUDA_HOST_FLAGS) + set(CUDA_NVCC_FLAGS_CONFIG) + else() + set(CUDA_HOST_FLAGS ${_cuda_host_flags}) + set(CUDA_NVCC_FLAGS_CONFIG ${_cuda_nvcc_flags_config}) + endif() + + # Determine output directory + cuda_compute_build_path("${file}" cuda_build_path) + set(cuda_compile_intermediate_directory "${CMAKE_CURRENT_BINARY_DIR}/CMakeFiles/${cuda_target}.dir/${cuda_build_path}") + if(CUDA_GENERATED_OUTPUT_DIR) + set(cuda_compile_output_dir "${CUDA_GENERATED_OUTPUT_DIR}") + else() + if ( cuda_compile_to_external_module ) + set(cuda_compile_output_dir "${CMAKE_CURRENT_BINARY_DIR}") + else() + set(cuda_compile_output_dir "${cuda_compile_intermediate_directory}") + endif() + endif() + + # Add a custom target to generate a c or ptx file. ###################### + + get_filename_component( basename ${file} NAME ) + if( cuda_compile_to_external_module ) + set(generated_file_path "${cuda_compile_output_dir}") + set(generated_file_basename "${cuda_target}_generated_${basename}.${cuda_compile_to_external_module_type}") + set(format_flag "-${cuda_compile_to_external_module_type}") + file(MAKE_DIRECTORY "${cuda_compile_output_dir}") + else() + set(generated_file_path "${cuda_compile_output_dir}/${CMAKE_CFG_INTDIR}") + set(generated_file_basename "${cuda_target}_generated_${basename}${generated_extension}") + if(CUDA_SEPARABLE_COMPILATION) + set(format_flag "-dc") + else() + set(format_flag "-c") + endif() + endif() + + # Set all of our file names. Make sure that whatever filenames that have + # generated_file_path in them get passed in through as a command line + # argument, so that the ${CMAKE_CFG_INTDIR} gets expanded at run time + # instead of configure time. + set(generated_file "${generated_file_path}/${generated_file_basename}") + set(cmake_dependency_file "${cuda_compile_intermediate_directory}/${generated_file_basename}.depend") + set(NVCC_generated_dependency_file "${cuda_compile_intermediate_directory}/${generated_file_basename}.NVCC-depend") + set(generated_cubin_file "${generated_file_path}/${generated_file_basename}.cubin.txt") + set(custom_target_script "${cuda_compile_intermediate_directory}/${generated_file_basename}.cmake") + + # Setup properties for obj files: + if( NOT cuda_compile_to_external_module ) + set_source_files_properties("${generated_file}" + PROPERTIES + EXTERNAL_OBJECT true # This is an object file not to be compiled, but only be linked. + ) + endif() + + # Don't add CMAKE_CURRENT_SOURCE_DIR if the path is already an absolute path. + get_filename_component(file_path "${file}" PATH) + if(IS_ABSOLUTE "${file_path}") + set(source_file "${file}") + else() + set(source_file "${CMAKE_CURRENT_SOURCE_DIR}/${file}") + endif() + + if( NOT cuda_compile_to_external_module AND CUDA_SEPARABLE_COMPILATION) + list(APPEND ${cuda_target}_SEPARABLE_COMPILATION_OBJECTS "${generated_file}") + endif() + + # Bring in the dependencies. Creates a variable CUDA_NVCC_DEPEND ####### + cuda_include_nvcc_dependencies(${cmake_dependency_file}) + + # Convience string for output ########################################### + if(CUDA_BUILD_EMULATION) + set(cuda_build_type "Emulation") + else() + set(cuda_build_type "Device") + endif() + + # Build the NVCC made dependency file ################################### + set(build_cubin OFF) + if ( NOT CUDA_BUILD_EMULATION AND CUDA_BUILD_CUBIN ) + if ( NOT cuda_compile_to_external_module ) + set ( build_cubin ON ) + endif() + endif() + + # Configure the build script + configure_file("${CUDA_run_nvcc}" "${custom_target_script}" @ONLY) + + # So if a user specifies the same cuda file as input more than once, you + # can have bad things happen with dependencies. Here we check an option + # to see if this is the behavior they want. + if(CUDA_ATTACH_VS_BUILD_RULE_TO_CUDA_FILE) + set(main_dep MAIN_DEPENDENCY ${source_file}) + else() + set(main_dep DEPENDS ${source_file}) + endif() + + if(CUDA_VERBOSE_BUILD) + set(verbose_output ON) + elseif(CMAKE_GENERATOR MATCHES "Makefiles") + set(verbose_output "$(VERBOSE)") + else() + set(verbose_output OFF) + endif() + + # Create up the comment string + file(RELATIVE_PATH generated_file_relative_path "${CMAKE_BINARY_DIR}" "${generated_file}") + if(cuda_compile_to_external_module) + set(cuda_build_comment_string "Building NVCC ${cuda_compile_to_external_module_type} file ${generated_file_relative_path}") + else() + set(cuda_build_comment_string "Building NVCC (${cuda_build_type}) object ${generated_file_relative_path}") + endif() + + # Build the generated file and dependency file ########################## + add_custom_command( + OUTPUT ${generated_file} + # These output files depend on the source_file and the contents of cmake_dependency_file + ${main_dep} + DEPENDS ${CUDA_NVCC_DEPEND} + DEPENDS ${custom_target_script} + # Make sure the output directory exists before trying to write to it. + COMMAND ${CMAKE_COMMAND} -E make_directory "${generated_file_path}" + COMMAND ${CMAKE_COMMAND} ARGS + -D verbose:BOOL=${verbose_output} + ${ccbin_flags} + -D build_configuration:STRING=${CUDA_build_configuration} + -D "generated_file:STRING=${generated_file}" + -D "generated_cubin_file:STRING=${generated_cubin_file}" + -P "${custom_target_script}" + WORKING_DIRECTORY "${cuda_compile_intermediate_directory}" + COMMENT "${cuda_build_comment_string}" + ) + + # Make sure the build system knows the file is generated. + set_source_files_properties(${generated_file} PROPERTIES GENERATED TRUE) + + list(APPEND _cuda_wrap_generated_files ${generated_file}) + + # Add the other files that we want cmake to clean on a cleanup ########## + list(APPEND CUDA_ADDITIONAL_CLEAN_FILES "${cmake_dependency_file}") + list(REMOVE_DUPLICATES CUDA_ADDITIONAL_CLEAN_FILES) + set(CUDA_ADDITIONAL_CLEAN_FILES ${CUDA_ADDITIONAL_CLEAN_FILES} CACHE INTERNAL "List of intermediate files that are part of the cuda dependency scanning.") + + endif() + endforeach() + + # Set the return parameter + set(${generated_files} ${_cuda_wrap_generated_files}) +endmacro() + +function(_cuda_get_important_host_flags important_flags flag_string) + if(CMAKE_GENERATOR MATCHES "Visual Studio") + string(REGEX MATCHALL "/M[DT][d]?" flags ${flag_string}) + list(APPEND ${important_flags} ${flags}) + else() + string(REGEX MATCHALL "-fPIC" flags ${flag_string}) + list(APPEND ${important_flags} ${flags}) + endif() + set(${important_flags} ${${important_flags}} PARENT_SCOPE) +endfunction() + +############################################################################### +############################################################################### +# Separable Compilation Link +############################################################################### +############################################################################### + +# Compute the filename to be used by CUDA_LINK_SEPARABLE_COMPILATION_OBJECTS +function(CUDA_COMPUTE_SEPARABLE_COMPILATION_OBJECT_FILE_NAME output_file_var cuda_target object_files) + if (object_files) + set(generated_extension ${CMAKE_${CUDA_C_OR_CXX}_OUTPUT_EXTENSION}) + set(output_file "${CMAKE_CURRENT_BINARY_DIR}/CMakeFiles/${cuda_target}.dir/${CMAKE_CFG_INTDIR}/${cuda_target}_intermediate_link${generated_extension}") + else() + set(output_file) + endif() + + set(${output_file_var} "${output_file}" PARENT_SCOPE) +endfunction() + +# Setup the build rule for the separable compilation intermediate link file. +function(CUDA_LINK_SEPARABLE_COMPILATION_OBJECTS output_file cuda_target options object_files) + if (object_files) + + set_source_files_properties("${output_file}" + PROPERTIES + EXTERNAL_OBJECT TRUE # This is an object file not to be compiled, but only + # be linked. + GENERATED TRUE # This file is generated during the build + ) + + # For now we are ignoring all the configuration specific flags. + set(nvcc_flags) + CUDA_PARSE_NVCC_OPTIONS(nvcc_flags ${options}) + if(CUDA_64_BIT_DEVICE_CODE) + list(APPEND nvcc_flags -m64) + else() + list(APPEND nvcc_flags -m32) + endif() + # If -ccbin, --compiler-bindir has been specified, don't do anything. Otherwise add it here. + list( FIND nvcc_flags "-ccbin" ccbin_found0 ) + list( FIND nvcc_flags "--compiler-bindir" ccbin_found1 ) + if( ccbin_found0 LESS 0 AND ccbin_found1 LESS 0 AND CUDA_HOST_COMPILER ) + list(APPEND nvcc_flags -ccbin "\"${CUDA_HOST_COMPILER}\"") + endif() + # Create a list of flags specified by CUDA_NVCC_FLAGS_${CONFIG} + set(config_specific_flags) + set(flags) + foreach(config ${CUDA_configuration_types}) + string(TOUPPER ${config} config_upper) + # Add config specific flags + foreach(f ${CUDA_NVCC_FLAGS_${config_upper}}) + list(APPEND config_specific_flags $<$:${f}>) + endforeach() + set(important_host_flags) + _cuda_get_important_host_flags(important_host_flags ${CMAKE_${CUDA_C_OR_CXX}_FLAGS_${config_upper}}) + foreach(f ${important_host_flags}) + list(APPEND flags $<$:-Xcompiler> $<$:${f}>) + endforeach() + endforeach() + # Add our general CUDA_NVCC_FLAGS with the configuration specifig flags + set(nvcc_flags ${CUDA_NVCC_FLAGS} ${config_specific_flags} ${nvcc_flags}) + + file(RELATIVE_PATH output_file_relative_path "${CMAKE_BINARY_DIR}" "${output_file}") + + # Some generators don't handle the multiple levels of custom command + # dependencies correctly (obj1 depends on file1, obj2 depends on obj1), so + # we work around that issue by compiling the intermediate link object as a + # pre-link custom command in that situation. + set(do_obj_build_rule TRUE) + if (MSVC_VERSION GREATER 1599) + # VS 2010 and 2012 have this problem. If future versions fix this issue, + # it should still work, it just won't be as nice as the other method. + set(do_obj_build_rule FALSE) + endif() + + if (do_obj_build_rule) + add_custom_command( + OUTPUT ${output_file} + DEPENDS ${object_files} + COMMAND ${CUDA_NVCC_EXECUTABLE} ${nvcc_flags} -dlink ${object_files} -o ${output_file} + ${flags} + COMMENT "Building NVCC intermediate link file ${output_file_relative_path}" + ) + else() + add_custom_command( + TARGET ${cuda_target} + PRE_LINK + COMMAND ${CMAKE_COMMAND} -E echo "Building NVCC intermediate link file ${output_file_relative_path}" + COMMAND ${CUDA_NVCC_EXECUTABLE} ${nvcc_flags} ${flags} -dlink ${object_files} -o "${output_file}" + ) + endif() + endif() +endfunction() + +############################################################################### +############################################################################### +# ADD LIBRARY +############################################################################### +############################################################################### +macro(CUDA_ADD_LIBRARY cuda_target) + + CUDA_ADD_CUDA_INCLUDE_ONCE() + + # Separate the sources from the options + CUDA_GET_SOURCES_AND_OPTIONS(_sources _cmake_options _options ${ARGN}) + CUDA_BUILD_SHARED_LIBRARY(_cuda_shared_flag ${ARGN}) + # Create custom commands and targets for each file. + CUDA_WRAP_SRCS( ${cuda_target} OBJ _generated_files ${_sources} + ${_cmake_options} ${_cuda_shared_flag} + OPTIONS ${_options} ) + + # Compute the file name of the intermedate link file used for separable + # compilation. + CUDA_COMPUTE_SEPARABLE_COMPILATION_OBJECT_FILE_NAME(link_file ${cuda_target} "${${cuda_target}_SEPARABLE_COMPILATION_OBJECTS}") + + # Add the library. + add_library(${cuda_target} ${_cmake_options} + ${_generated_files} + ${_sources} + ${link_file} + ) + + # Add a link phase for the separable compilation if it has been enabled. If + # it has been enabled then the ${cuda_target}_SEPARABLE_COMPILATION_OBJECTS + # variable will have been defined. + CUDA_LINK_SEPARABLE_COMPILATION_OBJECTS("${link_file}" ${cuda_target} "${_options}" "${${cuda_target}_SEPARABLE_COMPILATION_OBJECTS}") + + target_link_libraries(${cuda_target} + ${CUDA_LIBRARIES} + ) + + # We need to set the linker language based on what the expected generated file + # would be. CUDA_C_OR_CXX is computed based on CUDA_HOST_COMPILATION_CPP. + set_target_properties(${cuda_target} + PROPERTIES + LINKER_LANGUAGE ${CUDA_C_OR_CXX} + ) + +endmacro() + + +############################################################################### +############################################################################### +# ADD EXECUTABLE +############################################################################### +############################################################################### +macro(CUDA_ADD_EXECUTABLE cuda_target) + + CUDA_ADD_CUDA_INCLUDE_ONCE() + + # Separate the sources from the options + CUDA_GET_SOURCES_AND_OPTIONS(_sources _cmake_options _options ${ARGN}) + # Create custom commands and targets for each file. + CUDA_WRAP_SRCS( ${cuda_target} OBJ _generated_files ${_sources} OPTIONS ${_options} ) + + # Compute the file name of the intermedate link file used for separable + # compilation. + CUDA_COMPUTE_SEPARABLE_COMPILATION_OBJECT_FILE_NAME(link_file ${cuda_target} "${${cuda_target}_SEPARABLE_COMPILATION_OBJECTS}") + + # Add the library. + add_executable(${cuda_target} ${_cmake_options} + ${_generated_files} + ${_sources} + ${link_file} + ) + + # Add a link phase for the separable compilation if it has been enabled. If + # it has been enabled then the ${cuda_target}_SEPARABLE_COMPILATION_OBJECTS + # variable will have been defined. + CUDA_LINK_SEPARABLE_COMPILATION_OBJECTS("${link_file}" ${cuda_target} "${_options}" "${${cuda_target}_SEPARABLE_COMPILATION_OBJECTS}") + + target_link_libraries(${cuda_target} + ${CUDA_LIBRARIES} + ) + + # We need to set the linker language based on what the expected generated file + # would be. CUDA_C_OR_CXX is computed based on CUDA_HOST_COMPILATION_CPP. + set_target_properties(${cuda_target} + PROPERTIES + LINKER_LANGUAGE ${CUDA_C_OR_CXX} + ) + +endmacro() + + +############################################################################### +############################################################################### +# (Internal) helper for manually added cuda source files with specific targets +############################################################################### +############################################################################### +macro(cuda_compile_base cuda_target format generated_files) + + # Separate the sources from the options + CUDA_GET_SOURCES_AND_OPTIONS(_sources _cmake_options _options ${ARGN}) + # Create custom commands and targets for each file. + CUDA_WRAP_SRCS( ${cuda_target} ${format} _generated_files ${_sources} ${_cmake_options} + OPTIONS ${_options} ) + + set( ${generated_files} ${_generated_files}) + +endmacro() + +############################################################################### +############################################################################### +# CUDA COMPILE +############################################################################### +############################################################################### +macro(CUDA_COMPILE generated_files) + cuda_compile_base(cuda_compile OBJ ${generated_files} ${ARGN}) +endmacro() + +############################################################################### +############################################################################### +# CUDA COMPILE PTX +############################################################################### +############################################################################### +macro(CUDA_COMPILE_PTX generated_files) + cuda_compile_base(cuda_compile_ptx PTX ${generated_files} ${ARGN}) +endmacro() + +############################################################################### +############################################################################### +# CUDA COMPILE FATBIN +############################################################################### +############################################################################### +macro(CUDA_COMPILE_FATBIN generated_files) + cuda_compile_base(cuda_compile_fatbin FATBIN ${generated_files} ${ARGN}) +endmacro() + +############################################################################### +############################################################################### +# CUDA COMPILE CUBIN +############################################################################### +############################################################################### +macro(CUDA_COMPILE_CUBIN generated_files) + cuda_compile_base(cuda_compile_cubin CUBIN ${generated_files} ${ARGN}) +endmacro() + + +############################################################################### +############################################################################### +# CUDA ADD CUFFT TO TARGET +############################################################################### +############################################################################### +macro(CUDA_ADD_CUFFT_TO_TARGET target) + if (CUDA_BUILD_EMULATION) + target_link_libraries(${target} ${CUDA_cufftemu_LIBRARY}) + else() + target_link_libraries(${target} ${CUDA_cufft_LIBRARY}) + endif() +endmacro() + +############################################################################### +############################################################################### +# CUDA ADD CUBLAS TO TARGET +############################################################################### +############################################################################### +macro(CUDA_ADD_CUBLAS_TO_TARGET target) + if (CUDA_BUILD_EMULATION) + target_link_libraries(${target} ${CUDA_cublasemu_LIBRARY}) + else() + target_link_libraries(${target} ${CUDA_cublas_LIBRARY}) + endif() +endmacro() + +############################################################################### +############################################################################### +# CUDA BUILD CLEAN TARGET +############################################################################### +############################################################################### +macro(CUDA_BUILD_CLEAN_TARGET) + # Call this after you add all your CUDA targets, and you will get a convience + # target. You should also make clean after running this target to get the + # build system to generate all the code again. + + set(cuda_clean_target_name clean_cuda_depends) + if (CMAKE_GENERATOR MATCHES "Visual Studio") + string(TOUPPER ${cuda_clean_target_name} cuda_clean_target_name) + endif() + add_custom_target(${cuda_clean_target_name} + COMMAND ${CMAKE_COMMAND} -E remove ${CUDA_ADDITIONAL_CLEAN_FILES}) + + # Clear out the variable, so the next time we configure it will be empty. + # This is useful so that the files won't persist in the list after targets + # have been removed. + set(CUDA_ADDITIONAL_CLEAN_FILES "" CACHE INTERNAL "List of intermediate files that are part of the cuda dependency scanning.") +endmacro() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/FindCUDA/make2cmake.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/FindCUDA/make2cmake.cmake new file mode 100644 index 000000000..c433fa8ed --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/FindCUDA/make2cmake.cmake @@ -0,0 +1,92 @@ +# James Bigler, NVIDIA Corp (nvidia.com - jbigler) +# Abe Stephens, SCI Institute -- http://www.sci.utah.edu/~abe/FindCuda.html +# +# Copyright (c) 2008 - 2009 NVIDIA Corporation. All rights reserved. +# +# Copyright (c) 2007-2009 +# Scientific Computing and Imaging Institute, University of Utah +# +# This code is licensed under the MIT License. See the FindCUDA.cmake script +# for the text of the license. + +# The MIT License +# +# License for the specific language governing rights and limitations under +# Permission is hereby granted, free of charge, to any person obtaining a +# copy of this software and associated documentation files (the "Software"), +# to deal in the Software without restriction, including without limitation +# the rights to use, copy, modify, merge, publish, distribute, sublicense, +# and/or sell copies of the Software, and to permit persons to whom the +# Software is furnished to do so, subject to the following conditions: +# +# The above copyright notice and this permission notice shall be included +# in all copies or substantial portions of the Software. +# +# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS +# OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL +# THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING +# FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER +# DEALINGS IN THE SOFTWARE. +# + +####################################################################### +# This converts a file written in makefile syntax into one that can be included +# by CMake. + +file(READ ${input_file} depend_text) + +if (NOT "${depend_text}" STREQUAL "") + + # message("FOUND DEPENDS") + + string(REPLACE "\\ " " " depend_text ${depend_text}) + + # This works for the nvcc -M generated dependency files. + string(REGEX REPLACE "^.* : " "" depend_text ${depend_text}) + string(REGEX REPLACE "[ \\\\]*\n" ";" depend_text ${depend_text}) + + set(dependency_list "") + + foreach(file ${depend_text}) + + string(REGEX REPLACE "^ +" "" file ${file}) + + # OK, now if we had a UNC path, nvcc has a tendency to only output the first '/' + # instead of '//'. Here we will test to see if the file exists, if it doesn't then + # try to prepend another '/' to the path and test again. If it still fails remove the + # path. + + if(NOT EXISTS "${file}") + if (EXISTS "/${file}") + set(file "/${file}") + else() + message(WARNING " Removing non-existent dependency file: ${file}") + set(file "") + endif() + endif() + + if(NOT IS_DIRECTORY "${file}") + # If softlinks start to matter, we should change this to REALPATH. For now we need + # to flatten paths, because nvcc can generate stuff like /bin/../include instead of + # just /include. + get_filename_component(file_absolute "${file}" ABSOLUTE) + list(APPEND dependency_list "${file_absolute}") + endif() + + endforeach() + +else() + # message("FOUND NO DEPENDS") +endif() + +# Remove the duplicate entries and sort them. +list(REMOVE_DUPLICATES dependency_list) +list(SORT dependency_list) + +foreach(file ${dependency_list}) + set(cuda_nvcc_depend "${cuda_nvcc_depend} \"${file}\"\n") +endforeach() + +file(WRITE ${output_file} "# Generated by: make2cmake.cmake\nSET(CUDA_NVCC_DEPEND\n ${cuda_nvcc_depend})\n\n") diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/FindCUDA/parse_cubin.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/FindCUDA/parse_cubin.cmake new file mode 100644 index 000000000..25ceb49f3 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/FindCUDA/parse_cubin.cmake @@ -0,0 +1,109 @@ +# James Bigler, NVIDIA Corp (nvidia.com - jbigler) +# Abe Stephens, SCI Institute -- http://www.sci.utah.edu/~abe/FindCuda.html +# +# Copyright (c) 2008 - 2009 NVIDIA Corporation. All rights reserved. +# +# Copyright (c) 2007-2009 +# Scientific Computing and Imaging Institute, University of Utah +# +# This code is licensed under the MIT License. See the FindCUDA.cmake script +# for the text of the license. + +# The MIT License +# +# License for the specific language governing rights and limitations under +# Permission is hereby granted, free of charge, to any person obtaining a +# copy of this software and associated documentation files (the "Software"), +# to deal in the Software without restriction, including without limitation +# the rights to use, copy, modify, merge, publish, distribute, sublicense, +# and/or sell copies of the Software, and to permit persons to whom the +# Software is furnished to do so, subject to the following conditions: +# +# The above copyright notice and this permission notice shall be included +# in all copies or substantial portions of the Software. +# +# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS +# OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL +# THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING +# FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER +# DEALINGS IN THE SOFTWARE. +# + +####################################################################### +# Parses a .cubin file produced by nvcc and reports statistics about the file. + + +file(READ ${input_file} file_text) + +if (NOT "${file_text}" STREQUAL "") + + string(REPLACE ";" "\\;" file_text ${file_text}) + string(REPLACE "\ncode" ";code" file_text ${file_text}) + + list(LENGTH file_text len) + + foreach(line ${file_text}) + + # Only look at "code { }" blocks. + if(line MATCHES "^code") + + # Break into individual lines. + string(REGEX REPLACE "\n" ";" line ${line}) + + foreach(entry ${line}) + + # Extract kernel names. + if (${entry} MATCHES "[^g]name = ([^ ]+)") + set(entry "${CMAKE_MATCH_1}") + + # Check to see if the kernel name starts with "_" + set(skip FALSE) + # if (${entry} MATCHES "^_") + # Skip the rest of this block. + # message("Skipping ${entry}") + # set(skip TRUE) + # else () + message("Kernel: ${entry}") + # endif () + + endif() + + # Skip the rest of the block if necessary + if(NOT skip) + + # Registers + if (${entry} MATCHES "reg([ ]+)=([ ]+)([^ ]+)") + set(entry "${CMAKE_MATCH_3}") + message("Registers: ${entry}") + endif() + + # Local memory + if (${entry} MATCHES "lmem([ ]+)=([ ]+)([^ ]+)") + set(entry "${CMAKE_MATCH_3}") + message("Local: ${entry}") + endif() + + # Shared memory + if (${entry} MATCHES "smem([ ]+)=([ ]+)([^ ]+)") + set(entry "${CMAKE_MATCH_3}") + message("Shared: ${entry}") + endif() + + if (${entry} MATCHES "^}") + message("") + endif() + + endif() + + + endforeach() + + endif() + + endforeach() + +else() + # message("FOUND NO DEPENDS") +endif() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/FindCUDA/run_nvcc.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/FindCUDA/run_nvcc.cmake new file mode 100644 index 000000000..abdd3079e --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/FindCUDA/run_nvcc.cmake @@ -0,0 +1,288 @@ +# James Bigler, NVIDIA Corp (nvidia.com - jbigler) +# +# Copyright (c) 2008 - 2009 NVIDIA Corporation. All rights reserved. +# +# This code is licensed under the MIT License. See the FindCUDA.cmake script +# for the text of the license. + +# The MIT License +# +# License for the specific language governing rights and limitations under +# Permission is hereby granted, free of charge, to any person obtaining a +# copy of this software and associated documentation files (the "Software"), +# to deal in the Software without restriction, including without limitation +# the rights to use, copy, modify, merge, publish, distribute, sublicense, +# and/or sell copies of the Software, and to permit persons to whom the +# Software is furnished to do so, subject to the following conditions: +# +# The above copyright notice and this permission notice shall be included +# in all copies or substantial portions of the Software. +# +# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS +# OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL +# THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING +# FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER +# DEALINGS IN THE SOFTWARE. + + +########################################################################## +# This file runs the nvcc commands to produce the desired output file along with +# the dependency file needed by CMake to compute dependencies. In addition the +# file checks the output of each command and if the command fails it deletes the +# output files. + +# Input variables +# +# verbose:BOOL=<> OFF: Be as quiet as possible (default) +# ON : Describe each step +# +# build_configuration:STRING=<> Typically one of Debug, MinSizeRel, Release, or +# RelWithDebInfo, but it should match one of the +# entries in CUDA_HOST_FLAGS. This is the build +# configuration used when compiling the code. If +# blank or unspecified Debug is assumed as this is +# what CMake does. +# +# generated_file:STRING=<> File to generate. This argument must be passed in. +# +# generated_cubin_file:STRING=<> File to generate. This argument must be passed +# in if build_cubin is true. + +if(NOT generated_file) + message(FATAL_ERROR "You must specify generated_file on the command line") +endif() + +# Set these up as variables to make reading the generated file easier +set(CMAKE_COMMAND "@CMAKE_COMMAND@") # path +set(source_file "@source_file@") # path +set(NVCC_generated_dependency_file "@NVCC_generated_dependency_file@") # path +set(cmake_dependency_file "@cmake_dependency_file@") # path +set(CUDA_make2cmake "@CUDA_make2cmake@") # path +set(CUDA_parse_cubin "@CUDA_parse_cubin@") # path +set(build_cubin @build_cubin@) # bool +set(CUDA_HOST_COMPILER "@CUDA_HOST_COMPILER@") # path +# We won't actually use these variables for now, but we need to set this, in +# order to force this file to be run again if it changes. +set(generated_file_path "@generated_file_path@") # path +set(generated_file_internal "@generated_file@") # path +set(generated_cubin_file_internal "@generated_cubin_file@") # path + +set(CUDA_NVCC_EXECUTABLE "@CUDA_NVCC_EXECUTABLE@") # path +set(CUDA_NVCC_FLAGS @CUDA_NVCC_FLAGS@ ;; @CUDA_WRAP_OPTION_NVCC_FLAGS@) # list +@CUDA_NVCC_FLAGS_CONFIG@ +set(nvcc_flags @nvcc_flags@) # list +set(CUDA_NVCC_INCLUDE_ARGS "@CUDA_NVCC_INCLUDE_ARGS@") # list (needs to be in quotes to handle spaces properly). +set(format_flag "@format_flag@") # string + +if(build_cubin AND NOT generated_cubin_file) + message(FATAL_ERROR "You must specify generated_cubin_file on the command line") +endif() + +# This is the list of host compilation flags. It C or CXX should already have +# been chosen by FindCUDA.cmake. +@CUDA_HOST_FLAGS@ + +# Take the compiler flags and package them up to be sent to the compiler via -Xcompiler +set(nvcc_host_compiler_flags "") +# If we weren't given a build_configuration, use Debug. +if(NOT build_configuration) + set(build_configuration Debug) +endif() +string(TOUPPER "${build_configuration}" build_configuration) +#message("CUDA_NVCC_HOST_COMPILER_FLAGS = ${CUDA_NVCC_HOST_COMPILER_FLAGS}") +foreach(flag ${CMAKE_HOST_FLAGS} ${CMAKE_HOST_FLAGS_${build_configuration}}) + # Extra quotes are added around each flag to help nvcc parse out flags with spaces. + set(nvcc_host_compiler_flags "${nvcc_host_compiler_flags},\"${flag}\"") +endforeach() +if (nvcc_host_compiler_flags) + set(nvcc_host_compiler_flags "-Xcompiler" ${nvcc_host_compiler_flags}) +endif() +#message("nvcc_host_compiler_flags = \"${nvcc_host_compiler_flags}\"") +# Add the build specific configuration flags +list(APPEND CUDA_NVCC_FLAGS ${CUDA_NVCC_FLAGS_${build_configuration}}) + +# Any -ccbin existing in CUDA_NVCC_FLAGS gets highest priority +list( FIND CUDA_NVCC_FLAGS "-ccbin" ccbin_found0 ) +list( FIND CUDA_NVCC_FLAGS "--compiler-bindir" ccbin_found1 ) +if( ccbin_found0 LESS 0 AND ccbin_found1 LESS 0 AND CUDA_HOST_COMPILER ) + if (CUDA_HOST_COMPILER STREQUAL "$(VCInstallDir)bin" AND DEFINED CCBIN) + set(CCBIN -ccbin "${CCBIN}") + else() + set(CCBIN -ccbin "${CUDA_HOST_COMPILER}") + endif() +endif() + +# cuda_execute_process - Executes a command with optional command echo and status message. +# +# status - Status message to print if verbose is true +# command - COMMAND argument from the usual execute_process argument structure +# ARGN - Remaining arguments are the command with arguments +# +# CUDA_result - return value from running the command +# +# Make this a macro instead of a function, so that things like RESULT_VARIABLE +# and other return variables are present after executing the process. +macro(cuda_execute_process status command) + set(_command ${command}) + if(NOT "x${_command}" STREQUAL "xCOMMAND") + message(FATAL_ERROR "Malformed call to cuda_execute_process. Missing COMMAND as second argument. (command = ${command})") + endif() + if(verbose) + execute_process(COMMAND "${CMAKE_COMMAND}" -E echo -- ${status}) + # Now we need to build up our command string. We are accounting for quotes + # and spaces, anything else is left up to the user to fix if they want to + # copy and paste a runnable command line. + set(cuda_execute_process_string) + foreach(arg ${ARGN}) + # If there are quotes, excape them, so they come through. + string(REPLACE "\"" "\\\"" arg ${arg}) + # Args with spaces need quotes around them to get them to be parsed as a single argument. + if(arg MATCHES " ") + list(APPEND cuda_execute_process_string "\"${arg}\"") + else() + list(APPEND cuda_execute_process_string ${arg}) + endif() + endforeach() + # Echo the command + execute_process(COMMAND ${CMAKE_COMMAND} -E echo ${cuda_execute_process_string}) + endif() + # Run the command + execute_process(COMMAND ${ARGN} RESULT_VARIABLE CUDA_result ) +endmacro() + +# Delete the target file +cuda_execute_process( + "Removing ${generated_file}" + COMMAND "${CMAKE_COMMAND}" -E remove "${generated_file}" + ) + +# For CUDA 2.3 and below, -G -M doesn't work, so remove the -G flag +# for dependency generation and hope for the best. +set(depends_CUDA_NVCC_FLAGS "${CUDA_NVCC_FLAGS}") +set(CUDA_VERSION @CUDA_VERSION@) +if(CUDA_VERSION VERSION_LESS "3.0") + cmake_policy(PUSH) + # CMake policy 0007 NEW states that empty list elements are not + # ignored. I'm just setting it to avoid the warning that's printed. + cmake_policy(SET CMP0007 NEW) + # Note that this will remove all occurances of -G. + list(REMOVE_ITEM depends_CUDA_NVCC_FLAGS "-G") + cmake_policy(POP) +endif() + +# nvcc doesn't define __CUDACC__ for some reason when generating dependency files. This +# can cause incorrect dependencies when #including files based on this macro which is +# defined in the generating passes of nvcc invokation. We will go ahead and manually +# define this for now until a future version fixes this bug. +set(CUDACC_DEFINE -D__CUDACC__) + +# Generate the dependency file +cuda_execute_process( + "Generating dependency file: ${NVCC_generated_dependency_file}" + COMMAND "${CUDA_NVCC_EXECUTABLE}" + -M + ${CUDACC_DEFINE} + "${source_file}" + -o "${NVCC_generated_dependency_file}" + ${CCBIN} + ${nvcc_flags} + ${nvcc_host_compiler_flags} + ${depends_CUDA_NVCC_FLAGS} + -DNVCC + ${CUDA_NVCC_INCLUDE_ARGS} + ) + +if(CUDA_result) + message(FATAL_ERROR "Error generating ${generated_file}") +endif() + +# Generate the cmake readable dependency file to a temp file. Don't put the +# quotes just around the filenames for the input_file and output_file variables. +# CMake will pass the quotes through and not be able to find the file. +cuda_execute_process( + "Generating temporary cmake readable file: ${cmake_dependency_file}.tmp" + COMMAND "${CMAKE_COMMAND}" + -D "input_file:FILEPATH=${NVCC_generated_dependency_file}" + -D "output_file:FILEPATH=${cmake_dependency_file}.tmp" + -P "${CUDA_make2cmake}" + ) + +if(CUDA_result) + message(FATAL_ERROR "Error generating ${generated_file}") +endif() + +# Copy the file if it is different +cuda_execute_process( + "Copy if different ${cmake_dependency_file}.tmp to ${cmake_dependency_file}" + COMMAND "${CMAKE_COMMAND}" -E copy_if_different "${cmake_dependency_file}.tmp" "${cmake_dependency_file}" + ) + +if(CUDA_result) + message(FATAL_ERROR "Error generating ${generated_file}") +endif() + +# Delete the temporary file +cuda_execute_process( + "Removing ${cmake_dependency_file}.tmp and ${NVCC_generated_dependency_file}" + COMMAND "${CMAKE_COMMAND}" -E remove "${cmake_dependency_file}.tmp" "${NVCC_generated_dependency_file}" + ) + +if(CUDA_result) + message(FATAL_ERROR "Error generating ${generated_file}") +endif() + +# Generate the code +cuda_execute_process( + "Generating ${generated_file}" + COMMAND "${CUDA_NVCC_EXECUTABLE}" + "${source_file}" + ${format_flag} -o "${generated_file}" + ${CCBIN} + ${nvcc_flags} + ${nvcc_host_compiler_flags} + ${CUDA_NVCC_FLAGS} + -DNVCC + ${CUDA_NVCC_INCLUDE_ARGS} + ) + +if(CUDA_result) + # Since nvcc can sometimes leave half done files make sure that we delete the output file. + cuda_execute_process( + "Removing ${generated_file}" + COMMAND "${CMAKE_COMMAND}" -E remove "${generated_file}" + ) + message(FATAL_ERROR "Error generating file ${generated_file}") +else() + if(verbose) + message("Generated ${generated_file} successfully.") + endif() +endif() + +# Cubin resource report commands. +if( build_cubin ) + # Run with -cubin to produce resource usage report. + cuda_execute_process( + "Generating ${generated_cubin_file}" + COMMAND "${CUDA_NVCC_EXECUTABLE}" + "${source_file}" + ${CUDA_NVCC_FLAGS} + ${nvcc_flags} + ${CCBIN} + ${nvcc_host_compiler_flags} + -DNVCC + -cubin + -o "${generated_cubin_file}" + ${CUDA_NVCC_INCLUDE_ARGS} + ) + + # Execute the parser script. + cuda_execute_process( + "Executing the parser script" + COMMAND "${CMAKE_COMMAND}" + -D "input_file:STRING=${generated_cubin_file}" + -P "${CUDA_parse_cubin}" + ) + +endif() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVCRTLinkage.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVCRTLinkage.cmake new file mode 100644 index 000000000..2168c72e6 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVCRTLinkage.cmake @@ -0,0 +1,97 @@ +if(NOT MSVC) + message(FATAL_ERROR "CRT options are available only for MSVC") +endif() + +#if (${CMAKE_SYSTEM_NAME} MATCHES "WindowsStore" OR ${CMAKE_SYSTEM_NAME} MATCHES "WindowsPhone") +# set(WINRT TRUE) + +if (WINRT) + add_definitions(/DWINVER=_WIN32_WINNT_WIN8 /DNTDDI_VERSION=NTDDI_WIN8 /D_WIN32_WINNT=_WIN32_WINNT_WIN8) +endif() + +# Removing LNK4075 warnings for debug WinRT builds +# "LNK4075: ignoring '/INCREMENTAL' due to '/OPT:ICF' specification" +# "LNK4075: ignoring '/INCREMENTAL' due to '/OPT:REF' specification" +if(MSVC AND WINRT) + # Optional verification checks since we don't know existing contents of variables below + string(REPLACE "/OPT:ICF " "/OPT:NOICF " CMAKE_EXE_LINKER_FLAGS_DEBUG "${CMAKE_EXE_LINKER_FLAGS_DEBUG}") + string(REPLACE "/OPT:REF " "/OPT:NOREF " CMAKE_EXE_LINKER_FLAGS_DEBUG "${CMAKE_EXE_LINKER_FLAGS_DEBUG}") + string(REPLACE "/INCREMENTAL:YES " "/INCREMENTAL:NO " CMAKE_EXE_LINKER_FLAGS_DEBUG "${CMAKE_EXE_LINKER_FLAGS_DEBUG}") + string(REPLACE "/INCREMENTAL " "/INCREMENTAL:NO " CMAKE_EXE_LINKER_FLAGS_DEBUG "${CMAKE_EXE_LINKER_FLAGS_DEBUG}") + + string(REPLACE "/OPT:ICF " "/OPT:NOICF " CMAKE_MODULE_LINKER_FLAGS_DEBUG "${CMAKE_MODULE_LINKER_FLAGS_DEBUG}") + string(REPLACE "/OPT:REF " "/OPT:NORE F" CMAKE_MODULE_LINKER_FLAGS_DEBUG "${CMAKE_MODULE_LINKER_FLAGS_DEBUG}") + string(REPLACE "/INCREMENTAL:YES " "/INCREMENTAL:NO " CMAKE_MODULE_LINKER_FLAGS_DEBUG "${CMAKE_MODULE_LINKER_FLAGS_DEBUG}") + string(REPLACE "/INCREMENTAL " "/INCREMENTAL:NO " CMAKE_MODULE_LINKER_FLAGS_DEBUG "${CMAKE_MODULE_LINKER_FLAGS_DEBUG}") + + string(REPLACE "/OPT:ICF " "/OPT:NOICF " CMAKE_SHARED_LINKER_FLAGS_DEBUG "${CMAKE_SHARED_LINKER_FLAGS_DEBUG}") + string(REPLACE "/OPT:REF " "/OPT:NOREF " CMAKE_SHARED_LINKER_FLAGS_DEBUG "${CMAKE_SHARED_LINKER_FLAGS_DEBUG}") + string(REPLACE "/INCREMENTAL:YES " "/INCREMENTAL:NO " CMAKE_SHARED_LINKER_FLAGS_DEBUG "${CMAKE_SHARED_LINKER_FLAGS_DEBUG}") + string(REPLACE "/INCREMENTAL " "/INCREMENTAL:NO " CMAKE_SHARED_LINKER_FLAGS_DEBUG "${CMAKE_SHARED_LINKER_FLAGS_DEBUG}") + + # Mandatory + set(CMAKE_MODULE_LINKER_FLAGS_DEBUG "${CMAKE_MODULE_LINKER_FLAGS_DEBUG} /INCREMENTAL:NO /OPT:NOREF /OPT:NOICF") + set(CMAKE_EXE_LINKER_FLAGS_DEBUG "${CMAKE_EXE_LINKER_FLAGS_DEBUG} /INCREMENTAL:NO /OPT:NOREF /OPT:NOICF") + set(CMAKE_SHARED_LINKER_FLAGS_DEBUG "${CMAKE_SHARED_LINKER_FLAGS_DEBUG} /INCREMENTAL:NO /OPT:NOREF /OPT:NOICF") +endif() + +if(NOT BUILD_SHARED_LIBS AND BUILD_WITH_STATIC_CRT) + foreach(flag_var + CMAKE_C_FLAGS CMAKE_C_FLAGS_DEBUG CMAKE_C_FLAGS_RELEASE + CMAKE_C_FLAGS_MINSIZEREL CMAKE_C_FLAGS_RELWITHDEBINFO + CMAKE_CXX_FLAGS CMAKE_CXX_FLAGS_DEBUG CMAKE_CXX_FLAGS_RELEASE + CMAKE_CXX_FLAGS_MINSIZEREL CMAKE_CXX_FLAGS_RELWITHDEBINFO) + if(${flag_var} MATCHES "/MD") + string(REGEX REPLACE "/MD" "/MT" ${flag_var} "${${flag_var}}") + endif() + if(${flag_var} MATCHES "/MDd") + string(REGEX REPLACE "/MDd" "/MTd" ${flag_var} "${${flag_var}}") + endif() + endforeach(flag_var) + + set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} /NODEFAULTLIB:atlthunk.lib /NODEFAULTLIB:msvcrt.lib /NODEFAULTLIB:msvcrtd.lib") + set(CMAKE_EXE_LINKER_FLAGS_DEBUG "${CMAKE_EXE_LINKER_FLAGS_DEBUG} /NODEFAULTLIB:libcmt.lib") + set(CMAKE_EXE_LINKER_FLAGS_RELEASE "${CMAKE_EXE_LINKER_FLAGS_RELEASE} /NODEFAULTLIB:libcmtd.lib") +else() + foreach(flag_var + CMAKE_C_FLAGS CMAKE_C_FLAGS_DEBUG CMAKE_C_FLAGS_RELEASE + CMAKE_C_FLAGS_MINSIZEREL CMAKE_C_FLAGS_RELWITHDEBINFO + CMAKE_CXX_FLAGS CMAKE_CXX_FLAGS_DEBUG CMAKE_CXX_FLAGS_RELEASE + CMAKE_CXX_FLAGS_MINSIZEREL CMAKE_CXX_FLAGS_RELWITHDEBINFO) + if(${flag_var} MATCHES "/MT") + string(REGEX REPLACE "/MT" "/MD" ${flag_var} "${${flag_var}}") + endif() + if(${flag_var} MATCHES "/MTd") + string(REGEX REPLACE "/MTd" "/MDd" ${flag_var} "${${flag_var}}") + endif() + endforeach(flag_var) +endif() + +if(CMAKE_VERSION VERSION_GREATER "2.8.6") + include(ProcessorCount) + ProcessorCount(N) + if(NOT N EQUAL 0) + SET(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} /MP${N} ") + SET(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} /MP${N} ") + endif() +endif() + +if(NOT BUILD_WITH_DEBUG_INFO AND NOT MSVC) + string(REPLACE "/debug" "" CMAKE_EXE_LINKER_FLAGS_DEBUG "${CMAKE_EXE_LINKER_FLAGS_DEBUG}") + string(REPLACE "/DEBUG" "" CMAKE_EXE_LINKER_FLAGS_DEBUG "${CMAKE_EXE_LINKER_FLAGS_DEBUG}") + string(REPLACE "/INCREMENTAL:YES" "/INCREMENTAL:NO" CMAKE_EXE_LINKER_FLAGS_DEBUG "${CMAKE_EXE_LINKER_FLAGS_DEBUG}") + string(REPLACE "/INCREMENTAL " "/INCREMENTAL:NO " CMAKE_EXE_LINKER_FLAGS_DEBUG "${CMAKE_EXE_LINKER_FLAGS_DEBUG}") + + string(REPLACE "/debug" "" CMAKE_MODULE_LINKER_FLAGS_DEBUG "${CMAKE_MODULE_LINKER_FLAGS_DEBUG}") + string(REPLACE "/DEBUG" "" CMAKE_MODULE_LINKER_FLAGS_DEBUG "${CMAKE_MODULE_LINKER_FLAGS_DEBUG}") + string(REPLACE "/INCREMENTAL:YES" "/INCREMENTAL:NO" CMAKE_MODULE_LINKER_FLAGS_DEBUG "${CMAKE_MODULE_LINKER_FLAGS_DEBUG}") + string(REPLACE "/INCREMENTAL " "/INCREMENTAL:NO " CMAKE_MODULE_LINKER_FLAGS_DEBUG "${CMAKE_MODULE_LINKER_FLAGS_DEBUG}") + + string(REPLACE "/debug" "" CMAKE_SHARED_LINKER_FLAGS_DEBUG "${CMAKE_SHARED_LINKER_FLAGS_DEBUG}") + string(REPLACE "/DEBUG" "" CMAKE_SHARED_LINKER_FLAGS_DEBUG "${CMAKE_SHARED_LINKER_FLAGS_DEBUG}") + string(REPLACE "/INCREMENTAL:YES" "/INCREMENTAL:NO" CMAKE_SHARED_LINKER_FLAGS_DEBUG "${CMAKE_SHARED_LINKER_FLAGS_DEBUG}") + string(REPLACE "/INCREMENTAL " "/INCREMENTAL:NO " CMAKE_SHARED_LINKER_FLAGS_DEBUG "${CMAKE_SHARED_LINKER_FLAGS_DEBUG}") + + string(REPLACE "/Zi" "" CMAKE_C_FLAGS_DEBUG "${CMAKE_C_FLAGS_DEBUG}") + string(REPLACE "/Zi" "" CMAKE_CXX_FLAGS_DEBUG "${CMAKE_C_FLAGS_DEBUG}") +endif() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVCompilerOptions.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVCompilerOptions.cmake new file mode 100644 index 000000000..6c235ebfb --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVCompilerOptions.cmake @@ -0,0 +1,349 @@ +if(MINGW OR (X86 AND UNIX AND NOT APPLE)) + # mingw compiler is known to produce unstable SSE code with -O3 hence we are trying to use -O2 instead + if(CMAKE_COMPILER_IS_GNUCXX) + foreach(flags CMAKE_CXX_FLAGS CMAKE_CXX_FLAGS_RELEASE CMAKE_CXX_FLAGS_DEBUG) + string(REPLACE "-O3" "-O2" ${flags} "${${flags}}") + endforeach() + endif() + + if(CMAKE_COMPILER_IS_GNUCC) + foreach(flags CMAKE_C_FLAGS CMAKE_C_FLAGS_RELEASE CMAKE_C_FLAGS_DEBUG) + string(REPLACE "-O3" "-O2" ${flags} "${${flags}}") + endforeach() + endif() +endif() + +if(MSVC) + string(REGEX REPLACE "^ *| * $" "" CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS}") + string(REGEX REPLACE "^ *| * $" "" CMAKE_CXX_FLAGS_INIT "${CMAKE_CXX_FLAGS_INIT}") + if(CMAKE_CXX_FLAGS STREQUAL CMAKE_CXX_FLAGS_INIT) + # override cmake default exception handling option + string(REPLACE "/EHsc" "/EHa" CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS}") + set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS}" CACHE STRING "Flags used by the compiler during all build types." FORCE) + endif() +endif() + +set(OPENCV_EXTRA_FLAGS "") +set(OPENCV_EXTRA_C_FLAGS "") +set(OPENCV_EXTRA_CXX_FLAGS "") +set(OPENCV_EXTRA_FLAGS_RELEASE "") +set(OPENCV_EXTRA_FLAGS_DEBUG "") +set(OPENCV_EXTRA_EXE_LINKER_FLAGS "") +set(OPENCV_EXTRA_EXE_LINKER_FLAGS_RELEASE "") +set(OPENCV_EXTRA_EXE_LINKER_FLAGS_DEBUG "") + +macro(add_extra_compiler_option option) + if(CMAKE_BUILD_TYPE) + set(CMAKE_TRY_COMPILE_CONFIGURATION ${CMAKE_BUILD_TYPE}) + endif() + ocv_check_flag_support(CXX "${option}" _varname "${OPENCV_EXTRA_CXX_FLAGS} ${ARGN}") + if(${_varname}) + set(OPENCV_EXTRA_CXX_FLAGS "${OPENCV_EXTRA_CXX_FLAGS} ${option}") + endif() + + ocv_check_flag_support(C "${option}" _varname "${OPENCV_EXTRA_C_FLAGS} ${ARGN}") + if(${_varname}) + set(OPENCV_EXTRA_C_FLAGS "${OPENCV_EXTRA_C_FLAGS} ${option}") + endif() +endmacro() + +# OpenCV fails some tests when 'char' is 'unsigned' by default +add_extra_compiler_option(-fsigned-char) + +if(MINGW) + # http://gcc.gnu.org/bugzilla/show_bug.cgi?id=40838 + # here we are trying to workaround the problem + add_extra_compiler_option(-mstackrealign) + if(NOT HAVE_CXX_MSTACKREALIGN) + add_extra_compiler_option(-mpreferred-stack-boundary=2) + endif() +endif() + +if(CMAKE_COMPILER_IS_GNUCXX) + # High level of warnings. + add_extra_compiler_option(-W) + add_extra_compiler_option(-Wall) + add_extra_compiler_option(-Werror=return-type) + add_extra_compiler_option(-Werror=non-virtual-dtor) + add_extra_compiler_option(-Werror=address) + add_extra_compiler_option(-Werror=sequence-point) + add_extra_compiler_option(-Wformat) + add_extra_compiler_option(-Werror=format-security -Wformat) + add_extra_compiler_option(-Wmissing-declarations) + add_extra_compiler_option(-Wmissing-prototypes) + add_extra_compiler_option(-Wstrict-prototypes) + add_extra_compiler_option(-Wundef) + add_extra_compiler_option(-Winit-self) + add_extra_compiler_option(-Wpointer-arith) + add_extra_compiler_option(-Wshadow) + add_extra_compiler_option(-Wsign-promo) + + if(ENABLE_NOISY_WARNINGS) + add_extra_compiler_option(-Wcast-align) + add_extra_compiler_option(-Wstrict-aliasing=2) + else() + add_extra_compiler_option(-Wno-narrowing) + add_extra_compiler_option(-Wno-delete-non-virtual-dtor) + add_extra_compiler_option(-Wno-unnamed-type-template-args) + endif() + add_extra_compiler_option(-fdiagnostics-show-option) + + # The -Wno-long-long is required in 64bit systems when including sytem headers. + if(X86_64) + add_extra_compiler_option(-Wno-long-long) + endif() + + # We need pthread's + if(UNIX AND NOT ANDROID AND NOT (APPLE AND CMAKE_COMPILER_IS_CLANGCXX)) + add_extra_compiler_option(-pthread) + endif() + + if(CMAKE_COMPILER_IS_CLANGCXX) + add_extra_compiler_option(-Qunused-arguments) + endif() + + if(OPENCV_WARNINGS_ARE_ERRORS) + add_extra_compiler_option(-Werror) + endif() + + if(X86 AND NOT MINGW64 AND NOT X86_64 AND NOT APPLE) + add_extra_compiler_option(-march=i686) + endif() + + if(APPLE) + add_extra_compiler_option(-Wno-semicolon-before-method-body) + endif() + + # Other optimizations + if(ENABLE_OMIT_FRAME_POINTER) + add_extra_compiler_option(-fomit-frame-pointer) + else() + add_extra_compiler_option(-fno-omit-frame-pointer) + endif() + if(ENABLE_FAST_MATH) + add_extra_compiler_option(-ffast-math) + endif() + if(ENABLE_POWERPC) + add_extra_compiler_option("-mcpu=G3 -mtune=G5") + endif() + if(ENABLE_SSE) + add_extra_compiler_option(-msse) + endif() + if(ENABLE_SSE2) + add_extra_compiler_option(-msse2) + elseif(X86 OR X86_64) + add_extra_compiler_option(-mno-sse2) + endif() + if(ENABLE_NEON) + add_extra_compiler_option("-mfpu=neon") + endif() + if(ENABLE_VFPV3 AND NOT ENABLE_NEON) + add_extra_compiler_option("-mfpu=vfpv3") + endif() + + # SSE3 and further should be disabled under MingW because it generates compiler errors + if(NOT MINGW) + if(ENABLE_AVX) + add_extra_compiler_option(-mavx) + elseif(X86 OR X86_64) + add_extra_compiler_option(-mno-avx) + endif() + if(ENABLE_AVX2) + add_extra_compiler_option(-mavx2) + + if(ENABLE_FMA3) + add_extra_compiler_option(-mfma) + endif() + endif() + + # GCC depresses SSEx instructions when -mavx is used. Instead, it generates new AVX instructions or AVX equivalence for all SSEx instructions when needed. + if(NOT OPENCV_EXTRA_CXX_FLAGS MATCHES "-mavx") + if(ENABLE_SSE3) + add_extra_compiler_option(-msse3) + elseif(X86 OR X86_64) + add_extra_compiler_option(-mno-sse3) + endif() + + if(ENABLE_SSSE3) + add_extra_compiler_option(-mssse3) + elseif(X86 OR X86_64) + add_extra_compiler_option(-mno-ssse3) + endif() + + if(ENABLE_SSE41) + add_extra_compiler_option(-msse4.1) + elseif(X86 OR X86_64) + add_extra_compiler_option(-mno-sse4.1) + endif() + + if(ENABLE_SSE42) + add_extra_compiler_option(-msse4.2) + elseif(X86 OR X86_64) + add_extra_compiler_option(-mno-sse4.2) + endif() + + if(ENABLE_POPCNT) + add_extra_compiler_option(-mpopcnt) + endif() + endif() + endif(NOT MINGW) + + if(X86 OR X86_64) + if(NOT APPLE AND CMAKE_SIZEOF_VOID_P EQUAL 4) + if(OPENCV_EXTRA_CXX_FLAGS MATCHES "-m(sse2|avx)") + add_extra_compiler_option(-mfpmath=sse)# !! important - be on the same wave with x64 compilers + else() + add_extra_compiler_option(-mfpmath=387) + endif() + endif() + endif() + + # Profiling? + if(ENABLE_PROFILING) + add_extra_compiler_option("-pg -g") + # turn off incompatible options + foreach(flags CMAKE_CXX_FLAGS CMAKE_C_FLAGS CMAKE_CXX_FLAGS_RELEASE CMAKE_C_FLAGS_RELEASE CMAKE_CXX_FLAGS_DEBUG CMAKE_C_FLAGS_DEBUG + OPENCV_EXTRA_FLAGS_RELEASE OPENCV_EXTRA_FLAGS_DEBUG OPENCV_EXTRA_C_FLAGS OPENCV_EXTRA_CXX_FLAGS) + string(REPLACE "-fomit-frame-pointer" "" ${flags} "${${flags}}") + string(REPLACE "-ffunction-sections" "" ${flags} "${${flags}}") + endforeach() + elseif(NOT APPLE AND NOT ANDROID) + # Remove unreferenced functions: function level linking + add_extra_compiler_option(-ffunction-sections) + endif() + + if(ENABLE_COVERAGE) + set(OPENCV_EXTRA_C_FLAGS "${OPENCV_EXTRA_C_FLAGS} --coverage") + set(OPENCV_EXTRA_CXX_FLAGS "${OPENCV_EXTRA_CXX_FLAGS} --coverage") + endif() + + set(OPENCV_EXTRA_FLAGS_RELEASE "${OPENCV_EXTRA_FLAGS_RELEASE} -DNDEBUG") + set(OPENCV_EXTRA_FLAGS_DEBUG "${OPENCV_EXTRA_FLAGS_DEBUG} -O0 -DDEBUG -D_DEBUG") +endif() + +if(MSVC) + set(OPENCV_EXTRA_FLAGS "${OPENCV_EXTRA_FLAGS} /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _SCL_SECURE_NO_WARNINGS") + # 64-bit portability warnings, in MSVC80 + if(MSVC80) + set(OPENCV_EXTRA_FLAGS "${OPENCV_EXTRA_FLAGS} /Wp64") + endif() + + if(BUILD_WITH_DEBUG_INFO) + set(OPENCV_EXTRA_EXE_LINKER_FLAGS_RELEASE "${OPENCV_EXTRA_EXE_LINKER_FLAGS_RELEASE} /debug") + endif() + + # Remove unreferenced functions: function level linking + set(OPENCV_EXTRA_FLAGS "${OPENCV_EXTRA_FLAGS} /Gy") + if(NOT MSVC_VERSION LESS 1400) + set(OPENCV_EXTRA_FLAGS "${OPENCV_EXTRA_FLAGS} /bigobj") + endif() + if(BUILD_WITH_DEBUG_INFO) + set(OPENCV_EXTRA_FLAGS_RELEASE "${OPENCV_EXTRA_FLAGS_RELEASE} /Zi") + endif() + + if(ENABLE_AVX2 AND NOT MSVC_VERSION LESS 1800) + set(OPENCV_EXTRA_FLAGS "${OPENCV_EXTRA_FLAGS} /arch:AVX2") + endif() + if(ENABLE_AVX AND NOT MSVC_VERSION LESS 1600 AND NOT OPENCV_EXTRA_FLAGS MATCHES "/arch:") + set(OPENCV_EXTRA_FLAGS "${OPENCV_EXTRA_FLAGS} /arch:AVX") + endif() + + if(ENABLE_SSE4_1 AND CV_ICC AND NOT OPENCV_EXTRA_FLAGS MATCHES "/arch:") + set(OPENCV_EXTRA_FLAGS "${OPENCV_EXTRA_FLAGS} /arch:SSE4.1") + endif() + + if(ENABLE_SSE3 AND CV_ICC AND NOT OPENCV_EXTRA_FLAGS MATCHES "/arch:") + set(OPENCV_EXTRA_FLAGS "${OPENCV_EXTRA_FLAGS} /arch:SSE3") + endif() + + if(NOT MSVC64) + # 64-bit MSVC compiler uses SSE/SSE2 by default + if(ENABLE_SSE2 AND NOT OPENCV_EXTRA_FLAGS MATCHES "/arch:") + set(OPENCV_EXTRA_FLAGS "${OPENCV_EXTRA_FLAGS} /arch:SSE2") + endif() + if(ENABLE_SSE AND NOT OPENCV_EXTRA_FLAGS MATCHES "/arch:") + set(OPENCV_EXTRA_FLAGS "${OPENCV_EXTRA_FLAGS} /arch:SSE") + endif() + endif() + + if(ENABLE_SSE OR ENABLE_SSE2 OR ENABLE_SSE3 OR ENABLE_SSE4_1 OR ENABLE_AVX OR ENABLE_AVX2) + set(OPENCV_EXTRA_FLAGS "${OPENCV_EXTRA_FLAGS} /Oi") + endif() + + if(X86 OR X86_64) + if(CMAKE_SIZEOF_VOID_P EQUAL 4 AND ENABLE_SSE2) + set(OPENCV_EXTRA_FLAGS "${OPENCV_EXTRA_FLAGS} /fp:fast") # !! important - be on the same wave with x64 compilers + endif() + endif() + + if(OPENCV_WARNINGS_ARE_ERRORS) + set(OPENCV_EXTRA_FLAGS "${OPENCV_EXTRA_FLAGS} /WX") + endif() +endif() + +if(MSVC12 AND NOT CMAKE_GENERATOR MATCHES "Visual Studio") + set(OPENCV_EXTRA_C_FLAGS "${OPENCV_EXTRA_C_FLAGS} /FS") + set(OPENCV_EXTRA_CXX_FLAGS "${OPENCV_EXTRA_CXX_FLAGS} /FS") +endif() + +# Extra link libs if the user selects building static libs: +if(NOT BUILD_SHARED_LIBS AND CMAKE_COMPILER_IS_GNUCXX AND NOT ANDROID) + # Android does not need these settings because they are already set by toolchain file + set(OPENCV_LINKER_LIBS ${OPENCV_LINKER_LIBS} stdc++) + set(OPENCV_EXTRA_FLAGS "-fPIC ${OPENCV_EXTRA_FLAGS}") +endif() + +# Add user supplied extra options (optimization, etc...) +# ========================================================== +set(OPENCV_EXTRA_FLAGS "${OPENCV_EXTRA_FLAGS}" CACHE INTERNAL "Extra compiler options") +set(OPENCV_EXTRA_C_FLAGS "${OPENCV_EXTRA_C_FLAGS}" CACHE INTERNAL "Extra compiler options for C sources") +set(OPENCV_EXTRA_CXX_FLAGS "${OPENCV_EXTRA_CXX_FLAGS}" CACHE INTERNAL "Extra compiler options for C++ sources") +set(OPENCV_EXTRA_FLAGS_RELEASE "${OPENCV_EXTRA_FLAGS_RELEASE}" CACHE INTERNAL "Extra compiler options for Release build") +set(OPENCV_EXTRA_FLAGS_DEBUG "${OPENCV_EXTRA_FLAGS_DEBUG}" CACHE INTERNAL "Extra compiler options for Debug build") +set(OPENCV_EXTRA_EXE_LINKER_FLAGS "${OPENCV_EXTRA_EXE_LINKER_FLAGS}" CACHE INTERNAL "Extra linker flags") +set(OPENCV_EXTRA_EXE_LINKER_FLAGS_RELEASE "${OPENCV_EXTRA_EXE_LINKER_FLAGS_RELEASE}" CACHE INTERNAL "Extra linker flags for Release build") +set(OPENCV_EXTRA_EXE_LINKER_FLAGS_DEBUG "${OPENCV_EXTRA_EXE_LINKER_FLAGS_DEBUG}" CACHE INTERNAL "Extra linker flags for Debug build") + +# set default visibility to hidden +if(CMAKE_COMPILER_IS_GNUCXX AND CMAKE_OPENCV_GCC_VERSION_NUM GREATER 399) + add_extra_compiler_option(-fvisibility=hidden) + add_extra_compiler_option(-fvisibility-inlines-hidden) +endif() + +#combine all "extra" options +set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${OPENCV_EXTRA_FLAGS} ${OPENCV_EXTRA_C_FLAGS}") +set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${OPENCV_EXTRA_FLAGS} ${OPENCV_EXTRA_CXX_FLAGS}") +set(CMAKE_CXX_FLAGS_RELEASE "${CMAKE_CXX_FLAGS_RELEASE} ${OPENCV_EXTRA_FLAGS_RELEASE}") +set(CMAKE_C_FLAGS_RELEASE "${CMAKE_C_FLAGS_RELEASE} ${OPENCV_EXTRA_FLAGS_RELEASE}") +set(CMAKE_CXX_FLAGS_DEBUG "${CMAKE_CXX_FLAGS_DEBUG} ${OPENCV_EXTRA_FLAGS_DEBUG}") +set(CMAKE_C_FLAGS_DEBUG "${CMAKE_C_FLAGS_DEBUG} ${OPENCV_EXTRA_FLAGS_DEBUG}") +set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} ${OPENCV_EXTRA_EXE_LINKER_FLAGS}") +set(CMAKE_EXE_LINKER_FLAGS_RELEASE "${CMAKE_EXE_LINKER_FLAGS_RELEASE} ${OPENCV_EXTRA_EXE_LINKER_FLAGS_RELEASE}") +set(CMAKE_EXE_LINKER_FLAGS_DEBUG "${CMAKE_EXE_LINKER_FLAGS_DEBUG} ${OPENCV_EXTRA_EXE_LINKER_FLAGS_DEBUG}") + +if(MSVC) + # avoid warnings from MSVC about overriding the /W* option + # we replace /W3 with /W4 only for C++ files, + # since all the 3rd-party libraries OpenCV uses are in C, + # and we do not care about their warnings. + string(REPLACE "/W3" "/W4" CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS}") + string(REPLACE "/W3" "/W4" CMAKE_CXX_FLAGS_RELEASE "${CMAKE_CXX_FLAGS_RELEASE}") + string(REPLACE "/W3" "/W4" CMAKE_CXX_FLAGS_DEBUG "${CMAKE_CXX_FLAGS_DEBUG}") + + if(NOT ENABLE_NOISY_WARNINGS AND MSVC_VERSION EQUAL 1400) + ocv_warnings_disable(CMAKE_CXX_FLAGS /wd4510 /wd4610 /wd4312 /wd4201 /wd4244 /wd4328 /wd4267) + endif() + + # allow extern "C" functions throw exceptions + foreach(flags CMAKE_C_FLAGS CMAKE_C_FLAGS_RELEASE CMAKE_C_FLAGS_RELEASE CMAKE_CXX_FLAGS CMAKE_CXX_FLAGS_RELEASE CMAKE_CXX_FLAGS_DEBUG) + string(REPLACE "/EHsc-" "/EHs" ${flags} "${${flags}}") + string(REPLACE "/EHsc" "/EHs" ${flags} "${${flags}}") + + string(REPLACE "/Zm1000" "" ${flags} "${${flags}}") + endforeach() + + if(NOT ENABLE_NOISY_WARNINGS) + ocv_warnings_disable(CMAKE_CXX_FLAGS /wd4251) # class 'std::XXX' needs to have dll-interface to be used by clients of YYY + ocv_warnings_disable(CMAKE_CXX_FLAGS /wd4324) # 'struct_name' : structure was padded due to __declspec(align()) + endif() +endif() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVConfig.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVConfig.cmake new file mode 100644 index 000000000..83bcb39fe --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVConfig.cmake @@ -0,0 +1,173 @@ +# =================================================================================== +# The OpenCV CMake configuration file +# +# ** File generated automatically, do not modify ** +# +# Usage from an external project: +# In your CMakeLists.txt, add these lines: +# +# FIND_PACKAGE(OpenCV REQUIRED) +# TARGET_LINK_LIBRARIES(MY_TARGET_NAME ${OpenCV_LIBS}) +# +# Or you can search for specific OpenCV modules: +# +# FIND_PACKAGE(OpenCV REQUIRED core imgcodecs) +# +# If the module is found then OPENCV__FOUND is set to TRUE. +# +# This file will define the following variables: +# - OpenCV_LIBS : The list of libraries to link against. +# - OpenCV_LIB_DIR : The directory(es) where lib files are. Calling LINK_DIRECTORIES +# with this path is NOT needed. +# - OpenCV_INCLUDE_DIRS : The OpenCV include directories. +# - OpenCV_COMPUTE_CAPABILITIES : The version of compute capability +# - OpenCV_ANDROID_NATIVE_API_LEVEL : Minimum required level of Android API +# - OpenCV_VERSION : The version of this OpenCV build. Example: "2.4.0" +# - OpenCV_VERSION_MAJOR : Major version part of OpenCV_VERSION. Example: "2" +# - OpenCV_VERSION_MINOR : Minor version part of OpenCV_VERSION. Example: "4" +# - OpenCV_VERSION_PATCH : Patch version part of OpenCV_VERSION. Example: "0" +# +# Advanced variables: +# - OpenCV_SHARED +# - OpenCV_CONFIG_PATH +# - OpenCV_LIB_COMPONENTS +# +# =================================================================================== +# +# Windows pack specific options: +# - OpenCV_STATIC +# - OpenCV_CUDA + +if(CMAKE_VERSION VERSION_GREATER 2.6) + get_property(OpenCV_LANGUAGES GLOBAL PROPERTY ENABLED_LANGUAGES) + if(NOT ";${OpenCV_LANGUAGES};" MATCHES ";CXX;") + enable_language(CXX) + endif() +endif() + +if(NOT DEFINED OpenCV_STATIC) + # look for global setting + if(BUILD_SHARED_LIBS) + set(OpenCV_STATIC OFF) + else() + set(OpenCV_STATIC ON) + endif() +endif() + +if(NOT DEFINED OpenCV_CUDA) + # if user' app uses CUDA, then it probably wants CUDA-enabled OpenCV binaries + if(CUDA_FOUND) + set(OpenCV_CUDA ON) + endif() +endif() + +if(MSVC) + if(CMAKE_CL_64) + set(OpenCV_ARCH x64) + set(OpenCV_TBB_ARCH intel64) + elseif((CMAKE_GENERATOR MATCHES "ARM") OR ("${arch_hint}" STREQUAL "ARM") OR (CMAKE_VS_EFFECTIVE_PLATFORMS MATCHES "ARM|arm")) + # see Modules/CmakeGenericSystem.cmake + set(OpenCV_ARCH ARM) + else() + set(OpenCV_ARCH x86) + set(OpenCV_TBB_ARCH ia32) + endif() + if(MSVC_VERSION EQUAL 1400) + set(OpenCV_RUNTIME vc8) + elseif(MSVC_VERSION EQUAL 1500) + set(OpenCV_RUNTIME vc9) + elseif(MSVC_VERSION EQUAL 1600) + set(OpenCV_RUNTIME vc10) + elseif(MSVC_VERSION EQUAL 1700) + set(OpenCV_RUNTIME vc11) + elseif(MSVC_VERSION EQUAL 1800) + set(OpenCV_RUNTIME vc12) + elseif(MSVC_VERSION EQUAL 1900) + set(OpenCV_RUNTIME vc14) + endif() +elseif(MINGW) + set(OpenCV_RUNTIME mingw) + + execute_process(COMMAND ${CMAKE_CXX_COMPILER} -dumpmachine + OUTPUT_VARIABLE OPENCV_GCC_TARGET_MACHINE + OUTPUT_STRIP_TRAILING_WHITESPACE) + if(OPENCV_GCC_TARGET_MACHINE MATCHES "amd64|x86_64|AMD64") + set(MINGW64 1) + set(OpenCV_ARCH x64) + else() + set(OpenCV_ARCH x86) + endif() +endif() + +if(CMAKE_VERSION VERSION_GREATER 2.6.2) + unset(OpenCV_CONFIG_PATH CACHE) +endif() + +if(NOT OpenCV_FIND_QUIETLY) + message(STATUS "OpenCV ARCH: ${OpenCV_ARCH}") + message(STATUS "OpenCV RUNTIME: ${OpenCV_RUNTIME}") + message(STATUS "OpenCV STATIC: ${OpenCV_STATIC}") +endif() + +get_filename_component(OpenCV_CONFIG_PATH "${CMAKE_CURRENT_LIST_FILE}" PATH CACHE) +if(OpenCV_RUNTIME AND OpenCV_ARCH) + if(OpenCV_STATIC AND EXISTS "${OpenCV_CONFIG_PATH}/${OpenCV_ARCH}/${OpenCV_RUNTIME}/staticlib/OpenCVConfig.cmake") + if(OpenCV_CUDA AND EXISTS "${OpenCV_CONFIG_PATH}/gpu/${OpenCV_ARCH}/${OpenCV_RUNTIME}/staticlib/OpenCVConfig.cmake") + set(OpenCV_LIB_PATH "${OpenCV_CONFIG_PATH}/gpu/${OpenCV_ARCH}/${OpenCV_RUNTIME}/staticlib") + else() + set(OpenCV_LIB_PATH "${OpenCV_CONFIG_PATH}/${OpenCV_ARCH}/${OpenCV_RUNTIME}/staticlib") + endif() + elseif(EXISTS "${OpenCV_CONFIG_PATH}/${OpenCV_ARCH}/${OpenCV_RUNTIME}/lib/OpenCVConfig.cmake") + if(OpenCV_CUDA AND EXISTS "${OpenCV_CONFIG_PATH}/gpu/${OpenCV_ARCH}/${OpenCV_RUNTIME}/lib/OpenCVConfig.cmake") + set(OpenCV_LIB_PATH "${OpenCV_CONFIG_PATH}/gpu/${OpenCV_ARCH}/${OpenCV_RUNTIME}/lib") + else() + set(OpenCV_LIB_PATH "${OpenCV_CONFIG_PATH}/${OpenCV_ARCH}/${OpenCV_RUNTIME}/lib") + endif() + endif() +endif() + +if(OpenCV_LIB_PATH AND EXISTS "${OpenCV_LIB_PATH}/OpenCVConfig.cmake") + set(OpenCV_LIB_DIR_OPT "${OpenCV_LIB_PATH}" CACHE PATH "Path where release OpenCV libraries are located" FORCE) + set(OpenCV_LIB_DIR_DBG "${OpenCV_LIB_PATH}" CACHE PATH "Path where debug OpenCV libraries are located" FORCE) + set(OpenCV_3RDPARTY_LIB_DIR_OPT "${OpenCV_LIB_PATH}" CACHE PATH "Path where release 3rdparty OpenCV dependencies are located" FORCE) + set(OpenCV_3RDPARTY_LIB_DIR_DBG "${OpenCV_LIB_PATH}" CACHE PATH "Path where debug 3rdparty OpenCV dependencies are located" FORCE) + + include("${OpenCV_LIB_PATH}/OpenCVConfig.cmake") + + if(OpenCV_CUDA) + set(_OpenCV_LIBS "") + foreach(_lib ${OpenCV_LIBS}) + string(REPLACE "${OpenCV_CONFIG_PATH}/gpu/${OpenCV_ARCH}/${OpenCV_RUNTIME}" "${OpenCV_CONFIG_PATH}/${OpenCV_ARCH}/${OpenCV_RUNTIME}" _lib2 "${_lib}") + if(NOT EXISTS "${_lib}" AND EXISTS "${_lib2}") + list(APPEND _OpenCV_LIBS "${_lib2}") + else() + list(APPEND _OpenCV_LIBS "${_lib}") + endif() + endforeach() + set(OpenCV_LIBS ${_OpenCV_LIBS}) + endif() + set(OpenCV_FOUND TRUE CACHE BOOL "" FORCE) + set(OPENCV_FOUND TRUE CACHE BOOL "" FORCE) + + if(NOT OpenCV_FIND_QUIETLY) + message(STATUS "Found OpenCV ${OpenCV_VERSION} in ${OpenCV_LIB_PATH}") + if(NOT OpenCV_LIB_PATH MATCHES "/staticlib") + get_filename_component(_OpenCV_LIB_PATH "${OpenCV_LIB_PATH}/../bin" ABSOLUTE) + file(TO_NATIVE_PATH "${_OpenCV_LIB_PATH}" _OpenCV_LIB_PATH) + message(STATUS "You might need to add ${_OpenCV_LIB_PATH} to your PATH to be able to run your applications.") + if(OpenCV_LIB_PATH MATCHES "/gpu/") + string(REPLACE "\\gpu" "" _OpenCV_LIB_PATH2 "${_OpenCV_LIB_PATH}") + message(STATUS "GPU support is enabled so you might also need ${_OpenCV_LIB_PATH2} in your PATH (it must go after the ${_OpenCV_LIB_PATH}).") + endif() + endif() + endif() +else() + if(NOT OpenCV_FIND_QUIETLY) + message(WARNING +"Found OpenCV Windows Pack but it has no binaries compatible with your configuration. +You should manually point CMake variable OpenCV_DIR to your build of OpenCV library." + ) + endif() + set(OpenCV_FOUND FALSE CACHE BOOL "" FORCE) + set(OPENCV_FOUND FALSE CACHE BOOL "" FORCE) +endif() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVDetectAndroidSDK.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVDetectAndroidSDK.cmake new file mode 100644 index 000000000..3bfb10e2d --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVDetectAndroidSDK.cmake @@ -0,0 +1,385 @@ +if(EXISTS "${ANDROID_EXECUTABLE}") + set(ANDROID_SDK_DETECT_QUIET TRUE) +endif() + +file(TO_CMAKE_PATH "$ENV{ProgramFiles}" ProgramFiles_ENV_PATH) +file(TO_CMAKE_PATH "$ENV{HOME}" HOME_ENV_PATH) + +if(CMAKE_HOST_WIN32) + set(ANDROID_SDK_OS windows) +elseif(CMAKE_HOST_APPLE) + set(ANDROID_SDK_OS macosx) +else() + set(ANDROID_SDK_OS linux) +endif() + +#find android SDK: search in ANDROID_SDK first +find_host_program(ANDROID_EXECUTABLE + NAMES android.bat android + PATH_SUFFIXES tools + PATHS + ENV ANDROID_SDK + DOC "Android SDK location" + NO_DEFAULT_PATH + ) + +# Now search default paths +find_host_program(ANDROID_EXECUTABLE + NAMES android.bat android + PATH_SUFFIXES android-sdk-${ANDROID_SDK_OS}/tools + android-sdk-${ANDROID_SDK_OS}_x86/tools + android-sdk-${ANDROID_SDK_OS}_86/tools + android-sdk/tools + PATHS /opt + "${HOME_ENV_PATH}/NVPACK" + "$ENV{SystemDrive}/NVPACK" + "${ProgramFiles_ENV_PATH}/Android" + DOC "Android SDK location" + ) + +if(ANDROID_EXECUTABLE) + if(NOT ANDROID_SDK_DETECT_QUIET) + message(STATUS "Found android tool: ${ANDROID_EXECUTABLE}") + endif() + + get_filename_component(ANDROID_SDK_TOOLS_PATH "${ANDROID_EXECUTABLE}" PATH) + + #read source.properties + if(EXISTS "${ANDROID_SDK_TOOLS_PATH}/source.properties") + file(STRINGS "${ANDROID_SDK_TOOLS_PATH}/source.properties" ANDROID_SDK_TOOLS_SOURCE_PROPERTIES_LINES REGEX "^[ ]*[^#].*$") + foreach(line ${ANDROID_SDK_TOOLS_SOURCE_PROPERTIES_LINES}) + string(REPLACE "\\:" ":" line ${line}) + string(REPLACE "=" ";" line ${line}) + list(GET line 0 line_name) + list(GET line 1 line_value) + string(REPLACE "." "_" line_name ${line_name}) + SET(ANDROID_TOOLS_${line_name} "${line_value}" CACHE INTERNAL "from ${ANDROID_SDK_TOOLS_PATH}/source.properties") + MARK_AS_ADVANCED(ANDROID_TOOLS_${line_name}) + endforeach() + endif() + + #fix missing revision (SDK tools before r9 don't set revision number correctly) + if(NOT ANDROID_TOOLS_Pkg_Revision) + SET(ANDROID_TOOLS_Pkg_Revision "Unknown" CACHE INTERNAL "") + MARK_AS_ADVANCED(ANDROID_TOOLS_Pkg_Revision) + endif() + + #fix missing description + if(NOT ANDROID_TOOLS_Pkg_Desc) + SET(ANDROID_TOOLS_Pkg_Desc "Android SDK Tools, revision ${ANDROID_TOOLS_Pkg_Revision}." CACHE INTERNAL "") + MARK_AS_ADVANCED(ANDROID_TOOLS_Pkg_Desc) + endif() + + #warn about outdated SDK + if(NOT ANDROID_TOOLS_Pkg_Revision GREATER 13) + SET(ANDROID_TOOLS_Pkg_Desc "${ANDROID_TOOLS_Pkg_Desc} It is recommended to update your SDK tools to revision 14 or newer." CACHE INTERNAL "") + endif() + + if(ANDROID_TOOLS_Pkg_Revision GREATER 13) + SET(ANDROID_PROJECT_PROPERTIES_FILE project.properties) + SET(ANDROID_ANT_PROPERTIES_FILE ant.properties) + else() + SET(ANDROID_PROJECT_PROPERTIES_FILE default.properties) + SET(ANDROID_ANT_PROPERTIES_FILE build.properties) + endif() + + set(ANDROID_MANIFEST_FILE AndroidManifest.xml) + set(ANDROID_LIB_PROJECT_FILES build.xml local.properties proguard-project.txt ${ANDROID_PROJECT_PROPERTIES_FILE}) + set(ANDROID_PROJECT_FILES ${ANDROID_LIB_PROJECT_FILES}) + + #get installed targets + if(ANDROID_TOOLS_Pkg_Revision GREATER 11) + execute_process(COMMAND ${ANDROID_EXECUTABLE} list target -c + RESULT_VARIABLE ANDROID_PROCESS + OUTPUT_VARIABLE ANDROID_SDK_TARGETS + ERROR_VARIABLE ANDROID_PROCESS_ERRORS + OUTPUT_STRIP_TRAILING_WHITESPACE + ) + string(REGEX MATCHALL "[^\n]+" ANDROID_SDK_TARGETS "${ANDROID_SDK_TARGETS}") + else() + #old SDKs (r11 and older) don't provide compact list + execute_process(COMMAND ${ANDROID_EXECUTABLE} list target + RESULT_VARIABLE ANDROID_PROCESS + OUTPUT_VARIABLE ANDROID_SDK_TARGETS_FULL + ERROR_VARIABLE ANDROID_PROCESS_ERRORS + OUTPUT_STRIP_TRAILING_WHITESPACE + ) + string(REGEX MATCHALL "(^|\n)id: [0-9]+ or \"([^\n]+[0-9+])\"(\n|$)" ANDROID_SDK_TARGETS_FULL "${ANDROID_SDK_TARGETS_FULL}") + + SET(ANDROID_SDK_TARGETS "") + if(ANDROID_PROCESS EQUAL 0) + foreach(line ${ANDROID_SDK_TARGETS_FULL}) + string(REGEX REPLACE "(^|\n)id: [0-9]+ or \"([^\n]+[0-9+])\"(\n|$)" "\\2" line "${line}") + list(APPEND ANDROID_SDK_TARGETS "${line}") + endforeach() + endif() + endif() + + if(NOT ANDROID_PROCESS EQUAL 0) + message(ERROR "Failed to get list of installed Android targets.") + set(ANDROID_EXECUTABLE "ANDROID_EXECUTABLE-NOTFOUND") + endif() + + # clear ANDROID_SDK_TARGET if no target is provided by user + if(NOT ANDROID_SDK_TARGET) + set(ANDROID_SDK_TARGET "" CACHE STRING "Android SDK target for the OpenCV Java API and samples") + endif() + if(ANDROID_SDK_TARGETS) + set_property( CACHE ANDROID_SDK_TARGET PROPERTY STRINGS ${ANDROID_SDK_TARGETS} ) + endif() +endif(ANDROID_EXECUTABLE) + +# finds minimal installed SDK target compatible with provided names or API levels +# usage: +# get_compatible_android_api_level(VARIABLE [level1] [level2] ...) +macro(android_get_compatible_target VAR) + set(${VAR} "${VAR}-NOTFOUND") + if(ANDROID_SDK_TARGETS) + list(GET ANDROID_SDK_TARGETS 0 __lvl) + string(REGEX MATCH "[0-9]+$" __lvl "${__lvl}") + + #find minimal level mathing to all provided levels + foreach(lvl ${ARGN}) + string(REGEX MATCH "[0-9]+$" __level "${lvl}") + if(__level GREATER __lvl) + set(__lvl ${__level}) + endif() + endforeach() + + #search for compatible levels + foreach(lvl ${ANDROID_SDK_TARGETS}) + string(REGEX MATCH "[0-9]+$" __level "${lvl}") + if(__level EQUAL __lvl) + #look for exact match + foreach(usrlvl ${ARGN}) + if("${usrlvl}" STREQUAL "${lvl}") + set(${VAR} "${lvl}") + break() + endif() + endforeach() + if("${${VAR}}" STREQUAL "${lvl}") + break() #exact match was found + elseif(NOT ${VAR}) + set(${VAR} "${lvl}") + endif() + elseif(__level GREATER __lvl) + if(NOT ${VAR}) + set(${VAR} "${lvl}") + endif() + break() + endif() + endforeach() + + unset(__lvl) + unset(__level) + endif() +endmacro() + +unset(__android_project_chain CACHE) + +# add_android_project(target_name ${path} NATIVE_DEPS opencv_core LIBRARY_DEPS ${OpenCV_BINARY_DIR} SDK_TARGET 11) +macro(add_android_project target path) + # parse arguments + set(android_proj_arglist NATIVE_DEPS LIBRARY_DEPS SDK_TARGET IGNORE_JAVA IGNORE_MANIFEST COPY_LIBS) + set(__varname "android_proj_") + foreach(v ${android_proj_arglist}) + set(${__varname}${v} "") + endforeach() + foreach(arg ${ARGN}) + set(__var "${__varname}") + foreach(v ${android_proj_arglist}) + if("${v}" STREQUAL "${arg}") + set(__varname "android_proj_${v}") + break() + endif() + endforeach() + if(__var STREQUAL __varname) + list(APPEND ${__var} "${arg}") + endif() + endforeach() + + # get compatible SDK target + android_get_compatible_target(android_proj_sdk_target ${ANDROID_NATIVE_API_LEVEL} ${android_proj_SDK_TARGET}) + + if(NOT android_proj_sdk_target) + message(WARNING "Can not find any SDK target compatible with: ${ANDROID_NATIVE_API_LEVEL} ${android_proj_SDK_TARGET} + The project ${target} will not be build") + endif() + + # check native dependencies + if(android_proj_IGNORE_JAVA) + ocv_check_dependencies(${android_proj_NATIVE_DEPS}) + else() + ocv_check_dependencies(${android_proj_NATIVE_DEPS} opencv_java) + endif() + + if(EXISTS "${path}/jni/Android.mk" ) + # find if native_app_glue is used + file(STRINGS "${path}/jni/Android.mk" NATIVE_APP_GLUE REGEX ".*(call import-module,android/native_app_glue)" ) + if(NATIVE_APP_GLUE) + if(ANDROID_NATIVE_API_LEVEL LESS 9 OR NOT EXISTS "${ANDROID_NDK}/sources/android/native_app_glue") + set(OCV_DEPENDENCIES_FOUND FALSE) + endif() + endif() + endif() + + if(OCV_DEPENDENCIES_FOUND AND android_proj_sdk_target AND ANDROID_EXECUTABLE AND ANT_EXECUTABLE AND ANDROID_TOOLS_Pkg_Revision GREATER 13 AND EXISTS "${path}/${ANDROID_MANIFEST_FILE}") + + project(${target}) + set(android_proj_bin_dir "${CMAKE_CURRENT_BINARY_DIR}/.build") + + # get project sources + file(GLOB_RECURSE android_proj_files RELATIVE "${path}" "${path}/res/*" "${path}/src/*") + + if(NOT android_proj_IGNORE_MANIFEST) + list(APPEND android_proj_files ${ANDROID_MANIFEST_FILE}) + endif() + + # copy sources out from the build tree + set(android_proj_file_deps "") + foreach(f ${android_proj_files}) + add_custom_command( + OUTPUT "${android_proj_bin_dir}/${f}" + COMMAND ${CMAKE_COMMAND} -E copy "${path}/${f}" "${android_proj_bin_dir}/${f}" + MAIN_DEPENDENCY "${path}/${f}" + COMMENT "Copying ${f}") + list(APPEND android_proj_file_deps "${path}/${f}" "${android_proj_bin_dir}/${f}") + endforeach() + + set(android_proj_lib_deps_commands "") + set(android_proj_target_files ${ANDROID_PROJECT_FILES}) + ocv_list_add_prefix(android_proj_target_files "${android_proj_bin_dir}/") + + # process Android library dependencies + foreach(dep ${android_proj_LIBRARY_DEPS}) + file(RELATIVE_PATH __dep "${android_proj_bin_dir}" "${dep}") + list(APPEND android_proj_lib_deps_commands + COMMAND ${ANDROID_EXECUTABLE} --silent update project --path "${android_proj_bin_dir}" --library "${__dep}") + endforeach() + + # fix Android project + add_custom_command( + OUTPUT ${android_proj_target_files} + COMMAND ${CMAKE_COMMAND} -E remove ${android_proj_target_files} + COMMAND ${ANDROID_EXECUTABLE} --silent update project --path "${android_proj_bin_dir}" --target "${android_proj_sdk_target}" --name "${target}" + ${android_proj_lib_deps_commands} + MAIN_DEPENDENCY "${android_proj_bin_dir}/${ANDROID_MANIFEST_FILE}" + DEPENDS "${path}/${ANDROID_MANIFEST_FILE}" + COMMENT "Updating Android project at ${path}. SDK target: ${android_proj_sdk_target}" + ) + + list(APPEND android_proj_file_deps ${android_proj_target_files}) + + # build native part + file(GLOB_RECURSE android_proj_jni_files "${path}/jni/*.c" "${path}/jni/*.h" "${path}/jni/*.cpp" "${path}/jni/*.hpp") + ocv_list_filterout(android_proj_jni_files "\\\\.svn") + + if(android_proj_jni_files AND EXISTS ${path}/jni/Android.mk AND NOT DEFINED JNI_LIB_NAME) + # find local module name in Android.mk file to build native lib + file(STRINGS "${path}/jni/Android.mk" JNI_LIB_NAME REGEX "LOCAL_MODULE[ ]*:=[ ]*.*" ) + string(REGEX REPLACE "LOCAL_MODULE[ ]*:=[ ]*([a-zA-Z_][a-zA-Z_0-9]*)[ ]*" "\\1" JNI_LIB_NAME "${JNI_LIB_NAME}") + + if(JNI_LIB_NAME) + if(NATIVE_APP_GLUE) + include_directories(${ANDROID_NDK}/sources/android/native_app_glue) + list(APPEND android_proj_jni_files ${ANDROID_NDK}/sources/android/native_app_glue/android_native_app_glue.c) + ocv_warnings_disable(CMAKE_C_FLAGS -Wstrict-prototypes -Wunused-parameter -Wmissing-prototypes) + set(android_proj_NATIVE_DEPS ${android_proj_NATIVE_DEPS} android) + endif() + + add_library(${JNI_LIB_NAME} MODULE ${android_proj_jni_files}) + ocv_target_include_modules_recurse(${JNI_LIB_NAME} ${android_proj_NATIVE_DEPS}) + ocv_target_include_directories(${JNI_LIB_NAME} "${path}/jni") + ocv_target_link_libraries(${JNI_LIB_NAME} ${OPENCV_LINKER_LIBS} ${android_proj_NATIVE_DEPS}) + + set_target_properties(${JNI_LIB_NAME} PROPERTIES + OUTPUT_NAME "${JNI_LIB_NAME}" + LIBRARY_OUTPUT_DIRECTORY "${android_proj_bin_dir}/libs/${ANDROID_NDK_ABI_NAME}" + ) + + get_target_property(android_proj_jni_location "${JNI_LIB_NAME}" LOCATION) + if (NOT (CMAKE_BUILD_TYPE MATCHES "debug")) + add_custom_command(TARGET ${JNI_LIB_NAME} POST_BUILD COMMAND ${CMAKE_STRIP} --strip-unneeded "${android_proj_jni_location}") + endif() + endif() + endif() + + # build java part + if(android_proj_IGNORE_JAVA) + add_custom_command( + OUTPUT "${android_proj_bin_dir}/bin/${target}-debug.apk" + COMMAND ${ANT_EXECUTABLE} -q -noinput -k debug + COMMAND ${CMAKE_COMMAND} -E touch "${android_proj_bin_dir}/bin/${target}-debug.apk" # needed because ant does not update the timestamp of updated apk + WORKING_DIRECTORY "${android_proj_bin_dir}" + MAIN_DEPENDENCY "${android_proj_bin_dir}/${ANDROID_MANIFEST_FILE}" + DEPENDS ${android_proj_file_deps} ${JNI_LIB_NAME}) + else() + add_custom_command( + OUTPUT "${android_proj_bin_dir}/bin/${target}-debug.apk" + COMMAND ${ANT_EXECUTABLE} -q -noinput -k debug + COMMAND ${CMAKE_COMMAND} -E touch "${android_proj_bin_dir}/bin/${target}-debug.apk" # needed because ant does not update the timestamp of updated apk + WORKING_DIRECTORY "${android_proj_bin_dir}" + MAIN_DEPENDENCY "${android_proj_bin_dir}/${ANDROID_MANIFEST_FILE}" + DEPENDS "${OpenCV_BINARY_DIR}/bin/classes.jar.dephelper" opencv_java # as we are part of OpenCV we can just force this dependency + DEPENDS ${android_proj_file_deps} ${JNI_LIB_NAME}) + endif() + + unset(JNI_LIB_NAME) + + add_custom_target(${target} ALL SOURCES "${android_proj_bin_dir}/bin/${target}-debug.apk" ) + if(NOT android_proj_IGNORE_JAVA) + add_dependencies(${target} opencv_java) + endif() + if(android_proj_native_deps) + add_dependencies(${target} ${android_proj_native_deps}) + endif() + + if (android_proj_COPY_LIBS OR ANDROID_EXAMPLES_WITH_LIBS) + message(STATUS "Android project with libs: " ${target}) + add_custom_target( + ${target}_copy_libs + COMMAND ${CMAKE_COMMAND} -DSRC_DIR=${OpenCV_BINARY_DIR}/lib -DDST_DIR=${android_proj_bin_dir}/libs -P ${OpenCV_SOURCE_DIR}/cmake/copyAndroidLibs.cmake + WORKING_DIRECTORY ${OpenCV_BINARY_DIR}/lib + ) + add_dependencies(${target} ${target}_copy_libs) + if (ANDROID_EXAMPLES_WITH_LIBS) + add_dependencies(${target}_copy_libs "${OpenCV_BINARY_DIR}/bin/classes.jar.dephelper" opencv_java) + endif() + endif() + + if(__android_project_chain) + add_dependencies(${target} ${__android_project_chain}) + endif() + set(__android_project_chain ${target} CACHE INTERNAL "auxiliary variable used for Android progects chaining") + + # put the final .apk to the OpenCV's bin folder + add_custom_command(TARGET ${target} POST_BUILD COMMAND ${CMAKE_COMMAND} -E copy "${android_proj_bin_dir}/bin/${target}-debug.apk" "${OpenCV_BINARY_DIR}/bin/${target}.apk") + if(INSTALL_ANDROID_EXAMPLES AND "${target}" MATCHES "^example-") + #apk + install(FILES "${OpenCV_BINARY_DIR}/bin/${target}.apk" DESTINATION "samples" COMPONENT samples) + get_filename_component(sample_dir "${path}" NAME) + #java part + list(REMOVE_ITEM android_proj_files ${ANDROID_MANIFEST_FILE}) + foreach(f ${android_proj_files} ${ANDROID_MANIFEST_FILE}) + get_filename_component(install_subdir "${f}" PATH) + install(FILES "${android_proj_bin_dir}/${f}" DESTINATION "samples/${sample_dir}/${install_subdir}" COMPONENT samples) + endforeach() + #jni part + eclipse files + file(GLOB_RECURSE jni_files RELATIVE "${path}" "${path}/jni/*" "${path}/.cproject") + ocv_list_filterout(jni_files "\\\\.svn") + foreach(f ${jni_files} ".classpath" ".project" ".settings/org.eclipse.jdt.core.prefs") + get_filename_component(install_subdir "${f}" PATH) + install(FILES "${path}/${f}" DESTINATION "samples/${sample_dir}/${install_subdir}" COMPONENT samples) + endforeach() + #update proj + if(android_proj_lib_deps_commands) + set(inst_lib_opt " --library ../../sdk/java") + endif() + install(CODE "EXECUTE_PROCESS(COMMAND ${ANDROID_EXECUTABLE} --silent update project --path . --target \"${android_proj_sdk_target}\" --name \"${target}\" ${inst_lib_opt} + WORKING_DIRECTORY \"\$ENV{DESTDIR}\${CMAKE_INSTALL_PREFIX}/samples/${sample_dir}\" + )" COMPONENT samples) + #empty 'gen' + install(CODE "MAKE_DIRECTORY(\"\$ENV{DESTDIR}\${CMAKE_INSTALL_PREFIX}/samples/${sample_dir}/gen\")" COMPONENT samples) + endif() + endif() +endmacro() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVDetectApacheAnt.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVDetectApacheAnt.cmake new file mode 100644 index 000000000..7b7e9a6da --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVDetectApacheAnt.cmake @@ -0,0 +1,31 @@ +file(TO_CMAKE_PATH "$ENV{ANT_DIR}" ANT_DIR_ENV_PATH) +file(TO_CMAKE_PATH "$ENV{ProgramFiles}" ProgramFiles_ENV_PATH) + +if(CMAKE_HOST_WIN32) + set(ANT_NAME ant.bat) +else() + set(ANT_NAME ant) +endif() + +find_host_program(ANT_EXECUTABLE NAMES ${ANT_NAME} + PATHS "${ANT_DIR_ENV_PATH}/bin" "${ProgramFiles_ENV_PATH}/apache-ant/bin" + NO_DEFAULT_PATH + ) + +find_host_program(ANT_EXECUTABLE NAMES ${ANT_NAME}) + +if(ANT_EXECUTABLE) + execute_process(COMMAND ${ANT_EXECUTABLE} -version + RESULT_VARIABLE ANT_ERROR_LEVEL + OUTPUT_VARIABLE ANT_VERSION_FULL + OUTPUT_STRIP_TRAILING_WHITESPACE) + if (ANT_ERROR_LEVEL) + unset(ANT_EXECUTABLE) + unset(ANT_EXECUTABLE CACHE) + else() + string(REGEX MATCH "[0-9]+.[0-9]+.[0-9]+" ANT_VERSION "${ANT_VERSION_FULL}") + set(ANT_VERSION "${ANT_VERSION}" CACHE INTERNAL "Detected ant vesion") + + message(STATUS "Found apache ant ${ANT_VERSION}: ${ANT_EXECUTABLE}") + endif() +endif() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVDetectCStripes.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVDetectCStripes.cmake new file mode 100644 index 000000000..279a33996 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVDetectCStripes.cmake @@ -0,0 +1,11 @@ +if(WIN32) + find_path( CSTRIPES_LIB_DIR + NAMES "Š”=.lib" + DOC "The path to C= lib and dll") + if(CSTRIPES_LIB_DIR) + ocv_include_directories("${CSTRIPES_LIB_DIR}/..") + link_directories("${CSTRIPES_LIB_DIR}") + set(OPENCV_LINKER_LIBS ${OPENCV_LINKER_LIBS} "C=") + set(HAVE_CSTRIPES 1) + endif() +endif() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVDetectCUDA.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVDetectCUDA.cmake new file mode 100644 index 000000000..5789421a4 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVDetectCUDA.cmake @@ -0,0 +1,257 @@ +if(WIN32 AND NOT MSVC) + message(STATUS "CUDA compilation is disabled (due to only Visual Studio compiler supported on your platform).") + return() +endif() + +if(CMAKE_COMPILER_IS_GNUCXX AND NOT APPLE AND CMAKE_CXX_COMPILER_ID STREQUAL "Clang") + message(STATUS "CUDA compilation is disabled (due to Clang unsupported on your platform).") + return() +endif() + +set(CMAKE_MODULE_PATH "${OpenCV_SOURCE_DIR}/cmake" ${CMAKE_MODULE_PATH}) + +if(ANDROID) + set(CUDA_TARGET_OS_VARIANT "Android") +endif() +find_host_package(CUDA "${MIN_VER_CUDA}" QUIET) + +list(REMOVE_AT CMAKE_MODULE_PATH 0) + +if(CUDA_FOUND) + set(HAVE_CUDA 1) + + if(WITH_CUFFT) + set(HAVE_CUFFT 1) + endif() + + if(WITH_CUBLAS) + set(HAVE_CUBLAS 1) + endif() + + if(WITH_NVCUVID) + find_cuda_helper_libs(nvcuvid) + if(WIN32) + find_cuda_helper_libs(nvcuvenc) + endif() + set(HAVE_NVCUVID 1) + endif() + + message(STATUS "CUDA detected: " ${CUDA_VERSION}) + + set(_generations "Fermi" "Kepler") + if(NOT CMAKE_CROSSCOMPILING) + list(APPEND _generations "Auto") + endif() + set(CUDA_GENERATION "" CACHE STRING "Build CUDA device code only for specific GPU architecture. Leave empty to build for all architectures.") + if( CMAKE_VERSION VERSION_GREATER "2.8" ) + set_property( CACHE CUDA_GENERATION PROPERTY STRINGS "" ${_generations} ) + endif() + + if(CUDA_GENERATION) + if(NOT ";${_generations};" MATCHES ";${CUDA_GENERATION};") + string(REPLACE ";" ", " _generations "${_generations}") + message(FATAL_ERROR "ERROR: ${_generations} Generations are suppered.") + endif() + unset(CUDA_ARCH_BIN CACHE) + unset(CUDA_ARCH_PTX CACHE) + endif() + + set(__cuda_arch_ptx "") + if(CUDA_GENERATION STREQUAL "Fermi") + set(__cuda_arch_bin "2.0 2.1(2.0)") + elseif(CUDA_GENERATION STREQUAL "Kepler") + if(${CUDA_VERSION} VERSION_LESS "5.0") + set(__cuda_arch_bin "3.0") + else() + set(__cuda_arch_bin "3.0 3.5") + endif() + elseif(CUDA_GENERATION STREQUAL "Auto") + execute_process( COMMAND "${CUDA_NVCC_EXECUTABLE}" "${OpenCV_SOURCE_DIR}/cmake/checks/OpenCVDetectCudaArch.cu" "--run" + WORKING_DIRECTORY "${CMAKE_BINARY_DIR}${CMAKE_FILES_DIRECTORY}/CMakeTmp/" + RESULT_VARIABLE _nvcc_res OUTPUT_VARIABLE _nvcc_out + ERROR_QUIET OUTPUT_STRIP_TRAILING_WHITESPACE) + if(NOT _nvcc_res EQUAL 0) + message(STATUS "Automatic detection of CUDA generation failed. Going to build for all known architectures.") + else() + set(__cuda_arch_bin "${_nvcc_out}") + string(REPLACE "2.1" "2.1(2.0)" __cuda_arch_bin "${__cuda_arch_bin}") + endif() + endif() + + if(NOT DEFINED __cuda_arch_bin) + if(ANDROID) + if(ARM) + set(__cuda_arch_bin "3.2") + set(__cuda_arch_ptx "") + elseif(AARCH64) + set(__cuda_arch_bin "5.3") + set(__cuda_arch_ptx "") + endif() + else() + if(${CUDA_VERSION} VERSION_LESS "5.0") + set(__cuda_arch_bin "1.1 1.2 1.3 2.0 2.1(2.0) 3.0") + elseif(${CUDA_VERSION} VERSION_GREATER "6.5") + set(__cuda_arch_bin "2.0 2.1(2.0) 3.0 3.5") + else() + set(__cuda_arch_bin "1.1 1.2 1.3 2.0 2.1(2.0) 3.0 3.5") + endif() + set(__cuda_arch_ptx "3.0") + endif() + endif() + + set(CUDA_ARCH_BIN ${__cuda_arch_bin} CACHE STRING "Specify 'real' GPU architectures to build binaries for, BIN(PTX) format is supported") + set(CUDA_ARCH_PTX ${__cuda_arch_ptx} CACHE STRING "Specify 'virtual' PTX architectures to build PTX intermediate code for") + + string(REGEX REPLACE "\\." "" ARCH_BIN_NO_POINTS "${CUDA_ARCH_BIN}") + string(REGEX REPLACE "\\." "" ARCH_PTX_NO_POINTS "${CUDA_ARCH_PTX}") + + # Ckeck if user specified 1.0 compute capability: we don't support it + string(REGEX MATCH "1.0" HAS_ARCH_10 "${CUDA_ARCH_BIN} ${CUDA_ARCH_PTX}") + set(CUDA_ARCH_BIN_OR_PTX_10 0) + if(NOT ${HAS_ARCH_10} STREQUAL "") + set(CUDA_ARCH_BIN_OR_PTX_10 1) + endif() + + # NVCC flags to be set + set(NVCC_FLAGS_EXTRA "") + + # These vars will be passed into the templates + set(OPENCV_CUDA_ARCH_BIN "") + set(OPENCV_CUDA_ARCH_PTX "") + set(OPENCV_CUDA_ARCH_FEATURES "") + + # Tell NVCC to add binaries for the specified GPUs + string(REGEX MATCHALL "[0-9()]+" ARCH_LIST "${ARCH_BIN_NO_POINTS}") + foreach(ARCH IN LISTS ARCH_LIST) + if(ARCH MATCHES "([0-9]+)\\(([0-9]+)\\)") + # User explicitly specified PTX for the concrete BIN + set(NVCC_FLAGS_EXTRA ${NVCC_FLAGS_EXTRA} -gencode arch=compute_${CMAKE_MATCH_2},code=sm_${CMAKE_MATCH_1}) + set(OPENCV_CUDA_ARCH_BIN "${OPENCV_CUDA_ARCH_BIN} ${CMAKE_MATCH_1}") + set(OPENCV_CUDA_ARCH_FEATURES "${OPENCV_CUDA_ARCH_FEATURES} ${CMAKE_MATCH_2}") + else() + # User didn't explicitly specify PTX for the concrete BIN, we assume PTX=BIN + set(NVCC_FLAGS_EXTRA ${NVCC_FLAGS_EXTRA} -gencode arch=compute_${ARCH},code=sm_${ARCH}) + set(OPENCV_CUDA_ARCH_BIN "${OPENCV_CUDA_ARCH_BIN} ${ARCH}") + set(OPENCV_CUDA_ARCH_FEATURES "${OPENCV_CUDA_ARCH_FEATURES} ${ARCH}") + endif() + endforeach() + + # Tell NVCC to add PTX intermediate code for the specified architectures + string(REGEX MATCHALL "[0-9]+" ARCH_LIST "${ARCH_PTX_NO_POINTS}") + foreach(ARCH IN LISTS ARCH_LIST) + set(NVCC_FLAGS_EXTRA ${NVCC_FLAGS_EXTRA} -gencode arch=compute_${ARCH},code=compute_${ARCH}) + set(OPENCV_CUDA_ARCH_PTX "${OPENCV_CUDA_ARCH_PTX} ${ARCH}") + set(OPENCV_CUDA_ARCH_FEATURES "${OPENCV_CUDA_ARCH_FEATURES} ${ARCH}") + endforeach() + + # These vars will be processed in other scripts + set(CUDA_NVCC_FLAGS ${CUDA_NVCC_FLAGS} ${NVCC_FLAGS_EXTRA}) + set(OpenCV_CUDA_CC "${NVCC_FLAGS_EXTRA}") + + if(ANDROID) + set(CUDA_NVCC_FLAGS ${CUDA_NVCC_FLAGS} "-Xptxas;-dlcm=ca") + endif() + + message(STATUS "CUDA NVCC target flags: ${CUDA_NVCC_FLAGS}") + + OCV_OPTION(CUDA_FAST_MATH "Enable --use_fast_math for CUDA compiler " OFF) + + if(CUDA_FAST_MATH) + set(CUDA_NVCC_FLAGS ${CUDA_NVCC_FLAGS} --use_fast_math) + endif() + + mark_as_advanced(CUDA_BUILD_CUBIN CUDA_BUILD_EMULATION CUDA_VERBOSE_BUILD CUDA_SDK_ROOT_DIR) + + macro(ocv_cuda_compile VAR) + foreach(var CMAKE_CXX_FLAGS CMAKE_CXX_FLAGS_RELEASE CMAKE_CXX_FLAGS_DEBUG) + set(${var}_backup_in_cuda_compile_ "${${var}}") + + # we remove /EHa as it generates warnings under windows + string(REPLACE "/EHa" "" ${var} "${${var}}") + + # we remove -ggdb3 flag as it leads to preprocessor errors when compiling CUDA files (CUDA 4.1) + string(REPLACE "-ggdb3" "" ${var} "${${var}}") + + # we remove -Wsign-promo as it generates warnings under linux + string(REPLACE "-Wsign-promo" "" ${var} "${${var}}") + + # we remove -Wno-sign-promo as it generates warnings under linux + string(REPLACE "-Wno-sign-promo" "" ${var} "${${var}}") + + # we remove -Wno-delete-non-virtual-dtor because it's used for C++ compiler + # but NVCC uses C compiler by default + string(REPLACE "-Wno-delete-non-virtual-dtor" "" ${var} "${${var}}") + + # we remove -frtti because it's used for C++ compiler + # but NVCC uses C compiler by default + string(REPLACE "-frtti" "" ${var} "${${var}}") + + string(REPLACE "-fvisibility-inlines-hidden" "" ${var} "${${var}}") + endforeach() + + if(BUILD_SHARED_LIBS) + set(CUDA_NVCC_FLAGS ${CUDA_NVCC_FLAGS} -Xcompiler -DCVAPI_EXPORTS) + endif() + + if(UNIX OR APPLE) + set(CUDA_NVCC_FLAGS ${CUDA_NVCC_FLAGS} -Xcompiler -fPIC) + endif() + if(APPLE) + set(CUDA_NVCC_FLAGS ${CUDA_NVCC_FLAGS} -Xcompiler -fno-finite-math-only) + endif() + + # disabled because of multiple warnings during building nvcc auto generated files + if(CMAKE_COMPILER_IS_GNUCXX AND CMAKE_GCC_REGEX_VERSION VERSION_GREATER "4.6.0") + ocv_warnings_disable(CMAKE_CXX_FLAGS -Wunused-but-set-variable) + endif() + + CUDA_COMPILE(${VAR} ${ARGN}) + + foreach(var CMAKE_CXX_FLAGS CMAKE_CXX_FLAGS_RELEASE CMAKE_CXX_FLAGS_DEBUG) + set(${var} "${${var}_backup_in_cuda_compile_}") + unset(${var}_backup_in_cuda_compile_) + endforeach() + endmacro() +else() + unset(CUDA_ARCH_BIN CACHE) + unset(CUDA_ARCH_PTX CACHE) +endif() + +if(HAVE_CUDA) + set(CUDA_LIBS_PATH "") + foreach(p ${CUDA_LIBRARIES} ${CUDA_npp_LIBRARY}) + get_filename_component(_tmp ${p} PATH) + list(APPEND CUDA_LIBS_PATH ${_tmp}) + endforeach() + + if(HAVE_CUBLAS) + foreach(p ${CUDA_cublas_LIBRARY}) + get_filename_component(_tmp ${p} PATH) + list(APPEND CUDA_LIBS_PATH ${_tmp}) + endforeach() + endif() + + if(HAVE_CUFFT) + foreach(p ${CUDA_cufft_LIBRARY}) + get_filename_component(_tmp ${p} PATH) + list(APPEND CUDA_LIBS_PATH ${_tmp}) + endforeach() + endif() + + list(REMOVE_DUPLICATES CUDA_LIBS_PATH) + link_directories(${CUDA_LIBS_PATH}) + + set(CUDA_LIBRARIES_ABS ${CUDA_LIBRARIES}) + ocv_convert_to_lib_name(CUDA_LIBRARIES ${CUDA_LIBRARIES}) + set(CUDA_npp_LIBRARY_ABS ${CUDA_npp_LIBRARY}) + ocv_convert_to_lib_name(CUDA_npp_LIBRARY ${CUDA_npp_LIBRARY}) + if(HAVE_CUBLAS) + set(CUDA_cublas_LIBRARY_ABS ${CUDA_cublas_LIBRARY}) + ocv_convert_to_lib_name(CUDA_cublas_LIBRARY ${CUDA_cublas_LIBRARY}) + endif() + + if(HAVE_CUFFT) + set(CUDA_cufft_LIBRARY_ABS ${CUDA_cufft_LIBRARY}) + ocv_convert_to_lib_name(CUDA_cufft_LIBRARY ${CUDA_cufft_LIBRARY}) + endif() +endif() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVDetectCXXCompiler.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVDetectCXXCompiler.cmake new file mode 100644 index 000000000..49413467d --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVDetectCXXCompiler.cmake @@ -0,0 +1,157 @@ +# ---------------------------------------------------------------------------- +# Detect Microsoft compiler: +# ---------------------------------------------------------------------------- +if(CMAKE_CL_64) + set(MSVC64 1) +endif() + +if(CMAKE_CXX_COMPILER_ID STREQUAL "Clang") + set(CMAKE_COMPILER_IS_GNUCXX 1) + set(CMAKE_COMPILER_IS_CLANGCXX 1) +endif() +if(CMAKE_C_COMPILER_ID STREQUAL "Clang") + set(CMAKE_COMPILER_IS_GNUCC 1) + set(CMAKE_COMPILER_IS_CLANGCC 1) +endif() + +if((CMAKE_COMPILER_IS_CLANGCXX OR CMAKE_COMPILER_IS_CLANGCC) AND NOT CMAKE_GENERATOR MATCHES "Xcode") + set(ENABLE_PRECOMPILED_HEADERS OFF CACHE BOOL "" FORCE) +endif() + +# ---------------------------------------------------------------------------- +# Detect Intel ICC compiler -- for -fPIC in 3rdparty ( UNIX ONLY ): +# see include/opencv/cxtypes.h file for related ICC & CV_ICC defines. +# NOTE: The system needs to determine if the '-fPIC' option needs to be added +# for the 3rdparty static libs being compiled. The CMakeLists.txt files +# in 3rdparty use the CV_ICC definition being set here to determine if +# the -fPIC flag should be used. +# ---------------------------------------------------------------------------- +if(UNIX) + if (__ICL) + set(CV_ICC __ICL) + elseif(__ICC) + set(CV_ICC __ICC) + elseif(__ECL) + set(CV_ICC __ECL) + elseif(__ECC) + set(CV_ICC __ECC) + elseif(__INTEL_COMPILER) + set(CV_ICC __INTEL_COMPILER) + elseif(CMAKE_C_COMPILER MATCHES "icc") + set(CV_ICC icc_matches_c_compiler) + endif() +endif() + +if(MSVC AND CMAKE_C_COMPILER MATCHES "icc") + set(CV_ICC __INTEL_COMPILER_FOR_WINDOWS) +endif() + +# ---------------------------------------------------------------------------- +# Detect GNU version: +# ---------------------------------------------------------------------------- +if(CMAKE_COMPILER_IS_CLANGCXX) + set(CMAKE_GCC_REGEX_VERSION "4.2.1") + set(CMAKE_OPENCV_GCC_VERSION_MAJOR 4) + set(CMAKE_OPENCV_GCC_VERSION_MINOR 2) + set(CMAKE_OPENCV_GCC_VERSION 42) + set(CMAKE_OPENCV_GCC_VERSION_NUM 402) + + execute_process(COMMAND ${CMAKE_CXX_COMPILER} ${CMAKE_CXX_COMPILER_ARG1} -v + ERROR_VARIABLE CMAKE_OPENCV_CLANG_VERSION_FULL + ERROR_STRIP_TRAILING_WHITESPACE) + + string(REGEX MATCH "version.*$" CMAKE_OPENCV_CLANG_VERSION_FULL "${CMAKE_OPENCV_CLANG_VERSION_FULL}") + string(REGEX MATCH "[0-9]+\\.[0-9]+" CMAKE_CLANG_REGEX_VERSION "${CMAKE_OPENCV_CLANG_VERSION_FULL}") + +elseif(CMAKE_COMPILER_IS_GNUCXX) + execute_process(COMMAND ${CMAKE_CXX_COMPILER} ${CMAKE_CXX_COMPILER_ARG1} -dumpversion + OUTPUT_VARIABLE CMAKE_OPENCV_GCC_VERSION_FULL + OUTPUT_STRIP_TRAILING_WHITESPACE) + + execute_process(COMMAND ${CMAKE_CXX_COMPILER} ${CMAKE_CXX_COMPILER_ARG1} -v + ERROR_VARIABLE CMAKE_OPENCV_GCC_INFO_FULL + OUTPUT_STRIP_TRAILING_WHITESPACE) + + # Typical output in CMAKE_OPENCV_GCC_VERSION_FULL: "c+//0 (whatever) 4.2.3 (...)" + # Look for the version number + string(REGEX MATCH "[0-9]+\\.[0-9]+\\.[0-9]+" CMAKE_GCC_REGEX_VERSION "${CMAKE_OPENCV_GCC_VERSION_FULL}") + if(NOT CMAKE_GCC_REGEX_VERSION) + string(REGEX MATCH "[0-9]+\\.[0-9]+" CMAKE_GCC_REGEX_VERSION "${CMAKE_OPENCV_GCC_VERSION_FULL}") + endif() + + # Split the three parts: + string(REGEX MATCHALL "[0-9]+" CMAKE_OPENCV_GCC_VERSIONS "${CMAKE_GCC_REGEX_VERSION}") + + list(GET CMAKE_OPENCV_GCC_VERSIONS 0 CMAKE_OPENCV_GCC_VERSION_MAJOR) + list(GET CMAKE_OPENCV_GCC_VERSIONS 1 CMAKE_OPENCV_GCC_VERSION_MINOR) + + set(CMAKE_OPENCV_GCC_VERSION ${CMAKE_OPENCV_GCC_VERSION_MAJOR}${CMAKE_OPENCV_GCC_VERSION_MINOR}) + math(EXPR CMAKE_OPENCV_GCC_VERSION_NUM "${CMAKE_OPENCV_GCC_VERSION_MAJOR}*100 + ${CMAKE_OPENCV_GCC_VERSION_MINOR}") + message(STATUS "Detected version of GNU GCC: ${CMAKE_OPENCV_GCC_VERSION} (${CMAKE_OPENCV_GCC_VERSION_NUM})") + + if(WIN32) + execute_process(COMMAND ${CMAKE_CXX_COMPILER} -dumpmachine + OUTPUT_VARIABLE OPENCV_GCC_TARGET_MACHINE + OUTPUT_STRIP_TRAILING_WHITESPACE) + if(OPENCV_GCC_TARGET_MACHINE MATCHES "amd64|x86_64|AMD64") + set(MINGW64 1) + endif() + endif() +endif() + +if(MSVC64 OR MINGW64) + set(X86_64 1) +elseif(MINGW OR (MSVC AND NOT CMAKE_CROSSCOMPILING)) + set(X86 1) +elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "amd64.*|x86_64.*|AMD64.*") + set(X86_64 1) +elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "i686.*|i386.*|x86.*|amd64.*|AMD64.*") + set(X86 1) +elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "^(arm.*|ARM.*)") + set(ARM 1) +elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "^(aarch64.*|AARCH64.*)") + set(AARCH64 1) +endif() + + +# Similar code exists in OpenCVConfig.cmake +if(NOT DEFINED OpenCV_STATIC) + # look for global setting + if(NOT DEFINED BUILD_SHARED_LIBS OR BUILD_SHARED_LIBS) + set(OpenCV_STATIC OFF) + else() + set(OpenCV_STATIC ON) + endif() +endif() + +if(MSVC) + if(CMAKE_CL_64) + set(OpenCV_ARCH x64) + elseif((CMAKE_GENERATOR MATCHES "ARM") OR ("${arch_hint}" STREQUAL "ARM") OR (CMAKE_VS_EFFECTIVE_PLATFORMS MATCHES "ARM|arm")) + # see Modules/CmakeGenericSystem.cmake + set(OpenCV_ARCH ARM) + else() + set(OpenCV_ARCH x86) + endif() + if(MSVC_VERSION EQUAL 1400) + set(OpenCV_RUNTIME vc8) + elseif(MSVC_VERSION EQUAL 1500) + set(OpenCV_RUNTIME vc9) + elseif(MSVC_VERSION EQUAL 1600) + set(OpenCV_RUNTIME vc10) + elseif(MSVC_VERSION EQUAL 1700) + set(OpenCV_RUNTIME vc11) + elseif(MSVC_VERSION EQUAL 1800) + set(OpenCV_RUNTIME vc12) + elseif(MSVC_VERSION EQUAL 1900) + set(OpenCV_RUNTIME vc14) + endif() +elseif(MINGW) + set(OpenCV_RUNTIME mingw) + + if(MINGW64) + set(OpenCV_ARCH x64) + else() + set(OpenCV_ARCH x86) + endif() +endif() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVDetectDirectX.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVDetectDirectX.cmake new file mode 100644 index 000000000..913698620 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVDetectDirectX.cmake @@ -0,0 +1,14 @@ +if(WIN32) + try_compile(__VALID_DIRECTX + "${OpenCV_BINARY_DIR}" + "${OpenCV_SOURCE_DIR}/cmake/checks/directx.cpp" + OUTPUT_VARIABLE TRY_OUT + ) + if(NOT __VALID_DIRECTX) + return() + endif() + set(HAVE_DIRECTX ON) + set(HAVE_D3D11 ON) + set(HAVE_D3D10 ON) + set(HAVE_D3D9 ON) +endif() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVDetectOpenCL.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVDetectOpenCL.cmake new file mode 100644 index 000000000..67e10ede8 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVDetectOpenCL.cmake @@ -0,0 +1,87 @@ +if(APPLE) + set(OPENCL_FOUND YES) + set(OPENCL_LIBRARY "-framework OpenCL" CACHE STRING "OpenCL library") + set(OPENCL_INCLUDE_DIR "" CACHE STRING "OpenCL include directory") + mark_as_advanced(OPENCL_INCLUDE_DIR OPENCL_LIBRARY) + set(HAVE_OPENCL_STATIC ON) +else(APPLE) + set(OPENCL_FOUND YES) + set(HAVE_OPENCL_STATIC OFF) + set(OPENCL_INCLUDE_DIR "${OpenCV_SOURCE_DIR}/3rdparty/include/opencl/1.2") +endif(APPLE) + +if(WINRT) + set(OPENCL_FOUND NO) + set(HAVE_OPENCL_STATIC OFF) +endif(WINRT) + +if(OPENCL_FOUND) + if(NOT HAVE_OPENCL_STATIC) + try_compile(__VALID_OPENCL + "${OpenCV_BINARY_DIR}" + "${OpenCV_SOURCE_DIR}/cmake/checks/opencl.cpp" + CMAKE_FLAGS "-DINCLUDE_DIRECTORIES:STRING=${OPENCL_INCLUDE_DIR}" + OUTPUT_VARIABLE TRY_OUT + ) + if(NOT TRY_OUT MATCHES "OpenCL is valid") + message(WARNING "Can't use OpenCL") + return() + endif() + endif() + + if(NOT WINRT) + set(HAVE_OPENCL 1) + endif() + + if(WITH_OPENCL_SVM) + set(HAVE_OPENCL_SVM 1) + endif() + + if(HAVE_OPENCL_STATIC) + set(OPENCL_LIBRARIES "${OPENCL_LIBRARY}") + else() + unset(OPENCL_LIBRARIES) + endif() + + set(OPENCL_INCLUDE_DIRS ${OPENCL_INCLUDE_DIR}) + + if(WITH_OPENCLAMDFFT) + find_path(CLAMDFFT_ROOT_DIR + NAMES include/clAmdFft.h + PATHS ENV CLAMDFFT_PATH ENV ProgramFiles + PATH_SUFFIXES clAmdFft AMD/clAmdFft + DOC "AMD FFT root directory" + NO_DEFAULT_PATH) + + find_path(CLAMDFFT_INCLUDE_DIR + NAMES clAmdFft.h + HINTS ${CLAMDFFT_ROOT_DIR} + PATH_SUFFIXES include + DOC "clAmdFft include directory") + + if(CLAMDFFT_INCLUDE_DIR) + set(HAVE_CLAMDFFT 1) + list(APPEND OPENCL_INCLUDE_DIRS "${CLAMDFFT_INCLUDE_DIR}") + endif() + endif() + + if(WITH_OPENCLAMDBLAS) + find_path(CLAMDBLAS_ROOT_DIR + NAMES include/clAmdBlas.h + PATHS ENV CLAMDBLAS_PATH ENV ProgramFiles + PATH_SUFFIXES clAmdBlas AMD/clAmdBlas + DOC "AMD FFT root directory" + NO_DEFAULT_PATH) + + find_path(CLAMDBLAS_INCLUDE_DIR + NAMES clAmdBlas.h + HINTS ${CLAMDBLAS_ROOT_DIR} + PATH_SUFFIXES include + DOC "clAmdFft include directory") + + if(CLAMDBLAS_INCLUDE_DIR) + set(HAVE_CLAMDBLAS 1) + list(APPEND OPENCL_INCLUDE_DIRS "${CLAMDBLAS_INCLUDE_DIR}") + endif() + endif() +endif() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVDetectPython.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVDetectPython.cmake new file mode 100644 index 000000000..f883525c8 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVDetectPython.cmake @@ -0,0 +1,239 @@ +# Find specified Python version +# Arguments: +# preferred_version (value): Version to check for first +# min_version (value): Minimum supported version +# library_env (value): Name of Python library ENV variable to check +# include_dir_env (value): Name of Python include directory ENV variable to check +# found (variable): Set if interpreter found +# executable (variable): Output of executable found +# version_string (variable): Output of found version +# version_major (variable): Output of found major version +# version_minor (variable): Output of found minor version +# libs_found (variable): Set if libs found +# libs_version_string (variable): Output of found libs version +# libraries (variable): Output of found Python libraries +# library (variable): Output of found Python library +# debug_libraries (variable): Output of found Python debug libraries +# debug_library (variable): Output of found Python debug library +# include_path (variable): Output of found Python include path +# include_dir (variable): Output of found Python include dir +# include_dir2 (variable): Output of found Python include dir2 +# packages_path (variable): Output of found Python packages path +# numpy_include_dirs (variable): Output of found Python Numpy include dirs +# numpy_version (variable): Output of found Python Numpy version +function(find_python preferred_version min_version library_env include_dir_env + found executable version_string version_major version_minor + libs_found libs_version_string libraries library debug_libraries + debug_library include_path include_dir include_dir2 packages_path + numpy_include_dirs numpy_version) + + ocv_check_environment_variables(${executable}) + if(${executable}) + set(PYTHON_EXECUTABLE "${${executable}}") + endif() + + if(WIN32 AND NOT ${executable}) + # search for executable with the same bitness as resulting binaries + # standard FindPythonInterp always prefers executable from system path + # this is really important because we are using the interpreter for numpy search and for choosing the install location + foreach(_CURRENT_VERSION ${Python_ADDITIONAL_VERSIONS} "${preferred_version}" "${min_version}") + find_host_program(PYTHON_EXECUTABLE + NAMES python${_CURRENT_VERSION} python + PATHS + [HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Python\\\\PythonCore\\\\${_CURRENT_VERSION}\\\\InstallPath] + [HKEY_CURRENT_USER\\\\SOFTWARE\\\\Python\\\\PythonCore\\\\${_CURRENT_VERSION}\\\\InstallPath] + NO_SYSTEM_ENVIRONMENT_PATH + ) + endforeach() + endif() + + find_host_package(PythonInterp "${preferred_version}") + if(NOT PYTHONINTERP_FOUND) + find_host_package(PythonInterp "${min_version}") + endif() + + if(PYTHONINTERP_FOUND) + # Copy outputs + set(_found ${PYTHONINTERP_FOUND}) + set(_executable ${PYTHON_EXECUTABLE}) + set(_version_string ${PYTHON_VERSION_STRING}) + set(_version_major ${PYTHON_VERSION_MAJOR}) + set(_version_minor ${PYTHON_VERSION_MINOR}) + set(_version_patch ${PYTHON_VERSION_PATCH}) + + # Clear find_host_package side effects + unset(PYTHONINTERP_FOUND) + unset(PYTHON_EXECUTABLE CACHE) + unset(PYTHON_VERSION_STRING) + unset(PYTHON_VERSION_MAJOR) + unset(PYTHON_VERSION_MINOR) + unset(PYTHON_VERSION_PATCH) + endif() + + if(_found) + set(_version_major_minor "${_version_major}.${_version_minor}") + + if(NOT ANDROID AND NOT IOS) + ocv_check_environment_variables(${library_env} ${include_dir_env}) + if(NOT ${${library_env}} EQUAL "") + set(PYTHON_LIBRARY "${${library_env}}") + endif() + if(NOT ${${include_dir_env}} EQUAL "") + set(PYTHON_INCLUDE_DIR "${${include_dir_env}}") + endif() + + # not using _version_string here, because it might not conform to the CMake version format + if(CMAKE_CROSSCOMPILING) + # builder version can differ from target, matching base version (e.g. 2.7) + find_host_package(PythonLibs "${_version_major_minor}") + else() + find_host_package(PythonLibs "${_version_major_minor}.${_version_patch}" EXACT) + endif() + + if(PYTHONLIBS_FOUND) + # Copy outputs + set(_libs_found ${PYTHONLIBS_FOUND}) + set(_libraries ${PYTHON_LIBRARIES}) + set(_include_path ${PYTHON_INCLUDE_PATH}) + set(_include_dirs ${PYTHON_INCLUDE_DIRS}) + set(_debug_libraries ${PYTHON_DEBUG_LIBRARIES}) + set(_libs_version_string ${PYTHONLIBS_VERSION_STRING}) + set(_debug_library ${PYTHON_DEBUG_LIBRARY}) + set(_library ${PYTHON_LIBRARY}) + set(_library_debug ${PYTHON_LIBRARY_DEBUG}) + set(_library_release ${PYTHON_LIBRARY_RELEASE}) + set(_include_dir ${PYTHON_INCLUDE_DIR}) + set(_include_dir2 ${PYTHON_INCLUDE_DIR2}) + + # Clear find_host_package side effects + unset(PYTHONLIBS_FOUND) + unset(PYTHON_LIBRARIES) + unset(PYTHON_INCLUDE_PATH) + unset(PYTHON_INCLUDE_DIRS) + unset(PYTHON_DEBUG_LIBRARIES) + unset(PYTHONLIBS_VERSION_STRING) + unset(PYTHON_DEBUG_LIBRARY CACHE) + unset(PYTHON_LIBRARY) + unset(PYTHON_LIBRARY_DEBUG) + unset(PYTHON_LIBRARY_RELEASE) + unset(PYTHON_LIBRARY CACHE) + unset(PYTHON_LIBRARY_DEBUG CACHE) + unset(PYTHON_LIBRARY_RELEASE CACHE) + unset(PYTHON_INCLUDE_DIR CACHE) + unset(PYTHON_INCLUDE_DIR2 CACHE) + endif() + endif() + + if(NOT ANDROID AND NOT IOS) + if(CMAKE_HOST_UNIX) + execute_process(COMMAND ${_executable} -c "from distutils.sysconfig import *; print(get_python_lib())" + RESULT_VARIABLE _cvpy_process + OUTPUT_VARIABLE _std_packages_path + OUTPUT_STRIP_TRAILING_WHITESPACE) + if("${_std_packages_path}" MATCHES "site-packages") + set(_packages_path "python${_version_major_minor}/site-packages") + else() #debian based assumed, install to the dist-packages. + set(_packages_path "python${_version_major_minor}/dist-packages") + endif() + if(EXISTS "${CMAKE_INSTALL_PREFIX}/lib${LIB_SUFFIX}/${${packages_path}}") + set(_packages_path "lib${LIB_SUFFIX}/${_packages_path}") + else() + set(_packages_path "lib/${_packages_path}") + endif() + elseif(CMAKE_HOST_WIN32) + get_filename_component(_path "${_executable}" PATH) + file(TO_CMAKE_PATH "${_path}" _path) + if(NOT EXISTS "${_path}/Lib/site-packages") + unset(_path) + get_filename_component(_path "[HKEY_LOCAL_MACHINE\\SOFTWARE\\Python\\PythonCore\\${_version_major_minor}\\InstallPath]" ABSOLUTE) + if(NOT _path) + get_filename_component(_path "[HKEY_CURRENT_USER\\SOFTWARE\\Python\\PythonCore\\${_version_major_minor}\\InstallPath]" ABSOLUTE) + endif() + file(TO_CMAKE_PATH "${_path}" _path) + endif() + set(_packages_path "${_path}/Lib/site-packages") + unset(_path) + endif() + + set(_numpy_include_dirs ${${numpy_include_dirs}}) + + if(NOT _numpy_include_dirs) + if(CMAKE_CROSSCOMPILING) + message(STATUS "Cannot probe for Python/Numpy support (because we are cross-compiling OpenCV)") + message(STATUS "If you want to enable Python/Numpy support, set the following variables:") + message(STATUS " PYTHON2_INCLUDE_PATH") + message(STATUS " PYTHON2_LIBRARIES") + message(STATUS " PYTHON2_NUMPY_INCLUDE_DIRS") + message(STATUS " PYTHON3_INCLUDE_PATH") + message(STATUS " PYTHON3_LIBRARIES") + message(STATUS " PYTHON3_NUMPY_INCLUDE_DIRS") + else() + # Attempt to discover the NumPy include directory. If this succeeds, then build python API with NumPy + execute_process(COMMAND "${_executable}" -c "import os; os.environ['DISTUTILS_USE_SDK']='1'; import numpy.distutils; print(os.pathsep.join(numpy.distutils.misc_util.get_numpy_include_dirs()))" + RESULT_VARIABLE _numpy_process + OUTPUT_VARIABLE _numpy_include_dirs + OUTPUT_STRIP_TRAILING_WHITESPACE) + + if(NOT _numpy_process EQUAL 0) + unset(_numpy_include_dirs) + endif() + endif() + endif() + + if(_numpy_include_dirs) + file(TO_CMAKE_PATH "${_numpy_include_dirs}" _numpy_include_dirs) + if(CMAKE_CROSSCOMPILING) + if(NOT _numpy_version) + set(_numpy_version "undefined - cannot be probed because of the cross-compilation") + endif() + else() + execute_process(COMMAND "${_executable}" -c "import numpy; print(numpy.version.version)" + RESULT_VARIABLE _numpy_process + OUTPUT_VARIABLE _numpy_version + OUTPUT_STRIP_TRAILING_WHITESPACE) + endif() + endif() + endif(NOT ANDROID AND NOT IOS) + endif() + + # Export return values + set(${found} "${_found}" PARENT_SCOPE) + set(${executable} "${_executable}" CACHE FILEPATH "Path to Python interpretor") + set(${version_string} "${_version_string}" PARENT_SCOPE) + set(${version_major} "${_version_major}" PARENT_SCOPE) + set(${version_minor} "${_version_minor}" PARENT_SCOPE) + set(${libs_found} "${_libs_found}" PARENT_SCOPE) + set(${libs_version_string} "${_libs_version_string}" PARENT_SCOPE) + set(${libraries} "${_libraries}" PARENT_SCOPE) + set(${library} "${_library}" CACHE FILEPATH "Path to Python library") + set(${debug_libraries} "${_debug_libraries}" PARENT_SCOPE) + set(${debug_library} "${_debug_library}" CACHE FILEPATH "Path to Python debug") + set(${include_path} "${_include_path}" PARENT_SCOPE) + set(${include_dir} "${_include_dir}" CACHE PATH "Python include dir") + set(${include_dir2} "${_include_dir2}" CACHE PATH "Python include dir 2") + set(${packages_path} "${_packages_path}" CACHE PATH "Where to install the python packages.") + set(${numpy_include_dirs} ${_numpy_include_dirs} CACHE PATH "Path to numpy headers") + set(${numpy_version} "${_numpy_version}" PARENT_SCOPE) +endfunction(find_python) + +find_python(2.7 "${MIN_VER_PYTHON2}" PYTHON2_LIBRARY PYTHON2_INCLUDE_DIR + PYTHON2INTERP_FOUND PYTHON2_EXECUTABLE PYTHON2_VERSION_STRING + PYTHON2_VERSION_MAJOR PYTHON2_VERSION_MINOR PYTHON2LIBS_FOUND + PYTHON2LIBS_VERSION_STRING PYTHON2_LIBRARIES PYTHON2_LIBRARY + PYTHON2_DEBUG_LIBRARIES PYTHON2_LIBRARY_DEBUG PYTHON2_INCLUDE_PATH + PYTHON2_INCLUDE_DIR PYTHON2_INCLUDE_DIR2 PYTHON2_PACKAGES_PATH + PYTHON2_NUMPY_INCLUDE_DIRS PYTHON2_NUMPY_VERSION) + +find_python(3.4 "${MIN_VER_PYTHON3}" PYTHON3_LIBRARY PYTHON3_INCLUDE_DIR + PYTHON3INTERP_FOUND PYTHON3_EXECUTABLE PYTHON3_VERSION_STRING + PYTHON3_VERSION_MAJOR PYTHON3_VERSION_MINOR PYTHON3LIBS_FOUND + PYTHON3LIBS_VERSION_STRING PYTHON3_LIBRARIES PYTHON3_LIBRARY + PYTHON3_DEBUG_LIBRARIES PYTHON3_LIBRARY_DEBUG PYTHON3_INCLUDE_PATH + PYTHON3_INCLUDE_DIR PYTHON3_INCLUDE_DIR2 PYTHON3_PACKAGES_PATH + PYTHON3_NUMPY_INCLUDE_DIRS PYTHON3_NUMPY_VERSION) + +# Use Python 2 as default Python interpreter +if(PYTHON2INTERP_FOUND) + set(PYTHON_DEFAULT_AVAILABLE "TRUE") + set(PYTHON_DEFAULT_EXECUTABLE "${PYTHON2_EXECUTABLE}") +endif() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVDetectTBB.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVDetectTBB.cmake new file mode 100644 index 000000000..8ff78bb3d --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVDetectTBB.cmake @@ -0,0 +1,92 @@ +if(BUILD_TBB) + add_subdirectory("${OpenCV_SOURCE_DIR}/3rdparty/tbb") + include_directories(SYSTEM ${TBB_INCLUDE_DIRS}) + set(OPENCV_LINKER_LIBS ${OPENCV_LINKER_LIBS} tbb) + add_definitions(-DTBB_USE_GCC_BUILTINS=1 -D__TBB_GCC_BUILTIN_ATOMICS_PRESENT=1) + if(tbb_need_GENERIC_DWORD_LOAD_STORE) + add_definitions(-D__TBB_USE_GENERIC_DWORD_LOAD_STORE=1) + endif() + set(HAVE_TBB 1) +elseif(UNIX AND NOT APPLE) + PKG_CHECK_MODULES(TBB tbb) + + if(TBB_FOUND) + set(HAVE_TBB 1) + if(NOT ${TBB_INCLUDE_DIRS} STREQUAL "") + ocv_include_directories(${TBB_INCLUDE_DIRS}) + endif() + link_directories(${TBB_LIBRARY_DIRS}) + set(OPENCV_LINKER_LIBS ${OPENCV_LINKER_LIBS} ${TBB_LIBRARIES}) + endif() +endif() + +if(NOT HAVE_TBB) + set(TBB_DEFAULT_INCLUDE_DIRS + "/opt/intel/tbb/include" "/usr/local/include" "/usr/include" + "C:/Program Files/Intel/TBB" "C:/Program Files (x86)/Intel/TBB" + "C:/Program Files (x86)/tbb/include" + "C:/Program Files (x86)/tbb/include" + "${CMAKE_INSTALL_PREFIX}/include") + + find_path(TBB_INCLUDE_DIRS "tbb/tbb.h" PATHS ${TBB_INCLUDE_DIR} ${TBB_DEFAULT_INCLUDE_DIRS} DOC "The path to TBB headers") + if(TBB_INCLUDE_DIRS) + if(UNIX) + set(TBB_LIB_DIR "${TBB_INCLUDE_DIRS}/../lib" CACHE PATH "Full path of TBB library directory") + link_directories("${TBB_LIB_DIR}") + endif() + if(APPLE) + set(OPENCV_LINKER_LIBS ${OPENCV_LINKER_LIBS} libtbb.dylib) + elseif(ANDROID) + set(OPENCV_LINKER_LIBS ${OPENCV_LINKER_LIBS} tbb) + add_definitions(-DTBB_USE_GCC_BUILTINS) + elseif (UNIX) + set(OPENCV_LINKER_LIBS ${OPENCV_LINKER_LIBS} tbb) + elseif (WIN32) + if(CMAKE_COMPILER_IS_GNUCXX) + set(TBB_LIB_DIR "${TBB_INCLUDE_DIRS}/../lib" CACHE PATH "Full path of TBB library directory") + link_directories("${TBB_LIB_DIR}") + set(OPENCV_LINKER_LIBS ${OPENCV_LINKER_LIBS} tbb) + else() + get_filename_component(_TBB_LIB_PATH "${TBB_INCLUDE_DIRS}/../lib" ABSOLUTE) + + if(CMAKE_SYSTEM_PROCESSOR MATCHES amd64*|x86_64* OR MSVC64) + set(_TBB_LIB_PATH "${_TBB_LIB_PATH}/intel64") + else() + set(_TBB_LIB_PATH "${_TBB_LIB_PATH}/ia32") + endif() + + if(MSVC80) + set(_TBB_LIB_PATH "${_TBB_LIB_PATH}/vc8") + elseif(MSVC90) + set(_TBB_LIB_PATH "${_TBB_LIB_PATH}/vc9") + elseif(MSVC10) + set(_TBB_LIB_PATH "${_TBB_LIB_PATH}/vc10") + elseif(MSVC11) + set(_TBB_LIB_PATH "${_TBB_LIB_PATH}/vc11") + elseif(MSVC12) + set(_TBB_LIB_PATH "${_TBB_LIB_PATH}/vc12") + endif() + set(TBB_LIB_DIR "${_TBB_LIB_PATH}" CACHE PATH "Full path of TBB library directory") + link_directories("${TBB_LIB_DIR}") + endif() + endif() + + set(HAVE_TBB 1) + if(NOT "${TBB_INCLUDE_DIRS}" STREQUAL "") + ocv_include_directories("${TBB_INCLUDE_DIRS}") + endif() + endif(TBB_INCLUDE_DIRS) +endif(NOT HAVE_TBB) + +# get TBB version +if(HAVE_TBB) + find_file(TBB_STDDEF_PATH tbb/tbb_stddef.h "${TBB_INCLUDE_DIRS}") + mark_as_advanced(TBB _STDDEF_PATH) +endif() +if(HAVE_TBB AND TBB_STDDEF_PATH) + ocv_parse_header("${TBB_STDDEF_PATH}" TBB_VERSION_LINES TBB_VERSION_MAJOR TBB_VERSION_MINOR TBB_INTERFACE_VERSION) +else() + unset(TBB_VERSION_MAJOR) + unset(TBB_VERSION_MINOR) + unset(TBB_INTERFACE_VERSION) +endif() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVDetectVTK.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVDetectVTK.cmake new file mode 100644 index 000000000..2b55a9c3f --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVDetectVTK.cmake @@ -0,0 +1,53 @@ +if(NOT WITH_VTK OR ANDROID OR IOS) + return() +endif() + +# VTK 6.x components +find_package(VTK QUIET COMPONENTS vtkRenderingOpenGL vtkInteractionStyle vtkRenderingLOD vtkIOPLY vtkFiltersTexture vtkRenderingFreeType vtkIOExport NO_MODULE) + +# VTK 5.x components +if(NOT VTK_FOUND) + find_package(VTK QUIET COMPONENTS vtkCommon NO_MODULE) +endif() + +if(NOT VTK_FOUND) + set(HAVE_VTK OFF) + message(STATUS "VTK is not found. Please set -DVTK_DIR in CMake to VTK build directory, or to VTK install subdirectory with VTKConfig.cmake file") + return() +endif() + +# Don't support ealier VTKs +if(${VTK_VERSION} VERSION_LESS "5.8.0") + message(STATUS "VTK support is disabled. VTK ver. 5.8.0 is minimum required, but found VTK ver. ${VTK_VERSION}") + return() +endif() + +# Different Qt versions can't be linked together +if(HAVE_QT5 AND ${VTK_VERSION} VERSION_LESS "6.0.0") + if(VTK_USE_QT) + message(STATUS "VTK support is disabled. Incompatible combination: OpenCV + Qt5 and VTK ver.${VTK_VERSION} + Qt4") + endif() +endif() + +# Different Qt versions can't be linked together. VTK 6.0.0 doesn't provide a way to get Qt version it was linked with +if(HAVE_QT5 AND ${VTK_VERSION} VERSION_EQUAL "6.0.0" AND NOT DEFINED FORCE_VTK) + message(STATUS "VTK support is disabled. Possible incompatible combination: OpenCV+Qt5, and VTK ver.${VTK_VERSION} with Qt4") + message(STATUS "If it is known that VTK was compiled without Qt4, please define '-DFORCE_VTK=TRUE' flag in CMake") + return() +endif() + +# Different Qt versions can't be linked together +if(HAVE_QT AND ${VTK_VERSION} VERSION_GREATER "6.0.0" AND NOT ${VTK_QT_VERSION} STREQUAL "") + if(HAVE_QT5 AND ${VTK_QT_VERSION} EQUAL "4") + message(STATUS "VTK support is disabled. Incompatible combination: OpenCV + Qt5 and VTK ver.${VTK_VERSION} + Qt4") + return() + endif() + + if(NOT HAVE_QT5 AND ${VTK_QT_VERSION} EQUAL "5") + message(STATUS "VTK support is disabled. Incompatible combination: OpenCV + Qt4 and VTK ver.${VTK_VERSION} + Qt5") + return() + endif() +endif() + +set(HAVE_VTK ON) +message(STATUS "Found VTK ver. ${VTK_VERSION} (usefile: ${VTK_USE_FILE})") diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVExtraTargets.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVExtraTargets.cmake new file mode 100644 index 000000000..ecb2a3b36 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVExtraTargets.cmake @@ -0,0 +1,38 @@ +# ---------------------------------------------------------------------------- +# Uninstall target, for "make uninstall" +# ---------------------------------------------------------------------------- +CONFIGURE_FILE( + "${OpenCV_SOURCE_DIR}/cmake/templates/cmake_uninstall.cmake.in" + "${CMAKE_CURRENT_BINARY_DIR}/cmake_uninstall.cmake" + @ONLY) + +ADD_CUSTOM_TARGET(uninstall "${CMAKE_COMMAND}" -P "${CMAKE_CURRENT_BINARY_DIR}/cmake_uninstall.cmake") +if(ENABLE_SOLUTION_FOLDERS) + set_target_properties(uninstall PROPERTIES FOLDER "CMakeTargets") +endif() + + +# ---------------------------------------------------------------------------- +# target building all OpenCV modules +# ---------------------------------------------------------------------------- +add_custom_target(opencv_modules) +if(ENABLE_SOLUTION_FOLDERS) + set_target_properties(opencv_modules PROPERTIES FOLDER "extra") +endif() + + +# ---------------------------------------------------------------------------- +# targets building all tests +# ---------------------------------------------------------------------------- +if(BUILD_TESTS) + add_custom_target(opencv_tests) + if(ENABLE_SOLUTION_FOLDERS) + set_target_properties(opencv_tests PROPERTIES FOLDER "extra") + endif() +endif() +if(BUILD_PERF_TESTS) + add_custom_target(opencv_perf_tests) + if(ENABLE_SOLUTION_FOLDERS) + set_target_properties(opencv_perf_tests PROPERTIES FOLDER "extra") + endif() +endif() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindIPP.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindIPP.cmake new file mode 100644 index 000000000..71001d9c6 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindIPP.cmake @@ -0,0 +1,266 @@ +# +# The script to detect Intel(R) Integrated Performance Primitives (IPP) +# installation/package +# +# By default, ICV version will be used. +# To use standalone IPP update cmake command line: +# cmake ... -DIPPROOT= ... +# +# Note: Backward compatibility is broken, IPPROOT environment path is ignored +# +# +# On return this will define: +# +# HAVE_IPP - True if Intel IPP found +# HAVE_IPP_ICV_ONLY - True if Intel IPP ICV version is available +# IPP_ROOT_DIR - root of IPP installation +# IPP_INCLUDE_DIRS - IPP include folder +# IPP_LIBRARIES - IPP libraries that are used by OpenCV +# IPP_VERSION_STR - string with the newest detected IPP version +# IPP_VERSION_MAJOR - numbers of IPP version (MAJOR.MINOR.BUILD) +# IPP_VERSION_MINOR +# IPP_VERSION_BUILD +# +# Created: 30 Dec 2010 by Vladimir Dudnik (vladimir.dudnik@intel.com) +# + +unset(HAVE_IPP CACHE) +unset(HAVE_IPP_ICV_ONLY) +unset(IPP_ROOT_DIR) +unset(IPP_INCLUDE_DIRS) +unset(IPP_LIBRARIES) +unset(IPP_VERSION_STR) +unset(IPP_VERSION_MAJOR) +unset(IPP_VERSION_MINOR) +unset(IPP_VERSION_BUILD) + +if (X86 AND UNIX AND NOT APPLE AND NOT ANDROID AND BUILD_SHARED_LIBS) + message(STATUS "On 32-bit Linux IPP can not currently be used with dynamic libs because of linker errors. Set BUILD_SHARED_LIBS=OFF") + return() +endif() + +set(IPP_X64 0) +if(CMAKE_CXX_SIZEOF_DATA_PTR EQUAL 8) + set(IPP_X64 1) +endif() +if(CMAKE_CL_64) + set(IPP_X64 1) +endif() + +# This function detects IPP version by analyzing .h file +macro(ipp_get_version VERSION_FILE) + unset(_VERSION_STR) + unset(_MAJOR) + unset(_MINOR) + unset(_BUILD) + + # read IPP version info from file + file(STRINGS ${VERSION_FILE} STR1 REGEX "IPP_VERSION_MAJOR") + file(STRINGS ${VERSION_FILE} STR2 REGEX "IPP_VERSION_MINOR") + file(STRINGS ${VERSION_FILE} STR3 REGEX "IPP_VERSION_BUILD") + if("${STR3}" STREQUAL "") + file(STRINGS ${VERSION_FILE} STR3 REGEX "IPP_VERSION_UPDATE") + endif() + file(STRINGS ${VERSION_FILE} STR4 REGEX "IPP_VERSION_STR") + + # extract info and assign to variables + string(REGEX MATCHALL "[0-9]+" _MAJOR ${STR1}) + string(REGEX MATCHALL "[0-9]+" _MINOR ${STR2}) + string(REGEX MATCHALL "[0-9]+" _BUILD ${STR3}) + string(REGEX MATCHALL "[0-9]+[.]+[0-9]+[^\"]+|[0-9]+[.]+[0-9]+" _VERSION_STR ${STR4}) + + # export info to parent scope + set(IPP_VERSION_STR ${_VERSION_STR}) + set(IPP_VERSION_MAJOR ${_MAJOR}) + set(IPP_VERSION_MINOR ${_MINOR}) + set(IPP_VERSION_BUILD ${_BUILD}) +endmacro() + +macro(_ipp_not_supported) + message(STATUS ${ARGN}) + unset(HAVE_IPP) + unset(HAVE_IPP_ICV_ONLY) + unset(IPP_VERSION_STR) + return() +endmacro() + +# This macro uses IPP_ROOT_DIR variable +# TODO Cleanup code after ICV package stabilization +macro(ipp_detect_version) + set(IPP_INCLUDE_DIRS ${IPP_ROOT_DIR}/include) + + set(__msg) + if(EXISTS ${IPP_ROOT_DIR}/include/ippicv_redefs.h) + set(__msg " (ICV version)") + set(HAVE_IPP_ICV_ONLY 1) + elseif(EXISTS ${IPP_ROOT_DIR}/include/ipp.h) + # nothing + else() + _ipp_not_supported("Can't resolve IPP directory: ${IPP_ROOT_DIR}") + endif() + + ipp_get_version(${IPP_INCLUDE_DIRS}/ippversion.h) + ocv_assert(IPP_VERSION_STR VERSION_GREATER "1.0") + + message(STATUS "found IPP${__msg}: ${_MAJOR}.${_MINOR}.${_BUILD} [${IPP_VERSION_STR}]") + message(STATUS "at: ${IPP_ROOT_DIR}") + + if(${IPP_VERSION_STR} VERSION_LESS "7.0") + _ipp_not_supported("IPP ${IPP_VERSION_STR} is not supported") + endif() + + set(HAVE_IPP 1) + + macro(_ipp_set_library_dir DIR) + if(NOT EXISTS ${DIR}) + _ipp_not_supported("IPP library directory not found") + endif() + set(IPP_LIBRARY_DIR ${DIR}) + endmacro() + + if(APPLE) + _ipp_set_library_dir(${IPP_ROOT_DIR}/lib) + elseif(IPP_X64) + _ipp_set_library_dir(${IPP_ROOT_DIR}/lib/intel64) + else() + _ipp_set_library_dir(${IPP_ROOT_DIR}/lib/ia32) + endif() + + macro(_ipp_add_library name) + # dynamic linking is only supported for standalone version of IPP + if (BUILD_WITH_DYNAMIC_IPP AND NOT HAVE_IPP_ICV_ONLY) + set(IPP_LIB_PREFIX ${CMAKE_SHARED_LIBRARY_PREFIX}) + set(IPP_LIB_SUFFIX ${CMAKE_SHARED_LIBRARY_SUFFIX}) + else () + set(IPP_LIB_PREFIX ${CMAKE_STATIC_LIBRARY_PREFIX}) + set(IPP_LIB_SUFFIX ${CMAKE_STATIC_LIBRARY_SUFFIX}) + endif () + if (EXISTS ${IPP_LIBRARY_DIR}/${IPP_LIB_PREFIX}${IPP_PREFIX}${name}${IPP_SUFFIX}${IPP_LIB_SUFFIX}) + if (BUILD_WITH_DYNAMIC_IPP AND NOT HAVE_IPP_ICV_ONLY) + # When using dynamic libraries from standalone IPP it is your responsibility to install those on the target system + list(APPEND IPP_LIBRARIES ${IPP_LIBRARY_DIR}/${IPP_LIB_PREFIX}${IPP_PREFIX}${name}${IPP_SUFFIX}${IPP_LIB_SUFFIX}) + else () + add_library(ipp${name} STATIC IMPORTED) + set_target_properties(ipp${name} PROPERTIES + IMPORTED_LINK_INTERFACE_LIBRARIES "" + IMPORTED_LOCATION ${IPP_LIBRARY_DIR}/${IPP_LIB_PREFIX}${IPP_PREFIX}${name}${IPP_SUFFIX}${IPP_LIB_SUFFIX} + ) + list(APPEND IPP_LIBRARIES ipp${name}) + # CMake doesn't support "install(TARGETS ${IPP_PREFIX}${name} " command with imported targets + install(FILES ${IPP_LIBRARY_DIR}/${IPP_LIB_PREFIX}${IPP_PREFIX}${name}${IPP_SUFFIX}${IPP_LIB_SUFFIX} + DESTINATION ${OPENCV_3P_LIB_INSTALL_PATH} COMPONENT dev) + string(TOUPPER ${name} uname) + set(IPP${uname}_INSTALL_PATH "${CMAKE_INSTALL_PREFIX}/${OPENCV_3P_LIB_INSTALL_PATH}/${IPP_LIB_PREFIX}${IPP_PREFIX}${name}${IPP_SUFFIX}${IPP_LIB_SUFFIX}" CACHE INTERNAL "" FORCE) + set(IPP${uname}_LOCATION_PATH "${IPP_LIBRARY_DIR}/${IPP_LIB_PREFIX}${IPP_PREFIX}${name}${IPP_SUFFIX}${IPP_LIB_SUFFIX}" CACHE INTERNAL "" FORCE) + endif() + else() + message(STATUS "Can't find IPP library: ${name} at ${IPP_LIBRARY_DIR}/${IPP_LIB_PREFIX}${IPP_PREFIX}${name}${IPP_SUFFIX}${IPP_LIB_SUFFIX}") + endif() + endmacro() + + set(IPP_PREFIX "ipp") + if(${IPP_VERSION_STR} VERSION_LESS "8.0") + if (BUILD_WITH_DYNAMIC_IPP AND NOT HAVE_IPP_ICV_ONLY) + set(IPP_SUFFIX "") # dynamic not threaded libs suffix IPP 7.x + else () + set(IPP_SUFFIX "_l") # static not threaded libs suffix IPP 7.x + endif () + else () + if(WIN32) + if (BUILD_WITH_DYNAMIC_IPP AND NOT HAVE_IPP_ICV_ONLY) + set(IPP_SUFFIX "") # dynamic not threaded libs suffix IPP 8.x for Windows + else () + set(IPP_SUFFIX "mt") # static not threaded libs suffix IPP 8.x for Windows + endif () + else() + set(IPP_SUFFIX "") # static not threaded libs suffix IPP 8.x for Linux/OS X + endif() + endif() + + if(HAVE_IPP_ICV_ONLY) + _ipp_add_library(icv) + else() + _ipp_add_library(core) + _ipp_add_library(s) + _ipp_add_library(i) + _ipp_add_library(cc) + _ipp_add_library(cv) + _ipp_add_library(vm) + _ipp_add_library(m) + + if(UNIX) + get_filename_component(INTEL_COMPILER_LIBRARY_DIR ${IPP_ROOT_DIR}/../lib REALPATH) + if(NOT EXISTS ${INTEL_COMPILER_LIBRARY_DIR}) + get_filename_component(INTEL_COMPILER_LIBRARY_DIR ${IPP_ROOT_DIR}/../compiler/lib REALPATH) + endif() + if(NOT EXISTS ${INTEL_COMPILER_LIBRARY_DIR}) + _ipp_not_supported("IPP configuration error: can't find Intel compiler library dir ${INTEL_COMPILER_LIBRARY_DIR}") + endif() + if(NOT APPLE) + if(IPP_X64) + if(NOT EXISTS ${INTEL_COMPILER_LIBRARY_DIR}/intel64) + message(SEND_ERROR "Intel compiler EM64T libraries not found") + endif() + set(INTEL_COMPILER_LIBRARY_DIR ${INTEL_COMPILER_LIBRARY_DIR}/intel64) + else() + if(NOT EXISTS ${INTEL_COMPILER_LIBRARY_DIR}/ia32) + message(SEND_ERROR "Intel compiler IA32 libraries not found") + endif() + set(INTEL_COMPILER_LIBRARY_DIR ${INTEL_COMPILER_LIBRARY_DIR}/ia32) + endif() + endif() + + macro(_ipp_add_compiler_library name) + if (EXISTS ${INTEL_COMPILER_LIBRARY_DIR}/${IPP_LIB_PREFIX}${name}${CMAKE_SHARED_LIBRARY_SUFFIX}) + list(APPEND IPP_LIBRARIES ${INTEL_COMPILER_LIBRARY_DIR}/${IPP_LIB_PREFIX}${name}${CMAKE_SHARED_LIBRARY_SUFFIX}) + else() + message(STATUS "Can't find compiler library: ${name} at ${INTEL_COMPILER_LIBRARY_DIR}/${IPP_LIB_PREFIX}${name}${CMAKE_SHARED_LIBRARY_SUFFIX}") + endif() + endmacro() + + _ipp_add_compiler_library(irc) + _ipp_add_compiler_library(imf) + _ipp_add_compiler_library(svml) + endif(UNIX) + endif() + + #message(STATUS "IPP libs: ${IPP_LIBRARIES}") +endmacro() + +# OPENCV_IPP_PATH is an environment variable for internal usage only, do not use it +if(DEFINED ENV{OPENCV_IPP_PATH} AND NOT DEFINED IPPROOT) + set(IPPROOT "$ENV{OPENCV_IPP_PATH}") +endif() +if(NOT DEFINED IPPROOT) + include("${OpenCV_SOURCE_DIR}/3rdparty/ippicv/downloader.cmake") + if(DEFINED OPENCV_ICV_PATH) + set(IPPROOT "${OPENCV_ICV_PATH}") + else() + return() + endif() +endif() + +file(TO_CMAKE_PATH "${IPPROOT}" __IPPROOT) +if(EXISTS "${__IPPROOT}/include/ippversion.h") + set(IPP_ROOT_DIR ${__IPPROOT}) + ipp_detect_version() +endif() + + +if(WIN32 AND MINGW AND NOT IPP_VERSION_MAJOR LESS 7) + # Since IPP built with Microsoft compiler and /GS option + # ====================================================== + # From Windows SDK 7.1 + # (usually in "C:\Program Files\Microsoft Visual Studio 10.0\VC\lib"), + # to avoid undefined reference to __security_cookie and _chkstk: + set(MSV_RUNTMCHK "RunTmChk") + set(IPP_LIBRARIES ${IPP_LIBRARIES} ${MSV_RUNTMCHK}${IPP_LIB_SUFFIX}) + + # To avoid undefined reference to _alldiv and _chkstk + # =================================================== + # NB: it may require a recompilation of w32api (after having modified + # the file ntdll.def) to export the required functions + # See http://code.opencv.org/issues/1906 for additional details + set(MSV_NTDLL "ntdll") + set(IPP_LIBRARIES ${IPP_LIBRARIES} ${MSV_NTDLL}${IPP_LIB_SUFFIX}) +endif() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindIPPAsync.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindIPPAsync.cmake new file mode 100644 index 000000000..6f4765cbc --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindIPPAsync.cmake @@ -0,0 +1,45 @@ +# Main variables: +# IPP_A_LIBRARIES and IPP_A_INCLUDE to use IPP Async +# HAVE_IPP_A for conditional compilation OpenCV with/without IPP Async + +# IPP_ASYNC_ROOT - root of IPP Async installation + +if(X86_64) + find_path( + IPP_A_INCLUDE_DIR + NAMES ipp_async_defs.h + PATHS $ENV{IPP_ASYNC_ROOT} + PATH_SUFFIXES include + DOC "Path to Intel IPP Async interface headers") + + find_file( + IPP_A_LIBRARIES + NAMES ipp_async_preview.lib + PATHS $ENV{IPP_ASYNC_ROOT} + PATH_SUFFIXES lib/intel64 + DOC "Path to Intel IPP Async interface libraries") + +else() + find_path( + IPP_A_INCLUDE_DIR + NAMES ipp_async_defs.h + PATHS $ENV{IPP_ASYNC_ROOT} + PATH_SUFFIXES include + DOC "Path to Intel IPP Async interface headers") + + find_file( + IPP_A_LIBRARIES + NAMES ipp_async_preview.lib + PATHS $ENV{IPP_ASYNC_ROOT} + PATH_SUFFIXES lib/ia32 + DOC "Path to Intel IPP Async interface libraries") +endif() + +if(IPP_A_INCLUDE_DIR AND IPP_A_LIBRARIES) + set(HAVE_IPP_A TRUE) +else() + set(HAVE_IPP_A FALSE) + message(WARNING "Intel IPP Async library directory (set by IPP_A_LIBRARIES_DIR variable) is not found or does not have Intel IPP Async libraries.") +endif() + +mark_as_advanced(FORCE IPP_A_LIBRARIES IPP_A_INCLUDE_DIR) \ No newline at end of file diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindIntelPerCSDK.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindIntelPerCSDK.cmake new file mode 100644 index 000000000..724310560 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindIntelPerCSDK.cmake @@ -0,0 +1,20 @@ +# Main variables: +# INTELPERC_LIBRARIES and INTELPERC_INCLUDE to link Intel Perceptial Computing SDK modules +# HAVE_INTELPERC for conditional compilation OpenCV with/without Intel Perceptial Computing SDK + +if(X86_64) + find_path(INTELPERC_INCLUDE_DIR "pxcsession.h" PATHS "$ENV{PCSDK_DIR}include" DOC "Path to Intel Perceptual Computing SDK interface headers") + find_file(INTELPERC_LIBRARIES "libpxc.lib" PATHS "$ENV{PCSDK_DIR}lib/x64" DOC "Path to Intel Perceptual Computing SDK interface libraries") +else() + find_path(INTELPERC_INCLUDE_DIR "pxcsession.h" PATHS "$ENV{PCSDK_DIR}include" DOC "Path to Intel Perceptual Computing SDK interface headers") + find_file(INTELPERC_LIBRARIES "libpxc.lib" PATHS "$ENV{PCSDK_DIR}lib/Win32" DOC "Path to Intel Perceptual Computing SDK interface libraries") +endif() + +if(INTELPERC_INCLUDE_DIR AND INTELPERC_LIBRARIES) + set(HAVE_INTELPERC TRUE) +else() + set(HAVE_INTELPERC FALSE) + message(WARNING "Intel Perceptual Computing SDK library directory (set by INTELPERC_LIB_DIR variable) is not found or does not have Intel Perceptual Computing SDK libraries.") +endif() #if(INTELPERC_INCLUDE_DIR AND INTELPERC_LIBRARIES) + +mark_as_advanced(FORCE INTELPERC_LIBRARIES INTELPERC_INCLUDE_DIR) \ No newline at end of file diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindLATEX.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindLATEX.cmake new file mode 100644 index 000000000..fb324ce9b --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindLATEX.cmake @@ -0,0 +1,114 @@ +# - Find Latex +# This module finds if Latex is installed and determines where the +# executables are. This code sets the following variables: +# +# LATEX_COMPILER: path to the LaTeX compiler +# PDFLATEX_COMPILER: path to the PdfLaTeX compiler +# BIBTEX_COMPILER: path to the BibTeX compiler +# MAKEINDEX_COMPILER: path to the MakeIndex compiler +# DVIPS_CONVERTER: path to the DVIPS converter +# PS2PDF_CONVERTER: path to the PS2PDF converter +# LATEX2HTML_CONVERTER: path to the LaTeX2Html converter +# + +IF (WIN32) + + # Try to find the MikTex binary path (look for its package manager). + + FIND_PATH(MIKTEX_BINARY_PATH mpm.exe + "[HKEY_LOCAL_MACHINE\\SOFTWARE\\MiK\\MiKTeX\\CurrentVersion\\MiKTeX;Install Root]/miktex/bin" + DOC + "Path to the MikTex binary directory." + ) + MARK_AS_ADVANCED(MIKTEX_BINARY_PATH) + + # Try to find the GhostScript binary path (look for gswin32). + + GET_FILENAME_COMPONENT(GHOSTSCRIPT_BINARY_PATH_FROM_REGISTERY_8_00 + "[HKEY_LOCAL_MACHINE\\SOFTWARE\\AFPL Ghostscript\\8.00;GS_DLL]" PATH + ) + + GET_FILENAME_COMPONENT(GHOSTSCRIPT_BINARY_PATH_FROM_REGISTERY_7_04 + "[HKEY_LOCAL_MACHINE\\SOFTWARE\\AFPL Ghostscript\\7.04;GS_DLL]" PATH + ) + + FIND_PATH(GHOSTSCRIPT_BINARY_PATH gswin32.exe + ${GHOSTSCRIPT_BINARY_PATH_FROM_REGISTERY_8_00} + ${GHOSTSCRIPT_BINARY_PATH_FROM_REGISTERY_7_04} + DOC "Path to the GhostScript binary directory." + ) + MARK_AS_ADVANCED(GHOSTSCRIPT_BINARY_PATH) + + FIND_PATH(GHOSTSCRIPT_LIBRARY_PATH ps2pdf13.bat + "${GHOSTSCRIPT_BINARY_PATH}/../lib" + DOC "Path to the GhostScript library directory." + ) + MARK_AS_ADVANCED(GHOSTSCRIPT_LIBRARY_PATH) + +ENDIF (WIN32) + +FIND_HOST_PROGRAM(LATEX_COMPILER + NAMES latex + PATHS ${MIKTEX_BINARY_PATH} + /usr/bin /usr/texbin +) + +FIND_HOST_PROGRAM(PDFLATEX_COMPILER + NAMES pdflatex + PATHS ${MIKTEX_BINARY_PATH} + /usr/bin /usr/texbin +) + +FIND_HOST_PROGRAM(BIBTEX_COMPILER + NAMES bibtex + PATHS ${MIKTEX_BINARY_PATH} + /usr/bin /usr/texbin +) + +FIND_HOST_PROGRAM(MAKEINDEX_COMPILER + NAMES makeindex + PATHS ${MIKTEX_BINARY_PATH} + /usr/bin /usr/texbin +) + +FIND_HOST_PROGRAM(DVIPS_CONVERTER + NAMES dvips + PATHS ${MIKTEX_BINARY_PATH} + /usr/bin /usr/texbin +) + +FIND_HOST_PROGRAM(DVIPDF_CONVERTER + NAMES dvipdfm dvipdft dvipdf + PATHS ${MIKTEX_BINARY_PATH} + /usr/bin /usr/texbin +) + +IF (WIN32) + FIND_HOST_PROGRAM(PS2PDF_CONVERTER + NAMES ps2pdf14.bat + PATHS ${GHOSTSCRIPT_LIBRARY_PATH} + ) +ELSE (WIN32) + FIND_HOST_PROGRAM(PS2PDF_CONVERTER + NAMES ps2pdf14 ps2pdf + PATHS /usr/bin /usr/texbin + ) +ENDIF (WIN32) + +FIND_HOST_PROGRAM(LATEX2HTML_CONVERTER + NAMES latex2html + PATHS ${MIKTEX_BINARY_PATH} + /usr/bin /usr/texbin +) + + +MARK_AS_ADVANCED( + LATEX_COMPILER + PDFLATEX_COMPILER + BIBTEX_COMPILER + MAKEINDEX_COMPILER + DVIPS_CONVERTER + DVIPDF_CONVERTER + PS2PDF_CONVERTER + LATEX2HTML_CONVERTER +) diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindLibsGUI.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindLibsGUI.cmake new file mode 100644 index 000000000..1c13619d5 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindLibsGUI.cmake @@ -0,0 +1,90 @@ +# ---------------------------------------------------------------------------- +# Detect 3rd-party GUI libraries +# ---------------------------------------------------------------------------- + +#--- Win32 UI --- +ocv_clear_vars(HAVE_WIN32UI) +if(WITH_WIN32UI) + try_compile(HAVE_WIN32UI + "${OpenCV_BINARY_DIR}" + "${OpenCV_SOURCE_DIR}/cmake/checks/win32uitest.cpp" + CMAKE_FLAGS "-DLINK_LIBRARIES:STRING=user32;gdi32") +endif() + +# --- QT4 --- +ocv_clear_vars(HAVE_QT HAVE_QT5) +if(WITH_QT) + if(NOT WITH_QT EQUAL 4) + find_package(Qt5Core) + find_package(Qt5Gui) + find_package(Qt5Widgets) + find_package(Qt5Test) + find_package(Qt5Concurrent) + if(Qt5Core_FOUND AND Qt5Gui_FOUND AND Qt5Widgets_FOUND AND Qt5Test_FOUND AND Qt5Concurrent_FOUND) + set(HAVE_QT5 ON) + set(HAVE_QT ON) + find_package(Qt5OpenGL) + if(Qt5OpenGL_FOUND) + set(QT_QTOPENGL_FOUND ON) + endif() + endif() + endif() + + if(NOT HAVE_QT) + find_package(Qt4 REQUIRED QtCore QtGui QtTest) + if(QT4_FOUND) + set(HAVE_QT TRUE) + endif() + endif() +endif() + +# --- GTK --- +ocv_clear_vars(HAVE_GTK HAVE_GTK3 HAVE_GTHREAD HAVE_GTKGLEXT) +if(WITH_GTK AND NOT HAVE_QT) + if(NOT WITH_GTK_2_X) + CHECK_MODULE(gtk+-3.0 HAVE_GTK3) + if(HAVE_GTK3) + set(HAVE_GTK TRUE) + endif() + endif() + if(NOT HAVE_GTK) + CHECK_MODULE(gtk+-2.0 HAVE_GTK) + if(HAVE_GTK AND (ALIASOF_gtk+-2.0_VERSION VERSION_LESS MIN_VER_GTK)) + message (FATAL_ERROR "GTK support requires a minimum version of ${MIN_VER_GTK} (${ALIASOF_gtk+-2.0_VERSION} found)") + set(HAVE_GTK FALSE) + endif() + endif() + CHECK_MODULE(gthread-2.0 HAVE_GTHREAD) + if(HAVE_GTK AND NOT HAVE_GTHREAD) + message(FATAL_ERROR "gthread not found. This library is required when building with GTK support") + endif() + if(WITH_OPENGL AND NOT HAVE_GTK3) + CHECK_MODULE(gtkglext-1.0 HAVE_GTKGLEXT) + endif() +endif() + +# --- OpenGl --- +ocv_clear_vars(HAVE_OPENGL HAVE_QT_OPENGL) +if(WITH_OPENGL) + if(WITH_WIN32UI OR (HAVE_QT AND QT_QTOPENGL_FOUND) OR HAVE_GTKGLEXT) + find_package (OpenGL QUIET) + if(OPENGL_FOUND) + set(HAVE_OPENGL TRUE) + list(APPEND OPENCV_LINKER_LIBS ${OPENGL_LIBRARIES}) + if(QT_QTOPENGL_FOUND) + set(HAVE_QT_OPENGL TRUE) + else() + ocv_include_directories(${OPENGL_INCLUDE_DIR}) + endif() + endif() + endif() +endif(WITH_OPENGL) + +# --- Carbon & Cocoa --- +if(APPLE) + if(WITH_CARBON) + set(HAVE_CARBON YES) + elseif(NOT IOS AND CMAKE_COMPILER_IS_CLANGCXX) + set(HAVE_COCOA YES) + endif() +endif() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindLibsGrfmt.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindLibsGrfmt.cmake new file mode 100644 index 000000000..b5f38279e --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindLibsGrfmt.cmake @@ -0,0 +1,213 @@ +# ---------------------------------------------------------------------------- +# Detect 3rd-party image IO libraries +# ---------------------------------------------------------------------------- + +# --- zlib (required) --- +if(BUILD_ZLIB) + ocv_clear_vars(ZLIB_FOUND) +else() + find_package(ZLIB "${MIN_VER_ZLIB}") + if(ZLIB_FOUND AND ANDROID) + if(ZLIB_LIBRARIES STREQUAL "${ANDROID_SYSROOT}/usr/lib/libz.so") + set(ZLIB_LIBRARIES z) + endif() + endif() +endif() + +if(NOT ZLIB_FOUND) + ocv_clear_vars(ZLIB_LIBRARY ZLIB_LIBRARIES ZLIB_INCLUDE_DIRS) + + set(ZLIB_LIBRARY zlib) + add_subdirectory("${OpenCV_SOURCE_DIR}/3rdparty/zlib") + set(ZLIB_INCLUDE_DIRS "${${ZLIB_LIBRARY}_SOURCE_DIR}" "${${ZLIB_LIBRARY}_BINARY_DIR}") + set(ZLIB_LIBRARIES ${ZLIB_LIBRARY}) + + ocv_parse_header2(ZLIB "${${ZLIB_LIBRARY}_SOURCE_DIR}/zlib.h" ZLIB_VERSION) +endif() + +# --- libtiff (optional, should be searched after zlib) --- +if(WITH_TIFF) + if(BUILD_TIFF) + ocv_clear_vars(TIFF_FOUND) + else() + include(FindTIFF) + if(TIFF_FOUND) + ocv_parse_header("${TIFF_INCLUDE_DIR}/tiff.h" TIFF_VERSION_LINES TIFF_VERSION_CLASSIC TIFF_VERSION_BIG TIFF_VERSION TIFF_BIGTIFF_VERSION) + endif() + endif() + + if(NOT TIFF_FOUND) + ocv_clear_vars(TIFF_LIBRARY TIFF_LIBRARIES TIFF_INCLUDE_DIR) + + set(TIFF_LIBRARY libtiff) + set(TIFF_LIBRARIES ${TIFF_LIBRARY}) + add_subdirectory("${OpenCV_SOURCE_DIR}/3rdparty/libtiff") + set(TIFF_INCLUDE_DIR "${${TIFF_LIBRARY}_SOURCE_DIR}" "${${TIFF_LIBRARY}_BINARY_DIR}") + ocv_parse_header("${${TIFF_LIBRARY}_SOURCE_DIR}/tiff.h" TIFF_VERSION_LINES TIFF_VERSION_CLASSIC TIFF_VERSION_BIG TIFF_VERSION TIFF_BIGTIFF_VERSION) + endif() + + if(TIFF_VERSION_CLASSIC AND NOT TIFF_VERSION) + set(TIFF_VERSION ${TIFF_VERSION_CLASSIC}) + endif() + + if(TIFF_BIGTIFF_VERSION AND NOT TIFF_VERSION_BIG) + set(TIFF_VERSION_BIG ${TIFF_BIGTIFF_VERSION}) + endif() + + if(NOT TIFF_VERSION_STRING AND TIFF_INCLUDE_DIR) + list(GET TIFF_INCLUDE_DIR 0 _TIFF_INCLUDE_DIR) + if(EXISTS "${_TIFF_INCLUDE_DIR}/tiffvers.h") + file(STRINGS "${_TIFF_INCLUDE_DIR}/tiffvers.h" tiff_version_str REGEX "^#define[\t ]+TIFFLIB_VERSION_STR[\t ]+\"LIBTIFF, Version .*") + string(REGEX REPLACE "^#define[\t ]+TIFFLIB_VERSION_STR[\t ]+\"LIBTIFF, Version +([^ \\n]*).*" "\\1" TIFF_VERSION_STRING "${tiff_version_str}") + unset(tiff_version_str) + endif() + unset(_TIFF_INCLUDE_DIR) + endif() + + set(HAVE_TIFF YES) +endif() + +# --- libjpeg (optional) --- +if(WITH_JPEG) + if(BUILD_JPEG) + ocv_clear_vars(JPEG_FOUND) + else() + include(FindJPEG) + endif() + + if(NOT JPEG_FOUND) + ocv_clear_vars(JPEG_LIBRARY JPEG_LIBRARIES JPEG_INCLUDE_DIR) + + set(JPEG_LIBRARY libjpeg) + set(JPEG_LIBRARIES ${JPEG_LIBRARY}) + add_subdirectory("${OpenCV_SOURCE_DIR}/3rdparty/libjpeg") + set(JPEG_INCLUDE_DIR "${${JPEG_LIBRARY}_SOURCE_DIR}") + endif() + + ocv_parse_header("${JPEG_INCLUDE_DIR}/jpeglib.h" JPEG_VERSION_LINES JPEG_LIB_VERSION) + set(HAVE_JPEG YES) +endif() + +# --- libwebp (optional) --- + +if(WITH_WEBP) + if(BUILD_WEBP) + ocv_clear_vars(WEBP_FOUND WEBP_LIBRARY WEBP_LIBRARIES WEBP_INCLUDE_DIR) + else() + include(cmake/OpenCVFindWebP.cmake) + endif() +endif() + +# --- Add libwebp to 3rdparty/libwebp and compile it if not available --- +if(WITH_WEBP AND NOT WEBP_FOUND) + + set(WEBP_LIBRARY libwebp) + set(WEBP_LIBRARIES ${WEBP_LIBRARY}) + + add_subdirectory("${OpenCV_SOURCE_DIR}/3rdparty/libwebp") + set(WEBP_INCLUDE_DIR "${${WEBP_LIBRARY}_SOURCE_DIR}") +endif() + +if(NOT WEBP_VERSION AND WEBP_INCLUDE_DIR) + ocv_clear_vars(ENC_MAJ_VERSION ENC_MIN_VERSION ENC_REV_VERSION) + if(EXISTS "${WEBP_INCLUDE_DIR}/enc/vp8enci.h") + ocv_parse_header("${WEBP_INCLUDE_DIR}/enc/vp8enci.h" WEBP_VERSION_LINES ENC_MAJ_VERSION ENC_MIN_VERSION ENC_REV_VERSION) + set(WEBP_VERSION "${ENC_MAJ_VERSION}.${ENC_MIN_VERSION}.${ENC_REV_VERSION}") + elseif(EXISTS "${WEBP_INCLUDE_DIR}/webp/encode.h") + file(STRINGS "${WEBP_INCLUDE_DIR}/webp/encode.h" WEBP_ENCODER_ABI_VERSION REGEX "#define[ \t]+WEBP_ENCODER_ABI_VERSION[ \t]+([x0-9a-f]+)" ) + if(WEBP_ENCODER_ABI_VERSION MATCHES "#define[ \t]+WEBP_ENCODER_ABI_VERSION[ \t]+([x0-9a-f]+)") + set(WEBP_ENCODER_ABI_VERSION "${CMAKE_MATCH_1}") + set(WEBP_VERSION "encoder: ${WEBP_ENCODER_ABI_VERSION}") + else() + unset(WEBP_ENCODER_ABI_VERSION) + endif() + endif() +endif() + +# --- libjasper (optional, should be searched after libjpeg) --- +if(WITH_JASPER) + if(BUILD_JASPER) + ocv_clear_vars(JASPER_FOUND) + else() + include(FindJasper) + endif() + + if(NOT JASPER_FOUND) + ocv_clear_vars(JASPER_LIBRARY JASPER_LIBRARIES JASPER_INCLUDE_DIR) + + set(JASPER_LIBRARY libjasper) + set(JASPER_LIBRARIES ${JASPER_LIBRARY}) + add_subdirectory("${OpenCV_SOURCE_DIR}/3rdparty/libjasper") + set(JASPER_INCLUDE_DIR "${${JASPER_LIBRARY}_SOURCE_DIR}") + endif() + + set(HAVE_JASPER YES) + + if(NOT JASPER_VERSION_STRING) + ocv_parse_header2(JASPER "${JASPER_INCLUDE_DIR}/jasper/jas_config.h" JAS_VERSION "") + endif() +endif() + +# --- libpng (optional, should be searched after zlib) --- +if(WITH_PNG) + if(BUILD_PNG) + ocv_clear_vars(PNG_FOUND) + else() + include(FindPNG) + if(PNG_FOUND) + include(CheckIncludeFile) + check_include_file("${PNG_PNG_INCLUDE_DIR}/libpng/png.h" HAVE_LIBPNG_PNG_H) + if(HAVE_LIBPNG_PNG_H) + ocv_parse_header("${PNG_PNG_INCLUDE_DIR}/libpng/png.h" PNG_VERSION_LINES PNG_LIBPNG_VER_MAJOR PNG_LIBPNG_VER_MINOR PNG_LIBPNG_VER_RELEASE) + else() + ocv_parse_header("${PNG_PNG_INCLUDE_DIR}/png.h" PNG_VERSION_LINES PNG_LIBPNG_VER_MAJOR PNG_LIBPNG_VER_MINOR PNG_LIBPNG_VER_RELEASE) + endif() + endif() + endif() + + if(NOT PNG_FOUND) + ocv_clear_vars(PNG_LIBRARY PNG_LIBRARIES PNG_INCLUDE_DIR PNG_PNG_INCLUDE_DIR HAVE_LIBPNG_PNG_H PNG_DEFINITIONS) + + set(PNG_LIBRARY libpng) + set(PNG_LIBRARIES ${PNG_LIBRARY}) + add_subdirectory("${OpenCV_SOURCE_DIR}/3rdparty/libpng") + set(PNG_INCLUDE_DIR "${${PNG_LIBRARY}_SOURCE_DIR}") + set(PNG_DEFINITIONS "") + ocv_parse_header("${PNG_INCLUDE_DIR}/png.h" PNG_VERSION_LINES PNG_LIBPNG_VER_MAJOR PNG_LIBPNG_VER_MINOR PNG_LIBPNG_VER_RELEASE) + endif() + + set(HAVE_PNG YES) + set(PNG_VERSION "${PNG_LIBPNG_VER_MAJOR}.${PNG_LIBPNG_VER_MINOR}.${PNG_LIBPNG_VER_RELEASE}") +endif() + +# --- OpenEXR (optional) --- +if(WITH_OPENEXR) + if(BUILD_OPENEXR) + ocv_clear_vars(OPENEXR_FOUND) + else() + include("${OpenCV_SOURCE_DIR}/cmake/OpenCVFindOpenEXR.cmake") + endif() + + if(NOT OPENEXR_FOUND) + ocv_clear_vars(OPENEXR_INCLUDE_PATHS OPENEXR_LIBRARIES OPENEXR_ILMIMF_LIBRARY OPENEXR_VERSION) + + set(OPENEXR_LIBRARIES IlmImf) + set(OPENEXR_ILMIMF_LIBRARY IlmImf) + add_subdirectory("${OpenCV_SOURCE_DIR}/3rdparty/openexr") + endif() + + set(HAVE_OPENEXR YES) +endif() + +# --- GDAL (optional) --- +if(WITH_GDAL) + find_package(GDAL) + + if(NOT GDAL_FOUND) + ocv_clear_vars(GDAL_LIBRARY GDAL_INCLUDE_DIR) + set(HAVE_GDAL NO) + else() + set(HAVE_GDAL YES) + ocv_include_directories(${GDAL_INCLUDE_DIR}) + endif() +endif() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindLibsPerf.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindLibsPerf.cmake new file mode 100644 index 000000000..bda5d792a --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindLibsPerf.cmake @@ -0,0 +1,131 @@ +# ---------------------------------------------------------------------------- +# Detect other 3rd-party performance and math libraries +# ---------------------------------------------------------------------------- + +# --- TBB --- +if(WITH_TBB) + include("${OpenCV_SOURCE_DIR}/cmake/OpenCVDetectTBB.cmake") +endif(WITH_TBB) + +# --- IPP --- +if(WITH_IPP) + include("${OpenCV_SOURCE_DIR}/cmake/OpenCVFindIPP.cmake") + if(HAVE_IPP) + ocv_include_directories(${IPP_INCLUDE_DIRS}) + list(APPEND OPENCV_LINKER_LIBS ${IPP_LIBRARIES}) + endif() +endif() + +# --- IPP Async --- + +if(WITH_IPP_A) + include("${OpenCV_SOURCE_DIR}/cmake/OpenCVFindIPPAsync.cmake") + if(IPP_A_INCLUDE_DIR AND IPP_A_LIBRARIES) + ocv_include_directories(${IPP_A_INCLUDE_DIR}) + link_directories(${IPP_A_LIBRARIES}) + set(OPENCV_LINKER_LIBS ${OPENCV_LINKER_LIBS} ${IPP_A_LIBRARIES}) + endif() +endif(WITH_IPP_A) + +# --- CUDA --- +if(WITH_CUDA) + include("${OpenCV_SOURCE_DIR}/cmake/OpenCVDetectCUDA.cmake") +endif(WITH_CUDA) + +# --- Eigen --- +if(WITH_EIGEN) + find_path(EIGEN_INCLUDE_PATH "Eigen/Core" + PATHS /usr/local /opt /usr $ENV{EIGEN_ROOT}/include ENV ProgramFiles ENV ProgramW6432 + PATH_SUFFIXES include/eigen3 include/eigen2 Eigen/include/eigen3 Eigen/include/eigen2 + DOC "The path to Eigen3/Eigen2 headers" + CMAKE_FIND_ROOT_PATH_BOTH) + + if(EIGEN_INCLUDE_PATH) + ocv_include_directories(${EIGEN_INCLUDE_PATH}) + ocv_parse_header("${EIGEN_INCLUDE_PATH}/Eigen/src/Core/util/Macros.h" EIGEN_VERSION_LINES EIGEN_WORLD_VERSION EIGEN_MAJOR_VERSION EIGEN_MINOR_VERSION) + set(HAVE_EIGEN 1) + endif() +endif(WITH_EIGEN) + +# --- Clp --- +# Ubuntu: sudo apt-get install coinor-libclp-dev coinor-libcoinutils-dev +ocv_clear_vars(HAVE_CLP) +if(WITH_CLP) + if(UNIX) + PKG_CHECK_MODULES(CLP clp) + if(CLP_FOUND) + set(HAVE_CLP TRUE) + if(NOT ${CLP_INCLUDE_DIRS} STREQUAL "") + ocv_include_directories(${CLP_INCLUDE_DIRS}) + endif() + link_directories(${CLP_LIBRARY_DIRS}) + set(OPENCV_LINKER_LIBS ${OPENCV_LINKER_LIBS} ${CLP_LIBRARIES}) + endif() + endif() + + if(NOT CLP_FOUND) + find_path(CLP_INCLUDE_PATH "coin" + PATHS "/usr/local/include" "/usr/include" "/opt/include" + DOC "The path to Clp headers") + if(CLP_INCLUDE_PATH) + ocv_include_directories(${CLP_INCLUDE_PATH} "${CLP_INCLUDE_PATH}/coin") + get_filename_component(_CLP_LIBRARY_DIR "${CLP_INCLUDE_PATH}/../lib" ABSOLUTE) + set(CLP_LIBRARY_DIR "${_CLP_LIBRARY_DIR}" CACHE PATH "Full path of Clp library directory") + link_directories(${CLP_LIBRARY_DIR}) + if(UNIX) + set(OPENCV_LINKER_LIBS ${OPENCV_LINKER_LIBS} Clp CoinUtils m) + else() + if(MINGW) + set(OPENCV_LINKER_LIBS ${OPENCV_LINKER_LIBS} Clp CoinUtils) + else() + set(OPENCV_LINKER_LIBS ${OPENCV_LINKER_LIBS} libClp libCoinUtils) + endif() + endif() + set(HAVE_CLP TRUE) + endif() + endif() +endif(WITH_CLP) + +# --- C= --- +if(WITH_CSTRIPES AND NOT HAVE_TBB) + include("${OpenCV_SOURCE_DIR}/cmake/OpenCVDetectCStripes.cmake") +else() + set(HAVE_CSTRIPES 0) +endif() + +# --- GCD --- +if(APPLE AND NOT HAVE_TBB AND NOT HAVE_CSTRIPES) + set(HAVE_GCD 1) +else() + set(HAVE_GCD 0) +endif() + +# --- Concurrency --- +if(MSVC AND NOT HAVE_TBB AND NOT HAVE_CSTRIPES) + set(_fname "${CMAKE_BINARY_DIR}${CMAKE_FILES_DIRECTORY}/CMakeTmp/concurrencytest.cpp") + file(WRITE "${_fname}" "#if _MSC_VER < 1600\n#error\n#endif\nint main() { return 0; }\n") + try_compile(HAVE_CONCURRENCY "${CMAKE_BINARY_DIR}" "${_fname}") + file(REMOVE "${_fname}") +else() + set(HAVE_CONCURRENCY 0) +endif() + +# --- OpenMP --- +if(WITH_OPENMP) + find_package(OpenMP) + if(OPENMP_FOUND) + set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${OpenMP_C_FLAGS}") + set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${OpenMP_CXX_FLAGS}") + endif() + set(HAVE_OPENMP "${OPENMP_FOUND}") +endif() + +if(UNIX OR ANDROID) +if(NOT APPLE AND NOT HAVE_TBB AND NOT HAVE_OPENMP) + set(HAVE_PTHREADS_PF 1) +else() + set(HAVE_PTHREADS_PF 0) +endif() +else() + set(HAVE_PTHREADS_PF 0) +endif() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindLibsVideo.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindLibsVideo.cmake new file mode 100644 index 000000000..279787a34 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindLibsVideo.cmake @@ -0,0 +1,319 @@ +# ---------------------------------------------------------------------------- +# Detect 3rd-party video IO libraries +# ---------------------------------------------------------------------------- + +ocv_clear_vars(HAVE_VFW) +if(WITH_VFW) + try_compile(HAVE_VFW + "${OpenCV_BINARY_DIR}" + "${OpenCV_SOURCE_DIR}/cmake/checks/vfwtest.cpp" + CMAKE_FLAGS "-DLINK_LIBRARIES:STRING=vfw32") +endif(WITH_VFW) + +# --- GStreamer --- +ocv_clear_vars(HAVE_GSTREAMER) +# try to find gstreamer 1.x first +if(WITH_GSTREAMER AND NOT WITH_GSTREAMER_0_10) + CHECK_MODULE(gstreamer-base-1.0 HAVE_GSTREAMER_BASE) + CHECK_MODULE(gstreamer-video-1.0 HAVE_GSTREAMER_VIDEO) + CHECK_MODULE(gstreamer-app-1.0 HAVE_GSTREAMER_APP) + CHECK_MODULE(gstreamer-riff-1.0 HAVE_GSTREAMER_RIFF) + CHECK_MODULE(gstreamer-pbutils-1.0 HAVE_GSTREAMER_PBUTILS) + + if(HAVE_GSTREAMER_BASE AND HAVE_GSTREAMER_VIDEO AND HAVE_GSTREAMER_APP AND HAVE_GSTREAMER_RIFF AND HAVE_GSTREAMER_PBUTILS) + set(HAVE_GSTREAMER TRUE) + set(GSTREAMER_BASE_VERSION ${ALIASOF_gstreamer-base-1.0_VERSION}) + set(GSTREAMER_VIDEO_VERSION ${ALIASOF_gstreamer-video-1.0_VERSION}) + set(GSTREAMER_APP_VERSION ${ALIASOF_gstreamer-app-1.0_VERSION}) + set(GSTREAMER_RIFF_VERSION ${ALIASOF_gstreamer-riff-1.0_VERSION}) + set(GSTREAMER_PBUTILS_VERSION ${ALIASOF_gstreamer-pbutils-1.0_VERSION}) + endif() + +endif(WITH_GSTREAMER AND NOT WITH_GSTREAMER_0_10) + +# if gstreamer 1.x was not found, or we specified we wanted 0.10, try to find it +if(WITH_GSTREAMER AND NOT HAVE_GSTREAMER OR WITH_GSTREAMER_0_10) + CHECK_MODULE(gstreamer-base-0.10 HAVE_GSTREAMER_BASE) + CHECK_MODULE(gstreamer-video-0.10 HAVE_GSTREAMER_VIDEO) + CHECK_MODULE(gstreamer-app-0.10 HAVE_GSTREAMER_APP) + CHECK_MODULE(gstreamer-riff-0.10 HAVE_GSTREAMER_RIFF) + CHECK_MODULE(gstreamer-pbutils-0.10 HAVE_GSTREAMER_PBUTILS) + + if(HAVE_GSTREAMER_BASE AND HAVE_GSTREAMER_VIDEO AND HAVE_GSTREAMER_APP AND HAVE_GSTREAMER_RIFF AND HAVE_GSTREAMER_PBUTILS) + set(HAVE_GSTREAMER TRUE) + set(GSTREAMER_BASE_VERSION ${ALIASOF_gstreamer-base-0.10_VERSION}) + set(GSTREAMER_VIDEO_VERSION ${ALIASOF_gstreamer-video-0.10_VERSION}) + set(GSTREAMER_APP_VERSION ${ALIASOF_gstreamer-app-0.10_VERSION}) + set(GSTREAMER_RIFF_VERSION ${ALIASOF_gstreamer-riff-0.10_VERSION}) + set(GSTREAMER_PBUTILS_VERSION ${ALIASOF_gstreamer-pbutils-0.10_VERSION}) + endif() +endif(WITH_GSTREAMER AND NOT HAVE_GSTREAMER OR WITH_GSTREAMER_0_10) + +# --- unicap --- +ocv_clear_vars(HAVE_UNICAP) +if(WITH_UNICAP) + CHECK_MODULE(libunicap HAVE_UNICAP_) + CHECK_MODULE(libucil HAVE_UNICAP_UCIL) + if(HAVE_UNICAP_ AND HAVE_UNICAP_UCIL) + set(HAVE_UNICAP TRUE) + endif() +endif(WITH_UNICAP) + +# --- PvApi --- +ocv_clear_vars(HAVE_PVAPI) +if(WITH_PVAPI) + find_path(PVAPI_INCLUDE_PATH "PvApi.h" + PATHS /usr/local /opt /usr ENV ProgramFiles ENV ProgramW6432 + PATH_SUFFIXES include "Allied Vision Technologies/GigESDK/inc-pc" "AVT GigE SDK/inc-pc" "GigESDK/inc-pc" + DOC "The path to PvAPI header") + + if(PVAPI_INCLUDE_PATH) + if(X86 AND NOT WIN32) + set(PVAPI_SDK_SUBDIR x86) + elseif(X86_64) + set(PVAPI_SDK_SUBDIR x64) + elseif(ARM) + set(PVAPI_SDK_SUBDIR arm) + endif() + + get_filename_component(_PVAPI_LIBRARY "${PVAPI_INCLUDE_PATH}/../lib-pc" ABSOLUTE) + if(PVAPI_SDK_SUBDIR) + set(_PVAPI_LIBRARY "${_PVAPI_LIBRARY}/${PVAPI_SDK_SUBDIR}") + endif() + if(NOT WIN32 AND CMAKE_COMPILER_IS_GNUCXX) + set(_PVAPI_LIBRARY "${_PVAPI_LIBRARY}/${CMAKE_OPENCV_GCC_VERSION_MAJOR}.${CMAKE_OPENCV_GCC_VERSION_MINOR}") + endif() + + if(WIN32) + if(MINGW) + set(PVAPI_DEFINITIONS "-DPVDECL=__stdcall") + endif(MINGW) + set(PVAPI_LIBRARY "${_PVAPI_LIBRARY}/PvAPI.lib" CACHE PATH "The PvAPI library") + else(WIN32) + set(PVAPI_LIBRARY "${_PVAPI_LIBRARY}/${CMAKE_STATIC_LIBRARY_PREFIX}PvAPI${CMAKE_STATIC_LIBRARY_SUFFIX}" CACHE PATH "The PvAPI library") + endif(WIN32) + if(EXISTS "${PVAPI_LIBRARY}") + set(HAVE_PVAPI TRUE) + endif() + endif(PVAPI_INCLUDE_PATH) +endif(WITH_PVAPI) + +# --- GigEVisionSDK --- +ocv_clear_vars(HAVE_GIGE_API) +if(WITH_GIGEAPI) + find_path(GIGEAPI_INCLUDE_PATH "GigEVisionSDK.h" + PATHS /usr/local /var /opt /usr ENV ProgramFiles ENV ProgramW6432 + PATH_SUFFIXES include "Smartek Vision Technologies/GigEVisionSDK/gige_cpp" "GigEVisionSDK/gige_cpp" "GigEVisionSDK/gige_c" + DOC "The path to Smartek GigEVisionSDK header") + FIND_LIBRARY(GIGEAPI_LIBRARIES NAMES GigEVisionSDK) + if(GIGEAPI_LIBRARIES AND GIGEAPI_INCLUDE_PATH) + set(HAVE_GIGE_API TRUE) + endif() +endif(WITH_GIGEAPI) + +# --- Dc1394 --- +ocv_clear_vars(HAVE_DC1394 HAVE_DC1394_2) +if(WITH_1394) + if(WIN32 AND MINGW) + find_path(CMU1394_INCLUDE_PATH "/1394common.h" + PATH_SUFFIXES include + DOC "The path to cmu1394 headers") + find_path(DC1394_2_INCLUDE_PATH "/dc1394/dc1394.h" + PATH_SUFFIXES include + DOC "The path to DC1394 2.x headers") + if(CMU1394_INCLUDE_PATH AND DC1394_2_INCLUDE_PATH) + set(CMU1394_LIB_DIR "${CMU1394_INCLUDE_PATH}/../lib" CACHE PATH "Full path of CMU1394 library directory") + set(DC1394_2_LIB_DIR "${DC1394_2_INCLUDE_PATH}/../lib" CACHE PATH "Full path of DC1394 2.x library directory") + if(EXISTS "${CMU1394_LIB_DIR}/lib1394camera.a" AND EXISTS "${DC1394_2_LIB_DIR}/libdc1394.a") + set(HAVE_DC1394_2 TRUE) + endif() + endif() + if(HAVE_DC1394_2) + ocv_parse_pkg("libdc1394-2" "${DC1394_2_LIB_DIR}/pkgconfig" "") + ocv_include_directories(${DC1394_2_INCLUDE_PATH}) + set(VIDEOIO_LIBRARIES ${VIDEOIO_LIBRARIES} + "${DC1394_2_LIB_DIR}/libdc1394.a" + "${CMU1394_LIB_DIR}/lib1394camera.a") + endif(HAVE_DC1394_2) + else(WIN32 AND MINGW) + CHECK_MODULE(libdc1394-2 HAVE_DC1394_2) + if(NOT HAVE_DC1394_2) + CHECK_MODULE(libdc1394 HAVE_DC1394) + endif() + endif(WIN32 AND MINGW) +endif(WITH_1394) + +# --- xine --- +ocv_clear_vars(HAVE_XINE) +if(WITH_XINE) + CHECK_MODULE(libxine HAVE_XINE) +endif(WITH_XINE) + +# --- V4L --- +ocv_clear_vars(HAVE_LIBV4L HAVE_CAMV4L HAVE_CAMV4L2 HAVE_VIDEOIO) +if(WITH_V4L) + if(WITH_LIBV4L) + CHECK_MODULE(libv4l1 HAVE_LIBV4L1) + CHECK_MODULE(libv4l2 HAVE_LIBV4L2) + if(HAVE_LIBV4L1 AND HAVE_LIBV4L2) + set(HAVE_LIBV4L YES) + else() + set(HAVE_LIBV4L NO) + endif() + endif() + CHECK_INCLUDE_FILE(linux/videodev.h HAVE_CAMV4L) + CHECK_INCLUDE_FILE(linux/videodev2.h HAVE_CAMV4L2) + CHECK_INCLUDE_FILE(sys/videoio.h HAVE_VIDEOIO) +endif(WITH_V4L) + +# --- OpenNI --- +ocv_clear_vars(HAVE_OPENNI HAVE_OPENNI_PRIME_SENSOR_MODULE) +if(WITH_OPENNI) + include("${OpenCV_SOURCE_DIR}/cmake/OpenCVFindOpenNI.cmake") +endif(WITH_OPENNI) + +ocv_clear_vars(HAVE_OPENNI2) +if(WITH_OPENNI2) + include("${OpenCV_SOURCE_DIR}/cmake/OpenCVFindOpenNI2.cmake") +endif(WITH_OPENNI2) + +# --- XIMEA --- +ocv_clear_vars(HAVE_XIMEA) +if(WITH_XIMEA) + include("${OpenCV_SOURCE_DIR}/cmake/OpenCVFindXimea.cmake") + if(XIMEA_FOUND) + set(HAVE_XIMEA TRUE) + endif() +endif(WITH_XIMEA) + +# --- FFMPEG --- +ocv_clear_vars(HAVE_FFMPEG HAVE_FFMPEG_CODEC HAVE_FFMPEG_FORMAT HAVE_FFMPEG_UTIL HAVE_FFMPEG_SWSCALE HAVE_FFMPEG_RESAMPLE HAVE_GENTOO_FFMPEG HAVE_FFMPEG_FFMPEG) +if(WITH_FFMPEG) + if(WIN32 AND NOT ARM) + include("${OpenCV_SOURCE_DIR}/3rdparty/ffmpeg/ffmpeg_version.cmake") + elseif(UNIX) + CHECK_MODULE(libavcodec HAVE_FFMPEG_CODEC) + CHECK_MODULE(libavformat HAVE_FFMPEG_FORMAT) + CHECK_MODULE(libavutil HAVE_FFMPEG_UTIL) + CHECK_MODULE(libswscale HAVE_FFMPEG_SWSCALE) + CHECK_MODULE(libavresample HAVE_FFMPEG_RESAMPLE) + + CHECK_INCLUDE_FILE(libavformat/avformat.h HAVE_GENTOO_FFMPEG) + CHECK_INCLUDE_FILE(ffmpeg/avformat.h HAVE_FFMPEG_FFMPEG) + if(NOT HAVE_GENTOO_FFMPEG AND NOT HAVE_FFMPEG_FFMPEG) + if(EXISTS /usr/include/ffmpeg/libavformat/avformat.h OR HAVE_FFMPEG_SWSCALE) + set(HAVE_GENTOO_FFMPEG TRUE) + endif() + endif() + if(HAVE_FFMPEG_CODEC AND HAVE_FFMPEG_FORMAT AND HAVE_FFMPEG_UTIL AND HAVE_FFMPEG_SWSCALE) + set(HAVE_FFMPEG TRUE) + endif() + + if(HAVE_FFMPEG) + # Find the bzip2 library because it is required on some systems + FIND_LIBRARY(BZIP2_LIBRARIES NAMES bz2 bzip2) + if(NOT BZIP2_LIBRARIES) + # Do an other trial + FIND_FILE(BZIP2_LIBRARIES NAMES libbz2.so.1 PATHS /lib) + endif() + else() + find_path(FFMPEG_INCLUDE_DIR "libavformat/avformat.h" + PATHS /usr/local /usr /opt + PATH_SUFFIXES include + DOC "The path to FFMPEG headers") + if(FFMPEG_INCLUDE_DIR) + set(HAVE_GENTOO_FFMPEG TRUE) + set(FFMPEG_LIB_DIR "${FFMPEG_INCLUDE_DIR}/../lib" CACHE PATH "Full path of FFMPEG library directory") + find_library(FFMPEG_CODEC_LIB "avcodec" HINTS "${FFMPEG_LIB_DIR}") + find_library(FFMPEG_FORMAT_LIB "avformat" HINTS "${FFMPEG_LIB_DIR}") + find_library(FFMPEG_UTIL_LIB "avutil" HINTS "${FFMPEG_LIB_DIR}") + find_library(FFMPEG_SWSCALE_LIB "swscale" HINTS "${FFMPEG_LIB_DIR}") + find_library(FFMPEG_RESAMPLE_LIB "avresample" HINTS "${FFMPEG_LIB_DIR}") + if(FFMPEG_CODEC_LIB) + set(HAVE_FFMPEG_CODEC 1) + endif() + if(FFMPEG_FORMAT_LIB) + set(HAVE_FFMPEG_FORMAT 1) + endif() + if(FFMPEG_UTIL_LIB) + set(HAVE_FFMPEG_UTIL 1) + endif() + if(FFMPEG_SWSCALE_LIB) + set(HAVE_FFMPEG_SWSCALE 1) + endif() + if(FFMPEG_CODEC_LIB AND FFMPEG_FORMAT_LIB AND + FFMPEG_UTIL_LIB AND FFMPEG_SWSCALE_LIB) + set(ALIASOF_libavcodec_VERSION "Unknown") + set(ALIASOF_libavformat_VERSION "Unknown") + set(ALIASOF_libavutil_VERSION "Unknown") + set(ALIASOF_libswscale_VERSION "Unknown") + set(HAVE_FFMPEG 1) + if(FFMPEG_RESAMPLE_LIB) + set(HAVE_FFMPEG_RESAMPLE 1) + set(ALIASOF_libavresample_VERSION "Unknown") + endif() + endif() + endif(FFMPEG_INCLUDE_DIR) + if(HAVE_FFMPEG) + set(VIDEOIO_LIBRARIES ${VIDEOIO_LIBRARIES} "${FFMPEG_LIB_DIR}/libavcodec.a" + "${FFMPEG_LIB_DIR}/libavformat.a" "${FFMPEG_LIB_DIR}/libavutil.a" + "${FFMPEG_LIB_DIR}/libswscale.a") + if(HAVE_FFMPEG_RESAMPLE) + set(VIDEOIO_LIBRARIES ${VIDEOIO_LIBRARIES} "${FFMPEG_LIB_DIR}/libavresample.a") + endif() + ocv_include_directories(${FFMPEG_INCLUDE_DIR}) + endif(HAVE_FFMPEG) + endif() + endif() +endif(WITH_FFMPEG) + +# --- VideoInput/DirectShow --- +if(WITH_DSHOW) + # always have VideoInput on Windows + set(HAVE_DSHOW 1) +endif(WITH_DSHOW) + +# --- VideoInput/Microsoft Media Foundation --- +ocv_clear_vars(HAVE_MSMF) +if(WITH_MSMF) + check_include_file(Mfapi.h HAVE_MSMF) +endif(WITH_MSMF) + +# --- Extra HighGUI and VideoIO libs on Windows --- +if(WIN32) + list(APPEND HIGHGUI_LIBRARIES comctl32 gdi32 ole32 setupapi ws2_32) + if(HAVE_VFW) + list(APPEND VIDEOIO_LIBRARIES vfw32) + endif() + if(MINGW64) + list(APPEND VIDEOIO_LIBRARIES avifil32 avicap32 winmm msvfw32) + list(REMOVE_ITEM VIDEOIO_LIBRARIES vfw32) + elseif(MINGW) + list(APPEND VIDEOIO_LIBRARIES winmm) + endif() +endif(WIN32) + +# --- Apple AV Foundation --- +if(WITH_AVFOUNDATION) + set(HAVE_AVFOUNDATION YES) +endif() + +# --- QuickTime --- +if (NOT IOS) + if(WITH_QUICKTIME) + set(HAVE_QUICKTIME YES) + elseif(APPLE AND CMAKE_COMPILER_IS_CLANGCXX) + set(HAVE_QTKIT YES) + endif() +endif() + +# --- Intel Perceptual Computing SDK --- +if(WITH_INTELPERC) + include("${OpenCV_SOURCE_DIR}/cmake/OpenCVFindIntelPerCSDK.cmake") +endif(WITH_INTELPERC) + +# --- gPhoto2 --- +ocv_clear_vars(HAVE_GPHOTO2) +if(WITH_GPHOTO2) + CHECK_MODULE(libgphoto2 HAVE_GPHOTO2) +endif(WITH_GPHOTO2) diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindMatlab.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindMatlab.cmake new file mode 100644 index 000000000..c4a174c39 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindMatlab.cmake @@ -0,0 +1,199 @@ +# ----- Find Matlab/Octave ----- +# +# OpenCVFindMatlab.cmake attempts to locate the install path of Matlab in order +# to extract the mex headers, libraries and shell scripts. If found +# successfully, the following variables will be defined +# +# MATLAB_FOUND: true/false +# MATLAB_ROOT_DIR: Root of Matlab installation +# MATLAB_BIN: The main Matlab "executable" (shell script) +# MATLAB_MEX_SCRIPT: The mex script used to compile mex files +# MATLAB_INCLUDE_DIRS:Path to "mex.h" +# MATLAB_LIBRARY_DIRS:Path to mex and matrix libraries +# MATLAB_LIBRARIES: The Matlab libs, usually mx, mex, mat +# MATLAB_MEXEXT: The mex library extension. It will be one of: +# mexwin32, mexwin64, mexglx, mexa64, mexmac, +# mexmaci, mexmaci64, mexsol, mexs64 +# MATLAB_ARCH: The installation architecture. It is **usually** +# the MEXEXT with the preceding "mex" removed, +# though it's different for linux distros. +# +# There doesn't appear to be an elegant way to detect all versions of Matlab +# across different platforms. If you know the matlab path and want to avoid +# the search, you can define the path to the Matlab root when invoking cmake: +# +# cmake -DMATLAB_ROOT_DIR='/PATH/TO/ROOT_DIR' .. + + + +# ----- set_library_presuffix ----- +# +# Matlab tends to use some non-standard prefixes and suffixes on its libraries. +# For example, libmx.dll on Windows (Windows does not add prefixes) and +# mkl.dylib on OS X (OS X uses "lib" prefixes). +# On some versions of Windows the .dll suffix also appears to not be checked. +# +# This function modifies the library prefixes and suffixes used by +# find_library when finding Matlab libraries. It does not affect scopes +# outside of this file. +function(set_libarch_prefix_suffix) + if (UNIX AND NOT APPLE) + set(CMAKE_FIND_LIBRARY_PREFIXES "lib" PARENT_SCOPE) + set(CMAKE_FIND_LIBRARY_SUFFIXES ".so" ".a" PARENT_SCOPE) + elseif (APPLE) + set(CMAKE_FIND_LIBRARY_PREFIXES "lib" PARENT_SCOPE) + set(CMAKE_FIND_LIBRARY_SUFFIXES ".dylib" ".a" PARENT_SCOPE) + elseif (WIN32) + set(CMAKE_FIND_LIBRARY_PREFIXES "lib" PARENT_SCOPE) + set(CMAKE_FIND_LIBRARY_SUFFIXES ".lib" ".dll" PARENT_SCOPE) + endif() +endfunction() + + + +# ----- locate_matlab_root ----- +# +# Attempt to find the path to the Matlab installation. If successful, sets +# the absolute path in the variable MATLAB_ROOT_DIR +function(locate_matlab_root) + + # --- UNIX/APPLE --- + if (UNIX) + # possible root locations, in order of likelihood + set(SEARCH_DIRS_ /Applications /usr/local /opt/local /usr /opt) + foreach (DIR_ ${SEARCH_DIRS_}) + file(GLOB MATLAB_ROOT_DIR_ ${DIR_}/*matlab*) + if (MATLAB_ROOT_DIR_) + # sort in order from highest to lowest + # normally it's in the format MATLAB_R[20XX][A/B] + # TODO: numerical rather than lexicographic sort. However, + # CMake does not support floating-point MATH(EXPR ...) at this time. + list(SORT MATLAB_ROOT_DIR_) + list(REVERSE MATLAB_ROOT_DIR_) + list(GET MATLAB_ROOT_DIR_ 0 MATLAB_ROOT_DIR_) + set(MATLAB_ROOT_DIR ${MATLAB_ROOT_DIR_} PARENT_SCOPE) + return() + endif() + endforeach() + + # --- WINDOWS --- + elseif (WIN32) + # 1. search the path environment variable + find_program(MATLAB_ROOT_DIR_ matlab PATHS ENV PATH) + if (MATLAB_ROOT_DIR_) + # get the root directory from the full path + # /path/to/matlab/rootdir/bin/matlab.exe + get_filename_component(MATLAB_ROOT_DIR_ ${MATLAB_ROOT_DIR_} PATH) + get_filename_component(MATLAB_ROOT_DIR_ ${MATLAB_ROOT_DIR_} PATH) + set(MATLAB_ROOT_DIR ${MATLAB_ROOT_DIR_} PARENT_SCOPE) + return() + endif() + + # 2. search the registry + # determine the available Matlab versions + set(REG_EXTENSION_ "SOFTWARE\\Mathworks\\MATLAB") + set(REG_ROOTS_ "HKEY_LOCAL_MACHINE" "HKEY_CURRENT_USER") + foreach(REG_ROOT_ ${REG_ROOTS_}) + execute_process(COMMAND reg query "${REG_ROOT_}\\${REG_EXTENSION_}" OUTPUT_VARIABLE QUERY_RESPONSE_) + if (QUERY_RESPONSE_) + string(REGEX MATCHALL "[0-9]\\.[0-9]" VERSION_STRINGS_ ${QUERY_RESPONSE_}) + list(APPEND VERSIONS_ ${VERSION_STRINGS_}) + endif() + endforeach() + + # select the highest version + list(APPEND VERSIONS_ "0.0") + list(SORT VERSIONS_) + list(REVERSE VERSIONS_) + list(GET VERSIONS_ 0 VERSION_) + + # request the MATLABROOT from the registry + foreach(REG_ROOT_ ${REG_ROOTS_}) + get_filename_component(QUERY_RESPONSE_ [${REG_ROOT_}\\${REG_EXTENSION_}\\${VERSION_};MATLABROOT] ABSOLUTE) + if (NOT ${QUERY_RESPONSE_} MATCHES "registry$") + set(MATLAB_ROOT_DIR ${QUERY_RESPONSE_} PARENT_SCOPE) + return() + endif() + endforeach() + endif() +endfunction() + + + +# ----- locate_matlab_components ----- +# +# Given a directory MATLAB_ROOT_DIR, attempt to find the Matlab components +# (include directory and libraries) under the root. If everything is found, +# sets the variable MATLAB_FOUND to TRUE +function(locate_matlab_components MATLAB_ROOT_DIR) + # get the mex extension + find_file(MATLAB_MEXEXT_SCRIPT_ NAMES mexext mexext.bat PATHS ${MATLAB_ROOT_DIR}/bin NO_DEFAULT_PATH) + execute_process(COMMAND ${MATLAB_MEXEXT_SCRIPT_} + OUTPUT_VARIABLE MATLAB_MEXEXT_ + OUTPUT_STRIP_TRAILING_WHITESPACE) + if (NOT MATLAB_MEXEXT_) + return() + endif() + + # map the mexext to an architecture extension + set(ARCHITECTURES_ "maci64" "maci" "glnxa64" "glnx64" "sol64" "sola64" "win32" "win64" ) + foreach(ARCHITECTURE_ ${ARCHITECTURES_}) + if(EXISTS ${MATLAB_ROOT_DIR}/bin/${ARCHITECTURE_}) + set(MATLAB_ARCH_ ${ARCHITECTURE_}) + break() + endif() + endforeach() + + # get the path to the libraries + set(MATLAB_LIBRARY_DIRS_ ${MATLAB_ROOT_DIR}/bin/${MATLAB_ARCH_}) + + # get the libraries + set_libarch_prefix_suffix() + find_library(MATLAB_LIB_MX_ mx PATHS ${MATLAB_LIBRARY_DIRS_} NO_DEFAULT_PATH) + find_library(MATLAB_LIB_MEX_ mex PATHS ${MATLAB_LIBRARY_DIRS_} NO_DEFAULT_PATH) + find_library(MATLAB_LIB_MAT_ mat PATHS ${MATLAB_LIBRARY_DIRS_} NO_DEFAULT_PATH) + set(MATLAB_LIBRARIES_ ${MATLAB_LIB_MX_} ${MATLAB_LIB_MEX_} ${MATLAB_LIB_MAT_}) + + # get the include path + find_path(MATLAB_INCLUDE_DIRS_ mex.h ${MATLAB_ROOT_DIR}/extern/include) + + # get the mex shell script + find_program(MATLAB_MEX_SCRIPT_ NAMES mex mex.bat PATHS ${MATLAB_ROOT_DIR}/bin NO_DEFAULT_PATH) + + # get the Matlab executable + find_program(MATLAB_BIN_ NAMES matlab PATHS ${MATLAB_ROOT_DIR}/bin NO_DEFAULT_PATH) + + # export into parent scope + if (MATLAB_MEX_SCRIPT_ AND MATLAB_LIBRARIES_ AND MATLAB_INCLUDE_DIRS_) + set(MATLAB_BIN ${MATLAB_BIN_} PARENT_SCOPE) + set(MATLAB_MEX_SCRIPT ${MATLAB_MEX_SCRIPT_} PARENT_SCOPE) + set(MATLAB_INCLUDE_DIRS ${MATLAB_INCLUDE_DIRS_} PARENT_SCOPE) + set(MATLAB_LIBRARIES ${MATLAB_LIBRARIES_} PARENT_SCOPE) + set(MATLAB_LIBRARY_DIRS ${MATLAB_LIBRARY_DIRS_} PARENT_SCOPE) + set(MATLAB_MEXEXT ${MATLAB_MEXEXT_} PARENT_SCOPE) + set(MATLAB_ARCH ${MATLAB_ARCH_} PARENT_SCOPE) + endif() +endfunction() + + + +# ---------------------------------------------------------------------------- +# FIND MATLAB COMPONENTS +# ---------------------------------------------------------------------------- +if (NOT MATLAB_FOUND) + + # attempt to find the Matlab root folder + if (NOT MATLAB_ROOT_DIR) + locate_matlab_root() + endif() + + # given the matlab root folder, find the library locations + if (MATLAB_ROOT_DIR) + locate_matlab_components(${MATLAB_ROOT_DIR}) + endif() + find_package_handle_standard_args(Matlab DEFAULT_MSG + MATLAB_MEX_SCRIPT MATLAB_INCLUDE_DIRS + MATLAB_ROOT_DIR MATLAB_LIBRARIES + MATLAB_LIBRARY_DIRS MATLAB_MEXEXT + MATLAB_ARCH MATLAB_BIN) +endif() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindOpenEXR.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindOpenEXR.cmake new file mode 100644 index 000000000..c0a46806e --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindOpenEXR.cmake @@ -0,0 +1,108 @@ +# The script is taken from http://code.google.com/p/nvidia-texture-tools/ + +# +# Try to find OpenEXR's libraries, and include path. +# Once done this will define: +# +# OPENEXR_FOUND = OpenEXR found. +# OPENEXR_INCLUDE_PATHS = OpenEXR include directories. +# OPENEXR_LIBRARIES = libraries that are needed to use OpenEXR. +# + +SET(OPENEXR_LIBRARIES "") +SET(OPENEXR_LIBSEARCH_SUFFIXES "") +file(TO_CMAKE_PATH "$ENV{ProgramFiles}" ProgramFiles_ENV_PATH) + +if(WIN32) + SET(OPENEXR_ROOT "C:/Deploy" CACHE STRING "Path to the OpenEXR \"Deploy\" folder") + if(CMAKE_CL_64) + SET(OPENEXR_LIBSEARCH_SUFFIXES x64/Release x64 x64/Debug) + elseif(MSVC) + SET(OPENEXR_LIBSEARCH_SUFFIXES Win32/Release Win32 Win32/Debug) + endif() +else() + set(OPENEXR_ROOT "") +endif() + +SET(LIBRARY_PATHS + /usr/lib + /usr/local/lib + /sw/lib + /opt/local/lib + "${ProgramFiles_ENV_PATH}/OpenEXR/lib/static" + "${OPENEXR_ROOT}/lib") + +FIND_PATH(OPENEXR_INCLUDE_PATH ImfRgbaFile.h + PATH_SUFFIXES OpenEXR + PATHS + /usr/include + /usr/local/include + /sw/include + /opt/local/include + "${ProgramFiles_ENV_PATH}/OpenEXR/include" + "${OPENEXR_ROOT}/include") + +FIND_LIBRARY(OPENEXR_HALF_LIBRARY + NAMES Half + PATH_SUFFIXES ${OPENEXR_LIBSEARCH_SUFFIXES} + PATHS ${LIBRARY_PATHS}) + +FIND_LIBRARY(OPENEXR_IEX_LIBRARY + NAMES Iex + PATH_SUFFIXES ${OPENEXR_LIBSEARCH_SUFFIXES} + PATHS ${LIBRARY_PATHS}) + +FIND_LIBRARY(OPENEXR_IMATH_LIBRARY + NAMES Imath + PATH_SUFFIXES ${OPENEXR_LIBSEARCH_SUFFIXES} + PATHS ${LIBRARY_PATHS}) + +FIND_LIBRARY(OPENEXR_ILMIMF_LIBRARY + NAMES IlmImf + PATH_SUFFIXES ${OPENEXR_LIBSEARCH_SUFFIXES} + PATHS ${LIBRARY_PATHS}) + +FIND_LIBRARY(OPENEXR_ILMTHREAD_LIBRARY + NAMES IlmThread + PATH_SUFFIXES ${OPENEXR_LIBSEARCH_SUFFIXES} + PATHS ${LIBRARY_PATHS}) + +IF (OPENEXR_INCLUDE_PATH AND OPENEXR_IMATH_LIBRARY AND OPENEXR_ILMIMF_LIBRARY AND OPENEXR_IEX_LIBRARY AND OPENEXR_HALF_LIBRARY) + SET(OPENEXR_FOUND TRUE) + SET(OPENEXR_INCLUDE_PATHS ${OPENEXR_INCLUDE_PATH} CACHE PATH "The include paths needed to use OpenEXR") + SET(OPENEXR_LIBRARIES ${OPENEXR_IMATH_LIBRARY} ${OPENEXR_ILMIMF_LIBRARY} ${OPENEXR_IEX_LIBRARY} ${OPENEXR_HALF_LIBRARY} ${OPENEXR_ILMTHREAD_LIBRARY} CACHE STRING "The libraries needed to use OpenEXR" FORCE) +ENDIF () + +IF(OPENEXR_FOUND) + IF(NOT OPENEXR_FIND_QUIETLY) + MESSAGE(STATUS "Found OpenEXR: ${OPENEXR_ILMIMF_LIBRARY}") + ENDIF() + if(PKG_CONFIG_FOUND AND NOT OPENEXR_VERSION) + get_filename_component(OPENEXR_LIB_PATH "${OPENEXR_ILMIMF_LIBRARY}" PATH) + if(EXISTS "${OPENEXR_LIB_PATH}/pkgconfig/OpenEXR.pc") + execute_process(COMMAND ${PKG_CONFIG_EXECUTABLE} --modversion "${OPENEXR_LIB_PATH}/pkgconfig/OpenEXR.pc" + RESULT_VARIABLE PKG_CONFIG_PROCESS + OUTPUT_VARIABLE OPENEXR_VERSION + OUTPUT_STRIP_TRAILING_WHITESPACE ERROR_QUIET) + if(NOT PKG_CONFIG_PROCESS EQUAL 0) + SET(OPENEXR_VERSION "Unknown") + endif() + endif() + endif() + if(NOT OPENEXR_VERSION) + SET(OPENEXR_VERSION "Unknown") + endif() +ELSE() + IF(OPENEXR_FIND_REQUIRED) + MESSAGE(FATAL_ERROR "Could not find OpenEXR library") + ENDIF() +ENDIF() + +MARK_AS_ADVANCED( + OPENEXR_INCLUDE_PATHS + OPENEXR_LIBRARIES + OPENEXR_ILMIMF_LIBRARY + OPENEXR_IMATH_LIBRARY + OPENEXR_IEX_LIBRARY + OPENEXR_HALF_LIBRARY + OPENEXR_ILMTHREAD_LIBRARY) diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindOpenNI.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindOpenNI.cmake new file mode 100644 index 000000000..754186894 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindOpenNI.cmake @@ -0,0 +1,89 @@ +# Main variables: +# OPENNI_LIBRARY and OPENNI_INCLUDES to link OpenCV modules with OpenNI +# HAVE_OPENNI for conditional compilation OpenCV with/without OpenNI + +if(NOT "${OPENNI_LIB_DIR}" STREQUAL "${OPENNI_LIB_DIR_INTERNAL}") + unset(OPENNI_LIBRARY CACHE) + unset(OPENNI_LIB_DIR CACHE) +endif() + +if(NOT "${OPENNI_INCLUDE_DIR}" STREQUAL "${OPENNI_INCLUDE_DIR_INTERNAL}") + unset(OPENNI_INCLUDES CACHE) + unset(OPENNI_INCLUDE_DIR CACHE) +endif() + +if(NOT "${OPENNI_PRIME_SENSOR_MODULE_BIN_DIR}" STREQUAL "${OPENNI_PRIME_SENSOR_MODULE_BIN_DIR_INTERNAL}") + unset(OPENNI_PRIME_SENSOR_MODULE CACHE) + unset(OPENNI_PRIME_SENSOR_MODULE_BIN_DIR CACHE) +endif() + +if(WIN32) + if(NOT (MSVC64 OR MINGW64)) + find_file(OPENNI_INCLUDES "XnCppWrapper.h" PATHS "$ENV{OPEN_NI_INSTALL_PATH}Include" DOC "OpenNI c++ interface header") + find_library(OPENNI_LIBRARY "OpenNI" PATHS $ENV{OPEN_NI_LIB} DOC "OpenNI library") + else() + find_file(OPENNI_INCLUDES "XnCppWrapper.h" PATHS "$ENV{OPEN_NI_INSTALL_PATH64}Include" DOC "OpenNI c++ interface header") + find_library(OPENNI_LIBRARY "OpenNI64" PATHS $ENV{OPEN_NI_LIB64} DOC "OpenNI library") + endif() +elseif(UNIX OR APPLE) + find_file(OPENNI_INCLUDES "XnCppWrapper.h" PATHS "/usr/include/ni" "/usr/include/openni" DOC "OpenNI c++ interface header") + find_library(OPENNI_LIBRARY "OpenNI" PATHS "/usr/lib" DOC "OpenNI library") +endif() + +if(OPENNI_LIBRARY AND OPENNI_INCLUDES) + set(HAVE_OPENNI TRUE) + # the check: are PrimeSensor Modules for OpenNI installed + if(WIN32) + if(NOT (MSVC64 OR MINGW64)) + find_file(OPENNI_PRIME_SENSOR_MODULE "XnCore.dll" PATHS "$ENV{OPEN_NI_INSTALL_PATH}../PrimeSense/Sensor/Bin" "$ENV{OPEN_NI_INSTALL_PATH}../PrimeSense/SensorKinect/Bin" DOC "Core library of PrimeSensor Modules for OpenNI") + else() + find_file(OPENNI_PRIME_SENSOR_MODULE "XnCore64.dll" PATHS "$ENV{OPEN_NI_INSTALL_PATH64}../PrimeSense/Sensor/Bin64" "$ENV{OPEN_NI_INSTALL_PATH64}../PrimeSense/SensorKinect/Bin64" DOC "Core library of PrimeSensor Modules for OpenNI") + endif() + elseif(UNIX OR APPLE) + find_library(OPENNI_PRIME_SENSOR_MODULE "XnCore" PATHS "/usr/lib" DOC "Core library of PrimeSensor Modules for OpenNI") + endif() + + if(OPENNI_PRIME_SENSOR_MODULE) + set(HAVE_OPENNI_PRIME_SENSOR_MODULE TRUE) + endif() +endif() #if(OPENNI_LIBRARY AND OPENNI_INCLUDES) + +get_filename_component(OPENNI_LIB_DIR "${OPENNI_LIBRARY}" PATH) +get_filename_component(OPENNI_INCLUDE_DIR ${OPENNI_INCLUDES} PATH) +get_filename_component(OPENNI_PRIME_SENSOR_MODULE_BIN_DIR "${OPENNI_PRIME_SENSOR_MODULE}" PATH) + +if(HAVE_OPENNI) + set(OPENNI_LIB_DIR "${OPENNI_LIB_DIR}" CACHE PATH "Path to OpenNI libraries" FORCE) + set(OPENNI_INCLUDE_DIR "${OPENNI_INCLUDE_DIR}" CACHE PATH "Path to OpenNI headers" FORCE) + set(OPENNI_PRIME_SENSOR_MODULE_BIN_DIR "${OPENNI_PRIME_SENSOR_MODULE_BIN_DIR}" CACHE PATH "Path to OpenNI PrimeSensor Module binaries" FORCE) +endif() + +if(OPENNI_LIBRARY) + set(OPENNI_LIB_DIR_INTERNAL "${OPENNI_LIB_DIR}" CACHE INTERNAL "This is the value of the last time OPENNI_LIB_DIR was set successfully." FORCE) +else() + message( WARNING, " OpenNI library directory (set by OPENNI_LIB_DIR variable) is not found or does not have OpenNI libraries." ) +endif() + +if(OPENNI_INCLUDES) + set(OPENNI_INCLUDE_DIR_INTERNAL "${OPENNI_INCLUDE_DIR}" CACHE INTERNAL "This is the value of the last time OPENNI_INCLUDE_DIR was set successfully." FORCE) +else() + message( WARNING, " OpenNI include directory (set by OPENNI_INCLUDE_DIR variable) is not found or does not have OpenNI include files." ) +endif() + +if(OPENNI_PRIME_SENSOR_MODULE) + set(OPENNI_PRIME_SENSOR_MODULE_BIN_DIR_INTERNAL "${OPENNI_PRIME_SENSOR_MODULE_BIN_DIR}" CACHE INTERNAL "This is the value of the last time OPENNI_PRIME_SENSOR_MODULE_BIN_DIR was set successfully." FORCE) +else() + message( WARNING, " PrimeSensor Module binaries directory (set by OPENNI_PRIME_SENSOR_MODULE_BIN_DIR variable) is not found or does not have PrimeSensor Module binaries." ) +endif() + +mark_as_advanced(FORCE OPENNI_PRIME_SENSOR_MODULE) +mark_as_advanced(FORCE OPENNI_LIBRARY) +mark_as_advanced(FORCE OPENNI_INCLUDES) + +if(HAVE_OPENNI) + ocv_parse_header("${OPENNI_INCLUDE_DIR}/XnVersion.h" OPENNI_VERSION_LINES XN_MAJOR_VERSION XN_MINOR_VERSION XN_MAINTENANCE_VERSION XN_BUILD_VERSION) + if(XN_MAJOR_VERSION) + set(OPENNI_VERSION_STRING ${XN_MAJOR_VERSION}.${XN_MINOR_VERSION}.${XN_MAINTENANCE_VERSION} CACHE INTERNAL "OpenNI version") + set(OPENNI_VERSION_BUILD ${XN_BUILD_VERSION} CACHE INTERNAL "OpenNI build version") + endif() +endif() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindOpenNI2.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindOpenNI2.cmake new file mode 100644 index 000000000..08e55e6a2 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindOpenNI2.cmake @@ -0,0 +1,61 @@ +# Main variables: +# OPENNI2_LIBRARY and OPENNI2_INCLUDES to link OpenCV modules with OpenNI2 +# HAVE_OPENNI2 for conditional compilation OpenCV with/without OpenNI2 + +if(NOT "${OPENNI2_LIB_DIR}" STREQUAL "${OPENNI2_LIB_DIR_INTERNAL}") + unset(OPENNI2_LIBRARY CACHE) + unset(OPENNI2_LIB_DIR CACHE) +endif() + +if(NOT "${OPENNI2_INCLUDE_DIR}" STREQUAL "${OPENNI2_INCLUDE_DIR_INTERNAL}") + unset(OPENNI2_INCLUDES CACHE) + unset(OPENNI2_INCLUDE_DIR CACHE) +endif() + +if(WIN32) + if(NOT (MSVC64 OR MINGW64)) + find_file(OPENNI2_INCLUDES "OpenNI.h" PATHS "$ENV{OPEN_NI_INSTALL_PATH}Include" DOC "OpenNI2 c++ interface header") + find_library(OPENNI2_LIBRARY "OpenNI2" PATHS $ENV{OPENNI2_LIB} DOC "OpenNI2 library") + else() + find_file(OPENNI2_INCLUDES "OpenNI.h" PATHS $ENV{OPENNI2_INCLUDE64} "$ENV{OPEN_NI_INSTALL_PATH64}Include" DOC "OpenNI2 c++ interface header") + find_library(OPENNI2_LIBRARY "OpenNI2" PATHS $ENV{OPENNI2_LIB64} DOC "OpenNI2 library") + endif() +elseif(UNIX OR APPLE) + find_file(OPENNI2_INCLUDES "OpenNI.h" PATHS "/usr/include/ni2" "/usr/include/openni2" $ENV{OPENNI2_INCLUDE} DOC "OpenNI2 c++ interface header") + find_library(OPENNI2_LIBRARY "OpenNI2" PATHS "/usr/lib" $ENV{OPENNI2_REDIST} DOC "OpenNI2 library") +endif() + +if(OPENNI2_LIBRARY AND OPENNI2_INCLUDES) + set(HAVE_OPENNI2 TRUE) +endif() #if(OPENNI2_LIBRARY AND OPENNI2_INCLUDES) + +get_filename_component(OPENNI2_LIB_DIR "${OPENNI2_LIBRARY}" PATH) +get_filename_component(OPENNI2_INCLUDE_DIR ${OPENNI2_INCLUDES} PATH) + +if(HAVE_OPENNI2) + set(OPENNI2_LIB_DIR "${OPENNI2_LIB_DIR}" CACHE PATH "Path to OpenNI2 libraries" FORCE) + set(OPENNI2_INCLUDE_DIR "${OPENNI2_INCLUDE_DIR}" CACHE PATH "Path to OpenNI2 headers" FORCE) +endif() + +if(OPENNI2_LIBRARY) + set(OPENNI2_LIB_DIR_INTERNAL "${OPENNI2_LIB_DIR}" CACHE INTERNAL "This is the value of the last time OPENNI_LIB_DIR was set successfully." FORCE) +else() + message( WARNING, " OpenNI2 library directory (set by OPENNI2_LIB_DIR variable) is not found or does not have OpenNI2 libraries." ) +endif() + +if(OPENNI2_INCLUDES) + set(OPENNI2_INCLUDE_DIR_INTERNAL "${OPENNI2_INCLUDE_DIR}" CACHE INTERNAL "This is the value of the last time OPENNI2_INCLUDE_DIR was set successfully." FORCE) +else() + message( WARNING, " OpenNI2 include directory (set by OPENNI2_INCLUDE_DIR variable) is not found or does not have OpenNI2 include files." ) +endif() + +mark_as_advanced(FORCE OPENNI2_LIBRARY) +mark_as_advanced(FORCE OPENNI2_INCLUDES) + +if(HAVE_OPENNI2) + ocv_parse_header("${OPENNI2_INCLUDE_DIR}/OniVersion.h" ONI_VERSION_LINE ONI_VERSION_MAJOR ONI_VERSION_MINOR ONI_VERSION_MAINTENANCE ONI_VERSION_BUILD) + if(ONI_VERSION_MAJOR) + set(OPENNI2_VERSION_STRING ${ONI_VERSION_MAJOR}.${ONI_VERSION_MINOR}.${ONI_VERSION_MAINTENANCE} CACHE INTERNAL "OpenNI2 version") + set(OPENNI2_VERSION_BUILD ${ONI_VERSION_BUILD} CACHE INTERNAL "OpenNI2 build version") + endif() +endif() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindWebP.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindWebP.cmake new file mode 100644 index 000000000..740e98512 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindWebP.cmake @@ -0,0 +1,33 @@ +#============================================================================= +# Find WebP library +#============================================================================= +# Find the native WebP headers and libraries. +# +# WEBP_INCLUDE_DIRS - where to find webp/decode.h, etc. +# WEBP_LIBRARIES - List of libraries when using webp. +# WEBP_FOUND - True if webp is found. +#============================================================================= + +# Look for the header file. + +unset(WEBP_FOUND) + +FIND_PATH(WEBP_INCLUDE_DIR NAMES webp/decode.h) + +if(NOT WEBP_INCLUDE_DIR) + unset(WEBP_FOUND) +else() + MARK_AS_ADVANCED(WEBP_INCLUDE_DIR) + + # Look for the library. + FIND_LIBRARY(WEBP_LIBRARY NAMES webp) + MARK_AS_ADVANCED(WEBP_LIBRARY) + + # handle the QUIETLY and REQUIRED arguments and set WEBFOUND_FOUND to TRUE if + # all listed variables are TRUE + INCLUDE(${CMAKE_ROOT}/Modules/FindPackageHandleStandardArgs.cmake) + FIND_PACKAGE_HANDLE_STANDARD_ARGS(WebP DEFAULT_MSG WEBP_LIBRARY WEBP_INCLUDE_DIR) + + SET(WEBP_LIBRARIES ${WEBP_LIBRARY}) + SET(WEBP_INCLUDE_DIRS ${WEBP_INCLUDE_DIR}) +endif() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindXimea.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindXimea.cmake new file mode 100644 index 000000000..2d93292c1 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVFindXimea.cmake @@ -0,0 +1,52 @@ +# - Find XIMEA +# This module finds if XIMEA Software package is installed +# and determines where the binaries and header files are. +# This code sets the following variables: +# +# XIMEA_FOUND - True if XIMEA API found +# XIMEA_PATH: - Path to the XIMEA API folder +# XIMEA_LIBRARY_DIR - XIMEA libraries folder +# +# Created: 5 Aug 2011 by Marian Zajko (marian.zajko@ximea.com) +# Updated: 25 June 2012 by Igor Kuzmin (parafin@ximea.com) +# Updated: 22 October 2012 by Marian Zajko (marian.zajko@ximea.com) +# + +set(XIMEA_FOUND) +set(XIMEA_PATH) +set(XIMEA_LIBRARY_DIR) + +if(WIN32) + # Try to find the XIMEA API path in registry. + GET_FILENAME_COMPONENT(XIMEA_PATH "[HKEY_CURRENT_USER\\Software\\XIMEA\\CamSupport\\API;Path]" ABSOLUTE) + + if(EXISTS ${XIMEA_PATH}) + set(XIMEA_FOUND 1) + # set LIB folders + if(X86_64) + set(XIMEA_LIBRARY_DIR "${XIMEA_PATH}/x64") + else() + set(XIMEA_LIBRARY_DIR "${XIMEA_PATH}/x86") + endif() + else() + set(XIMEA_FOUND 0) + endif() +elseif(APPLE) + if(EXISTS /Library/Frameworks/m3api.framework) + set(XIMEA_FOUND 1) + else() + set(XIMEA_FOUND 0) + endif() +else() + if(EXISTS /opt/XIMEA) + set(XIMEA_FOUND 1) + # set folders + set(XIMEA_PATH /opt/XIMEA/include) + else() + set(XIMEA_FOUND 0) + endif() +endif() + +mark_as_advanced(FORCE XIMEA_FOUND) +mark_as_advanced(FORCE XIMEA_PATH) +mark_as_advanced(FORCE XIMEA_LIBRARY_DIR) diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVGenABI.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVGenABI.cmake new file mode 100644 index 000000000..35cc10d8e --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVGenABI.cmake @@ -0,0 +1,49 @@ +if (NOT GENERATE_ABI_DESCRIPTOR) + return() +endif() + +set(filename "opencv_abi.xml") +set(path1 "${CMAKE_BINARY_DIR}/${filename}") + +set(modules "${OPENCV_MODULES_PUBLIC}") +ocv_list_filterout(modules "opencv_ts") + +message(STATUS "Generating ABI compliance checker configuration: ${filename}") + +if (OPENCV_VCSVERSION AND NOT OPENCV_VCSVERSION STREQUAL "unknown") + set(OPENCV_ABI_VERSION "${OPENCV_VCSVERSION}") +else() + set(OPENCV_ABI_VERSION "${OPENCV_VERSION}") +endif() + +# Headers +set(OPENCV_ABI_HEADERS "{RELPATH}/${OPENCV_INCLUDE_INSTALL_PATH}") + +# Libraries +set(OPENCV_ABI_LIBRARIES "{RELPATH}/${OPENCV_LIB_INSTALL_PATH}") + +set(OPENCV_ABI_SKIP_HEADERS "") +set(OPENCV_ABI_SKIP_LIBRARIES "") +foreach(mod ${OPENCV_MODULES_BUILD}) + string(REGEX REPLACE "^opencv_" "" mod "${mod}") + if(NOT "${OPENCV_MODULE_opencv_${mod}_LOCATION}" STREQUAL "${OpenCV_SOURCE_DIR}/modules/${mod}") + # headers + foreach(h ${OPENCV_MODULE_opencv_${mod}_HEADERS}) + file(RELATIVE_PATH h "${OPENCV_MODULE_opencv_${mod}_LOCATION}/include" "${h}") + list(APPEND OPENCV_ABI_SKIP_HEADERS "${h}") + endforeach() + # libraries + set(lib_name "") + get_target_property(lib_name opencv_${mod} LOCATION) + get_filename_component(lib_name "${lib_name}" NAME) + list(APPEND OPENCV_ABI_SKIP_LIBRARIES "${lib_name}") + endif() +endforeach() +string(REPLACE ";" "\n " OPENCV_ABI_SKIP_HEADERS "${OPENCV_ABI_SKIP_HEADERS}") +string(REPLACE ";" "\n " OPENCV_ABI_SKIP_LIBRARIES "${OPENCV_ABI_SKIP_LIBRARIES}") + +# Options +set(OPENCV_ABI_GCC_OPTIONS "${CMAKE_CXX_FLAGS} ${CMAKE_CXX_FLAGS_RELEASE}") +string(REGEX REPLACE "([^ ]) +([^ ])" "\\1\\n \\2" OPENCV_ABI_GCC_OPTIONS "${OPENCV_ABI_GCC_OPTIONS}") + +configure_file("${CMAKE_CURRENT_SOURCE_DIR}/cmake/templates/opencv_abi.xml.in" "${path1}") diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVGenAndroidMK.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVGenAndroidMK.cmake new file mode 100644 index 000000000..627d86016 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVGenAndroidMK.cmake @@ -0,0 +1,66 @@ +if(ANDROID) + # -------------------------------------------------------------------------------------------- + # Installation for Android ndk-build makefile: OpenCV.mk + # Part 1/2: ${BIN_DIR}/OpenCV.mk -> For use *without* "make install" + # Part 2/2: ${BIN_DIR}/unix-install/OpenCV.mk -> For use with "make install" + # ------------------------------------------------------------------------------------------- + + # build type + if(BUILD_SHARED_LIBS) + set(OPENCV_LIBTYPE_CONFIGMAKE "SHARED") + else() + set(OPENCV_LIBTYPE_CONFIGMAKE "STATIC") + endif() + + if(BUILD_FAT_JAVA_LIB) + set(OPENCV_LIBTYPE_CONFIGMAKE "SHARED") + set(OPENCV_STATIC_LIBTYPE_CONFIGMAKE "STATIC") + else() + set(OPENCV_STATIC_LIBTYPE_CONFIGMAKE ${OPENCV_LIBTYPE_CONFIGMAKE}) + endif() + + # build the list of opencv libs and dependencies for all modules + ocv_get_all_libs(OPENCV_MODULES_CONFIGMAKE OPENCV_EXTRA_COMPONENTS_CONFIGMAKE OPENCV_3RDPARTY_COMPONENTS_CONFIGMAKE) + + # list -> string + string(REPLACE ";" " " OPENCV_MODULES_CONFIGMAKE "${OPENCV_MODULES_CONFIGMAKE}") + string(REPLACE ";" " " OPENCV_EXTRA_COMPONENTS_CONFIGMAKE "${OPENCV_EXTRA_COMPONENTS_CONFIGMAKE}") + string(REPLACE ";" " " OPENCV_3RDPARTY_COMPONENTS_CONFIGMAKE "${OPENCV_3RDPARTY_COMPONENTS_CONFIGMAKE}") + + # replace 'opencv_' -> ''' + string(REPLACE "opencv_" "" OPENCV_MODULES_CONFIGMAKE "${OPENCV_MODULES_CONFIGMAKE}") + + + # prepare 3rd-party component list without TBB for armeabi and mips platforms. TBB is useless there. + set(OPENCV_3RDPARTY_COMPONENTS_CONFIGMAKE_NO_TBB ${OPENCV_3RDPARTY_COMPONENTS_CONFIGMAKE}) + foreach(mod ${OPENCV_3RDPARTY_COMPONENTS_CONFIGMAKE_NO_TBB}) + string(REPLACE "tbb" "" OPENCV_3RDPARTY_COMPONENTS_CONFIGMAKE_NO_TBB "${OPENCV_3RDPARTY_COMPONENTS_CONFIGMAKE_NO_TBB}") + endforeach() + + if(BUILD_FAT_JAVA_LIB) + set(OPENCV_LIBS_CONFIGMAKE java3) + else() + set(OPENCV_LIBS_CONFIGMAKE "${OPENCV_MODULES_CONFIGMAKE}") + endif() + + # ------------------------------------------------------------------------------------------- + # Part 1/2: ${BIN_DIR}/OpenCV.mk -> For use *without* "make install" + # ------------------------------------------------------------------------------------------- + set(OPENCV_INCLUDE_DIRS_CONFIGCMAKE "\"${OPENCV_CONFIG_FILE_INCLUDE_DIR}\" \"${OpenCV_SOURCE_DIR}/include\" \"${OpenCV_SOURCE_DIR}/include/opencv\"") + set(OPENCV_BASE_INCLUDE_DIR_CONFIGCMAKE "\"${OpenCV_SOURCE_DIR}\"") + set(OPENCV_LIBS_DIR_CONFIGCMAKE "\$(OPENCV_THIS_DIR)/lib/\$(OPENCV_TARGET_ARCH_ABI)") + set(OPENCV_3RDPARTY_LIBS_DIR_CONFIGCMAKE "\$(OPENCV_THIS_DIR)/3rdparty/lib/\$(OPENCV_TARGET_ARCH_ABI)") + + configure_file("${OpenCV_SOURCE_DIR}/cmake/templates/OpenCV.mk.in" "${CMAKE_BINARY_DIR}/OpenCV.mk" @ONLY) + + # ------------------------------------------------------------------------------------------- + # Part 2/2: ${BIN_DIR}/unix-install/OpenCV.mk -> For use with "make install" + # ------------------------------------------------------------------------------------------- + set(OPENCV_INCLUDE_DIRS_CONFIGCMAKE "\"\$(LOCAL_PATH)/\$(OPENCV_THIS_DIR)/include/opencv\" \"\$(LOCAL_PATH)/\$(OPENCV_THIS_DIR)/include\"") + set(OPENCV_BASE_INCLUDE_DIR_CONFIGCMAKE "") + set(OPENCV_LIBS_DIR_CONFIGCMAKE "\$(OPENCV_THIS_DIR)/../libs/\$(OPENCV_TARGET_ARCH_ABI)") + set(OPENCV_3RDPARTY_LIBS_DIR_CONFIGCMAKE "\$(OPENCV_THIS_DIR)/../3rdparty/libs/\$(OPENCV_TARGET_ARCH_ABI)") + + configure_file("${OpenCV_SOURCE_DIR}/cmake/templates/OpenCV.mk.in" "${CMAKE_BINARY_DIR}/unix-install/OpenCV.mk" @ONLY) + install(FILES ${CMAKE_BINARY_DIR}/unix-install/OpenCV.mk DESTINATION ${OPENCV_CONFIG_INSTALL_PATH} COMPONENT dev) +endif(ANDROID) diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVGenConfig.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVGenConfig.cmake new file mode 100644 index 000000000..ae8fc8939 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVGenConfig.cmake @@ -0,0 +1,159 @@ +# -------------------------------------------------------------------------------------------- +# Installation for CMake Module: OpenCVConfig.cmake +# Part 1/3: ${BIN_DIR}/OpenCVConfig.cmake -> For use *without* "make install" +# Part 2/3: ${BIN_DIR}/unix-install/OpenCVConfig.cmake -> For use with "make install" +# Part 3/3: ${BIN_DIR}/win-install/OpenCVConfig.cmake -> For use within binary installers/packages +# ------------------------------------------------------------------------------------------- + +if(INSTALL_TO_MANGLED_PATHS) + set(OpenCV_USE_MANGLED_PATHS_CONFIGCMAKE TRUE) +else() + set(OpenCV_USE_MANGLED_PATHS_CONFIGCMAKE FALSE) +endif() + +if(NOT OpenCV_CUDA_CC) + set(OpenCV_CUDA_CC_CONFIGCMAKE "\"\"") + set(OpenCV_CUDA_VERSION "") +else() + set(OpenCV_CUDA_CC_CONFIGCMAKE "${OpenCV_CUDA_CC}") + set(OpenCV_CUDA_VERSION ${CUDA_VERSION_STRING}) +endif() + +if(NOT ANDROID_NATIVE_API_LEVEL) + set(OpenCV_ANDROID_NATIVE_API_LEVEL_CONFIGCMAKE 0) +else() + set(OpenCV_ANDROID_NATIVE_API_LEVEL_CONFIGCMAKE "${ANDROID_NATIVE_API_LEVEL}") +endif() + +if(CMAKE_GENERATOR MATCHES "Visual" OR CMAKE_GENERATOR MATCHES "Xcode") + set(OpenCV_ADD_DEBUG_RELEASE_CONFIGCMAKE TRUE) +else() + set(OpenCV_ADD_DEBUG_RELEASE_CONFIGCMAKE FALSE) +endif() + + + +if(WIN32) + if(MINGW) + set(OPENCV_LINK_LIBRARY_SUFFIX ".dll.a") + else() + set(OPENCV_LINK_LIBRARY_SUFFIX ".lib") + endif() +endif() + +#build list of modules available for the OpenCV user +set(OpenCV_LIB_COMPONENTS "") +foreach(m ${OPENCV_MODULES_PUBLIC}) + list(INSERT OpenCV_LIB_COMPONENTS 0 ${${m}_MODULE_DEPS_OPT} ${m}) +endforeach() +ocv_list_unique(OpenCV_LIB_COMPONENTS) +set(OPENCV_MODULES_CONFIGCMAKE ${OpenCV_LIB_COMPONENTS}) +ocv_list_filterout(OpenCV_LIB_COMPONENTS "^opencv_") +if(OpenCV_LIB_COMPONENTS) + list(REMOVE_ITEM OPENCV_MODULES_CONFIGCMAKE ${OpenCV_LIB_COMPONENTS}) +endif() + +if(BUILD_FAT_JAVA_LIB AND HAVE_opencv_java) + list(APPEND OPENCV_MODULES_CONFIGCMAKE opencv_java) +endif() + +# ------------------------------------------------------------------------------------------- +# Part 1/3: ${BIN_DIR}/OpenCVConfig.cmake -> For use *without* "make install" +# ------------------------------------------------------------------------------------------- +set(OpenCV_INCLUDE_DIRS_CONFIGCMAKE "\"${OPENCV_CONFIG_FILE_INCLUDE_DIR}\" \"${OpenCV_SOURCE_DIR}/include\" \"${OpenCV_SOURCE_DIR}/include/opencv\"") + +set(OpenCV2_INCLUDE_DIRS_CONFIGCMAKE "") +foreach(m ${OPENCV_MODULES_BUILD}) + if(EXISTS "${OPENCV_MODULE_${m}_LOCATION}/include") + list(APPEND OpenCV2_INCLUDE_DIRS_CONFIGCMAKE "${OPENCV_MODULE_${m}_LOCATION}/include") + endif() +endforeach() + +if(ANDROID AND NOT BUILD_SHARED_LIBS AND HAVE_TBB) + #export TBB headers location because static linkage of TBB might be troublesome if application wants to use TBB itself + list(APPEND OpenCV2_INCLUDE_DIRS_CONFIGCMAKE ${TBB_INCLUDE_DIRS}) +endif() + +set(modules_file_suffix "") +if(ANDROID) + # the REPLACE here is needed, because OpenCVModules_armeabi.cmake includes + # OpenCVModules_armeabi-*.cmake, which would match OpenCVModules_armeabi-v7a*.cmake. + string(REPLACE - _ modules_file_suffix "_${ANDROID_NDK_ABI_NAME}") +endif() + +export(TARGETS ${OpenCVModules_TARGETS} FILE "${CMAKE_BINARY_DIR}/OpenCVModules${modules_file_suffix}.cmake") + +if(TARGET ippicv) + set(USE_IPPICV TRUE) + file(RELATIVE_PATH INSTALL_PATH_RELATIVE_IPPICV ${CMAKE_BINARY_DIR} ${IPPICV_LOCATION_PATH}) +else() + set(USE_IPPICV FALSE) + set(INSTALL_PATH_RELATIVE_IPPICV "non-existed-path") +endif() + +configure_file("${OpenCV_SOURCE_DIR}/cmake/templates/OpenCVConfig.cmake.in" "${CMAKE_BINARY_DIR}/OpenCVConfig.cmake" @ONLY) +#support for version checking when finding opencv. find_package(OpenCV 2.3.1 EXACT) should now work. +configure_file("${OpenCV_SOURCE_DIR}/cmake/templates/OpenCVConfig-version.cmake.in" "${CMAKE_BINARY_DIR}/OpenCVConfig-version.cmake" @ONLY) + +# -------------------------------------------------------------------------------------------- +# Part 2/3: ${BIN_DIR}/unix-install/OpenCVConfig.cmake -> For use *with* "make install" +# ------------------------------------------------------------------------------------------- +set(OpenCV_INCLUDE_DIRS_CONFIGCMAKE "\"\${OpenCV_INSTALL_PATH}/${OPENCV_INCLUDE_INSTALL_PATH}/opencv" "\${OpenCV_INSTALL_PATH}/${OPENCV_INCLUDE_INSTALL_PATH}\"") + +set(OpenCV2_INCLUDE_DIRS_CONFIGCMAKE "\"\"") +set(OpenCV_3RDPARTY_LIB_DIRS_CONFIGCMAKE "\"\${OpenCV_INSTALL_PATH}/${OPENCV_3P_LIB_INSTALL_PATH}\"") + +if(UNIX) # ANDROID configuration is created here also + #http://www.vtk.org/Wiki/CMake/Tutorials/Packaging reference + # For a command "find_package( [major[.minor]] [EXACT] [REQUIRED|QUIET])" + # cmake will look in the following dir on unix: + # /(share|lib)/cmake/*/ (U) + # /(share|lib)/*/ (U) + # /(share|lib)/*/(cmake|CMake)/ (U) + if(USE_IPPICV) + file(RELATIVE_PATH INSTALL_PATH_RELATIVE_IPPICV "${CMAKE_INSTALL_PREFIX}/${OPENCV_CONFIG_INSTALL_PATH}/" ${IPPICV_INSTALL_PATH}) + endif() + configure_file("${OpenCV_SOURCE_DIR}/cmake/templates/OpenCVConfig.cmake.in" "${CMAKE_BINARY_DIR}/unix-install/OpenCVConfig.cmake" @ONLY) + configure_file("${OpenCV_SOURCE_DIR}/cmake/templates/OpenCVConfig-version.cmake.in" "${CMAKE_BINARY_DIR}/unix-install/OpenCVConfig-version.cmake" @ONLY) + install(FILES "${CMAKE_BINARY_DIR}/unix-install/OpenCVConfig.cmake" DESTINATION ${OPENCV_CONFIG_INSTALL_PATH}/ COMPONENT dev) + install(FILES ${CMAKE_BINARY_DIR}/unix-install/OpenCVConfig-version.cmake DESTINATION ${OPENCV_CONFIG_INSTALL_PATH}/ COMPONENT dev) + install(EXPORT OpenCVModules DESTINATION ${OPENCV_CONFIG_INSTALL_PATH}/ FILE OpenCVModules${modules_file_suffix}.cmake COMPONENT dev) +endif() + +if(ANDROID) + install(FILES "${OpenCV_SOURCE_DIR}/platforms/android/android.toolchain.cmake" DESTINATION ${OPENCV_CONFIG_INSTALL_PATH}/ COMPONENT dev) +endif() + +# -------------------------------------------------------------------------------------------- +# Part 3/3: ${BIN_DIR}/win-install/OpenCVConfig.cmake -> For use within binary installers/packages +# -------------------------------------------------------------------------------------------- +if(WIN32) + set(OpenCV_INCLUDE_DIRS_CONFIGCMAKE "\"\${OpenCV_CONFIG_PATH}/include\" \"\${OpenCV_CONFIG_PATH}/include/opencv\"") + set(OpenCV2_INCLUDE_DIRS_CONFIGCMAKE "\"\"") + + exec_program(mkdir ARGS "-p \"${CMAKE_BINARY_DIR}/win-install/\"" OUTPUT_VARIABLE RET_VAL) + if(USE_IPPICV) + if(BUILD_SHARED_LIBS) + file(RELATIVE_PATH INSTALL_PATH_RELATIVE_IPPICV "${CMAKE_INSTALL_PREFIX}/${OpenCV_INSTALL_BINARIES_PREFIX}lib" ${IPPICV_INSTALL_PATH}) + else() + file(RELATIVE_PATH INSTALL_PATH_RELATIVE_IPPICV "${CMAKE_INSTALL_PREFIX}/${OpenCV_INSTALL_BINARIES_PREFIX}staticlib" ${IPPICV_INSTALL_PATH}) + endif() + endif() + configure_file("${OpenCV_SOURCE_DIR}/cmake/templates/OpenCVConfig.cmake.in" "${CMAKE_BINARY_DIR}/win-install/OpenCVConfig.cmake" @ONLY) + configure_file("${OpenCV_SOURCE_DIR}/cmake/templates/OpenCVConfig-version.cmake.in" "${CMAKE_BINARY_DIR}/win-install/OpenCVConfig-version.cmake" @ONLY) + if (CMAKE_HOST_SYSTEM_NAME MATCHES Windows) + if(BUILD_SHARED_LIBS) + install(FILES "${CMAKE_BINARY_DIR}/win-install/OpenCVConfig.cmake" DESTINATION "${OpenCV_INSTALL_BINARIES_PREFIX}lib" COMPONENT dev) + install(EXPORT OpenCVModules DESTINATION "${OpenCV_INSTALL_BINARIES_PREFIX}lib" FILE OpenCVModules${modules_file_suffix}.cmake COMPONENT dev) + else() + install(FILES "${CMAKE_BINARY_DIR}/win-install/OpenCVConfig.cmake" DESTINATION "${OpenCV_INSTALL_BINARIES_PREFIX}staticlib" COMPONENT dev) + install(EXPORT OpenCVModules DESTINATION "${OpenCV_INSTALL_BINARIES_PREFIX}staticlib" FILE OpenCVModules${modules_file_suffix}.cmake COMPONENT dev) + endif() + install(FILES "${CMAKE_BINARY_DIR}/win-install/OpenCVConfig-version.cmake" DESTINATION "${CMAKE_INSTALL_PREFIX}" COMPONENT dev) + install(FILES "${OpenCV_SOURCE_DIR}/cmake/OpenCVConfig.cmake" DESTINATION "${CMAKE_INSTALL_PREFIX}/" COMPONENT dev) + else () + install(FILES "${CMAKE_BINARY_DIR}/win-install/OpenCVConfig.cmake" DESTINATION "${OpenCV_INSTALL_BINARIES_PREFIX}lib/cmake/opencv-${OPENCV_VERSION}" COMPONENT dev) + install(EXPORT OpenCVModules DESTINATION "${OpenCV_INSTALL_BINARIES_PREFIX}lib/cmake/opencv-${OPENCV_VERSION}" FILE OpenCVModules${modules_file_suffix}.cmake COMPONENT dev) + install(FILES "${CMAKE_BINARY_DIR}/win-install/OpenCVConfig-version.cmake" DESTINATION "${CMAKE_INSTALL_PREFIX}/lib/cmake/opencv-${OPENCV_VERSION}" COMPONENT dev) + endif () +endif() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVGenHeaders.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVGenHeaders.cmake new file mode 100644 index 000000000..298897904 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVGenHeaders.cmake @@ -0,0 +1,28 @@ +# platform-specific config file +configure_file("${OpenCV_SOURCE_DIR}/cmake/templates/cvconfig.h.in" "${OPENCV_CONFIG_FILE_INCLUDE_DIR}/cvconfig.h") +configure_file("${OpenCV_SOURCE_DIR}/cmake/templates/cvconfig.h.in" "${OPENCV_CONFIG_FILE_INCLUDE_DIR}/opencv2/cvconfig.h") +install(FILES "${OPENCV_CONFIG_FILE_INCLUDE_DIR}/cvconfig.h" DESTINATION ${OPENCV_INCLUDE_INSTALL_PATH}/opencv2 COMPONENT dev) + +# ---------------------------------------------------------------------------- +# opencv_modules.hpp based on actual modules list +# ---------------------------------------------------------------------------- +set(OPENCV_MODULE_DEFINITIONS_CONFIGMAKE "") + +set(OPENCV_MOD_LIST ${OPENCV_MODULES_PUBLIC}) +ocv_list_sort(OPENCV_MOD_LIST) +foreach(m ${OPENCV_MOD_LIST}) + string(TOUPPER "${m}" m) + set(OPENCV_MODULE_DEFINITIONS_CONFIGMAKE "${OPENCV_MODULE_DEFINITIONS_CONFIGMAKE}#define HAVE_${m}\n") +endforeach() + +set(OPENCV_MODULE_DEFINITIONS_CONFIGMAKE "${OPENCV_MODULE_DEFINITIONS_CONFIGMAKE}\n") + +#set(OPENCV_MOD_LIST ${OPENCV_MODULES_DISABLED_USER} ${OPENCV_MODULES_DISABLED_AUTO} ${OPENCV_MODULES_DISABLED_FORCE}) +#ocv_list_sort(OPENCV_MOD_LIST) +#foreach(m ${OPENCV_MOD_LIST}) +# string(TOUPPER "${m}" m) +# set(OPENCV_MODULE_DEFINITIONS_CONFIGMAKE "${OPENCV_MODULE_DEFINITIONS_CONFIGMAKE}#undef HAVE_${m}\n") +#endforeach() + +configure_file("${OpenCV_SOURCE_DIR}/cmake/templates/opencv_modules.hpp.in" "${OPENCV_CONFIG_FILE_INCLUDE_DIR}/opencv2/opencv_modules.hpp") +install(FILES "${OPENCV_CONFIG_FILE_INCLUDE_DIR}/opencv2/opencv_modules.hpp" DESTINATION ${OPENCV_INCLUDE_INSTALL_PATH}/opencv2 COMPONENT dev) diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVGenInfoPlist.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVGenInfoPlist.cmake new file mode 100644 index 000000000..680afb2df --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVGenInfoPlist.cmake @@ -0,0 +1,15 @@ +if(OPENCV_EXTRA_WORLD) + set(OPENCV_APPLE_BUNDLE_NAME "OpenCV_contrib") + set(OPENCV_APPLE_BUNDLE_ID "org.opencv_contrib") +else() + set(OPENCV_APPLE_BUNDLE_NAME "OpenCV") + set(OPENCV_APPLE_BUNDLE_ID "org.opencv") +endif() + +if(IOS) + configure_file("${OpenCV_SOURCE_DIR}/platforms/ios/Info.plist.in" + "${CMAKE_BINARY_DIR}/ios/Info.plist") +elseif(APPLE) + configure_file("${OpenCV_SOURCE_DIR}/platforms/osx/Info.plist.in" + "${CMAKE_BINARY_DIR}/osx/Info.plist") +endif() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVGenPkgconfig.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVGenPkgconfig.cmake new file mode 100644 index 000000000..28a6da686 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVGenPkgconfig.cmake @@ -0,0 +1,98 @@ +# -------------------------------------------------------------------------------------------- +# according to man pkg-config +# The package name specified on the pkg-config command line is defined to +# be the name of the metadata file, minus the .pc extension. If a library +# can install multiple versions simultaneously, it must give each version +# its own name (for example, GTK 1.2 might have the package name "gtk+" +# while GTK 2.0 has "gtk+-2.0"). +# +# ${BIN_DIR}/unix-install/opencv.pc -> For use *with* "make install" +# ------------------------------------------------------------------------------------------- + +macro(fix_prefix lst isown) + set(_lst) + foreach(item ${${lst}}) + if(TARGET ${item}) + get_target_property(item "${item}" LOCATION_${CMAKE_BUILD_TYPE}) + if("${isown}") + get_filename_component(item "${item}" NAME_WE) + string(REGEX REPLACE "^lib(.*)" "\\1" item "${item}") + endif() + endif() + if(item MATCHES "^-l") + list(APPEND _lst "${item}") + elseif(item MATCHES "[\\/]") + get_filename_component(libdir "${item}" PATH) + get_filename_component(libname "${item}" NAME_WE) + string(REGEX REPLACE "^lib(.*)" "\\1" libname "${libname}") + list(APPEND _lst "-L${libdir}" "-l${libname}") + else() + list(APPEND _lst "-l${item}") + endif() + endforeach() + set(${lst} ${_lst}) + unset(_lst) +endmacro() + +# build the list of opencv libs and dependencies for all modules +ocv_get_all_libs(_modules _extra _3rdparty) + +#build the list of components + +# Note: +# when linking against static libraries, if libfoo depends on libbar, then +# libfoo must come first in the linker flags. + +# world and contrib_world are special targets whose library should come first, +# especially for static link. +if(_modules MATCHES "opencv_world") + set(_modules "opencv_world") +endif() + +if(_modules MATCHES "opencv_contrib_world") + list(REMOVE_ITEM _modules "opencv_contrib_world") + list(INSERT _modules 0 "opencv_contrib_world") +endif() + +fix_prefix(_modules TRUE) +fix_prefix(_extra FALSE) +fix_prefix(_3rdparty TRUE) + +ocv_list_unique(_modules) +ocv_list_unique(_extra) +ocv_list_unique(_3rdparty) + +set(OPENCV_PC_LIBS + "-L\${exec_prefix}/${OPENCV_LIB_INSTALL_PATH}" + "${_modules}" +) +if (BUILD_SHARED_LIBS) + set(OPENCV_PC_LIBS_PRIVATE "${_extra}") +else() + set(OPENCV_PC_LIBS_PRIVATE + "-L\${exec_prefix}/${OPENCV_3P_LIB_INSTALL_PATH}" + "${_3rdparty}" + "${_extra}" + ) +endif() +string(REPLACE ";" " " OPENCV_PC_LIBS "${OPENCV_PC_LIBS}") +string(REPLACE ";" " " OPENCV_PC_LIBS_PRIVATE "${OPENCV_PC_LIBS_PRIVATE}") + +#generate the .pc file +set(prefix "${CMAKE_INSTALL_PREFIX}") +set(exec_prefix "\${prefix}") +set(libdir "\${exec_prefix}/${OPENCV_LIB_INSTALL_PATH}") +set(includedir "\${prefix}/${OPENCV_INCLUDE_INSTALL_PATH}") + +if(INSTALL_TO_MANGLED_PATHS) + set(OPENCV_PC_FILE_NAME "opencv-${OPENCV_VERSION}.pc") +else() + set(OPENCV_PC_FILE_NAME opencv.pc) +endif() +configure_file("${OpenCV_SOURCE_DIR}/cmake/templates/opencv-XXX.pc.in" + "${CMAKE_BINARY_DIR}/unix-install/${OPENCV_PC_FILE_NAME}" + @ONLY) + +if(UNIX AND NOT ANDROID) + install(FILES ${CMAKE_BINARY_DIR}/unix-install/${OPENCV_PC_FILE_NAME} DESTINATION ${OPENCV_LIB_INSTALL_PATH}/pkgconfig COMPONENT dev) +endif() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVMinDepVersions.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVMinDepVersions.cmake new file mode 100644 index 000000000..e8591e26e --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVMinDepVersions.cmake @@ -0,0 +1,6 @@ +set(MIN_VER_CMAKE 2.8.7) +set(MIN_VER_CUDA 4.2) +set(MIN_VER_PYTHON2 2.6) +set(MIN_VER_PYTHON3 3.2) +set(MIN_VER_ZLIB 1.2.3) +set(MIN_VER_GTK 2.18.0) diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVModule.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVModule.cmake new file mode 100644 index 000000000..a1a1b9020 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVModule.cmake @@ -0,0 +1,1071 @@ +# Local variables (set for each module): +# +# name - short name in lower case i.e. core +# the_module - full name in lower case i.e. opencv_core + +# Global variables: +# +# OPENCV_MODULE_${the_module}_LOCATION +# OPENCV_MODULE_${the_module}_BINARY_DIR +# OPENCV_MODULE_${the_module}_DESCRIPTION +# OPENCV_MODULE_${the_module}_CLASS - PUBLIC|INTERNAL|BINDINGS +# OPENCV_MODULE_${the_module}_HEADERS +# OPENCV_MODULE_${the_module}_SOURCES +# OPENCV_MODULE_${the_module}_DEPS - final flattened set of module dependencies +# OPENCV_MODULE_${the_module}_DEPS_TO_LINK - differs from above for world build only +# OPENCV_MODULE_${the_module}_DEPS_EXT - non-module dependencies +# OPENCV_MODULE_${the_module}_REQ_DEPS +# OPENCV_MODULE_${the_module}_OPT_DEPS +# OPENCV_MODULE_${the_module}_PRIVATE_REQ_DEPS +# OPENCV_MODULE_${the_module}_PRIVATE_OPT_DEPS +# OPENCV_MODULE_${the_module}_IS_PART_OF_WORLD +# OPENCV_MODULE_${the_module}_CUDA_OBJECTS - compiled CUDA objects list +# OPENCV_MODULE_${the_module}_CHILDREN - list of submodules for compound modules (cmake >= 2.8.8) +# OPENCV_MODULE_${the_module}_WRAPPERS - list of wrappers supporting this module +# HAVE_${the_module} - for fast check of module availability + +# To control the setup of the module you could also set: +# the_description - text to be used as current module description +# OPENCV_MODULE_TYPE - STATIC|SHARED - set to force override global settings for current module +# OPENCV_MODULE_IS_PART_OF_WORLD - ON|OFF (default ON) - should the module be added to the opencv_world? +# BUILD_${the_module}_INIT - ON|OFF (default ON) - initial value for BUILD_${the_module} +# OPENCV_MODULE_CHILDREN - list of submodules + +# The verbose template for OpenCV module: +# +# ocv_add_module(modname ) +# ocv_glob_module_sources(([EXCLUDE_CUDA] ) +# or glob them manually and ocv_set_module_sources(...) +# ocv_module_include_directories() +# ocv_create_module() +# +# ocv_add_precompiled_headers(${the_module}) +# +# ocv_add_accuracy_tests() +# ocv_add_perf_tests() +# ocv_add_samples() +# +# +# If module have no "extra" then you can define it in one line: +# +# ocv_define_module(modname ) + +# clean flags for modules enabled on previous cmake run +# this is necessary to correctly handle modules removal +foreach(mod ${OPENCV_MODULES_BUILD} ${OPENCV_MODULES_DISABLED_USER} ${OPENCV_MODULES_DISABLED_AUTO} ${OPENCV_MODULES_DISABLED_FORCE}) + if(HAVE_${mod}) + unset(HAVE_${mod} CACHE) + endif() + unset(OPENCV_MODULE_${mod}_REQ_DEPS CACHE) + unset(OPENCV_MODULE_${mod}_OPT_DEPS CACHE) + unset(OPENCV_MODULE_${mod}_PRIVATE_REQ_DEPS CACHE) + unset(OPENCV_MODULE_${mod}_PRIVATE_OPT_DEPS CACHE) + unset(OPENCV_MODULE_${mod}_LINK_DEPS CACHE) + unset(OPENCV_MODULE_${mod}_WRAPPERS CACHE) +endforeach() + +# clean modules info which needs to be recalculated +set(OPENCV_MODULES_PUBLIC "" CACHE INTERNAL "List of OpenCV modules marked for export") +set(OPENCV_MODULES_BUILD "" CACHE INTERNAL "List of OpenCV modules included into the build") +set(OPENCV_MODULES_DISABLED_USER "" CACHE INTERNAL "List of OpenCV modules explicitly disabled by user") +set(OPENCV_MODULES_DISABLED_AUTO "" CACHE INTERNAL "List of OpenCV modules implicitly disabled due to dependencies") +set(OPENCV_MODULES_DISABLED_FORCE "" CACHE INTERNAL "List of OpenCV modules which can not be build in current configuration") +unset(OPENCV_WORLD_MODULES CACHE) + +# adds dependencies to OpenCV module +# Usage: +# add_dependencies(opencv_ [REQUIRED] [] [OPTIONAL ] [WRAP ]) +# Notes: +# * - can include full names of modules or full pathes to shared/static libraries or cmake targets +macro(ocv_add_dependencies full_modname) + ocv_debug_message("ocv_add_dependencies(" ${full_modname} ${ARGN} ")") + #we don't clean the dependencies here to allow this macro several times for every module + foreach(d "REQUIRED" ${ARGN}) + if(d STREQUAL "REQUIRED") + set(__depsvar OPENCV_MODULE_${full_modname}_REQ_DEPS) + elseif(d STREQUAL "OPTIONAL") + set(__depsvar OPENCV_MODULE_${full_modname}_OPT_DEPS) + elseif(d STREQUAL "PRIVATE_REQUIRED") + set(__depsvar OPENCV_MODULE_${full_modname}_PRIVATE_REQ_DEPS) + elseif(d STREQUAL "PRIVATE_OPTIONAL") + set(__depsvar OPENCV_MODULE_${full_modname}_PRIVATE_OPT_DEPS) + elseif(d STREQUAL "WRAP") + set(__depsvar OPENCV_MODULE_${full_modname}_WRAPPERS) + else() + list(APPEND ${__depsvar} "${d}") + endif() + endforeach() + unset(__depsvar) + + # hack for python + set(__python_idx) + list(FIND OPENCV_MODULE_${full_modname}_WRAPPERS "python" __python_idx) + if (NOT __python_idx EQUAL -1) + list(REMOVE_ITEM OPENCV_MODULE_${full_modname}_WRAPPERS "python") + list(APPEND OPENCV_MODULE_${full_modname}_WRAPPERS "python2" "python3") + endif() + unset(__python_idx) + + ocv_list_unique(OPENCV_MODULE_${full_modname}_REQ_DEPS) + ocv_list_unique(OPENCV_MODULE_${full_modname}_OPT_DEPS) + ocv_list_unique(OPENCV_MODULE_${full_modname}_PRIVATE_REQ_DEPS) + ocv_list_unique(OPENCV_MODULE_${full_modname}_PRIVATE_OPT_DEPS) + ocv_list_unique(OPENCV_MODULE_${full_modname}_WRAPPERS) + + set(OPENCV_MODULE_${full_modname}_REQ_DEPS ${OPENCV_MODULE_${full_modname}_REQ_DEPS} + CACHE INTERNAL "Required dependencies of ${full_modname} module") + set(OPENCV_MODULE_${full_modname}_OPT_DEPS ${OPENCV_MODULE_${full_modname}_OPT_DEPS} + CACHE INTERNAL "Optional dependencies of ${full_modname} module") + set(OPENCV_MODULE_${full_modname}_PRIVATE_REQ_DEPS ${OPENCV_MODULE_${full_modname}_PRIVATE_REQ_DEPS} + CACHE INTERNAL "Required private dependencies of ${full_modname} module") + set(OPENCV_MODULE_${full_modname}_PRIVATE_OPT_DEPS ${OPENCV_MODULE_${full_modname}_PRIVATE_OPT_DEPS} + CACHE INTERNAL "Optional private dependencies of ${full_modname} module") + set(OPENCV_MODULE_${full_modname}_WRAPPERS ${OPENCV_MODULE_${full_modname}_WRAPPERS} + CACHE INTERNAL "List of wrappers supporting module ${full_modname}") +endmacro() + +# declare new OpenCV module in current folder +# Usage: +# ocv_add_module( [INTERNAL|BINDINGS] [REQUIRED] [] [OPTIONAL ] [WRAP ]) +# Example: +# ocv_add_module(yaom INTERNAL opencv_core opencv_highgui opencv_flann OPTIONAL opencv_cudev) +macro(ocv_add_module _name) + ocv_debug_message("ocv_add_module(" ${_name} ${ARGN} ")") + string(TOLOWER "${_name}" name) + set(the_module opencv_${name}) + + # the first pass - collect modules info, the second pass - create targets + if(OPENCV_INITIAL_PASS) + #guard agains redefinition + if(";${OPENCV_MODULES_BUILD};${OPENCV_MODULES_DISABLED_USER};" MATCHES ";${the_module};") + message(FATAL_ERROR "Redefinition of the ${the_module} module. + at: ${CMAKE_CURRENT_SOURCE_DIR} + previously defined at: ${OPENCV_MODULE_${the_module}_LOCATION} +") + endif() + + if(NOT DEFINED the_description) + set(the_description "The ${name} OpenCV module") + endif() + + if(NOT DEFINED BUILD_${the_module}_INIT) + set(BUILD_${the_module}_INIT ON) + endif() + + # create option to enable/disable this module + option(BUILD_${the_module} "Include ${the_module} module into the OpenCV build" ${BUILD_${the_module}_INIT}) + + # remember the module details + set(OPENCV_MODULE_${the_module}_DESCRIPTION "${the_description}" CACHE INTERNAL "Brief description of ${the_module} module") + set(OPENCV_MODULE_${the_module}_LOCATION "${CMAKE_CURRENT_SOURCE_DIR}" CACHE INTERNAL "Location of ${the_module} module sources") + + set(OPENCV_MODULE_${the_module}_LINK_DEPS "" CACHE INTERNAL "") + + # parse list of dependencies + if("${ARGV1}" STREQUAL "INTERNAL" OR "${ARGV1}" STREQUAL "BINDINGS") + set(OPENCV_MODULE_${the_module}_CLASS "${ARGV1}" CACHE INTERNAL "The category of the module") + set(__ocv_argn__ ${ARGN}) + list(REMOVE_AT __ocv_argn__ 0) + ocv_add_dependencies(${the_module} ${__ocv_argn__}) + unset(__ocv_argn__) + else() + set(OPENCV_MODULE_${the_module}_CLASS "PUBLIC" CACHE INTERNAL "The category of the module") + ocv_add_dependencies(${the_module} ${ARGN}) + if(BUILD_${the_module}) + set(OPENCV_MODULES_PUBLIC ${OPENCV_MODULES_PUBLIC} "${the_module}" CACHE INTERNAL "List of OpenCV modules marked for export") + endif() + endif() + + # add HAL as dependency + if(NOT "${the_module}" STREQUAL "opencv_hal") + ocv_add_dependencies(${the_module} opencv_hal) + endif() + + # add self to the world dependencies + if((NOT DEFINED OPENCV_MODULE_IS_PART_OF_WORLD + AND NOT OPENCV_MODULE_${the_module}_CLASS STREQUAL "BINDINGS" + AND NOT OPENCV_PROCESSING_EXTRA_MODULES) + OR OPENCV_MODULE_IS_PART_OF_WORLD + ) + set(OPENCV_MODULE_${the_module}_IS_PART_OF_WORLD ON CACHE INTERNAL "") + ocv_add_dependencies(opencv_world OPTIONAL ${the_module}) + else() + set(OPENCV_MODULE_${the_module}_IS_PART_OF_WORLD OFF CACHE INTERNAL "") + endif() + + if(BUILD_${the_module}) + set(OPENCV_MODULES_BUILD ${OPENCV_MODULES_BUILD} "${the_module}" CACHE INTERNAL "List of OpenCV modules included into the build") + else() + set(OPENCV_MODULES_DISABLED_USER ${OPENCV_MODULES_DISABLED_USER} "${the_module}" CACHE INTERNAL "List of OpenCV modules explicitly disabled by user") + endif() + + # add submodules if any + set(OPENCV_MODULE_${the_module}_CHILDREN "${OPENCV_MODULE_CHILDREN}" CACHE INTERNAL "List of ${the_module} submodules") + + # add reverse wrapper dependencies + foreach (wrapper ${OPENCV_MODULE_${the_module}_WRAPPERS}) + ocv_add_dependencies(opencv_${wrapper} OPTIONAL ${the_module}) + endforeach() + + # stop processing of current file + return() + else() + set(OPENCV_MODULE_${the_module}_BINARY_DIR "${CMAKE_CURRENT_BINARY_DIR}" CACHE INTERNAL "") + if(NOT BUILD_${the_module}) + return() # extra protection from redefinition + endif() + if((NOT OPENCV_MODULE_${the_module}_IS_PART_OF_WORLD AND NOT ${the_module} STREQUAL opencv_world) OR NOT ${BUILD_opencv_world}) + project(${the_module}) + endif() + endif() +endmacro() + +# excludes module from current configuration +macro(ocv_module_disable module) + set(__modname ${module}) + if(NOT __modname MATCHES "^opencv_") + set(__modname opencv_${module}) + endif() + list(APPEND OPENCV_MODULES_DISABLED_FORCE "${__modname}") + set(HAVE_${__modname} OFF CACHE INTERNAL "Module ${__modname} can not be built in current configuration") + set(OPENCV_MODULE_${__modname}_LOCATION "${CMAKE_CURRENT_SOURCE_DIR}" CACHE INTERNAL "Location of ${__modname} module sources") + set(OPENCV_MODULES_DISABLED_FORCE "${OPENCV_MODULES_DISABLED_FORCE}" CACHE INTERNAL "List of OpenCV modules which can not be build in current configuration") + if(BUILD_${__modname}) + # touch variable controlling build of the module to suppress "unused variable" CMake warning + endif() + unset(__modname) + return() # leave the current folder +endmacro() + + +# collect modules from specified directories +# NB: must be called only once! +macro(ocv_glob_modules) + if(DEFINED OPENCV_INITIAL_PASS) + message(FATAL_ERROR "OpenCV has already loaded its modules. Calling ocv_glob_modules second time is not allowed.") + endif() + set(__directories_observed "") + + # collect modules + set(OPENCV_INITIAL_PASS ON) + set(OPENCV_PROCESSING_EXTRA_MODULES 0) + foreach(__path ${ARGN}) + if("${__path}" STREQUAL "EXTRA") + set(OPENCV_PROCESSING_EXTRA_MODULES 1) + endif() + get_filename_component(__path "${__path}" ABSOLUTE) + + list(FIND __directories_observed "${__path}" __pathIdx) + if(__pathIdx GREATER -1) + message(FATAL_ERROR "The directory ${__path} is observed for OpenCV modules second time.") + endif() + list(APPEND __directories_observed "${__path}") + + file(GLOB __ocvmodules RELATIVE "${__path}" "${__path}/*") + if(__ocvmodules) + list(SORT __ocvmodules) + foreach(mod ${__ocvmodules}) + get_filename_component(__modpath "${__path}/${mod}" ABSOLUTE) + if(EXISTS "${__modpath}/CMakeLists.txt") + + list(FIND __directories_observed "${__modpath}" __pathIdx) + if(__pathIdx GREATER -1) + message(FATAL_ERROR "The module from ${__modpath} is already loaded.") + endif() + list(APPEND __directories_observed "${__modpath}") + + add_subdirectory("${__modpath}" "${CMAKE_CURRENT_BINARY_DIR}/${mod}/.${mod}") + endif() + endforeach() + endif() + endforeach() + ocv_clear_vars(__ocvmodules __directories_observed __path __modpath __pathIdx) + + # resolve dependencies + __ocv_resolve_dependencies() + + # create modules + set(OPENCV_INITIAL_PASS OFF PARENT_SCOPE) + set(OPENCV_INITIAL_PASS OFF) + if(${BUILD_opencv_world}) + add_subdirectory("${OPENCV_MODULE_opencv_world_LOCATION}" "${CMAKE_CURRENT_BINARY_DIR}/world") + foreach(m ${OPENCV_MODULES_BUILD}) + if(NOT OPENCV_MODULE_${m}_IS_PART_OF_WORLD AND NOT ${m} STREQUAL opencv_world) + message(STATUS "Processing module ${m}...") + if(m MATCHES "^opencv_") + string(REGEX REPLACE "^opencv_" "" __shortname "${m}") + add_subdirectory("${OPENCV_MODULE_${m}_LOCATION}" "${CMAKE_CURRENT_BINARY_DIR}/${__shortname}") + else() + message(WARNING "Check module name: ${m}") + add_subdirectory("${OPENCV_MODULE_${m}_LOCATION}" "${CMAKE_CURRENT_BINARY_DIR}/${m}") + endif() + endif() + endforeach() + else() + foreach(m ${OPENCV_MODULES_BUILD}) + if(m MATCHES "^opencv_") + string(REGEX REPLACE "^opencv_" "" __shortname "${m}") + add_subdirectory("${OPENCV_MODULE_${m}_LOCATION}" "${CMAKE_CURRENT_BINARY_DIR}/${__shortname}") + else() + message(WARNING "Check module name: ${m}") + add_subdirectory("${OPENCV_MODULE_${m}_LOCATION}" "${CMAKE_CURRENT_BINARY_DIR}/${m}") + endif() + endforeach() + endif() + unset(__shortname) +endmacro() + + +# disables OpenCV module with missing dependencies +function(__ocv_module_turn_off the_module) + list(REMOVE_ITEM OPENCV_MODULES_DISABLED_AUTO "${the_module}") + list(APPEND OPENCV_MODULES_DISABLED_AUTO "${the_module}") + list(REMOVE_ITEM OPENCV_MODULES_BUILD "${the_module}") + list(REMOVE_ITEM OPENCV_MODULES_PUBLIC "${the_module}") + set(HAVE_${the_module} OFF CACHE INTERNAL "Module ${the_module} can not be built in current configuration") + + set(OPENCV_MODULES_DISABLED_AUTO "${OPENCV_MODULES_DISABLED_AUTO}" CACHE INTERNAL "") + set(OPENCV_MODULES_BUILD "${OPENCV_MODULES_BUILD}" CACHE INTERNAL "") + set(OPENCV_MODULES_PUBLIC "${OPENCV_MODULES_PUBLIC}" CACHE INTERNAL "") +endfunction() + +# sort modules by dependencies +function(__ocv_sort_modules_by_deps __lst) + ocv_list_sort(${__lst}) + set(input ${${__lst}}) + set(result "") + while(input) + list(LENGTH input length_before) + foreach (m ${input}) + # check if module is in the result already + if (NOT ";${result};" MATCHES ";${m};") + # scan through module dependencies... + set(unresolved_deps_found FALSE) + foreach (d ${OPENCV_MODULE_${m}_CHILDREN} ${OPENCV_MODULE_${m}_DEPS}) + # ... which are not already in the result and are enabled + if ((NOT ";${result};" MATCHES ";${d};") AND HAVE_${d}) + set(unresolved_deps_found TRUE) + break() + endif() + endforeach() + # chek if all dependencies for this module has been resolved + if (NOT unresolved_deps_found) + list(APPEND result ${m}) + list(REMOVE_ITEM input ${m}) + endif() + endif() + endforeach() + list(LENGTH input length_after) + # check for infinite loop or unresolved dependencies + if (NOT length_after LESS length_before) + message(WARNING "Unresolved dependencies or loop in dependency graph (${length_after})\n" + "Processed ${__lst}: ${${__lst}}\n" + "Good modules: ${result}\n" + "Bad modules: ${input}" + ) + list(APPEND result ${input}) + break() + endif() + endwhile() + set(${__lst} "${result}" PARENT_SCOPE) +endfunction() + +# resolve dependensies +function(__ocv_resolve_dependencies) + foreach(m ${OPENCV_MODULES_DISABLED_USER}) + set(HAVE_${m} OFF CACHE INTERNAL "Module ${m} will not be built in current configuration") + endforeach() + foreach(m ${OPENCV_MODULES_BUILD}) + set(HAVE_${m} ON CACHE INTERNAL "Module ${m} will be built in current configuration") + endforeach() + + # disable MODULES with unresolved dependencies + set(has_changes ON) + while(has_changes) + set(has_changes OFF) + foreach(m ${OPENCV_MODULES_BUILD}) + set(__deps ${OPENCV_MODULE_${m}_REQ_DEPS} ${OPENCV_MODULE_${m}_PRIVATE_REQ_DEPS}) + while(__deps) + ocv_list_pop_front(__deps d) + string(TOLOWER "${d}" upper_d) + if(NOT (HAVE_${d} OR HAVE_${upper_d} OR TARGET ${d} OR EXISTS ${d})) + if(d MATCHES "^opencv_") # TODO Remove this condition in the future and use HAVE_ variables only + message(STATUS "Module ${m} disabled because ${d} dependency can't be resolved!") + __ocv_module_turn_off(${m}) + set(has_changes ON) + break() + else() + message(STATUS "Assume that non-module dependency is available: ${d} (for module ${m})") + endif() + endif() + endwhile() + endforeach() + endwhile() + +# message(STATUS "List of active modules: ${OPENCV_MODULES_BUILD}") + + foreach(m ${OPENCV_MODULES_BUILD}) + set(deps_${m} ${OPENCV_MODULE_${m}_REQ_DEPS}) + foreach(d ${OPENCV_MODULE_${m}_OPT_DEPS}) + if(NOT (";${deps_${m}};" MATCHES ";${d};")) + if(HAVE_${d} OR TARGET ${d}) + list(APPEND deps_${m} ${d}) + endif() + endif() + endforeach() +# message(STATUS "Initial deps of ${m} (w/o private deps): ${deps_${m}}") + endforeach() + + # propagate dependencies + set(has_changes ON) + while(has_changes) + set(has_changes OFF) + foreach(m2 ${OPENCV_MODULES_BUILD}) # transfer deps of m2 to m + foreach(m ${OPENCV_MODULES_BUILD}) + if((NOT m STREQUAL m2) AND ";${deps_${m}};" MATCHES ";${m2};") + foreach(d ${deps_${m2}}) + if(NOT (";${deps_${m}};" MATCHES ";${d};")) +# message(STATUS " Transfer dependency ${d} from ${m2} to ${m}") + list(APPEND deps_${m} ${d}) + set(has_changes ON) + endif() + endforeach() + endif() + endforeach() + endforeach() + endwhile() + + # process private deps + foreach(m ${OPENCV_MODULES_BUILD}) + foreach(d ${OPENCV_MODULE_${m}_PRIVATE_REQ_DEPS}) + if(NOT (";${deps_${m}};" MATCHES ";${d};")) + list(APPEND deps_${m} ${d}) + endif() + endforeach() + foreach(d ${OPENCV_MODULE_${m}_PRIVATE_OPT_DEPS}) + if(NOT (";${deps_${m}};" MATCHES ";${d};")) + if(HAVE_${d} OR TARGET ${d}) + list(APPEND deps_${m} ${d}) + endif() + endif() + endforeach() + endforeach() + + ocv_list_sort(OPENCV_MODULES_BUILD) + + foreach(m ${OPENCV_MODULES_BUILD}) +# message(STATUS "FULL deps of ${m}: ${deps_${m}}") + set(OPENCV_MODULE_${m}_DEPS ${deps_${m}}) + set(OPENCV_MODULE_${m}_DEPS_EXT ${deps_${m}}) + ocv_list_filterout(OPENCV_MODULE_${m}_DEPS_EXT "^opencv_[^ ]+$") + if(OPENCV_MODULE_${m}_DEPS_EXT AND OPENCV_MODULE_${m}_DEPS) + list(REMOVE_ITEM OPENCV_MODULE_${m}_DEPS ${OPENCV_MODULE_${m}_DEPS_EXT}) + endif() + endforeach() + + # reorder dependencies + foreach(m ${OPENCV_MODULES_BUILD}) + __ocv_sort_modules_by_deps(OPENCV_MODULE_${m}_DEPS) + ocv_list_sort(OPENCV_MODULE_${m}_DEPS_EXT) + + set(LINK_DEPS ${OPENCV_MODULE_${m}_DEPS}) + + # process world + if(BUILD_opencv_world) + if(OPENCV_MODULE_${m}_IS_PART_OF_WORLD) + list(APPEND OPENCV_WORLD_MODULES ${m}) + endif() + foreach(m2 ${OPENCV_MODULES_BUILD}) + if(OPENCV_MODULE_${m2}_IS_PART_OF_WORLD) + if(";${LINK_DEPS};" MATCHES ";${m2};") + list(REMOVE_ITEM LINK_DEPS ${m2}) + if(NOT (";${LINK_DEPS};" MATCHES ";opencv_world;") AND NOT (${m} STREQUAL opencv_world)) + list(APPEND LINK_DEPS opencv_world) + endif() + endif() + if(${m} STREQUAL opencv_world) + list(APPEND OPENCV_MODULE_opencv_world_DEPS_EXT ${OPENCV_MODULE_${m2}_DEPS_EXT}) + endif() + endif() + endforeach() + endif() + + set(OPENCV_MODULE_${m}_DEPS ${OPENCV_MODULE_${m}_DEPS} CACHE INTERNAL "Flattened dependencies of ${m} module") + set(OPENCV_MODULE_${m}_DEPS_EXT ${OPENCV_MODULE_${m}_DEPS_EXT} CACHE INTERNAL "Extra dependencies of ${m} module") + set(OPENCV_MODULE_${m}_DEPS_TO_LINK ${LINK_DEPS} CACHE INTERNAL "Flattened dependencies of ${m} module (for linker)") + +# message(STATUS " module deps of ${m}: ${OPENCV_MODULE_${m}_DEPS}") +# message(STATUS " module link deps of ${m}: ${OPENCV_MODULE_${m}_DEPS_TO_LINK}") +# message(STATUS " extra deps of ${m}: ${OPENCV_MODULE_${m}_DEPS_EXT}") +# message(STATUS "") + endforeach() + + __ocv_sort_modules_by_deps(OPENCV_MODULES_BUILD) + + set(OPENCV_MODULES_PUBLIC ${OPENCV_MODULES_PUBLIC} CACHE INTERNAL "List of OpenCV modules marked for export") + set(OPENCV_MODULES_BUILD ${OPENCV_MODULES_BUILD} CACHE INTERNAL "List of OpenCV modules included into the build") + set(OPENCV_MODULES_DISABLED_AUTO ${OPENCV_MODULES_DISABLED_AUTO} CACHE INTERNAL "List of OpenCV modules implicitly disabled due to dependencies") + set(OPENCV_WORLD_MODULES ${OPENCV_WORLD_MODULES} CACHE INTERNAL "List of OpenCV modules included into the world") +endfunction() + + +# setup include paths for the list of passed modules +macro(ocv_include_modules) + foreach(d ${ARGN}) + if(d MATCHES "^opencv_" AND HAVE_${d}) + if (EXISTS "${OPENCV_MODULE_${d}_LOCATION}/include") + ocv_include_directories("${OPENCV_MODULE_${d}_LOCATION}/include") + endif() + elseif(EXISTS "${d}") + ocv_include_directories("${d}") + endif() + endforeach() +endmacro() + +# same as previous but with dependencies +macro(ocv_include_modules_recurse) + ocv_include_modules(${ARGN}) + foreach(d ${ARGN}) + if(d MATCHES "^opencv_" AND HAVE_${d} AND DEFINED OPENCV_MODULE_${d}_DEPS) + foreach (sub ${OPENCV_MODULE_${d}_DEPS}) + ocv_include_modules(${sub}) + endforeach() + endif() + endforeach() +endmacro() + +# setup include paths for the list of passed modules +macro(ocv_target_include_modules target) + foreach(d ${ARGN}) + if(d MATCHES "^opencv_" AND HAVE_${d}) + if (EXISTS "${OPENCV_MODULE_${d}_LOCATION}/include") + ocv_target_include_directories(${target} "${OPENCV_MODULE_${d}_LOCATION}/include") + endif() + elseif(EXISTS "${d}") + ocv_target_include_directories(${target} "${d}") + endif() + endforeach() +endmacro() + +# setup include paths for the list of passed modules and recursively add dependent modules +macro(ocv_target_include_modules_recurse target) + foreach(d ${ARGN}) + if(d MATCHES "^opencv_" AND HAVE_${d}) + if (EXISTS "${OPENCV_MODULE_${d}_LOCATION}/include") + ocv_target_include_directories(${target} "${OPENCV_MODULE_${d}_LOCATION}/include") + endif() + if(OPENCV_MODULE_${d}_DEPS) + ocv_target_include_modules(${target} ${OPENCV_MODULE_${d}_DEPS}) + endif() + elseif(EXISTS "${d}") + ocv_target_include_directories(${target} "${d}") + endif() + endforeach() +endmacro() + +# setup include path for OpenCV headers for specified module +# ocv_module_include_directories() +macro(ocv_module_include_directories) + ocv_target_include_directories(${the_module} + "${OPENCV_MODULE_${the_module}_LOCATION}/include" + "${OPENCV_MODULE_${the_module}_LOCATION}/src" + "${CMAKE_CURRENT_BINARY_DIR}" # for precompiled headers + ) + ocv_target_include_modules(${the_module} ${OPENCV_MODULE_${the_module}_DEPS} ${ARGN}) +endmacro() + + +# sets header and source files for the current module +# NB: all files specified as headers will be installed +# Usage: +# ocv_set_module_sources([HEADERS] [SOURCES] ) +macro(ocv_set_module_sources) + ocv_debug_message("ocv_set_module_sources(" ${ARGN} ")") + + set(OPENCV_MODULE_${the_module}_HEADERS "") + set(OPENCV_MODULE_${the_module}_SOURCES "") + + foreach(f "HEADERS" ${ARGN}) + if(f STREQUAL "HEADERS" OR f STREQUAL "SOURCES") + set(__filesvar "OPENCV_MODULE_${the_module}_${f}") + else() + list(APPEND ${__filesvar} "${f}") + endif() + endforeach() + + # the hacky way to embeed any files into the OpenCV without modification of its build system + if(COMMAND ocv_get_module_external_sources) + ocv_get_module_external_sources() + endif() + + # use full paths for module to be independent from the module location + ocv_convert_to_full_paths(OPENCV_MODULE_${the_module}_HEADERS) + + set(OPENCV_MODULE_${the_module}_HEADERS ${OPENCV_MODULE_${the_module}_HEADERS} CACHE INTERNAL "List of header files for ${the_module}") + set(OPENCV_MODULE_${the_module}_SOURCES ${OPENCV_MODULE_${the_module}_SOURCES} CACHE INTERNAL "List of source files for ${the_module}") +endmacro() + +# finds and sets headers and sources for the standard OpenCV module +# Usage: +# ocv_glob_module_sources([EXCLUDE_CUDA] ) +macro(ocv_glob_module_sources) + ocv_debug_message("ocv_glob_module_sources(" ${ARGN} ")") + set(_argn ${ARGN}) + list(FIND _argn "EXCLUDE_CUDA" exclude_cuda) + if(NOT exclude_cuda EQUAL -1) + list(REMOVE_AT _argn ${exclude_cuda}) + endif() + + file(GLOB_RECURSE lib_srcs + "${CMAKE_CURRENT_LIST_DIR}/src/*.cpp" + ) + file(GLOB_RECURSE lib_int_hdrs + "${CMAKE_CURRENT_LIST_DIR}/src/*.hpp" + "${CMAKE_CURRENT_LIST_DIR}/src/*.h" + ) + file(GLOB lib_hdrs + "${CMAKE_CURRENT_LIST_DIR}/include/opencv2/*.hpp" + "${CMAKE_CURRENT_LIST_DIR}/include/opencv2/${name}/*.hpp" + "${CMAKE_CURRENT_LIST_DIR}/include/opencv2/${name}/*.h" + ) + file(GLOB lib_hdrs_detail + "${CMAKE_CURRENT_LIST_DIR}/include/opencv2/${name}/detail/*.hpp" + "${CMAKE_CURRENT_LIST_DIR}/include/opencv2/${name}/detail/*.h" + ) + if (APPLE) + file(GLOB_RECURSE lib_srcs_apple + "${CMAKE_CURRENT_LIST_DIR}/src/*.mm" + ) + list(APPEND lib_srcs ${lib_srcs_apple}) + endif() + + ocv_source_group("Src" DIRBASE "${CMAKE_CURRENT_LIST_DIR}/src" FILES ${lib_srcs} ${lib_int_hdrs}) + ocv_source_group("Include" DIRBASE "${CMAKE_CURRENT_LIST_DIR}/include" FILES ${lib_hdrs} ${lib_hdrs_detail}) + + set(lib_cuda_srcs "") + set(lib_cuda_hdrs "") + if(HAVE_CUDA AND exclude_cuda EQUAL -1) + file(GLOB lib_cuda_srcs + "${CMAKE_CURRENT_LIST_DIR}/src/cuda/*.cu" + ) + file(GLOB lib_cuda_hdrs + "${CMAKE_CURRENT_LIST_DIR}/src/cuda/*.hpp" + ) + source_group("Src\\Cuda" FILES ${lib_cuda_srcs} ${lib_cuda_hdrs}) + endif() + + file(GLOB cl_kernels + "${CMAKE_CURRENT_LIST_DIR}/src/opencl/*.cl" + ) + if(cl_kernels) + set(OCL_NAME opencl_kernels_${name}) + ocv_include_directories(${OPENCL_INCLUDE_DIRS}) + add_custom_command( + OUTPUT "${CMAKE_CURRENT_BINARY_DIR}/${OCL_NAME}.cpp" "${CMAKE_CURRENT_BINARY_DIR}/${OCL_NAME}.hpp" + COMMAND ${CMAKE_COMMAND} -DMODULE_NAME="${name}" -DCL_DIR="${CMAKE_CURRENT_LIST_DIR}/src/opencl" -DOUTPUT="${CMAKE_CURRENT_BINARY_DIR}/${OCL_NAME}.cpp" -P "${OpenCV_SOURCE_DIR}/cmake/cl2cpp.cmake" + DEPENDS ${cl_kernels} "${OpenCV_SOURCE_DIR}/cmake/cl2cpp.cmake") + ocv_source_group("Src\\opencl\\kernels" FILES ${cl_kernels}) + ocv_source_group("Src\\opencl\\kernels\\autogenerated" FILES "${CMAKE_CURRENT_BINARY_DIR}/${OCL_NAME}.cpp" "${CMAKE_CURRENT_BINARY_DIR}/${OCL_NAME}.hpp") + list(APPEND lib_srcs ${cl_kernels} "${CMAKE_CURRENT_BINARY_DIR}/${OCL_NAME}.cpp" "${CMAKE_CURRENT_BINARY_DIR}/${OCL_NAME}.hpp") + endif() + + ocv_set_module_sources(${_argn} HEADERS ${lib_hdrs} ${lib_hdrs_detail} + SOURCES ${lib_srcs} ${lib_int_hdrs} ${lib_cuda_srcs} ${lib_cuda_hdrs}) +endmacro() + +# creates OpenCV module in current folder +# creates new target, configures standard dependencies, compilers flags, install rules +# Usage: +# ocv_create_module() +# ocv_create_module() +macro(ocv_create_module) + ocv_debug_message("ocv_create_module(" ${ARGN} ")") + set(OPENCV_MODULE_${the_module}_LINK_DEPS "${OPENCV_MODULE_${the_module}_LINK_DEPS};${ARGN}" CACHE INTERNAL "") + if(${BUILD_opencv_world} AND OPENCV_MODULE_${the_module}_IS_PART_OF_WORLD) + # nothing + set(the_module_target opencv_world) + else() + _ocv_create_module(${ARGN}) + set(the_module_target ${the_module}) + endif() +endmacro() + +macro(_ocv_create_module) + # The condition we ought to be testing here is whether ocv_add_precompiled_headers will + # be called at some point in the future. We can't look into the future, though, + # so this will have to do. + if(EXISTS "${CMAKE_CURRENT_SOURCE_DIR}/src/precomp.hpp" AND NOT ${the_module} STREQUAL opencv_world) + get_native_precompiled_header(${the_module} precomp.hpp) + endif() + + set(sub_objs "") + set(sub_links "") + set(cuda_objs "") + if (OPENCV_MODULE_${the_module}_CHILDREN) + status("Complex module ${the_module}") + foreach (m ${OPENCV_MODULE_${the_module}_CHILDREN}) + if (BUILD_${m} AND TARGET ${m}_object) + get_target_property(_sub_links ${m} LINK_LIBRARIES) + list(APPEND sub_objs $) + list(APPEND sub_links ${_sub_links}) + status(" + ${m}") + else() + status(" - ${m}") + endif() + list(APPEND cuda_objs ${OPENCV_MODULE_${m}_CUDA_OBJECTS}) + endforeach() + endif() + + ocv_add_library(${the_module} ${OPENCV_MODULE_TYPE} ${OPENCV_MODULE_${the_module}_HEADERS} ${OPENCV_MODULE_${the_module}_SOURCES} + "${OPENCV_CONFIG_FILE_INCLUDE_DIR}/cvconfig.h" "${OPENCV_CONFIG_FILE_INCLUDE_DIR}/opencv2/opencv_modules.hpp" + ${${the_module}_pch} ${sub_objs}) + + if (cuda_objs) + target_link_libraries(${the_module} ${cuda_objs}) + endif() + + # TODO: is it needed? + if (sub_links) + ocv_list_filterout(sub_links "^opencv_") + ocv_list_unique(sub_links) + target_link_libraries(${the_module} ${sub_links}) + endif() + + unset(sub_objs) + unset(sub_links) + unset(cuda_objs) + + ocv_target_link_libraries(${the_module} ${OPENCV_MODULE_${the_module}_DEPS_TO_LINK}) + ocv_target_link_libraries(${the_module} LINK_INTERFACE_LIBRARIES ${OPENCV_MODULE_${the_module}_DEPS_TO_LINK}) + ocv_target_link_libraries(${the_module} ${OPENCV_MODULE_${the_module}_DEPS_EXT} ${OPENCV_LINKER_LIBS} ${IPP_LIBS} ${ARGN}) + if (HAVE_CUDA) + ocv_target_link_libraries(${the_module} ${CUDA_LIBRARIES} ${CUDA_npp_LIBRARY}) + endif() + + add_dependencies(opencv_modules ${the_module}) + + if(ENABLE_SOLUTION_FOLDERS) + set_target_properties(${the_module} PROPERTIES FOLDER "modules") + endif() + + set_target_properties(${the_module} PROPERTIES + OUTPUT_NAME "${the_module}${OPENCV_DLLVERSION}" + DEBUG_POSTFIX "${OPENCV_DEBUG_POSTFIX}" + ARCHIVE_OUTPUT_DIRECTORY ${LIBRARY_OUTPUT_PATH} + LIBRARY_OUTPUT_DIRECTORY ${LIBRARY_OUTPUT_PATH} + RUNTIME_OUTPUT_DIRECTORY ${EXECUTABLE_OUTPUT_PATH} + INSTALL_NAME_DIR lib + ) + + # For dynamic link numbering convenions + if(NOT ANDROID) + # Android SDK build scripts can include only .so files into final .apk + # As result we should not set version properties for Android + set_target_properties(${the_module} PROPERTIES + VERSION ${OPENCV_LIBVERSION} + SOVERSION ${OPENCV_SOVERSION} + ) + endif() + + if((NOT DEFINED OPENCV_MODULE_TYPE AND BUILD_SHARED_LIBS) + OR (DEFINED OPENCV_MODULE_TYPE AND OPENCV_MODULE_TYPE STREQUAL SHARED)) + set_target_properties(${the_module} PROPERTIES COMPILE_DEFINITIONS CVAPI_EXPORTS) + set_target_properties(${the_module} PROPERTIES DEFINE_SYMBOL CVAPI_EXPORTS) + endif() + + if(MSVC) + if(CMAKE_CROSSCOMPILING) + set_target_properties(${the_module} PROPERTIES LINK_FLAGS "/NODEFAULTLIB:secchk") + endif() + set_target_properties(${the_module} PROPERTIES LINK_FLAGS "/NODEFAULTLIB:libc /DEBUG") + endif() + + ocv_install_target(${the_module} EXPORT OpenCVModules OPTIONAL + RUNTIME DESTINATION ${OPENCV_BIN_INSTALL_PATH} COMPONENT libs + LIBRARY DESTINATION ${OPENCV_LIB_INSTALL_PATH} COMPONENT libs NAMELINK_SKIP + ARCHIVE DESTINATION ${OPENCV_LIB_INSTALL_PATH} COMPONENT dev + ) + get_target_property(_target_type ${the_module} TYPE) + if("${_target_type}" STREQUAL "SHARED_LIBRARY") + install(TARGETS ${the_module} + LIBRARY DESTINATION ${OPENCV_LIB_INSTALL_PATH} COMPONENT dev NAMELINK_ONLY) + endif() + + foreach(m ${OPENCV_MODULE_${the_module}_CHILDREN} ${the_module}) + # only "public" headers need to be installed + if(OPENCV_MODULE_${m}_HEADERS AND ";${OPENCV_MODULES_PUBLIC};" MATCHES ";${m};") + foreach(hdr ${OPENCV_MODULE_${m}_HEADERS}) + string(REGEX REPLACE "^.*opencv2/" "opencv2/" hdr2 "${hdr}") + if(NOT hdr2 MATCHES "opencv2/${m}/private.*" AND hdr2 MATCHES "^(opencv2/?.*)/[^/]+.h(..)?$" ) + install(FILES ${hdr} OPTIONAL DESTINATION "${OPENCV_INCLUDE_INSTALL_PATH}/${CMAKE_MATCH_1}" COMPONENT dev) + endif() + endforeach() + endif() + endforeach() + + _ocv_add_precompiled_headers(${the_module}) + + if (TARGET ${the_module}_object) + # copy COMPILE_DEFINITIONS + get_target_property(main_defs ${the_module} COMPILE_DEFINITIONS) + if (main_defs) + set_target_properties(${the_module}_object PROPERTIES COMPILE_DEFINITIONS ${main_defs}) + endif() + # use same PCH + if (TARGET pch_Generate_${the_module}) + add_dependencies(${the_module}_object pch_Generate_${the_module} ) + endif() + endif() +endmacro() + +# opencv precompiled headers macro (can add pch to modules and tests) +# this macro must be called after any "add_definitions" commands, otherwise precompiled headers will not work +# Usage: +# ocv_add_precompiled_headers(${the_module}) +macro(_ocv_add_precompiled_headers the_target) + ocv_debug_message("ocv_add_precompiled_headers(" ${the_target} ${ARGN} ")") + + if("${the_target}" MATCHES "^opencv_test_.*$") + SET(pch_path "test/test_") + elseif("${the_target}" MATCHES "^opencv_perf_.*$") + SET(pch_path "perf/perf_") + else() + SET(pch_path "src/") + endif() + ocv_add_precompiled_header_to_target(${the_target} "${CMAKE_CURRENT_SOURCE_DIR}/${pch_path}precomp.hpp") + unset(pch_path) +endmacro() + +# short command for adding simple OpenCV module +# see ocv_add_module for argument details +# Usage: +# ocv_define_module(module_name [INTERNAL] [EXCLUDE_CUDA] [REQUIRED] [] [OPTIONAL ] [WRAP ]) +macro(ocv_define_module module_name) + ocv_debug_message("ocv_define_module(" ${module_name} ${ARGN} ")") + set(_argn ${ARGN}) + set(exclude_cuda "") + foreach(arg ${_argn}) + if("${arg}" STREQUAL "EXCLUDE_CUDA") + set(exclude_cuda "${arg}") + list(REMOVE_ITEM _argn ${arg}) + endif() + endforeach() + + ocv_add_module(${module_name} ${_argn}) + ocv_glob_module_sources(${exclude_cuda}) + ocv_module_include_directories() + ocv_create_module() + + ocv_add_accuracy_tests() + ocv_add_perf_tests() + ocv_add_samples() +endmacro() + +# ensures that all passed modules are available +# sets OCV_DEPENDENCIES_FOUND variable to TRUE/FALSE +macro(ocv_check_dependencies) + set(OCV_DEPENDENCIES_FOUND TRUE) + foreach(d ${ARGN}) + if(d MATCHES "^opencv_[^ ]+$" AND NOT HAVE_${d}) + set(OCV_DEPENDENCIES_FOUND FALSE) + break() + endif() + endforeach() +endmacro() + +# auxiliary macro to parse arguments of ocv_add_accuracy_tests and ocv_add_perf_tests commands +macro(__ocv_parse_test_sources tests_type) + set(OPENCV_${tests_type}_${the_module}_SOURCES "") + set(OPENCV_${tests_type}_${the_module}_DEPS "") + set(__file_group_name "") + set(__file_group_sources "") + foreach(arg "DEPENDS_ON" ${ARGN} "FILES") + if(arg STREQUAL "FILES") + set(__currentvar "__file_group_sources") + if(__file_group_name AND __file_group_sources) + source_group("${__file_group_name}" FILES ${__file_group_sources}) + list(APPEND OPENCV_${tests_type}_${the_module}_SOURCES ${__file_group_sources}) + endif() + set(__file_group_name "") + set(__file_group_sources "") + elseif(arg STREQUAL "DEPENDS_ON") + set(__currentvar "OPENCV_${tests_type}_${the_module}_DEPS") + elseif(" ${__currentvar}" STREQUAL " __file_group_sources" AND NOT __file_group_name) # spaces to avoid CMP0054 + set(__file_group_name "${arg}") + else() + list(APPEND ${__currentvar} "${arg}") + endif() + endforeach() + unset(__file_group_name) + unset(__file_group_sources) + unset(__currentvar) +endmacro() + +# this is a command for adding OpenCV performance tests to the module +# ocv_add_perf_tests() +function(ocv_add_perf_tests) + ocv_debug_message("ocv_add_perf_tests(" ${ARGN} ")") + + set(perf_path "${CMAKE_CURRENT_LIST_DIR}/perf") + if(BUILD_PERF_TESTS AND EXISTS "${perf_path}") + __ocv_parse_test_sources(PERF ${ARGN}) + + # opencv_imgcodecs is required for imread/imwrite + set(perf_deps opencv_ts ${the_module} opencv_imgcodecs ${OPENCV_MODULE_${the_module}_DEPS} ${OPENCV_MODULE_opencv_ts_DEPS}) + ocv_check_dependencies(${perf_deps}) + + if(OCV_DEPENDENCIES_FOUND) + set(the_target "opencv_perf_${name}") + # project(${the_target}) + + if(NOT OPENCV_PERF_${the_module}_SOURCES) + file(GLOB_RECURSE perf_srcs "${perf_path}/*.cpp") + file(GLOB_RECURSE perf_hdrs "${perf_path}/*.hpp" "${perf_path}/*.h") + ocv_source_group("Src" DIRBASE "${perf_path}" FILES ${perf_srcs}) + ocv_source_group("Include" DIRBASE "${perf_path}" FILES ${perf_hdrs}) + set(OPENCV_PERF_${the_module}_SOURCES ${perf_srcs} ${perf_hdrs}) + endif() + + if(NOT BUILD_opencv_world) + get_native_precompiled_header(${the_target} perf_precomp.hpp) + endif() + + ocv_add_executable(${the_target} ${OPENCV_PERF_${the_module}_SOURCES} ${${the_target}_pch}) + ocv_target_include_modules(${the_target} ${perf_deps} "${perf_path}") + ocv_target_link_libraries(${the_target} ${perf_deps} ${OPENCV_MODULE_${the_module}_DEPS} ${OPENCV_LINKER_LIBS}) + add_dependencies(opencv_perf_tests ${the_target}) + + # Additional target properties + set_target_properties(${the_target} PROPERTIES + DEBUG_POSTFIX "${OPENCV_DEBUG_POSTFIX}" + RUNTIME_OUTPUT_DIRECTORY "${EXECUTABLE_OUTPUT_PATH}" + ) + + if(ENABLE_SOLUTION_FOLDERS) + set_target_properties(${the_target} PROPERTIES FOLDER "tests performance") + endif() + + if(NOT BUILD_opencv_world) + _ocv_add_precompiled_headers(${the_target}) + endif() + else(OCV_DEPENDENCIES_FOUND) + # TODO: warn about unsatisfied dependencies + endif(OCV_DEPENDENCIES_FOUND) + if(INSTALL_TESTS) + install(TARGETS ${the_target} RUNTIME DESTINATION ${OPENCV_TEST_INSTALL_PATH} COMPONENT tests) + endif() + endif() +endfunction() + +# this is a command for adding OpenCV accuracy/regression tests to the module +# ocv_add_accuracy_tests([FILES ] [DEPENDS_ON] ) +function(ocv_add_accuracy_tests) + ocv_debug_message("ocv_add_accuracy_tests(" ${ARGN} ")") + + set(test_path "${CMAKE_CURRENT_LIST_DIR}/test") + if(BUILD_TESTS AND EXISTS "${test_path}") + __ocv_parse_test_sources(TEST ${ARGN}) + + # opencv_imgcodecs is required for imread/imwrite + set(test_deps opencv_ts ${the_module} opencv_imgcodecs opencv_videoio ${OPENCV_MODULE_${the_module}_DEPS} ${OPENCV_MODULE_opencv_ts_DEPS}) + ocv_check_dependencies(${test_deps}) + if(OCV_DEPENDENCIES_FOUND) + set(the_target "opencv_test_${name}") + # project(${the_target}) + + if(NOT OPENCV_TEST_${the_module}_SOURCES) + file(GLOB_RECURSE test_srcs "${test_path}/*.cpp") + file(GLOB_RECURSE test_hdrs "${test_path}/*.hpp" "${test_path}/*.h") + ocv_source_group("Src" DIRBASE "${test_path}" FILES ${test_srcs}) + ocv_source_group("Include" DIRBASE "${test_path}" FILES ${test_hdrs}) + set(OPENCV_TEST_${the_module}_SOURCES ${test_srcs} ${test_hdrs}) + endif() + + if(NOT BUILD_opencv_world) + get_native_precompiled_header(${the_target} test_precomp.hpp) + endif() + + ocv_add_executable(${the_target} ${OPENCV_TEST_${the_module}_SOURCES} ${${the_target}_pch}) + ocv_target_include_modules(${the_target} ${test_deps} "${test_path}") + ocv_target_link_libraries(${the_target} ${test_deps} ${OPENCV_MODULE_${the_module}_DEPS} ${OPENCV_LINKER_LIBS}) + add_dependencies(opencv_tests ${the_target}) + + # Additional target properties + set_target_properties(${the_target} PROPERTIES + DEBUG_POSTFIX "${OPENCV_DEBUG_POSTFIX}" + RUNTIME_OUTPUT_DIRECTORY "${EXECUTABLE_OUTPUT_PATH}" + ) + + if(ENABLE_SOLUTION_FOLDERS) + set_target_properties(${the_target} PROPERTIES FOLDER "tests accuracy") + endif() + + enable_testing() + get_target_property(LOC ${the_target} LOCATION) + add_test(${the_target} "${LOC}") + + if(NOT BUILD_opencv_world) + _ocv_add_precompiled_headers(${the_target}) + endif() + else(OCV_DEPENDENCIES_FOUND) + # TODO: warn about unsatisfied dependencies + endif(OCV_DEPENDENCIES_FOUND) + + if(INSTALL_TESTS) + install(TARGETS ${the_target} RUNTIME DESTINATION ${OPENCV_TEST_INSTALL_PATH} COMPONENT tests) + endif() + endif() +endfunction() + +function(ocv_add_samples) + ocv_debug_message("ocv_add_samples(" ${ARGN} ")") + + set(samples_path "${CMAKE_CURRENT_SOURCE_DIR}/samples") + string(REGEX REPLACE "^opencv_" "" module_id ${the_module}) + + if(BUILD_EXAMPLES AND EXISTS "${samples_path}") + set(samples_deps ${the_module} ${OPENCV_MODULE_${the_module}_DEPS} opencv_imgcodecs opencv_videoio opencv_highgui ${ARGN}) + ocv_check_dependencies(${samples_deps}) + + if(OCV_DEPENDENCIES_FOUND) + file(GLOB sample_sources "${samples_path}/*.cpp") + + foreach(source ${sample_sources}) + get_filename_component(name "${source}" NAME_WE) + set(the_target "example_${module_id}_${name}") + + ocv_add_executable(${the_target} "${source}") + ocv_target_include_modules(${the_target} ${samples_deps}) + ocv_target_link_libraries(${the_target} ${samples_deps}) + set_target_properties(${the_target} PROPERTIES PROJECT_LABEL "(sample) ${name}") + + if(ENABLE_SOLUTION_FOLDERS) + set_target_properties(${the_target} PROPERTIES + OUTPUT_NAME "${module_id}-example-${name}" + FOLDER "samples/${module_id}") + endif() + + if(WIN32) + install(TARGETS ${the_target} RUNTIME DESTINATION "samples/${module_id}" COMPONENT samples) + endif() + endforeach() + endif() + endif() + + if(INSTALL_C_EXAMPLES AND NOT WIN32 AND EXISTS "${samples_path}") + file(GLOB DEPLOY_FILES_AND_DIRS "${samples_path}/*") + foreach(ITEM ${DEPLOY_FILES_AND_DIRS}) + IF( IS_DIRECTORY "${ITEM}" ) + LIST( APPEND sample_dirs "${ITEM}" ) + ELSE() + LIST( APPEND sample_files "${ITEM}" ) + ENDIF() + endforeach() + install(FILES ${sample_files} + DESTINATION ${OPENCV_SAMPLES_SRC_INSTALL_PATH}/${module_id} + PERMISSIONS OWNER_READ GROUP_READ WORLD_READ COMPONENT samples) + install(DIRECTORY ${sample_dirs} + DESTINATION ${OPENCV_SAMPLES_SRC_INSTALL_PATH}/${module_id} + USE_SOURCE_PERMISSIONS COMPONENT samples) + endif() +endfunction() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVPCHSupport.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVPCHSupport.cmake new file mode 100644 index 000000000..e5fb90e6f --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVPCHSupport.cmake @@ -0,0 +1,372 @@ +# taken from http://public.kitware.com/Bug/view.php?id=1260 and slightly adjusted + +# - Try to find precompiled headers support for GCC 3.4 and 4.x +# Once done this will define: +# +# Variable: +# PCHSupport_FOUND +# +# Macro: +# ADD_PRECOMPILED_HEADER _targetName _input _dowarn +# ADD_PRECOMPILED_HEADER_TO_TARGET _targetName _input _pch_output_to_use _dowarn +# ADD_NATIVE_PRECOMPILED_HEADER _targetName _input _dowarn +# GET_NATIVE_PRECOMPILED_HEADER _targetName _input + +IF(CMAKE_COMPILER_IS_GNUCXX) + + EXEC_PROGRAM( + ${CMAKE_CXX_COMPILER} + ARGS ${CMAKE_CXX_COMPILER_ARG1} -dumpversion + OUTPUT_VARIABLE gcc_compiler_version) + #MESSAGE("GCC Version: ${gcc_compiler_version}") + IF(gcc_compiler_version VERSION_GREATER "4.2.-1") + SET(PCHSupport_FOUND TRUE) + ENDIF() + + SET(_PCH_include_prefix "-I") + SET(_PCH_isystem_prefix "-isystem") + SET(_PCH_define_prefix "-D") + +ELSEIF(CMAKE_GENERATOR MATCHES "^Visual.*$") + SET(PCHSupport_FOUND TRUE) + SET(_PCH_include_prefix "/I") + SET(_PCH_isystem_prefix "/I") + SET(_PCH_define_prefix "/D") +ELSE() + SET(PCHSupport_FOUND FALSE) +ENDIF() + +MACRO(_PCH_GET_COMPILE_FLAGS _out_compile_flags) + + STRING(TOUPPER "CMAKE_CXX_FLAGS_${CMAKE_BUILD_TYPE}" _flags_var_name) + SET(${_out_compile_flags} ${${_flags_var_name}} ) + + IF(CMAKE_COMPILER_IS_GNUCXX) + + GET_TARGET_PROPERTY(_targetType ${_PCH_current_target} TYPE) + IF(${_targetType} STREQUAL SHARED_LIBRARY AND NOT WIN32) + LIST(APPEND ${_out_compile_flags} "-fPIC") + ENDIF() + + GET_TARGET_PROPERTY(_target_definitions ${_PCH_current_target} COMPILE_DEFINITIONS) + if(_target_definitions) + foreach(_def ${_target_definitions}) + LIST(APPEND ${_out_compile_flags} "-D${_def}") + endforeach() + endif() + + ELSE() + ## TODO ... ? or does it work out of the box + ENDIF() + + GET_DIRECTORY_PROPERTY(DIRINC INCLUDE_DIRECTORIES ) + FOREACH(item ${DIRINC}) + if(item MATCHES "^${OpenCV_SOURCE_DIR}/modules/") + LIST(APPEND ${_out_compile_flags} "${_PCH_include_prefix}\"${item}\"") + else() + LIST(APPEND ${_out_compile_flags} "${_PCH_isystem_prefix}\"${item}\"") + endif() + ENDFOREACH(item) + + get_target_property(DIRINC ${_PCH_current_target} INCLUDE_DIRECTORIES ) + FOREACH(item ${DIRINC}) + if(item MATCHES "^${OpenCV_SOURCE_DIR}/modules/") + LIST(APPEND ${_out_compile_flags} "${_PCH_include_prefix}\"${item}\"") + else() + LIST(APPEND ${_out_compile_flags} "${_PCH_isystem_prefix}\"${item}\"") + endif() + ENDFOREACH(item) + + GET_DIRECTORY_PROPERTY(_directory_flags DEFINITIONS) + GET_DIRECTORY_PROPERTY(_global_definitions DIRECTORY ${OpenCV_SOURCE_DIR} DEFINITIONS) + #MESSAGE("_directory_flags ${_directory_flags} ${_global_definitions}" ) + LIST(APPEND ${_out_compile_flags} ${_directory_flags}) + LIST(APPEND ${_out_compile_flags} ${_global_definitions}) + LIST(APPEND ${_out_compile_flags} ${CMAKE_CXX_FLAGS}) + + SEPARATE_ARGUMENTS(${_out_compile_flags}) + +ENDMACRO(_PCH_GET_COMPILE_FLAGS) + + +MACRO(_PCH_WRITE_PCHDEP_CXX _targetName _include_file _dephelp) + + SET(${_dephelp} ${CMAKE_CURRENT_BINARY_DIR}/${_targetName}_pch_dephelp.cxx) + IF(CMAKE_HOST_WIN32) + ADD_CUSTOM_COMMAND( + OUTPUT "${${_dephelp}}" + COMMAND ${CMAKE_COMMAND} -E echo "#include \\\"${_include_file}\\\"" > "${${_dephelp}}" + COMMAND ${CMAKE_COMMAND} -E echo "int testfunction();" >> "${${_dephelp}}" + COMMAND ${CMAKE_COMMAND} -E echo "int testfunction()" >> "${${_dephelp}}" + COMMAND ${CMAKE_COMMAND} -E echo "{" >> "${${_dephelp}}" + COMMAND ${CMAKE_COMMAND} -E echo " return 0;" >> "${${_dephelp}}" + COMMAND ${CMAKE_COMMAND} -E echo "}" >> "${${_dephelp}}" + DEPENDS "${_include_file}" + ) + else() + ADD_CUSTOM_COMMAND( + OUTPUT "${${_dephelp}}" + COMMAND ${CMAKE_COMMAND} -E echo "\\#include \\\"${_include_file}\\\"" > "${${_dephelp}}" + COMMAND ${CMAKE_COMMAND} -E echo "int testfunction\\(\\)\\;" >> "${${_dephelp}}" + COMMAND ${CMAKE_COMMAND} -E echo "int testfunction\\(\\)" >> "${${_dephelp}}" + COMMAND ${CMAKE_COMMAND} -E echo "{" >> "${${_dephelp}}" + COMMAND ${CMAKE_COMMAND} -E echo " \\return 0\\;" >> "${${_dephelp}}" + COMMAND ${CMAKE_COMMAND} -E echo "}" >> "${${_dephelp}}" + DEPENDS "${_include_file}" + ) + endif() + +ENDMACRO(_PCH_WRITE_PCHDEP_CXX ) + +MACRO(_PCH_GET_COMPILE_COMMAND out_command _input _output) + + FILE(TO_NATIVE_PATH ${_input} _native_input) + FILE(TO_NATIVE_PATH ${_output} _native_output) + + IF(CMAKE_COMPILER_IS_GNUCXX) + IF(CMAKE_CXX_COMPILER_ARG1) + # remove leading space in compiler argument + STRING(REGEX REPLACE "^ +" "" pchsupport_compiler_cxx_arg1 ${CMAKE_CXX_COMPILER_ARG1}) + + SET(${out_command} + ${CMAKE_CXX_COMPILER} ${pchsupport_compiler_cxx_arg1} ${_compile_FLAGS} -x c++-header -o ${_output} ${_input} + ) + ELSE(CMAKE_CXX_COMPILER_ARG1) + SET(${out_command} + ${CMAKE_CXX_COMPILER} ${_compile_FLAGS} -x c++-header -o ${_output} ${_input} + ) + ENDIF(CMAKE_CXX_COMPILER_ARG1) + ELSE(CMAKE_COMPILER_IS_GNUCXX) + + SET(_dummy_str "#include <${_input}>") + FILE(WRITE ${CMAKE_CURRENT_BINARY_DIR}/pch_dummy.cpp ${_dummy_str}) + + SET(${out_command} + ${CMAKE_CXX_COMPILER} ${_compile_FLAGS} /c /Fp${_native_output} /Yc${_native_input} pch_dummy.cpp + ) + #/out:${_output} + + ENDIF(CMAKE_COMPILER_IS_GNUCXX) + +ENDMACRO(_PCH_GET_COMPILE_COMMAND ) + + +MACRO(_PCH_GET_TARGET_COMPILE_FLAGS _cflags _header_name _pch_path _dowarn ) + + FILE(TO_NATIVE_PATH ${_pch_path} _native_pch_path) + + IF(CMAKE_COMPILER_IS_GNUCXX) + # for use with distcc and gcc >4.0.1 if preprocessed files are accessible + # on all remote machines set + # PCH_ADDITIONAL_COMPILER_FLAGS to -fpch-preprocess + # if you want warnings for invalid header files (which is very inconvenient + # if you have different versions of the headers for different build types + # you may set _pch_dowarn + IF (_dowarn) + SET(${_cflags} "${PCH_ADDITIONAL_COMPILER_FLAGS} -include \"${CMAKE_CURRENT_BINARY_DIR}/${_header_name}\" -Winvalid-pch " ) + ELSE (_dowarn) + SET(${_cflags} "${PCH_ADDITIONAL_COMPILER_FLAGS} -include \"${CMAKE_CURRENT_BINARY_DIR}/${_header_name}\" " ) + ENDIF (_dowarn) + + ELSE(CMAKE_COMPILER_IS_GNUCXX) + + set(${_cflags} "/Fp${_native_pch_path} /Yu${_header_name}" ) + + ENDIF(CMAKE_COMPILER_IS_GNUCXX) + +ENDMACRO(_PCH_GET_TARGET_COMPILE_FLAGS ) + + +MACRO(GET_PRECOMPILED_HEADER_OUTPUT _targetName _input _output) + + GET_FILENAME_COMPONENT(_name ${_input} NAME) + GET_FILENAME_COMPONENT(_path ${_input} PATH) + SET(${_output} "${CMAKE_CURRENT_BINARY_DIR}/${_name}.gch/${_targetName}_${CMAKE_BUILD_TYPE}.gch") + +ENDMACRO(GET_PRECOMPILED_HEADER_OUTPUT _targetName _input) + + +MACRO(ADD_PRECOMPILED_HEADER_TO_TARGET _targetName _input _pch_output_to_use ) + + # to do: test whether compiler flags match between target _targetName + # and _pch_output_to_use + GET_FILENAME_COMPONENT(_name ${_input} NAME) + + IF(ARGN STREQUAL "0") + SET(_dowarn 0) + ELSE() + SET(_dowarn 1) + ENDIF() + + _PCH_GET_TARGET_COMPILE_FLAGS(_target_cflags ${_name} ${_pch_output_to_use} ${_dowarn}) + #MESSAGE("Add flags ${_target_cflags} to ${_targetName} " ) + + GET_TARGET_PROPERTY(_sources ${_targetName} SOURCES) + FOREACH(src ${_sources}) + if(NOT "${src}" MATCHES "\\.mm$") + get_source_file_property(_flags "${src}" COMPILE_FLAGS) + if(_flags) + set(_flags "${_flags} ${_target_cflags}") + else() + set(_flags "${_target_cflags}") + endif() + + set_source_files_properties("${src}" PROPERTIES COMPILE_FLAGS "${_flags}") + endif() + ENDFOREACH() + + ADD_CUSTOM_TARGET(pch_Generate_${_targetName} + DEPENDS ${_pch_output_to_use} + ) + + ADD_DEPENDENCIES(${_targetName} pch_Generate_${_targetName} ) + +ENDMACRO(ADD_PRECOMPILED_HEADER_TO_TARGET) + +MACRO(ADD_PRECOMPILED_HEADER _targetName _input) + + SET(_PCH_current_target ${_targetName}) + + IF(NOT CMAKE_BUILD_TYPE) + MESSAGE(FATAL_ERROR + "This is the ADD_PRECOMPILED_HEADER macro. " + "You must set CMAKE_BUILD_TYPE!" + ) + ENDIF() + + IF(ARGN STREQUAL "0") + SET(_dowarn 0) + ELSE() + SET(_dowarn 1) + ENDIF() + + GET_FILENAME_COMPONENT(_name ${_input} NAME) + GET_FILENAME_COMPONENT(_path ${_input} PATH) + GET_PRECOMPILED_HEADER_OUTPUT( ${_targetName} ${_input} _output) + + _PCH_WRITE_PCHDEP_CXX(${_targetName} "${_input}" _pch_dephelp_cxx) + + ADD_LIBRARY(${_targetName}_pch_dephelp STATIC "${_pch_dephelp_cxx}" "${_input}" ) + + set_target_properties(${_targetName}_pch_dephelp PROPERTIES + DEBUG_POSTFIX "${OPENCV_DEBUG_POSTFIX}" + ARCHIVE_OUTPUT_DIRECTORY "${LIBRARY_OUTPUT_PATH}" + ) + + _PCH_GET_COMPILE_FLAGS(_compile_FLAGS) + + get_target_property(type ${_targetName} TYPE) + if(type STREQUAL "SHARED_LIBRARY") + get_target_property(__DEFINES ${_targetName} DEFINE_SYMBOL) + if(NOT __DEFINES MATCHES __DEFINES-NOTFOUND) + list(APPEND _compile_FLAGS "${_PCH_define_prefix}${__DEFINES}") + endif() + endif() + + get_target_property(DIRINC ${_targetName} INCLUDE_DIRECTORIES) + set_target_properties(${_targetName}_pch_dephelp PROPERTIES INCLUDE_DIRECTORIES "${DIRINC}") + + #MESSAGE("_compile_FLAGS: ${_compile_FLAGS}") + #message("COMMAND ${CMAKE_CXX_COMPILER} ${_compile_FLAGS} -x c++-header -o ${_output} ${_input}") + + ADD_CUSTOM_COMMAND( + OUTPUT "${CMAKE_CURRENT_BINARY_DIR}/${_name}" + COMMAND ${CMAKE_COMMAND} -E copy "${_input}" "${CMAKE_CURRENT_BINARY_DIR}/${_name}" # ensure same directory! Required by gcc + DEPENDS "${_input}" + ) + + #message("_command ${_input} ${_output}") + _PCH_GET_COMPILE_COMMAND(_command ${CMAKE_CURRENT_BINARY_DIR}/${_name} ${_output} ) + + GET_FILENAME_COMPONENT(_outdir ${_output} PATH) + ADD_CUSTOM_COMMAND( + OUTPUT "${_output}" + COMMAND ${CMAKE_COMMAND} -E make_directory "${_outdir}" + COMMAND ${_command} + DEPENDS "${_input}" + DEPENDS "${CMAKE_CURRENT_BINARY_DIR}/${_name}" + DEPENDS ${_targetName}_pch_dephelp + ) + + ADD_PRECOMPILED_HEADER_TO_TARGET(${_targetName} ${_input} ${_output} ${_dowarn}) + +ENDMACRO(ADD_PRECOMPILED_HEADER) + + +# Generates the use of precompiled in a target, +# without using depency targets (2 extra for each target) +# Using Visual, must also add ${_targetName}_pch to sources +# Not needed by Xcode + +MACRO(GET_NATIVE_PRECOMPILED_HEADER _targetName _input) + + if(CMAKE_GENERATOR MATCHES "^Visual.*$") + set(_dummy_str "#include \"${_input}\"\n") + + set(${_targetName}_pch ${CMAKE_CURRENT_BINARY_DIR}/${_targetName}_pch.cpp) + if(EXISTS ${${_targetName}_pch}) + # Check if contents is the same, if not rewrite + # todo + else() + FILE(WRITE ${${_targetName}_pch} ${_dummy_str}) + endif() + endif() + +ENDMACRO(GET_NATIVE_PRECOMPILED_HEADER) + + +MACRO(ADD_NATIVE_PRECOMPILED_HEADER _targetName _input) + + IF(ARGN STREQUAL "0") + SET(_dowarn 0) + ELSE() + SET(_dowarn 1) + ENDIF() + + if(CMAKE_GENERATOR MATCHES "^Visual.*$") + + # Auto include the precompile (useful for moc processing, since the use of + # precompiled is specified at the target level + # and I don't want to specifiy /F- for each moc/res/ui generated files (using Qt) + + GET_TARGET_PROPERTY(oldProps ${_targetName} COMPILE_FLAGS) + if (oldProps MATCHES NOTFOUND) + SET(oldProps "") + endif() + + SET(newProperties "${oldProps} /Yu\"${_input}\" /FI\"${_input}\"") + SET_TARGET_PROPERTIES(${_targetName} PROPERTIES COMPILE_FLAGS "${newProperties}") + + #also inlude ${oldProps} to have the same compile options + SET_SOURCE_FILES_PROPERTIES(${${_targetName}_pch} PROPERTIES COMPILE_FLAGS "${oldProps} /Yc\"${_input}\"") + + elseif (CMAKE_GENERATOR MATCHES Xcode) + + # For Xcode, cmake needs my patch to process + # GCC_PREFIX_HEADER and GCC_PRECOMPILE_PREFIX_HEADER as target properties + + # When buiding out of the tree, precompiled may not be located + # Use full path instead. + GET_FILENAME_COMPONENT(fullPath ${_input} ABSOLUTE) + + SET_TARGET_PROPERTIES(${_targetName} PROPERTIES XCODE_ATTRIBUTE_GCC_PREFIX_HEADER "${fullPath}") + SET_TARGET_PROPERTIES(${_targetName} PROPERTIES XCODE_ATTRIBUTE_GCC_PRECOMPILE_PREFIX_HEADER "YES") + + else() + + #Fallback to the "old" precompiled suppport + #ADD_PRECOMPILED_HEADER(${_targetName} ${_input} ${_dowarn}) + + endif() + +ENDMACRO(ADD_NATIVE_PRECOMPILED_HEADER) + +macro(ocv_add_precompiled_header_to_target the_target pch_header) + if(PCHSupport_FOUND AND ENABLE_PRECOMPILED_HEADERS AND EXISTS "${pch_header}") + if(CMAKE_GENERATOR MATCHES "^Visual" OR CMAKE_GENERATOR MATCHES Xcode) + add_native_precompiled_header(${the_target} ${pch_header}) + elseif(CMAKE_COMPILER_IS_GNUCXX AND CMAKE_GENERATOR MATCHES "Makefiles|Ninja") + add_precompiled_header(${the_target} ${pch_header}) + endif() + endif() +endmacro() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVPackaging.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVPackaging.cmake new file mode 100644 index 000000000..59d602c5d --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVPackaging.cmake @@ -0,0 +1,124 @@ +if(EXISTS "${CMAKE_ROOT}/Modules/CPack.cmake") +set(CPACK_set_DESTDIR "on") + +if(NOT OPENCV_CUSTOM_PACKAGE_INFO) + set(CPACK_PACKAGE_DESCRIPTION_SUMMARY "Open Computer Vision Library") + set(CPACK_PACKAGE_DESCRIPTION +"OpenCV (Open Source Computer Vision Library) is an open source computer vision +and machine learning software library. OpenCV was built to provide a common +infrastructure for computer vision applications and to accelerate the use of +machine perception in the commercial products. Being a BSD-licensed product, +OpenCV makes it easy for businesses to utilize and modify the code.") + set(CPACK_PACKAGE_VENDOR "OpenCV Foundation") + set(CPACK_RESOURCE_FILE_LICENSE "${CMAKE_CURRENT_SOURCE_DIR}/LICENSE") + set(CPACK_PACKAGE_CONTACT "admin@opencv.org") + set(CPACK_PACKAGE_VERSION_MAJOR "${OPENCV_VERSION_MAJOR}") + set(CPACK_PACKAGE_VERSION_MINOR "${OPENCV_VERSION_MINOR}") + set(CPACK_PACKAGE_VERSION_PATCH "${OPENCV_VERSION_PATCH}") + set(CPACK_PACKAGE_VERSION "${OPENCV_VCSVERSION}") +endif(NOT OPENCV_CUSTOM_PACKAGE_INFO) + +#arch +if(X86) + set(CPACK_DEBIAN_ARCHITECTURE "i386") + set(CPACK_RPM_PACKAGE_ARCHITECTURE "i686") +elseif(X86_64) + set(CPACK_DEBIAN_ARCHITECTURE "amd64") + set(CPACK_RPM_PACKAGE_ARCHITECTURE "x86_64") +elseif(ARM) + set(CPACK_DEBIAN_ARCHITECTURE "armhf") + set(CPACK_RPM_PACKAGE_ARCHITECTURE "armhf") +else() + set(CPACK_DEBIAN_ARCHITECTURE ${CMAKE_SYSTEM_PROCESSOR}) + set(CPACK_RPM_PACKAGE_ARCHITECTURE ${CMAKE_SYSTEM_PROCESSOR}) +endif() + +if(CPACK_GENERATOR STREQUAL "DEB") + set(OPENCV_PACKAGE_ARCH_SUFFIX ${CPACK_DEBIAN_ARCHITECTURE}) +elseif(CPACK_GENERATOR STREQUAL "RPM") + set(OPENCV_PACKAGE_ARCH_SUFFIX ${CPACK_RPM_PACKAGE_ARCHITECTURE}) +else() + set(OPENCV_PACKAGE_ARCH_SUFFIX ${CMAKE_SYSTEM_PROCESSOR}) +endif() + +set(CPACK_PACKAGE_FILE_NAME "${CMAKE_PROJECT_NAME}-${OPENCV_VCSVERSION}-${OPENCV_PACKAGE_ARCH_SUFFIX}") +set(CPACK_SOURCE_PACKAGE_FILE_NAME "${CMAKE_PROJECT_NAME}-${OPENCV_VCSVERSION}-${OPENCV_PACKAGE_ARCH_SUFFIX}") + +#rpm options +set(CPACK_RPM_COMPONENT_INSTALL TRUE) +set(CPACK_RPM_PACKAGE_SUMMARY ${CPACK_PACKAGE_DESCRIPTION_SUMMARY}) +set(CPACK_RPM_PACKAGE_DESCRIPTION ${CPACK_PACKAGE_DESCRIPTION}) +set(CPACK_RPM_PACKAGE_URL "http://opencv.org") +set(CPACK_RPM_PACKAGE_LICENSE "BSD") + +#deb options +set(CPACK_DEB_COMPONENT_INSTALL TRUE) +set(CPACK_DEBIAN_PACKAGE_PRIORITY "optional") +set(CPACK_DEBIAN_PACKAGE_SECTION "libs") +set(CPACK_DEBIAN_PACKAGE_HOMEPAGE "http://opencv.org") + +#display names +set(CPACK_COMPONENT_DEV_DISPLAY_NAME "Development files") +set(CPACK_COMPONENT_DOCS_DISPLAY_NAME "Documentation") +set(CPACK_COMPONENT_JAVA_DISPLAY_NAME "Java bindings") +set(CPACK_COMPONENT_LIBS_DISPLAY_NAME "Libraries and data") +set(CPACK_COMPONENT_PYTHON_DISPLAY_NAME "Python bindings") +set(CPACK_COMPONENT_SAMPLES_DISPLAY_NAME "Samples") +set(CPACK_COMPONENT_TESTS_DISPLAY_NAME "Tests") + +#depencencies +set(CPACK_DEBIAN_PACKAGE_SHLIBDEPS TRUE) +set(CPACK_COMPONENT_LIBS_REQUIRED TRUE) +set(CPACK_COMPONENT_SAMPLES_DEPENDS libs) +set(CPACK_COMPONENT_DEV_DEPENDS libs) +set(CPACK_COMPONENT_DOCS_DEPENDS libs) +set(CPACK_COMPONENT_JAVA_DEPENDS libs) +set(CPACK_COMPONENT_PYTHON_DEPENDS libs) +set(CPACK_COMPONENT_TESTS_DEPENDS libs) + +if(HAVE_CUDA) + string(REPLACE "." "-" cuda_version_suffix ${CUDA_VERSION}) + if(${CUDA_VERSION} VERSION_LESS "6.5") + set(CPACK_DEB_libs_PACKAGE_DEPENDS "cuda-core-libs-${cuda_version_suffix}, cuda-extra-libs-${cuda_version_suffix}") + set(CPACK_DEB_dev_PACKAGE_DEPENDS "cuda-headers-${cuda_version_suffix}") + else() + set(CPACK_DEB_libs_PACKAGE_DEPENDS "cuda-cudart-${cuda_version_suffix}, cuda-npp-${cuda_version_suffix}") + set(CPACK_DEB_dev_PACKAGE_DEPENDS "cuda-cudart-dev-${cuda_version_suffix}, cuda-npp-dev-${cuda_version_suffix}") + if(HAVE_CUFFT) + set(CPACK_DEB_libs_PACKAGE_DEPENDS "${CPACK_DEB_libs_PACKAGE_DEPENDS}, cuda-cufft-${cuda_version_suffix}") + set(CPACK_DEB_dev_PACKAGE_DEPENDS "${CPACK_DEB_dev_PACKAGE_DEPENDS}, cuda-cufft-dev-${cuda_version_suffix}") + endif() + if(HAVE_HAVE_CUBLAS) + set(CPACK_DEB_libs_PACKAGE_DEPENDS "${CPACK_DEB_libs_PACKAGE_DEPENDS}, cuda-cublas-${cuda_version_suffix}") + set(CPACK_DEB_dev_PACKAGE_DEPENDS "${CPACK_DEB_dev_PACKAGE_DEPENDS}, cuda-cublas-dev-${cuda_version_suffix}") + endif() + endif() + set(CPACK_COMPONENT_dev_DEPENDS libs) +endif() + +if(NOT OPENCV_CUSTOM_PACKAGE_INFO) + set(CPACK_COMPONENT_LIBS_DESCRIPTION "Open Computer Vision Library") + set(CPACK_DEBIAN_COMPONENT_LIBS_NAME "lib${CMAKE_PROJECT_NAME}") + + set(CPACK_COMPONENT_PYTHON_DESCRIPTION "Python bindings for Open Source Computer Vision Library") + set(CPACK_DEBIAN_COMPONENT_PYTHON_NAME "lib${CMAKE_PROJECT_NAME}-python") + + set(CPACK_COMPONENT_JAVA_DESCRIPTION "Java bindings for Open Source Computer Vision Library") + set(CPACK_DEBIAN_COMPONENT_JAVA_NAME "lib${CMAKE_PROJECT_NAME}-java") + + set(CPACK_COMPONENT_DEV_DESCRIPTION "Development files for Open Source Computer Vision Library") + set(CPACK_DEBIAN_COMPONENT_DEV_NAME "lib${CMAKE_PROJECT_NAME}-dev") + + set(CPACK_COMPONENT_DOCS_DESCRIPTION "Documentation for Open Source Computer Vision Library") + set(CPACK_DEBIAN_COMPONENT_DOCS_NAME "lib${CMAKE_PROJECT_NAME}-docs") + + set(CPACK_COMPONENT_SAMPLES_DESCRIPTION "Samples for Open Source Computer Vision Library") + set(CPACK_DEBIAN_COMPONENT_SAMPLES_NAME "lib${CMAKE_PROJECT_NAME}-samples") + + set(CPACK_COMPONENT_TESTS_DESCRIPTION "Accuracy and performance tests for Open Source Computer Vision Library") + set(CPACK_DEBIAN_COMPONENT_TESTS_NAME "lib${CMAKE_PROJECT_NAME}-tests") +endif(NOT OPENCV_CUSTOM_PACKAGE_INFO) + +include(CPack) + +ENDif(EXISTS "${CMAKE_ROOT}/Modules/CPack.cmake") \ No newline at end of file diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVUtils.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVUtils.cmake new file mode 100644 index 000000000..3e2ea8a7a --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVUtils.cmake @@ -0,0 +1,834 @@ +# Debugging function +function(ocv_cmake_dump_vars) + cmake_parse_arguments(DUMP "" "TOFILE" "" ${ARGN}) + set(regex "${DUMP_UNPARSED_ARGUMENTS}") + get_cmake_property(_variableNames VARIABLES) + set(VARS "") + foreach(_variableName ${_variableNames}) + if(_variableName MATCHES "${regex}") + set(VARS "${VARS}${_variableName}=${${_variableName}}\n") + endif() + endforeach() + if(DUMP_TOFILE) + file(WRITE ${CMAKE_BINARY_DIR}/${DUMP_TOFILE} "${VARS}") + else() + message(AUTHOR_WARNING "${VARS}") + endif() +endfunction() + + +# Search packages for host system instead of packages for target system +# in case of cross compilation thess macro should be defined by toolchain file +if(NOT COMMAND find_host_package) + macro(find_host_package) + find_package(${ARGN}) + endmacro() +endif() +if(NOT COMMAND find_host_program) + macro(find_host_program) + find_program(${ARGN}) + endmacro() +endif() + +# assert macro +# Note: it doesn't support lists in arguments +# Usage samples: +# ocv_assert(MyLib_FOUND) +# ocv_assert(DEFINED MyLib_INCLUDE_DIRS) +macro(ocv_assert) + if(NOT (${ARGN})) + string(REPLACE ";" " " __assert_msg "${ARGN}") + message(AUTHOR_WARNING "Assertion failed: ${__assert_msg}") + endif() +endmacro() + +macro(ocv_debug_message) +# string(REPLACE ";" " " __msg "${ARGN}") +# message(STATUS "${__msg}") +endmacro() + +macro(ocv_check_environment_variables) + foreach(_var ${ARGN}) + if(NOT DEFINED ${_var} AND DEFINED ENV{${_var}}) + set(__value "$ENV{${_var}}") + file(TO_CMAKE_PATH "${__value}" __value) # Assume that we receive paths + set(${_var} "${__value}") + message(STATUS "Update variable ${_var} from environment: ${${_var}}") + endif() + endforeach() +endmacro() + +# rename modules target to world if needed +macro(_ocv_fix_target target_var) + if(BUILD_opencv_world) + if(OPENCV_MODULE_${${target_var}}_IS_PART_OF_WORLD) + set(${target_var} opencv_world) + endif() + endif() +endmacro() + +# adds include directories in such way that directories from the OpenCV source tree go first +function(ocv_include_directories) + ocv_debug_message("ocv_include_directories( ${ARGN} )") + set(__add_before "") + foreach(dir ${ARGN}) + get_filename_component(__abs_dir "${dir}" ABSOLUTE) + if("${__abs_dir}" MATCHES "^${OpenCV_SOURCE_DIR}" OR "${__abs_dir}" MATCHES "^${OpenCV_BINARY_DIR}") + list(APPEND __add_before "${dir}") + else() + include_directories(AFTER SYSTEM "${dir}") + endif() + endforeach() + include_directories(BEFORE ${__add_before}) +endfunction() + +# adds include directories in such way that directories from the OpenCV source tree go first +function(ocv_target_include_directories target) + _ocv_fix_target(target) + set(__params "") + foreach(dir ${ARGN}) + get_filename_component(__abs_dir "${dir}" ABSOLUTE) + if("${__abs_dir}" MATCHES "^${OpenCV_SOURCE_DIR}" OR "${__abs_dir}" MATCHES "^${OpenCV_BINARY_DIR}") + list(APPEND __params "${__abs_dir}") + else() + list(APPEND __params "${dir}") + endif() + endforeach() + if(HAVE_CUDA OR CMAKE_VERSION VERSION_LESS 2.8.11) + include_directories(${__params}) + else() + if(TARGET ${target}) + target_include_directories(${target} PRIVATE ${__params}) + else() + set(__new_inc "${OCV_TARGET_INCLUDE_DIRS_${target}};${__params}") + set(OCV_TARGET_INCLUDE_DIRS_${target} "${__new_inc}" CACHE INTERNAL "") + endif() + endif() +endfunction() + +# clears all passed variables +macro(ocv_clear_vars) + foreach(_var ${ARGN}) + unset(${_var} CACHE) + endforeach() +endmacro() + +set(OCV_COMPILER_FAIL_REGEX + "command line option .* is valid for .* but not for C\\+\\+" # GNU + "command line option .* is valid for .* but not for C" # GNU + "unrecognized .*option" # GNU + "unknown .*option" # Clang + "ignoring unknown option" # MSVC + "warning D9002" # MSVC, any lang + "option .*not supported" # Intel + "[Uu]nknown option" # HP + "[Ww]arning: [Oo]ption" # SunPro + "command option .* is not recognized" # XL + "not supported in this configuration; ignored" # AIX + "File with unknown suffix passed to linker" # PGI + "WARNING: unknown flag:" # Open64 + ) + +MACRO(ocv_check_compiler_flag LANG FLAG RESULT) + if(NOT DEFINED ${RESULT}) + if("_${LANG}_" MATCHES "_CXX_") + set(_fname "${CMAKE_BINARY_DIR}${CMAKE_FILES_DIRECTORY}/CMakeTmp/src.cxx") + if("${CMAKE_CXX_FLAGS} ${FLAG} " MATCHES "-Werror " OR "${CMAKE_CXX_FLAGS} ${FLAG} " MATCHES "-Werror=unknown-pragmas ") + FILE(WRITE "${_fname}" "int main() { return 0; }\n") + else() + FILE(WRITE "${_fname}" "#pragma\nint main() { return 0; }\n") + endif() + elseif("_${LANG}_" MATCHES "_C_") + set(_fname "${CMAKE_BINARY_DIR}${CMAKE_FILES_DIRECTORY}/CMakeTmp/src.c") + if("${CMAKE_C_FLAGS} ${FLAG} " MATCHES "-Werror " OR "${CMAKE_C_FLAGS} ${FLAG} " MATCHES "-Werror=unknown-pragmas ") + FILE(WRITE "${_fname}" "int main(void) { return 0; }\n") + else() + FILE(WRITE "${_fname}" "#pragma\nint main(void) { return 0; }\n") + endif() + elseif("_${LANG}_" MATCHES "_OBJCXX_") + set(_fname "${CMAKE_BINARY_DIR}${CMAKE_FILES_DIRECTORY}/CMakeTmp/src.mm") + if("${CMAKE_CXX_FLAGS} ${FLAG} " MATCHES "-Werror " OR "${CMAKE_CXX_FLAGS} ${FLAG} " MATCHES "-Werror=unknown-pragmas ") + FILE(WRITE "${_fname}" "int main() { return 0; }\n") + else() + FILE(WRITE "${_fname}" "#pragma\nint main() { return 0; }\n") + endif() + else() + unset(_fname) + endif() + if(_fname) + MESSAGE(STATUS "Performing Test ${RESULT}") + TRY_COMPILE(${RESULT} + "${CMAKE_BINARY_DIR}" + "${_fname}" + COMPILE_DEFINITIONS "${FLAG}" + OUTPUT_VARIABLE OUTPUT) + + FOREACH(_regex ${OCV_COMPILER_FAIL_REGEX}) + IF("${OUTPUT}" MATCHES "${_regex}") + SET(${RESULT} 0) + break() + ENDIF() + ENDFOREACH() + + IF(${RESULT}) + SET(${RESULT} 1 CACHE INTERNAL "Test ${RESULT}") + MESSAGE(STATUS "Performing Test ${RESULT} - Success") + ELSE(${RESULT}) + MESSAGE(STATUS "Performing Test ${RESULT} - Failed") + SET(${RESULT} "" CACHE INTERNAL "Test ${RESULT}") + ENDIF(${RESULT}) + else() + SET(${RESULT} 0) + endif() + endif() +ENDMACRO() + +macro(ocv_check_flag_support lang flag varname) + if("_${lang}_" MATCHES "_CXX_") + set(_lang CXX) + elseif("_${lang}_" MATCHES "_C_") + set(_lang C) + elseif("_${lang}_" MATCHES "_OBJCXX_") + set(_lang OBJCXX) + else() + set(_lang ${lang}) + endif() + + string(TOUPPER "${flag}" ${varname}) + string(REGEX REPLACE "^(/|-)" "HAVE_${_lang}_" ${varname} "${${varname}}") + string(REGEX REPLACE " -|-|=| |\\." "_" ${varname} "${${varname}}") + + ocv_check_compiler_flag("${_lang}" "${ARGN} ${flag}" ${${varname}}) +endmacro() + +# turns off warnings +macro(ocv_warnings_disable) + if(NOT ENABLE_NOISY_WARNINGS) + set(_flag_vars "") + set(_msvc_warnings "") + set(_gxx_warnings "") + foreach(arg ${ARGN}) + if(arg MATCHES "^CMAKE_") + list(APPEND _flag_vars ${arg}) + elseif(arg MATCHES "^/wd") + list(APPEND _msvc_warnings ${arg}) + elseif(arg MATCHES "^-W") + list(APPEND _gxx_warnings ${arg}) + endif() + endforeach() + if(MSVC AND _msvc_warnings AND _flag_vars) + foreach(var ${_flag_vars}) + foreach(warning ${_msvc_warnings}) + set(${var} "${${var}} ${warning}") + endforeach() + endforeach() + elseif((CMAKE_COMPILER_IS_GNUCXX OR (UNIX AND CV_ICC)) AND _gxx_warnings AND _flag_vars) + foreach(var ${_flag_vars}) + foreach(warning ${_gxx_warnings}) + if(NOT warning MATCHES "^-Wno-") + string(REPLACE "${warning}" "" ${var} "${${var}}") + string(REPLACE "-W" "-Wno-" warning "${warning}") + endif() + ocv_check_flag_support(${var} "${warning}" _varname) + if(${_varname}) + set(${var} "${${var}} ${warning}") + endif() + endforeach() + endforeach() + endif() + unset(_flag_vars) + unset(_msvc_warnings) + unset(_gxx_warnings) + endif(NOT ENABLE_NOISY_WARNINGS) +endmacro() + +macro(add_apple_compiler_options the_module) + ocv_check_flag_support(OBJCXX "-fobjc-exceptions" HAVE_OBJC_EXCEPTIONS) + if(HAVE_OBJC_EXCEPTIONS) + foreach(source ${OPENCV_MODULE_${the_module}_SOURCES}) + if("${source}" MATCHES "\\.mm$") + get_source_file_property(flags "${source}" COMPILE_FLAGS) + if(flags) + set(flags "${_flags} -fobjc-exceptions") + else() + set(flags "-fobjc-exceptions") + endif() + + set_source_files_properties("${source}" PROPERTIES COMPILE_FLAGS "${flags}") + endif() + endforeach() + endif() +endmacro() + +# Provides an option that the user can optionally select. +# Can accept condition to control when option is available for user. +# Usage: +# option( "help string describing the option" [IF ]) +macro(OCV_OPTION variable description value) + set(__value ${value}) + set(__condition "") + set(__varname "__value") + foreach(arg ${ARGN}) + if(arg STREQUAL "IF" OR arg STREQUAL "if") + set(__varname "__condition") + else() + list(APPEND ${__varname} ${arg}) + endif() + endforeach() + unset(__varname) + if(__condition STREQUAL "") + set(__condition 2 GREATER 1) + endif() + + if(${__condition}) + if(__value MATCHES ";") + if(${__value}) + option(${variable} "${description}" ON) + else() + option(${variable} "${description}" OFF) + endif() + elseif(DEFINED ${__value}) + if(${__value}) + option(${variable} "${description}" ON) + else() + option(${variable} "${description}" OFF) + endif() + else() + option(${variable} "${description}" ${__value}) + endif() + else() + unset(${variable} CACHE) + endif() + unset(__condition) + unset(__value) +endmacro() + + +# Macros that checks if module have been installed. +# After it adds module to build and define +# constants passed as second arg +macro(CHECK_MODULE module_name define) + set(${define} 0) + if(PKG_CONFIG_FOUND) + set(ALIAS ALIASOF_${module_name}) + set(ALIAS_FOUND ${ALIAS}_FOUND) + set(ALIAS_INCLUDE_DIRS ${ALIAS}_INCLUDE_DIRS) + set(ALIAS_LIBRARY_DIRS ${ALIAS}_LIBRARY_DIRS) + set(ALIAS_LIBRARIES ${ALIAS}_LIBRARIES) + + PKG_CHECK_MODULES(${ALIAS} ${module_name}) + + if(${ALIAS_FOUND}) + set(${define} 1) + foreach(P "${ALIAS_INCLUDE_DIRS}") + if(${P}) + list(APPEND VIDEOIO_INCLUDE_DIRS ${${P}}) + list(APPEND HIGHGUI_INCLUDE_DIRS ${${P}}) + endif() + endforeach() + + foreach(P "${ALIAS_LIBRARY_DIRS}") + if(${P}) + list(APPEND VIDEOIO_LIBRARY_DIRS ${${P}}) + list(APPEND HIGHGUI_LIBRARY_DIRS ${${P}}) + endif() + endforeach() + + list(APPEND VIDEOIO_LIBRARIES ${${ALIAS_LIBRARIES}}) + list(APPEND HIGHGUI_LIBRARIES ${${ALIAS_LIBRARIES}}) + endif() + endif() +endmacro() + + +set(OPENCV_BUILD_INFO_FILE "${OpenCV_BINARY_DIR}/version_string.tmp") +file(REMOVE "${OPENCV_BUILD_INFO_FILE}") +function(ocv_output_status msg) + message(STATUS "${msg}") + string(REPLACE "\\" "\\\\" msg "${msg}") + string(REPLACE "\"" "\\\"" msg "${msg}") + file(APPEND "${OPENCV_BUILD_INFO_FILE}" "\"${msg}\\n\"\n") +endfunction() + +macro(ocv_finalize_status) + if(NOT OPENCV_SKIP_STATUS_FINALIZATION) + if(DEFINED OPENCV_MODULE_opencv_core_BINARY_DIR) + execute_process(COMMAND ${CMAKE_COMMAND} -E copy_if_different "${OPENCV_BUILD_INFO_FILE}" "${OPENCV_MODULE_opencv_core_BINARY_DIR}/version_string.inc" OUTPUT_QUIET) + endif() + endif() +endmacro() + + +# Status report function. +# Automatically align right column and selects text based on condition. +# Usage: +# status() +# status( [ ...]) +# status( THEN ELSE ) +function(status text) + set(status_cond) + set(status_then) + set(status_else) + + set(status_current_name "cond") + foreach(arg ${ARGN}) + if(arg STREQUAL "THEN") + set(status_current_name "then") + elseif(arg STREQUAL "ELSE") + set(status_current_name "else") + else() + list(APPEND status_${status_current_name} ${arg}) + endif() + endforeach() + + if(DEFINED status_cond) + set(status_placeholder_length 32) + string(RANDOM LENGTH ${status_placeholder_length} ALPHABET " " status_placeholder) + string(LENGTH "${text}" status_text_length) + if(status_text_length LESS status_placeholder_length) + string(SUBSTRING "${text}${status_placeholder}" 0 ${status_placeholder_length} status_text) + elseif(DEFINED status_then OR DEFINED status_else) + ocv_output_status("${text}") + set(status_text "${status_placeholder}") + else() + set(status_text "${text}") + endif() + + if(DEFINED status_then OR DEFINED status_else) + if(${status_cond}) + string(REPLACE ";" " " status_then "${status_then}") + string(REGEX REPLACE "^[ \t]+" "" status_then "${status_then}") + ocv_output_status("${status_text} ${status_then}") + else() + string(REPLACE ";" " " status_else "${status_else}") + string(REGEX REPLACE "^[ \t]+" "" status_else "${status_else}") + ocv_output_status("${status_text} ${status_else}") + endif() + else() + string(REPLACE ";" " " status_cond "${status_cond}") + string(REGEX REPLACE "^[ \t]+" "" status_cond "${status_cond}") + ocv_output_status("${status_text} ${status_cond}") + endif() + else() + ocv_output_status("${text}") + endif() +endfunction() + + +# remove all matching elements from the list +macro(ocv_list_filterout lst regex) + foreach(item ${${lst}}) + if(item MATCHES "${regex}") + list(REMOVE_ITEM ${lst} "${item}") + endif() + endforeach() +endmacro() + + +# stable & safe duplicates removal macro +macro(ocv_list_unique __lst) + if(${__lst}) + list(REMOVE_DUPLICATES ${__lst}) + endif() +endmacro() + + +# safe list reversal macro +macro(ocv_list_reverse __lst) + if(${__lst}) + list(REVERSE ${__lst}) + endif() +endmacro() + + +# safe list sorting macro +macro(ocv_list_sort __lst) + if(${__lst}) + list(SORT ${__lst}) + endif() +endmacro() + + +# add prefix to each item in the list +macro(ocv_list_add_prefix LST PREFIX) + set(__tmp "") + foreach(item ${${LST}}) + list(APPEND __tmp "${PREFIX}${item}") + endforeach() + set(${LST} ${__tmp}) + unset(__tmp) +endmacro() + + +# add suffix to each item in the list +macro(ocv_list_add_suffix LST SUFFIX) + set(__tmp "") + foreach(item ${${LST}}) + list(APPEND __tmp "${item}${SUFFIX}") + endforeach() + set(${LST} ${__tmp}) + unset(__tmp) +endmacro() + + +# gets and removes the first element from list +macro(ocv_list_pop_front LST VAR) + if(${LST}) + list(GET ${LST} 0 ${VAR}) + list(REMOVE_AT ${LST} 0) + else() + set(${VAR} "") + endif() +endmacro() + + +# simple regex escaping routine (does not cover all cases!!!) +macro(ocv_regex_escape var regex) + string(REGEX REPLACE "([+.*^$])" "\\\\1" ${var} "${regex}") +endmacro() + + +# convert list of paths to full paths +macro(ocv_convert_to_full_paths VAR) + if(${VAR}) + set(__tmp "") + foreach(path ${${VAR}}) + get_filename_component(${VAR} "${path}" ABSOLUTE) + list(APPEND __tmp "${${VAR}}") + endforeach() + set(${VAR} ${__tmp}) + unset(__tmp) + endif() +endmacro() + + +# convert list of paths to libraries names without lib prefix +macro(ocv_convert_to_lib_name var) + set(__tmp "") + foreach(path ${ARGN}) + get_filename_component(__tmp_name "${path}" NAME_WE) + string(REGEX REPLACE "^lib" "" __tmp_name ${__tmp_name}) + list(APPEND __tmp "${__tmp_name}") + endforeach() + set(${var} ${__tmp}) + unset(__tmp) + unset(__tmp_name) +endmacro() + + +# add install command +function(ocv_install_target) + install(TARGETS ${ARGN}) + + set(isPackage 0) + unset(__package) + unset(__target) + foreach(e ${ARGN}) + if(NOT DEFINED __target) + set(__target "${e}") + endif() + if(isPackage EQUAL 1) + set(__package "${e}") + break() + endif() + if(e STREQUAL "EXPORT") + set(isPackage 1) + endif() + endforeach() + + if(DEFINED __package) + list(APPEND ${__package}_TARGETS ${__target}) + set(${__package}_TARGETS "${${__package}_TARGETS}" CACHE INTERNAL "List of ${__package} targets") + endif() + + if(INSTALL_CREATE_DISTRIB) + if(MSVC AND NOT BUILD_SHARED_LIBS) + set(__target "${ARGV0}") + + set(isArchive 0) + set(isDst 0) + unset(__dst) + foreach(e ${ARGN}) + if(isDst EQUAL 1) + set(__dst "${e}") + break() + endif() + if(isArchive EQUAL 1 AND e STREQUAL "DESTINATION") + set(isDst 1) + endif() + if(e STREQUAL "ARCHIVE") + set(isArchive 1) + else() + set(isArchive 0) + endif() + endforeach() + +# message(STATUS "Process ${__target} dst=${__dst}...") + if(DEFINED __dst) + if(CMAKE_VERSION VERSION_LESS 2.8.12) + get_target_property(fname ${__target} LOCATION_DEBUG) + if(fname MATCHES "\\.lib$") + string(REGEX REPLACE "\\.lib$" ".pdb" fname "${fname}") + install(FILES ${fname} DESTINATION ${__dst} CONFIGURATIONS Debug) + endif() + + get_target_property(fname ${__target} LOCATION_RELEASE) + if(fname MATCHES "\\.lib$") + string(REGEX REPLACE "\\.lib$" ".pdb" fname "${fname}") + install(FILES ${fname} DESTINATION ${__dst} CONFIGURATIONS Release) + endif() + else() + # CMake 2.8.12 brokes PDB support in STATIC libraries for MSVS + endif() + endif() + endif() + endif() +endfunction() + + +# read set of version defines from the header file +macro(ocv_parse_header FILENAME FILE_VAR) + set(vars_regex "") + set(__parnet_scope OFF) + set(__add_cache OFF) + foreach(name ${ARGN}) + if("${name}" STREQUAL "PARENT_SCOPE") + set(__parnet_scope ON) + elseif("${name}" STREQUAL "CACHE") + set(__add_cache ON) + elseif(vars_regex) + set(vars_regex "${vars_regex}|${name}") + else() + set(vars_regex "${name}") + endif() + endforeach() + if(EXISTS "${FILENAME}") + file(STRINGS "${FILENAME}" ${FILE_VAR} REGEX "#define[ \t]+(${vars_regex})[ \t]+[0-9]+" ) + else() + unset(${FILE_VAR}) + endif() + foreach(name ${ARGN}) + if(NOT "${name}" STREQUAL "PARENT_SCOPE" AND NOT "${name}" STREQUAL "CACHE") + if(${FILE_VAR}) + if(${FILE_VAR} MATCHES ".+[ \t]${name}[ \t]+([0-9]+).*") + string(REGEX REPLACE ".+[ \t]${name}[ \t]+([0-9]+).*" "\\1" ${name} "${${FILE_VAR}}") + else() + set(${name} "") + endif() + if(__add_cache) + set(${name} ${${name}} CACHE INTERNAL "${name} parsed from ${FILENAME}" FORCE) + elseif(__parnet_scope) + set(${name} "${${name}}" PARENT_SCOPE) + endif() + else() + unset(${name} CACHE) + endif() + endif() + endforeach() +endmacro() + +# read single version define from the header file +macro(ocv_parse_header2 LIBNAME HDR_PATH VARNAME) + ocv_clear_vars(${LIBNAME}_VERSION_MAJOR + ${LIBNAME}_VERSION_MAJOR + ${LIBNAME}_VERSION_MINOR + ${LIBNAME}_VERSION_PATCH + ${LIBNAME}_VERSION_TWEAK + ${LIBNAME}_VERSION_STRING) + set(${LIBNAME}_H "") + if(EXISTS "${HDR_PATH}") + file(STRINGS "${HDR_PATH}" ${LIBNAME}_H REGEX "^#define[ \t]+${VARNAME}[ \t]+\"[^\"]*\".*$" LIMIT_COUNT 1) + endif() + + if(${LIBNAME}_H) + string(REGEX REPLACE "^.*[ \t]${VARNAME}[ \t]+\"([0-9]+).*$" "\\1" ${LIBNAME}_VERSION_MAJOR "${${LIBNAME}_H}") + string(REGEX REPLACE "^.*[ \t]${VARNAME}[ \t]+\"[0-9]+\\.([0-9]+).*$" "\\1" ${LIBNAME}_VERSION_MINOR "${${LIBNAME}_H}") + string(REGEX REPLACE "^.*[ \t]${VARNAME}[ \t]+\"[0-9]+\\.[0-9]+\\.([0-9]+).*$" "\\1" ${LIBNAME}_VERSION_PATCH "${${LIBNAME}_H}") + set(${LIBNAME}_VERSION_MAJOR ${${LIBNAME}_VERSION_MAJOR} ${ARGN}) + set(${LIBNAME}_VERSION_MINOR ${${LIBNAME}_VERSION_MINOR} ${ARGN}) + set(${LIBNAME}_VERSION_PATCH ${${LIBNAME}_VERSION_PATCH} ${ARGN}) + set(${LIBNAME}_VERSION_STRING "${${LIBNAME}_VERSION_MAJOR}.${${LIBNAME}_VERSION_MINOR}.${${LIBNAME}_VERSION_PATCH}") + + # append a TWEAK version if it exists: + set(${LIBNAME}_VERSION_TWEAK "") + if("${${LIBNAME}_H}" MATCHES "^.*[ \t]${VARNAME}[ \t]+\"[0-9]+\\.[0-9]+\\.[0-9]+\\.([0-9]+).*$") + set(${LIBNAME}_VERSION_TWEAK "${CMAKE_MATCH_1}" ${ARGN}) + endif() + if(${LIBNAME}_VERSION_TWEAK) + set(${LIBNAME}_VERSION_STRING "${${LIBNAME}_VERSION_STRING}.${${LIBNAME}_VERSION_TWEAK}" ${ARGN}) + else() + set(${LIBNAME}_VERSION_STRING "${${LIBNAME}_VERSION_STRING}" ${ARGN}) + endif() + endif() +endmacro() + +# read single version info from the pkg file +macro(ocv_parse_pkg LIBNAME PKG_PATH SCOPE) + if(EXISTS "${PKG_PATH}/${LIBNAME}.pc") + file(STRINGS "${PKG_PATH}/${LIBNAME}.pc" line_to_parse REGEX "^Version:[ \t]+[0-9.]*.*$" LIMIT_COUNT 1) + STRING(REGEX REPLACE ".*Version: ([^ ]+).*" "\\1" ALIASOF_${LIBNAME}_VERSION "${line_to_parse}" ) + endif() +endmacro() + +################################################################################################ +# short command to setup source group +function(ocv_source_group group) + if(BUILD_opencv_world AND OPENCV_MODULE_${the_module}_IS_PART_OF_WORLD) + set(group "${the_module}\\${group}") + endif() + cmake_parse_arguments(SG "" "DIRBASE" "GLOB;GLOB_RECURSE;FILES" ${ARGN}) + set(files "") + if(SG_FILES) + list(APPEND files ${SG_FILES}) + endif() + if(SG_GLOB) + file(GLOB srcs ${SG_GLOB}) + list(APPEND files ${srcs}) + endif() + if(SG_GLOB_RECURSE) + file(GLOB_RECURSE srcs ${SG_GLOB_RECURSE}) + list(APPEND files ${srcs}) + endif() + if(SG_DIRBASE) + foreach(f ${files}) + file(RELATIVE_PATH fpart "${SG_DIRBASE}" "${f}") + if(fpart MATCHES "^\\.\\.") + message(AUTHOR_WARNING "Can't detect subpath for source_group command: Group=${group} FILE=${f} DIRBASE=${SG_DIRBASE}") + set(fpart "") + else() + get_filename_component(fpart "${fpart}" PATH) + if(fpart) + set(fpart "/${fpart}") # add '/' + string(REPLACE "/" "\\" fpart "${fpart}") + endif() + endif() + source_group("${group}${fpart}" FILES ${f}) + endforeach() + else() + source_group(${group} FILES ${files}) + endif() +endfunction() + +function(ocv_target_link_libraries target) + _ocv_fix_target(target) + set(LINK_DEPS ${ARGN}) + # process world + if(BUILD_opencv_world) + foreach(m ${OPENCV_MODULES_BUILD}) + if(OPENCV_MODULE_${m}_IS_PART_OF_WORLD) + if(";${LINK_DEPS};" MATCHES ";${m};") + list(REMOVE_ITEM LINK_DEPS ${m}) + if(NOT (";${LINK_DEPS};" MATCHES ";opencv_world;")) + list(APPEND LINK_DEPS opencv_world) + endif() + endif() + endif() + endforeach() + endif() + target_link_libraries(${target} ${LINK_DEPS}) +endfunction() + +function(_ocv_append_target_includes target) + if(DEFINED OCV_TARGET_INCLUDE_DIRS_${target}) + target_include_directories(${target} PRIVATE ${OCV_TARGET_INCLUDE_DIRS_${target}}) + if (TARGET ${target}_object) + target_include_directories(${target}_object PRIVATE ${OCV_TARGET_INCLUDE_DIRS_${target}}) + endif() + unset(OCV_TARGET_INCLUDE_DIRS_${target} CACHE) + endif() +endfunction() + +function(ocv_add_executable target) + add_executable(${target} ${ARGN}) + _ocv_append_target_includes(${target}) +endfunction() + +function(ocv_add_library target) + set(cuda_objs "") + if(HAVE_CUDA) + set(cuda_srcs "") + + foreach(var ${ARGN}) + if(var MATCHES ".cu") + list(APPEND cuda_srcs ${var}) + endif() + endforeach() + + if(cuda_srcs) + ocv_include_directories(${CUDA_INCLUDE_DIRS}) + ocv_cuda_compile(cuda_objs ${lib_cuda_srcs} ${lib_cuda_hdrs}) + endif() + set(OPENCV_MODULE_${target}_CUDA_OBJECTS ${cuda_objs} CACHE INTERNAL "Compiled CUDA object files") + endif() + + add_library(${target} ${ARGN} ${cuda_objs}) + + # Add OBJECT library (added in cmake 2.8.8) to use in compound modules + if (NOT CMAKE_VERSION VERSION_LESS "2.8.8" + AND NOT OPENCV_MODULE_${target}_CHILDREN + AND NOT OPENCV_MODULE_${target}_CLASS STREQUAL "BINDINGS" + AND NOT ${target} STREQUAL "opencv_ts" + ) + set(sources ${ARGN}) + ocv_list_filterout(sources "\\\\.(cl|inc)$") + add_library(${target}_object OBJECT ${sources}) + set_target_properties(${target}_object PROPERTIES + EXCLUDE_FROM_ALL True + EXCLUDE_FROM_DEFAULT_BUILD True + POSITION_INDEPENDENT_CODE True + ) + if (ENABLE_SOLUTION_FOLDERS) + set_target_properties(${target}_object PROPERTIES FOLDER "object_libraries") + endif() + unset(sources) + endif() + + _ocv_append_target_includes(${target}) +endfunction() + +# build the list of opencv libs and dependencies for all modules +# _modules - variable to hold list of all modules +# _extra - variable to hold list of extra dependencies +# _3rdparty - variable to hold list of prebuilt 3rdparty libraries +macro(ocv_get_all_libs _modules _extra _3rdparty) + set(${_modules} "") + set(${_extra} "") + set(${_3rdparty} "") + foreach(m ${OPENCV_MODULES_PUBLIC}) + get_target_property(deps ${m} INTERFACE_LINK_LIBRARIES) + if(NOT deps) + set(deps "") + endif() + list(INSERT ${_modules} 0 ${deps} ${m}) + foreach (dep ${deps} ${OPENCV_LINKER_LIBS}) + if (NOT DEFINED OPENCV_MODULE_${dep}_LOCATION) + if (TARGET ${dep}) + get_target_property(_output ${dep} ARCHIVE_OUTPUT_DIRECTORY) + if ("${_output}" STREQUAL "${3P_LIBRARY_OUTPUT_PATH}") + list(INSERT ${_3rdparty} 0 ${dep}) + else() + list(INSERT ${_extra} 0 ${dep}) + endif() + else() + list(INSERT ${_extra} 0 ${dep}) + endif() + endif() + endforeach() + endforeach() + + # ippicv specific handling + list(FIND ${_extra} "ippicv" ippicv_idx) + if (${ippicv_idx} GREATER -1) + list(REMOVE_ITEM ${_extra} "ippicv") + list(INSERT ${_3rdparty} 0 "ippicv") + endif() + + # split 3rdparty libs and modules + list(REMOVE_ITEM ${_modules} ${${_3rdparty}} ${${_extra}}) + + # convert CMake lists to makefile literals + foreach(lst ${_modules} ${_3rdparty} ${_extra}) + ocv_list_unique(${lst}) + ocv_list_reverse(${lst}) + endforeach() +endmacro() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVVersion.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVVersion.cmake new file mode 100644 index 000000000..60ac16420 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/OpenCVVersion.cmake @@ -0,0 +1,18 @@ +SET(OPENCV_VERSION_FILE "${CMAKE_CURRENT_SOURCE_DIR}/modules/core/include/opencv2/core/version.hpp") +file(STRINGS "${OPENCV_VERSION_FILE}" OPENCV_VERSION_PARTS REGEX "#define CV_VERSION_[A-Z]+[ ]+" ) + +string(REGEX REPLACE ".+CV_VERSION_MAJOR[ ]+([0-9]+).*" "\\1" OPENCV_VERSION_MAJOR "${OPENCV_VERSION_PARTS}") +string(REGEX REPLACE ".+CV_VERSION_MINOR[ ]+([0-9]+).*" "\\1" OPENCV_VERSION_MINOR "${OPENCV_VERSION_PARTS}") +string(REGEX REPLACE ".+CV_VERSION_REVISION[ ]+([0-9]+).*" "\\1" OPENCV_VERSION_PATCH "${OPENCV_VERSION_PARTS}") +string(REGEX REPLACE ".+CV_VERSION_STATUS[ ]+\"([^\"]*)\".*" "\\1" OPENCV_VERSION_STATUS "${OPENCV_VERSION_PARTS}") + +set(OPENCV_VERSION_PLAIN "${OPENCV_VERSION_MAJOR}.${OPENCV_VERSION_MINOR}.${OPENCV_VERSION_PATCH}") + +set(OPENCV_VERSION "${OPENCV_VERSION_PLAIN}${OPENCV_VERSION_STATUS}") + +set(OPENCV_SOVERSION "${OPENCV_VERSION_MAJOR}.${OPENCV_VERSION_MINOR}") +set(OPENCV_LIBVERSION "${OPENCV_VERSION_MAJOR}.${OPENCV_VERSION_MINOR}.${OPENCV_VERSION_PATCH}") + +# create a dependency on version file +# we never use output of the following command but cmake will rerun automatically if the version file changes +configure_file("${OPENCV_VERSION_FILE}" "${CMAKE_BINARY_DIR}/junk/version.junk" COPYONLY) diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/checks/OpenCVDetectCudaArch.cu b/dependency-check-core/src/test/resources/cmake/opencv/cmake/checks/OpenCVDetectCudaArch.cu new file mode 100644 index 000000000..9d7086cf2 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/checks/OpenCVDetectCudaArch.cu @@ -0,0 +1,14 @@ +#include +int main() +{ + int count = 0; + if (cudaSuccess != cudaGetDeviceCount(&count)){return -1;} + if (count == 0) {return -1;} + for (int device = 0; device < count; ++device) + { + cudaDeviceProp prop; + if (cudaSuccess != cudaGetDeviceProperties(&prop, device)){ continue;} + printf("%d.%d ", prop.major, prop.minor); + } + return 0; +} diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/checks/directx.cpp b/dependency-check-core/src/test/resources/cmake/opencv/cmake/checks/directx.cpp new file mode 100644 index 000000000..452a885cd --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/checks/directx.cpp @@ -0,0 +1,70 @@ +#include + +#include +#pragma comment (lib, "d3d11.lib") + +HINSTANCE g_hInst = NULL; +D3D_DRIVER_TYPE g_driverType = D3D_DRIVER_TYPE_NULL; +D3D_FEATURE_LEVEL g_featureLevel = D3D_FEATURE_LEVEL_11_0; +ID3D11Device* g_pd3dDevice = NULL; +ID3D11DeviceContext* g_pImmediateContext = NULL; +IDXGISwapChain* g_pSwapChain = NULL; + +static HRESULT InitDevice() +{ + HRESULT hr = S_OK; + + UINT width = 640; + UINT height = 480; + + UINT createDeviceFlags = 0; + + D3D_DRIVER_TYPE driverTypes[] = + { + D3D_DRIVER_TYPE_HARDWARE, + D3D_DRIVER_TYPE_WARP, + D3D_DRIVER_TYPE_REFERENCE, + }; + UINT numDriverTypes = ARRAYSIZE(driverTypes); + + D3D_FEATURE_LEVEL featureLevels[] = + { + D3D_FEATURE_LEVEL_11_0, + D3D_FEATURE_LEVEL_10_1, + D3D_FEATURE_LEVEL_10_0, + }; + UINT numFeatureLevels = ARRAYSIZE(featureLevels); + + DXGI_SWAP_CHAIN_DESC sd; + ZeroMemory( &sd, sizeof( sd ) ); + sd.BufferCount = 1; + sd.BufferDesc.Width = width; + sd.BufferDesc.Height = height; + sd.BufferDesc.Format = DXGI_FORMAT_R8G8B8A8_UNORM; + sd.BufferDesc.RefreshRate.Numerator = 60; + sd.BufferDesc.RefreshRate.Denominator = 1; + sd.BufferUsage = DXGI_USAGE_RENDER_TARGET_OUTPUT; + sd.OutputWindow = NULL; //g_hWnd; + sd.SampleDesc.Count = 1; + sd.SampleDesc.Quality = 0; + sd.Windowed = TRUE; + + for (UINT driverTypeIndex = 0; driverTypeIndex < numDriverTypes; driverTypeIndex++) + { + g_driverType = driverTypes[driverTypeIndex]; + hr = D3D11CreateDeviceAndSwapChain(NULL, g_driverType, NULL, createDeviceFlags, featureLevels, numFeatureLevels, + D3D11_SDK_VERSION, &sd, &g_pSwapChain, &g_pd3dDevice, &g_featureLevel, &g_pImmediateContext); + if (SUCCEEDED(hr)) + break; + } + if (FAILED(hr)) + return hr; + + return S_OK; +} + +int main(int /*argc*/, char** /*argv*/) +{ + InitDevice(); + return 0; +} diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/checks/opencl.cpp b/dependency-check-core/src/test/resources/cmake/opencv/cmake/checks/opencl.cpp new file mode 100644 index 000000000..95a36f3ac --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/checks/opencl.cpp @@ -0,0 +1,24 @@ +#if defined __APPLE__ +#include +#else +#include +#endif + +#ifndef _MSC_VER +#ifdef CL_VERSION_1_2 +#error OpenCL is valid +#else +#error OpenCL check failed +#endif +#else +#ifdef CL_VERSION_1_2 +#pragma message ("OpenCL is valid") +#else +#pragma message ("OpenCL check failed") +#endif +#endif + +int main(int /*argc*/, char** /*argv*/) +{ + return 0; +} diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/checks/vfwtest.cpp b/dependency-check-core/src/test/resources/cmake/opencv/cmake/checks/vfwtest.cpp new file mode 100644 index 000000000..8d8ecb271 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/checks/vfwtest.cpp @@ -0,0 +1,10 @@ + +#include +#include + +int main() +{ + AVIFileInit(); + AVIFileExit(); + return 0; +} diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/checks/win32uitest.cpp b/dependency-check-core/src/test/resources/cmake/opencv/cmake/checks/win32uitest.cpp new file mode 100644 index 000000000..f475e1c96 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/checks/win32uitest.cpp @@ -0,0 +1,11 @@ +#include + +int main(int argc, char** argv) +{ + CreateWindow(NULL /*lpClassName*/, NULL /*lpWindowName*/, 0 /*dwStyle*/, 0 /*x*/, + 0 /*y*/, 0 /*nWidth*/, 0 /*nHeight*/, NULL /*hWndParent*/, NULL /*hMenu*/, + NULL /*hInstance*/, NULL /*lpParam*/); + DeleteDC(NULL); + + return 0; +} diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/cl2cpp.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/cl2cpp.cmake new file mode 100644 index 000000000..700f12fb5 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/cl2cpp.cmake @@ -0,0 +1,89 @@ +file(GLOB cl_list "${CL_DIR}/*.cl" ) +list(SORT cl_list) + +string(REPLACE ".cpp" ".hpp" OUTPUT_HPP "${OUTPUT}") +get_filename_component(OUTPUT_HPP_NAME "${OUTPUT_HPP}" NAME) + +if("${MODULE_NAME}" STREQUAL "ocl") + set(nested_namespace_start "") + set(nested_namespace_end "") +else() + set(new_mode ON) + set(nested_namespace_start "namespace ${MODULE_NAME}\n{") + set(nested_namespace_end "}") +endif() + +set(STR_CPP "// This file is auto-generated. Do not edit! + +#include \"precomp.hpp\" +#include \"${OUTPUT_HPP_NAME}\" + +namespace cv +{ +namespace ocl +{ +${nested_namespace_start} + +") + +set(STR_HPP "// This file is auto-generated. Do not edit! + +#include \"opencv2/core/ocl.hpp\" +#include \"opencv2/core/ocl_genbase.hpp\" +#include \"opencv2/core/opencl/ocl_defs.hpp\" + +namespace cv +{ +namespace ocl +{ +${nested_namespace_start} + +") + +foreach(cl ${cl_list}) + get_filename_component(cl_filename "${cl}" NAME_WE) + #message("${cl_filename}") + + file(READ "${cl}" lines) + + string(REPLACE "\r" "" lines "${lines}\n") + string(REPLACE "\t" " " lines "${lines}") + + string(REGEX REPLACE "/\\*([^*]/|\\*[^/]|[^*/])*\\*/" "" lines "${lines}") # multiline comments + string(REGEX REPLACE "/\\*([^\n])*\\*/" "" lines "${lines}") # single-line comments + string(REGEX REPLACE "[ ]*//[^\n]*\n" "\n" lines "${lines}") # single-line comments + string(REGEX REPLACE "\n[ ]*(\n[ ]*)*" "\n" lines "${lines}") # empty lines & leading whitespace + string(REGEX REPLACE "^\n" "" lines "${lines}") # leading new line + + string(REPLACE "\\" "\\\\" lines "${lines}") + string(REPLACE "\"" "\\\"" lines "${lines}") + string(REPLACE "\n" "\\n\"\n\"" lines "${lines}") + + string(REGEX REPLACE "\"$" "" lines "${lines}") # unneeded " at the eof + + string(MD5 hash "${lines}") + + set(STR_CPP_DECL "const struct ProgramEntry ${cl_filename}={\"${cl_filename}\",\n\"${lines}, \"${hash}\"};\n") + set(STR_HPP_DECL "extern const struct ProgramEntry ${cl_filename};\n") + if(new_mode) + set(STR_CPP_DECL "${STR_CPP_DECL}ProgramSource ${cl_filename}_oclsrc(${cl_filename}.programStr);\n") + set(STR_HPP_DECL "${STR_HPP_DECL}extern ProgramSource ${cl_filename}_oclsrc;\n") + endif() + + set(STR_CPP "${STR_CPP}${STR_CPP_DECL}") + set(STR_HPP "${STR_HPP}${STR_HPP_DECL}") +endforeach() + +set(STR_CPP "${STR_CPP}}\n${nested_namespace_end}}\n") +set(STR_HPP "${STR_HPP}}\n${nested_namespace_end}}\n") + +file(WRITE "${OUTPUT}" "${STR_CPP}") + +if(EXISTS "${OUTPUT_HPP}") + file(READ "${OUTPUT_HPP}" hpp_lines) +endif() +if("${hpp_lines}" STREQUAL "${STR_HPP}") + message(STATUS "${OUTPUT_HPP} contains same content") +else() + file(WRITE "${OUTPUT_HPP}" "${STR_HPP}") +endif() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/copyAndroidLibs.cmake b/dependency-check-core/src/test/resources/cmake/opencv/cmake/copyAndroidLibs.cmake new file mode 100644 index 000000000..4e9e17f4c --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/copyAndroidLibs.cmake @@ -0,0 +1,8 @@ +# helper file for Android samples build + +file(GLOB_RECURSE LIBS RELATIVE ${SRC_DIR} "*.so") + +foreach(l ${LIBS}) + message(STATUS " Copying: ${l} ...") + execute_process(COMMAND ${CMAKE_COMMAND} -E copy_if_different ${SRC_DIR}/${l} ${DST_DIR}/${l}) +endforeach() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/templates/OpenCV.mk.in b/dependency-check-core/src/test/resources/cmake/opencv/cmake/templates/OpenCV.mk.in new file mode 100644 index 000000000..acbb763c9 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/templates/OpenCV.mk.in @@ -0,0 +1,121 @@ +# In order to compile your application under cygwin +# you might need to define NDK_USE_CYGPATH=1 before calling the ndk-build + +USER_LOCAL_PATH:=$(LOCAL_PATH) + +USER_LOCAL_C_INCLUDES:=$(LOCAL_C_INCLUDES) +USER_LOCAL_CFLAGS:=$(LOCAL_CFLAGS) +USER_LOCAL_STATIC_LIBRARIES:=$(LOCAL_STATIC_LIBRARIES) +USER_LOCAL_SHARED_LIBRARIES:=$(LOCAL_SHARED_LIBRARIES) +USER_LOCAL_LDLIBS:=$(LOCAL_LDLIBS) + +LOCAL_PATH:=$(subst ?,,$(firstword ?$(subst \, ,$(subst /, ,$(call my-dir))))) + +OPENCV_TARGET_ARCH_ABI:=$(TARGET_ARCH_ABI) +OPENCV_THIS_DIR:=$(patsubst $(LOCAL_PATH)\\%,%,$(patsubst $(LOCAL_PATH)/%,%,$(call my-dir))) +OPENCV_MK_DIR:=$(dir $(lastword $(MAKEFILE_LIST))) +OPENCV_LIBS_DIR:=@OPENCV_LIBS_DIR_CONFIGCMAKE@ +OPENCV_3RDPARTY_LIBS_DIR:=@OPENCV_3RDPARTY_LIBS_DIR_CONFIGCMAKE@ +OPENCV_BASEDIR:=@OPENCV_BASE_INCLUDE_DIR_CONFIGCMAKE@ +OPENCV_LOCAL_C_INCLUDES:=@OPENCV_INCLUDE_DIRS_CONFIGCMAKE@ +OPENCV_MODULES:=@OPENCV_MODULES_CONFIGMAKE@ + +ifeq ($(OPENCV_LIB_TYPE),) + OPENCV_LIB_TYPE:=@OPENCV_LIBTYPE_CONFIGMAKE@ +endif + +ifeq ($(OPENCV_LIB_TYPE),SHARED) + OPENCV_LIBS:=@OPENCV_LIBS_CONFIGMAKE@ + OPENCV_LIB_TYPE:=@OPENCV_LIBTYPE_CONFIGMAKE@ +else + OPENCV_LIBS:=$(OPENCV_MODULES) + OPENCV_LIB_TYPE:=@OPENCV_STATIC_LIBTYPE_CONFIGMAKE@ +endif + +ifeq ($(OPENCV_LIB_TYPE),SHARED) + OPENCV_3RDPARTY_COMPONENTS:= + OPENCV_EXTRA_COMPONENTS:= +else + ifeq ($(TARGET_ARCH_ABI),armeabi-v7a) + OPENCV_3RDPARTY_COMPONENTS:=@OPENCV_3RDPARTY_COMPONENTS_CONFIGMAKE@ + OPENCV_EXTRA_COMPONENTS:=@OPENCV_EXTRA_COMPONENTS_CONFIGMAKE@ + endif + ifeq ($(TARGET_ARCH_ABI),x86) + OPENCV_3RDPARTY_COMPONENTS:=@OPENCV_3RDPARTY_COMPONENTS_CONFIGMAKE@ + OPENCV_EXTRA_COMPONENTS:=@OPENCV_EXTRA_COMPONENTS_CONFIGMAKE@ + endif + ifeq ($(TARGET_ARCH_ABI),armeabi) + OPENCV_3RDPARTY_COMPONENTS:=@OPENCV_3RDPARTY_COMPONENTS_CONFIGMAKE_NO_TBB@ + OPENCV_EXTRA_COMPONENTS:=@OPENCV_EXTRA_COMPONENTS_CONFIGMAKE@ + endif + ifeq ($(TARGET_ARCH_ABI),mips) + OPENCV_3RDPARTY_COMPONENTS:=@OPENCV_3RDPARTY_COMPONENTS_CONFIGMAKE@ + OPENCV_EXTRA_COMPONENTS:=@OPENCV_EXTRA_COMPONENTS_CONFIGMAKE@ + endif +endif + +ifeq ($(OPENCV_LIB_TYPE),SHARED) + OPENCV_LIB_SUFFIX:=so +else + OPENCV_LIB_SUFFIX:=a + OPENCV_INSTALL_MODULES:=on +endif + +define add_opencv_module + include $(CLEAR_VARS) + LOCAL_MODULE:=opencv_$1 + LOCAL_SRC_FILES:=$(OPENCV_LIBS_DIR)/libopencv_$1.$(OPENCV_LIB_SUFFIX) + include $(PREBUILT_$(OPENCV_LIB_TYPE)_LIBRARY) +endef + +define add_opencv_3rdparty_component + include $(CLEAR_VARS) + LOCAL_MODULE:=$1 + LOCAL_SRC_FILES:=$(OPENCV_3RDPARTY_LIBS_DIR)/lib$1.a + include $(PREBUILT_STATIC_LIBRARY) +endef + +ifeq ($(OPENCV_MK_$(OPENCV_TARGET_ARCH_ABI)_ALREADY_INCLUDED),) + ifeq ($(OPENCV_INSTALL_MODULES),on) + $(foreach module,$(OPENCV_LIBS),$(eval $(call add_opencv_module,$(module)))) + endif + + $(foreach module,$(OPENCV_3RDPARTY_COMPONENTS),$(eval $(call add_opencv_3rdparty_component,$(module)))) + + ifneq ($(OPENCV_BASEDIR),) + OPENCV_LOCAL_C_INCLUDES += $(foreach mod, $(OPENCV_MODULES), $(OPENCV_BASEDIR)/modules/$(mod)/include) + endif + + #turn off module installation to prevent their redefinition + OPENCV_MK_$(OPENCV_TARGET_ARCH_ABI)_ALREADY_INCLUDED:=on +endif + +ifeq ($(OPENCV_LOCAL_CFLAGS),) + OPENCV_LOCAL_CFLAGS := -fPIC -DANDROID -fsigned-char +endif + +include $(CLEAR_VARS) + +LOCAL_C_INCLUDES:=$(USER_LOCAL_C_INCLUDES) +LOCAL_CFLAGS:=$(USER_LOCAL_CFLAGS) +LOCAL_STATIC_LIBRARIES:=$(USER_LOCAL_STATIC_LIBRARIES) +LOCAL_SHARED_LIBRARIES:=$(USER_LOCAL_SHARED_LIBRARIES) +LOCAL_LDLIBS:=$(USER_LOCAL_LDLIBS) + +LOCAL_C_INCLUDES += $(OPENCV_LOCAL_C_INCLUDES) +LOCAL_CFLAGS += $(OPENCV_LOCAL_CFLAGS) + +ifeq ($(OPENCV_INSTALL_MODULES),on) + LOCAL_$(OPENCV_LIB_TYPE)_LIBRARIES += $(foreach mod, $(OPENCV_LIBS), opencv_$(mod)) +else + LOCAL_LDLIBS += -L$(call host-path,$(LOCAL_PATH)/$(OPENCV_LIBS_DIR)) $(foreach lib, $(OPENCV_LIBS), -lopencv_$(lib)) +endif + +ifeq ($(OPENCV_LIB_TYPE),STATIC) + LOCAL_STATIC_LIBRARIES += $(OPENCV_3RDPARTY_COMPONENTS) +endif + +LOCAL_LDLIBS += $(foreach lib,$(OPENCV_EXTRA_COMPONENTS), -l$(lib)) + +#restore the LOCAL_PATH +LOCAL_PATH:=$(USER_LOCAL_PATH) diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/templates/OpenCVConfig-version.cmake.in b/dependency-check-core/src/test/resources/cmake/opencv/cmake/templates/OpenCVConfig-version.cmake.in new file mode 100644 index 000000000..b5ac5f8e2 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/templates/OpenCVConfig-version.cmake.in @@ -0,0 +1,14 @@ +set(OpenCV_VERSION @OPENCV_VERSION_PLAIN@) +set(PACKAGE_VERSION ${OpenCV_VERSION}) + +set(PACKAGE_VERSION_EXACT False) +set(PACKAGE_VERSION_COMPATIBLE False) + +if(PACKAGE_FIND_VERSION VERSION_EQUAL PACKAGE_VERSION) + set(PACKAGE_VERSION_EXACT True) + set(PACKAGE_VERSION_COMPATIBLE True) +endif() + +if(PACKAGE_FIND_VERSION VERSION_LESS PACKAGE_VERSION) + set(PACKAGE_VERSION_COMPATIBLE True) +endif() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/templates/OpenCVConfig.cmake.in b/dependency-check-core/src/test/resources/cmake/opencv/cmake/templates/OpenCVConfig.cmake.in new file mode 100644 index 000000000..e5904aba3 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/templates/OpenCVConfig.cmake.in @@ -0,0 +1,391 @@ +# =================================================================================== +# The OpenCV CMake configuration file +# +# ** File generated automatically, do not modify ** +# +# Usage from an external project: +# In your CMakeLists.txt, add these lines: +# +# find_package(OpenCV REQUIRED) +# include_directories(${OpenCV_INCLUDE_DIRS}) +# target_link_libraries(MY_TARGET_NAME ${OpenCV_LIBS}) +# +# Or you can search for specific OpenCV modules: +# +# find_package(OpenCV REQUIRED core videoio) +# +# If the module is found then OPENCV__FOUND is set to TRUE. +# +# This file will define the following variables: +# - OpenCV_LIBS : The list of all imported targets for OpenCV modules. +# - OpenCV_INCLUDE_DIRS : The OpenCV include directories. +# - OpenCV_COMPUTE_CAPABILITIES : The version of compute capability. +# - OpenCV_ANDROID_NATIVE_API_LEVEL : Minimum required level of Android API. +# - OpenCV_VERSION : The version of this OpenCV build: "@OPENCV_VERSION_PLAIN@" +# - OpenCV_VERSION_MAJOR : Major version part of OpenCV_VERSION: "@OPENCV_VERSION_MAJOR@" +# - OpenCV_VERSION_MINOR : Minor version part of OpenCV_VERSION: "@OPENCV_VERSION_MINOR@" +# - OpenCV_VERSION_PATCH : Patch version part of OpenCV_VERSION: "@OPENCV_VERSION_PATCH@" +# - OpenCV_VERSION_STATUS : Development status of this build: "@OPENCV_VERSION_STATUS@" +# +# Advanced variables: +# - OpenCV_SHARED : Use OpenCV as shared library +# - OpenCV_CONFIG_PATH : Path to this OpenCVConfig.cmake +# - OpenCV_INSTALL_PATH : OpenCV location (not set on Windows) +# - OpenCV_LIB_COMPONENTS : Present OpenCV modules list +# - OpenCV_USE_MANGLED_PATHS : Mangled OpenCV path flag +# - OpenCV_MODULES_SUFFIX : The suffix for OpenCVModules-XXX.cmake file +# +# Deprecated variables: +# - OpenCV_VERSION_TWEAK : Always "0" +# +# =================================================================================== + +# Search packages for host system instead of packages for target system. +# in case of cross compilation thess macro should be defined by toolchain file + +if(NOT COMMAND find_host_package) + macro(find_host_package) + find_package(${ARGN}) + endmacro() +endif() + +if(NOT COMMAND find_host_program) + macro(find_host_program) + find_program(${ARGN}) + endmacro() +endif() + +if(NOT DEFINED OpenCV_MODULES_SUFFIX) + if(ANDROID) + string(REPLACE - _ OpenCV_MODULES_SUFFIX "_${ANDROID_NDK_ABI_NAME}") + else() + set(OpenCV_MODULES_SUFFIX "") + endif() +endif() + +if("@USE_IPPICV@" STREQUAL "TRUE") # value is defined by package builder (use STREQUAL to comply new CMake policy CMP0012) + if(NOT TARGET ippicv) + if(EXISTS "${CMAKE_CURRENT_LIST_DIR}/@INSTALL_PATH_RELATIVE_IPPICV@") + add_library(ippicv STATIC IMPORTED) + set_target_properties(ippicv PROPERTIES + IMPORTED_LINK_INTERFACE_LIBRARIES "" + IMPORTED_LOCATION "${CMAKE_CURRENT_LIST_DIR}/@INSTALL_PATH_RELATIVE_IPPICV@" + ) + endif() + endif() +endif() + +if(NOT TARGET opencv_core) + # Extract directory name from full path of the file currently being processed. + # Note that CMake 2.8.3 introduced CMAKE_CURRENT_LIST_DIR. We reimplement it + # for older versions of CMake to support these as well. + if(CMAKE_VERSION VERSION_LESS "2.8.3") + get_filename_component(CMAKE_CURRENT_LIST_DIR "${CMAKE_CURRENT_LIST_FILE}" PATH) + endif() + + include(${CMAKE_CURRENT_LIST_DIR}/OpenCVModules${OpenCV_MODULES_SUFFIX}.cmake) +endif() + +# TODO All things below should be reviewed. What is about of moving this code into related modules (special vars/hooks/files) + +# Version Compute Capability from which OpenCV has been compiled is remembered +set(OpenCV_COMPUTE_CAPABILITIES @OpenCV_CUDA_CC_CONFIGCMAKE@) + +set(OpenCV_CUDA_VERSION @OpenCV_CUDA_VERSION@) +set(OpenCV_USE_CUBLAS @HAVE_CUBLAS@) +set(OpenCV_USE_CUFFT @HAVE_CUFFT@) +set(OpenCV_USE_NVCUVID @HAVE_NVCUVID@) + +# Android API level from which OpenCV has been compiled is remembered +if(ANDROID) + set(OpenCV_ANDROID_NATIVE_API_LEVEL @OpenCV_ANDROID_NATIVE_API_LEVEL_CONFIGCMAKE@) +else() + set(OpenCV_ANDROID_NATIVE_API_LEVEL 0) +endif() + +# Some additional settings are required if OpenCV is built as static libs +set(OpenCV_SHARED @BUILD_SHARED_LIBS@) + +# Enables mangled install paths, that help with side by side installs +set(OpenCV_USE_MANGLED_PATHS @OpenCV_USE_MANGLED_PATHS_CONFIGCMAKE@) + +# Extract the directory where *this* file has been installed (determined at cmake run-time) +get_filename_component(OpenCV_CONFIG_PATH "${CMAKE_CURRENT_LIST_FILE}" PATH CACHE) + +if(NOT WIN32 OR ANDROID) + if(ANDROID) + set(OpenCV_INSTALL_PATH "${OpenCV_CONFIG_PATH}/../../..") + else() + set(OpenCV_INSTALL_PATH "${OpenCV_CONFIG_PATH}/../..") + endif() + # Get the absolute path with no ../.. relative marks, to eliminate implicit linker warnings + if(${CMAKE_MAJOR_VERSION}.${CMAKE_MINOR_VERSION} VERSION_LESS 2.8) + get_filename_component(OpenCV_INSTALL_PATH "${OpenCV_INSTALL_PATH}" ABSOLUTE) + else() + get_filename_component(OpenCV_INSTALL_PATH "${OpenCV_INSTALL_PATH}" REALPATH) + endif() +endif() + +# ====================================================== +# Include directories to add to the user project: +# ====================================================== + +# Provide the include directories to the caller +set(OpenCV_INCLUDE_DIRS @OpenCV_INCLUDE_DIRS_CONFIGCMAKE@) + +# ====================================================== +# Link directories to add to the user project: +# ====================================================== + +# Provide the libs directories to the caller +set(OpenCV_LIB_DIR_OPT @OpenCV_LIB_DIRS_CONFIGCMAKE@ CACHE PATH "Path where release OpenCV libraries are located") +set(OpenCV_LIB_DIR_DBG @OpenCV_LIB_DIRS_CONFIGCMAKE@ CACHE PATH "Path where debug OpenCV libraries are located") +set(OpenCV_3RDPARTY_LIB_DIR_OPT @OpenCV_3RDPARTY_LIB_DIRS_CONFIGCMAKE@ CACHE PATH "Path where release 3rdparty OpenCV dependencies are located") +set(OpenCV_3RDPARTY_LIB_DIR_DBG @OpenCV_3RDPARTY_LIB_DIRS_CONFIGCMAKE@ CACHE PATH "Path where debug 3rdparty OpenCV dependencies are located") +mark_as_advanced(FORCE OpenCV_LIB_DIR_OPT OpenCV_LIB_DIR_DBG OpenCV_3RDPARTY_LIB_DIR_OPT OpenCV_3RDPARTY_LIB_DIR_DBG OpenCV_CONFIG_PATH) + +# ====================================================== +# Version variables: +# ====================================================== +SET(OpenCV_VERSION @OPENCV_VERSION_PLAIN@) +SET(OpenCV_VERSION_MAJOR @OPENCV_VERSION_MAJOR@) +SET(OpenCV_VERSION_MINOR @OPENCV_VERSION_MINOR@) +SET(OpenCV_VERSION_PATCH @OPENCV_VERSION_PATCH@) +SET(OpenCV_VERSION_TWEAK 0) +SET(OpenCV_VERSION_STATUS "@OPENCV_VERSION_STATUS@") + +# ==================================================================== +# Link libraries: e.g. opencv_core;opencv_imgproc; etc... +# ==================================================================== + +SET(OpenCV_LIB_COMPONENTS @OPENCV_MODULES_CONFIGCMAKE@) +SET(OpenCV_WORLD_COMPONENTS @OPENCV_WORLD_MODULES@) + +# ============================================================== +# Extra include directories, needed by OpenCV 2 new structure +# ============================================================== +SET(OpenCV2_INCLUDE_DIRS @OpenCV2_INCLUDE_DIRS_CONFIGCMAKE@) +if(OpenCV2_INCLUDE_DIRS) + list(APPEND OpenCV_INCLUDE_DIRS ${OpenCV2_INCLUDE_DIRS}) + + set(OpenCV_ADD_DEBUG_RELEASE @OpenCV_ADD_DEBUG_RELEASE_CONFIGCMAKE@) + if(OpenCV_ADD_DEBUG_RELEASE) + set(OpenCV_LIB_DIR_OPT "${OpenCV_LIB_DIR_OPT}/Release") + set(OpenCV_LIB_DIR_DBG "${OpenCV_LIB_DIR_DBG}/Debug") + set(OpenCV_3RDPARTY_LIB_DIR_OPT "${OpenCV_3RDPARTY_LIB_DIR_OPT}/Release") + set(OpenCV_3RDPARTY_LIB_DIR_DBG "${OpenCV_3RDPARTY_LIB_DIR_DBG}/Debug") + endif() +endif() + +# ============================================================== +# Check OpenCV availability +# ============================================================== +if(ANDROID AND OpenCV_ANDROID_NATIVE_API_LEVEL GREATER ANDROID_NATIVE_API_LEVEL) + message(FATAL_ERROR "Minimum required by OpenCV API level is android-${OpenCV_ANDROID_NATIVE_API_LEVEL}") + #always FATAL_ERROR because we can't say to the caller that OpenCV is not found + #http://www.mail-archive.com/cmake@cmake.org/msg37831.html + if(OpenCV_FIND_REQUIRED) + message(FATAL_ERROR "Minimum required by OpenCV API level is android-${OpenCV_ANDROID_NATIVE_API_LEVEL}") + elseif(NOT OpenCV_FIND_QUIETLY) + message(WARNING "Minimum required by OpenCV API level is android-${OpenCV_ANDROID_NATIVE_API_LEVEL}") + endif() + set(OpenCV_FOUND "OpenCV_FOUND-NOTFOUND") + return()#Android toolchain requires CMake > 2.6 +endif() + +# ============================================================== +# Form list of modules (components) to find +# ============================================================== +if(NOT OpenCV_FIND_COMPONENTS) + set(OpenCV_FIND_COMPONENTS ${OpenCV_LIB_COMPONENTS}) + list(REMOVE_ITEM OpenCV_FIND_COMPONENTS opencv_java) + if(GTest_FOUND OR GTEST_FOUND) + list(REMOVE_ITEM OpenCV_FIND_COMPONENTS opencv_ts) + endif() +endif() + +# expand short module names and see if requested components exist +set(OpenCV_FIND_COMPONENTS_ "") +foreach(__cvcomponent ${OpenCV_FIND_COMPONENTS}) + if(NOT __cvcomponent MATCHES "^opencv_") + set(__cvcomponent opencv_${__cvcomponent}) + endif() + list(FIND OpenCV_LIB_COMPONENTS ${__cvcomponent} __cvcomponentIdx) + if(__cvcomponentIdx LESS 0) + #requested component is not found... + if(OpenCV_FIND_REQUIRED) + message(FATAL_ERROR "${__cvcomponent} is required but was not found") + elseif(NOT OpenCV_FIND_QUIETLY) + message(WARNING "${__cvcomponent} is required but was not found") + endif() + #indicate that module is NOT found + string(TOUPPER "${__cvcomponent}" __cvcomponentUP) + set(${__cvcomponentUP}_FOUND "${__cvcomponentUP}_FOUND-NOTFOUND") + else() + list(APPEND OpenCV_FIND_COMPONENTS_ ${__cvcomponent}) + # Not using list(APPEND) here, because OpenCV_LIBS may not exist yet. + # Also not clearing OpenCV_LIBS anywhere, so that multiple calls + # to find_package(OpenCV) with different component lists add up. + set(OpenCV_LIBS ${OpenCV_LIBS} "${__cvcomponent}") + #indicate that module is found + string(TOUPPER "${__cvcomponent}" __cvcomponentUP) + set(${__cvcomponentUP}_FOUND 1) + endif() + if(OpenCV_SHARED AND ";${OpenCV_WORLD_COMPONENTS};" MATCHES ";${__cvcomponent};" AND NOT TARGET ${__cvcomponent}) + get_target_property(__implib_dbg opencv_world IMPORTED_IMPLIB_DEBUG) + get_target_property(__implib_release opencv_world IMPORTED_IMPLIB_RELEASE) + get_target_property(__location_dbg opencv_world IMPORTED_LOCATION_DEBUG) + get_target_property(__location_release opencv_world IMPORTED_LOCATION_RELEASE) + add_library(${__cvcomponent} SHARED IMPORTED) + if(__location_dbg) + set_property(TARGET ${__cvcomponent} APPEND PROPERTY IMPORTED_CONFIGURATIONS DEBUG) + set_target_properties(${__cvcomponent} PROPERTIES + IMPORTED_IMPLIB_DEBUG "${__implib_dbg}" + IMPORTED_LINK_INTERFACE_LIBRARIES_DEBUG "" + IMPORTED_LOCATION_DEBUG "${__location_dbg}" + ) + endif() + if(__location_release) + set_property(TARGET ${__cvcomponent} APPEND PROPERTY IMPORTED_CONFIGURATIONS RELEASE) + set_target_properties(${__cvcomponent} PROPERTIES + IMPORTED_IMPLIB_RELEASE "${__implib_release}" + IMPORTED_LINK_INTERFACE_LIBRARIES_RELEASE "" + IMPORTED_LOCATION_RELEASE "${__location_release}" + ) + endif() + endif() +endforeach() +set(OpenCV_FIND_COMPONENTS ${OpenCV_FIND_COMPONENTS_}) + +# ============================================================== +# Resolve dependencies +# ============================================================== +if(OpenCV_USE_MANGLED_PATHS) + set(OpenCV_LIB_SUFFIX ".${OpenCV_VERSION_MAJOR}.${OpenCV_VERSION_MINOR}.${OpenCV_VERSION_PATCH}") +else() + set(OpenCV_LIB_SUFFIX "") +endif() + +foreach(__opttype OPT DBG) + SET(OpenCV_LIBS_${__opttype} "${OpenCV_LIBS}") + SET(OpenCV_EXTRA_LIBS_${__opttype} "") + + # CUDA + if(OpenCV_CUDA_VERSION) + if(NOT CUDA_FOUND) + find_host_package(CUDA ${OpenCV_CUDA_VERSION} EXACT REQUIRED) + else() + if(NOT CUDA_VERSION_STRING VERSION_EQUAL OpenCV_CUDA_VERSION) + message(FATAL_ERROR "OpenCV static library was compiled with CUDA ${OpenCV_CUDA_VERSION} support. Please, use the same version or rebuild OpenCV with CUDA ${CUDA_VERSION_STRING}") + endif() + endif() + + set(OpenCV_CUDA_LIBS_ABSPATH ${CUDA_LIBRARIES}) + + if(${CUDA_VERSION} VERSION_LESS "5.5") + list(APPEND OpenCV_CUDA_LIBS_ABSPATH ${CUDA_npp_LIBRARY}) + else() + find_cuda_helper_libs(nppc) + find_cuda_helper_libs(nppi) + find_cuda_helper_libs(npps) + list(APPEND OpenCV_CUDA_LIBS_ABSPATH ${CUDA_nppc_LIBRARY} ${CUDA_nppi_LIBRARY} ${CUDA_npps_LIBRARY}) + endif() + + if(OpenCV_USE_CUBLAS) + list(APPEND OpenCV_CUDA_LIBS_ABSPATH ${CUDA_CUBLAS_LIBRARIES}) + endif() + + if(OpenCV_USE_CUFFT) + list(APPEND OpenCV_CUDA_LIBS_ABSPATH ${CUDA_CUFFT_LIBRARIES}) + endif() + + if(OpenCV_USE_NVCUVID) + list(APPEND OpenCV_CUDA_LIBS_ABSPATH ${CUDA_nvcuvid_LIBRARIES}) + endif() + + if(WIN32) + list(APPEND OpenCV_CUDA_LIBS_ABSPATH ${CUDA_nvcuvenc_LIBRARIES}) + endif() + + set(OpenCV_CUDA_LIBS_RELPATH "") + foreach(l ${OpenCV_CUDA_LIBS_ABSPATH}) + get_filename_component(_tmp ${l} PATH) + if(NOT ${_tmp} MATCHES "-Wl.*") + list(APPEND OpenCV_CUDA_LIBS_RELPATH ${_tmp}) + endif() + endforeach() + + list(REMOVE_DUPLICATES OpenCV_CUDA_LIBS_RELPATH) + link_directories(${OpenCV_CUDA_LIBS_RELPATH}) + endif() +endforeach() + +# ============================================================== +# Compatibility stuff +# ============================================================== +if(CMAKE_BUILD_TYPE MATCHES "Debug") + SET(OpenCV_LIB_DIR ${OpenCV_LIB_DIR_DBG} ${OpenCV_3RDPARTY_LIB_DIR_DBG}) +else() + SET(OpenCV_LIB_DIR ${OpenCV_LIB_DIR_OPT} ${OpenCV_3RDPARTY_LIB_DIR_OPT}) +endif() +set(OpenCV_LIBRARIES ${OpenCV_LIBS}) + +if(CMAKE_CROSSCOMPILING AND OpenCV_SHARED AND (CMAKE_SYSTEM_NAME MATCHES "Linux")) + foreach(dir ${OpenCV_LIB_DIR}) + set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -Wl,-rpath-link,${dir}") + set(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS} -Wl,-rpath-link,${dir}") + set(CMAKE_MODULE_LINKER_FLAGS "${CMAKE_MODULE_LINKER_FLAGS} -Wl,-rpath-link,${dir}") + endforeach() +endif() + + + +# +# Some macroses for samples +# +macro(ocv_check_dependencies) + set(OCV_DEPENDENCIES_FOUND TRUE) + foreach(d ${ARGN}) + if(NOT TARGET ${d}) + message(WARNING "OpenCV: Can't resolve dependency: ${d}") + set(OCV_DEPENDENCIES_FOUND FALSE) + break() + endif() + endforeach() +endmacro() + +# adds include directories in such way that directories from the OpenCV source tree go first +function(ocv_include_directories) + set(__add_before "") + file(TO_CMAKE_PATH "${OpenCV_DIR}" __baseDir) + foreach(dir ${ARGN}) + get_filename_component(__abs_dir "${dir}" ABSOLUTE) + if("${__abs_dir}" MATCHES "^${__baseDir}") + list(APPEND __add_before "${dir}") + else() + include_directories(AFTER SYSTEM "${dir}") + endif() + endforeach() + include_directories(BEFORE ${__add_before}) +endfunction() + +macro(ocv_include_modules) + include_directories(BEFORE "${OpenCV_INCLUDE_DIRS}") +endmacro() + +macro(ocv_include_modules_recurse) + include_directories(BEFORE "${OpenCV_INCLUDE_DIRS}") +endmacro() + +macro(ocv_target_link_libraries) + target_link_libraries(${ARGN}) +endmacro() + +# remove all matching elements from the list +macro(ocv_list_filterout lst regex) + foreach(item ${${lst}}) + if(item MATCHES "${regex}") + list(REMOVE_ITEM ${lst} "${item}") + endif() + endforeach() +endmacro() diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/templates/cmake_uninstall.cmake.in b/dependency-check-core/src/test/resources/cmake/opencv/cmake/templates/cmake_uninstall.cmake.in new file mode 100644 index 000000000..0e63d705c --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/templates/cmake_uninstall.cmake.in @@ -0,0 +1,25 @@ +# ----------------------------------------------- +# File that provides "make uninstall" target +# We use the file 'install_manifest.txt' +# ----------------------------------------------- +IF(NOT EXISTS "@CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt") + MESSAGE(FATAL_ERROR "Cannot find install manifest: \"@CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt\"") +ENDIF(NOT EXISTS "@CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt") + +FILE(READ "@CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt" files) +STRING(REGEX REPLACE "\n" ";" files "${files}") +FOREACH(file ${files}) + MESSAGE(STATUS "Uninstalling \"$ENV{DESTDIR}${file}\"") + IF(EXISTS "$ENV{DESTDIR}${file}") + EXEC_PROGRAM( + "@CMAKE_COMMAND@" ARGS "-E remove \"$ENV{DESTDIR}${file}\"" + OUTPUT_VARIABLE rm_out + RETURN_VALUE rm_retval + ) + IF(NOT "${rm_retval}" STREQUAL 0) + MESSAGE(FATAL_ERROR "Problem when removing \"$ENV{DESTDIR}${file}\"") + ENDIF(NOT "${rm_retval}" STREQUAL 0) + ELSE(EXISTS "$ENV{DESTDIR}${file}") + MESSAGE(STATUS "File \"$ENV{DESTDIR}${file}\" does not exist.") + ENDIF(EXISTS "$ENV{DESTDIR}${file}") +ENDFOREACH(file) diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/templates/cvconfig.h.in b/dependency-check-core/src/test/resources/cmake/opencv/cmake/templates/cvconfig.h.in new file mode 100644 index 000000000..4a1d1c632 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/templates/cvconfig.h.in @@ -0,0 +1,183 @@ +/* OpenCV compiled as static or dynamic libs */ +#cmakedefine BUILD_SHARED_LIBS + +/* Compile for 'real' NVIDIA GPU architectures */ +#define CUDA_ARCH_BIN "${OPENCV_CUDA_ARCH_BIN}" + +/* Create PTX or BIN for 1.0 compute capability */ +#cmakedefine CUDA_ARCH_BIN_OR_PTX_10 + +/* NVIDIA GPU features are used */ +#define CUDA_ARCH_FEATURES "${OPENCV_CUDA_ARCH_FEATURES}" + +/* Compile for 'virtual' NVIDIA PTX architectures */ +#define CUDA_ARCH_PTX "${OPENCV_CUDA_ARCH_PTX}" + +/* AVFoundation video libraries */ +#cmakedefine HAVE_AVFOUNDATION + +/* V4L capturing support */ +#cmakedefine HAVE_CAMV4L + +/* V4L2 capturing support */ +#cmakedefine HAVE_CAMV4L2 + +/* Carbon windowing environment */ +#cmakedefine HAVE_CARBON + +/* AMD's Basic Linear Algebra Subprograms Library*/ +#cmakedefine HAVE_CLAMDBLAS + +/* AMD's OpenCL Fast Fourier Transform Library*/ +#cmakedefine HAVE_CLAMDFFT + +/* Clp support */ +#cmakedefine HAVE_CLP + +/* Cocoa API */ +#cmakedefine HAVE_COCOA + +/* C= */ +#cmakedefine HAVE_CSTRIPES + +/* NVidia Cuda Basic Linear Algebra Subprograms (BLAS) API*/ +#cmakedefine HAVE_CUBLAS + +/* NVidia Cuda Runtime API*/ +#cmakedefine HAVE_CUDA + +/* NVidia Cuda Fast Fourier Transform (FFT) API*/ +#cmakedefine HAVE_CUFFT + +/* IEEE1394 capturing support */ +#cmakedefine HAVE_DC1394 + +/* IEEE1394 capturing support - libdc1394 v2.x */ +#cmakedefine HAVE_DC1394_2 + +/* DirectX */ +#cmakedefine HAVE_DIRECTX +#cmakedefine HAVE_D3D11 +#cmakedefine HAVE_D3D10 +#cmakedefine HAVE_D3D9 + +/* DirectShow Video Capture library */ +#cmakedefine HAVE_DSHOW + +/* Eigen Matrix & Linear Algebra Library */ +#cmakedefine HAVE_EIGEN + +/* FFMpeg video library */ +#cmakedefine HAVE_FFMPEG + +/* ffmpeg's libswscale */ +#cmakedefine HAVE_FFMPEG_SWSCALE + +/* ffmpeg in Gentoo */ +#cmakedefine HAVE_GENTOO_FFMPEG + +/* Geospatial Data Abstraction Library */ +#cmakedefine HAVE_GDAL + +/* GStreamer multimedia framework */ +#cmakedefine HAVE_GSTREAMER + +/* GTK+ 2.0 Thread support */ +#cmakedefine HAVE_GTHREAD + +/* GTK+ 2.x toolkit */ +#cmakedefine HAVE_GTK + +/* Define to 1 if you have the header file. */ +#cmakedefine HAVE_INTTYPES_H 1 + +/* Intel Perceptual Computing SDK library */ +#cmakedefine HAVE_INTELPERC + +/* Intel Integrated Performance Primitives */ +#cmakedefine HAVE_IPP +#cmakedefine HAVE_IPP_ICV_ONLY + +/* Intel IPP Async */ +#cmakedefine HAVE_IPP_A + +/* JPEG-2000 codec */ +#cmakedefine HAVE_JASPER + +/* IJG JPEG codec */ +#cmakedefine HAVE_JPEG + +/* libpng/png.h needs to be included */ +#cmakedefine HAVE_LIBPNG_PNG_H + +/* V4L/V4L2 capturing support via libv4l */ +#cmakedefine HAVE_LIBV4L + +/* Microsoft Media Foundation Capture library */ +#cmakedefine HAVE_MSMF + +/* NVidia Video Decoding API*/ +#cmakedefine HAVE_NVCUVID + +/* OpenCL Support */ +#cmakedefine HAVE_OPENCL +#cmakedefine HAVE_OPENCL_STATIC +#cmakedefine HAVE_OPENCL_SVM + +/* OpenEXR codec */ +#cmakedefine HAVE_OPENEXR + +/* OpenGL support*/ +#cmakedefine HAVE_OPENGL + +/* OpenNI library */ +#cmakedefine HAVE_OPENNI + +/* OpenNI library */ +#cmakedefine HAVE_OPENNI2 + +/* PNG codec */ +#cmakedefine HAVE_PNG + +/* Qt support */ +#cmakedefine HAVE_QT + +/* Qt OpenGL support */ +#cmakedefine HAVE_QT_OPENGL + +/* QuickTime video libraries */ +#cmakedefine HAVE_QUICKTIME + +/* QTKit video libraries */ +#cmakedefine HAVE_QTKIT + +/* Intel Threading Building Blocks */ +#cmakedefine HAVE_TBB + +/* TIFF codec */ +#cmakedefine HAVE_TIFF + +/* Unicap video capture library */ +#cmakedefine HAVE_UNICAP + +/* Video for Windows support */ +#cmakedefine HAVE_VFW + +/* V4L2 capturing support in videoio.h */ +#cmakedefine HAVE_VIDEOIO + +/* Win32 UI */ +#cmakedefine HAVE_WIN32UI + +/* XIMEA camera support */ +#cmakedefine HAVE_XIMEA + +/* Xine video library */ +#cmakedefine HAVE_XINE + +/* Define if your processor stores words with the most significant byte + first (like Motorola and SPARC, unlike Intel and VAX). */ +#cmakedefine WORDS_BIGENDIAN + +/* gPhoto2 library */ +#cmakedefine HAVE_GPHOTO2 diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/templates/opencv-XXX.pc.in b/dependency-check-core/src/test/resources/cmake/opencv/cmake/templates/opencv-XXX.pc.in new file mode 100644 index 000000000..04d675af1 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/templates/opencv-XXX.pc.in @@ -0,0 +1,14 @@ +# Package Information for pkg-config + +prefix=@prefix@ +exec_prefix=@exec_prefix@ +libdir=@libdir@ +includedir_old=@includedir@/opencv +includedir_new=@includedir@ + +Name: OpenCV +Description: Open Source Computer Vision Library +Version: @OPENCV_VERSION_PLAIN@ +Libs: @OPENCV_PC_LIBS@ +Libs.private: @OPENCV_PC_LIBS_PRIVATE@ +Cflags: -I${includedir_old} -I${includedir_new} diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/templates/opencv_abi.xml.in b/dependency-check-core/src/test/resources/cmake/opencv/cmake/templates/opencv_abi.xml.in new file mode 100644 index 000000000..292d9b491 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/templates/opencv_abi.xml.in @@ -0,0 +1,46 @@ + + + + + + + + @OPENCV_ABI_VERSION@ + + + + @OPENCV_ABI_HEADERS@ + + + + @OPENCV_ABI_LIBRARIES@ + + + + opencv2/hal/intrin* + opencv2/core/cuda* + opencv2/core/private* + opencv/cxeigen.hpp + opencv2/core/eigen.hpp + opencv2/flann/hdf5.h + opencv2/imgcodecs/ios.h + opencv2/videoio/cap_ios.h + opencv2/ts.hpp + opencv2/ts/* + opencv2/xobjdetect/private.hpp + @OPENCV_ABI_SKIP_HEADERS@ + + + + @OPENCV_ABI_SKIP_LIBRARIES@ + + + + @OPENCV_ABI_GCC_OPTIONS@ + + + diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/templates/opencv_modules.hpp.in b/dependency-check-core/src/test/resources/cmake/opencv/cmake/templates/opencv_modules.hpp.in new file mode 100644 index 000000000..149871502 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/templates/opencv_modules.hpp.in @@ -0,0 +1,9 @@ +/* + * ** File generated automatically, do not modify ** + * + * This file defines the list of modules available in current build configuration + * + * +*/ + +@OPENCV_MODULE_DEFINITIONS_CONFIGMAKE@ diff --git a/dependency-check-core/src/test/resources/cmake/opencv/cmake/templates/opencv_run_all_tests_android.sh.in b/dependency-check-core/src/test/resources/cmake/opencv/cmake/templates/opencv_run_all_tests_android.sh.in new file mode 100644 index 000000000..93373fa96 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/opencv/cmake/templates/opencv_run_all_tests_android.sh.in @@ -0,0 +1,51 @@ +#!/bin/sh + +BASE_DIR=`dirname $0` +OPENCV_TEST_PATH=$BASE_DIR/@TEST_PATH@ +OPENCV_TEST_DATA_PATH=$BASE_DIR/sdk/etc/testdata/ + +if [ $# -ne 1 ]; then + echo "Device architecture is not preset in command line" + echo "Tests are available for architectures: `ls -m ${OPENCV_TEST_PATH}`" + echo "Usage: $0 " + return 1 +else + TARGET_ARCH=$1 +fi + +if [ -z `which adb` ]; then + echo "adb command was not found in PATH" + return 1 +fi + +adb push $OPENCV_TEST_DATA_PATH /sdcard/opencv_testdata + +adb shell "mkdir -p /data/local/tmp/opencv_test" +SUMMARY_STATUS=0 +for t in "$OPENCV_TEST_PATH/$TARGET_ARCH/"opencv_test_* "$OPENCV_TEST_PATH/$TARGET_ARCH/"opencv_perf_*; +do + test_name=`basename "$t"` + report="$test_name-`date --rfc-3339=date`.xml" + adb push $t /data/local/tmp/opencv_test/ + adb shell "export OPENCV_TEST_DATA_PATH=/sdcard/opencv_testdata && /data/local/tmp/opencv_test/$test_name --perf_min_samples=1 --perf_force_samples=1 --gtest_output=xml:/data/local/tmp/opencv_test/$report" + adb pull "/data/local/tmp/opencv_test/$report" $report + TEST_STATUS=0 + if [ -e $report ]; then + if [ `grep -c "&2 This script runs the OpenCV tests on Windows. + echo>&2 + echo>&2 usage: %0 ^ + exit /B 1 +) + +if NOT EXIST "%OPENCV_DIR%" ( + echo>&2 error: "%OPENCV_DIR%" doesn't exist +) + +rem Set up paths + +set PATH=%OPENCV_DIR%\@OPENCV_BIN_INSTALL_PATH@;%PATH% +set OPENCV_TEST_PATH=%~dp0 +set OPENCV_TEST_DATA_PATH=%OPENCV_TEST_PATH%\..\testdata + +rem Run tests + +set SUMMARY_STATUS=0 +set FAILED_TESTS= +set PASSED_TESTS= + +for %%t IN ("%OPENCV_TEST_PATH%\opencv_test_*.exe" "%OPENCV_TEST_PATH%\opencv_perf_*.exe") DO ( + set test_name=%%~nt + set report=!test_name!.xml + + set cmd="%%t" --perf_min_samples=1 --perf_force_samples=1 "--gtest_output=xml:!report!" + + echo [!test_name!] RUN : !cmd! + !cmd! + set ret=!errorlevel! + echo [!test_name!] RETURN_CODE : !ret! + + if !ret! EQU 0 ( + echo [!test_name!] OK + set PASSED_TESTS=!PASSED_TESTS! !test_name! + ) ELSE ( + echo [!test_name!] FAILED + set SUMMARY_STATUS=1 + set FAILED_TESTS=!FAILED_TESTS! !test_name! + ) + + echo. +) + +rem Remove temporary test files + +del /F /Q "%TMP%\ocv*.tmp*" + +rem Report final status + +echo =============================================================== +echo PASSED TESTS : %PASSED_TESTS% +echo FAILED TESTS : %FAILED_TESTS% +if %SUMMARY_STATUS% EQU 0 ( + echo STATUS : OK + echo STATUS : All OpenCV tests finished successfully +) ELSE ( + echo STATUS : FAIL + echo STATUS : OpenCV tests finished with status %SUMMARY_STATUS% +) + +exit /B %SUMMARY_STATUS% diff --git a/dependency-check-core/src/test/resources/cmake/zlib/CMakeLists.txt b/dependency-check-core/src/test/resources/cmake/zlib/CMakeLists.txt new file mode 100644 index 000000000..0c0247cc5 --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/zlib/CMakeLists.txt @@ -0,0 +1,249 @@ +cmake_minimum_required(VERSION 2.4.4) +set(CMAKE_ALLOW_LOOSE_LOOP_CONSTRUCTS ON) + +project(zlib C) + +set(VERSION "1.2.8") + +option(ASM686 "Enable building i686 assembly implementation") +option(AMD64 "Enable building amd64 assembly implementation") + +set(INSTALL_BIN_DIR "${CMAKE_INSTALL_PREFIX}/bin" CACHE PATH "Installation directory for executables") +set(INSTALL_LIB_DIR "${CMAKE_INSTALL_PREFIX}/lib" CACHE PATH "Installation directory for libraries") +set(INSTALL_INC_DIR "${CMAKE_INSTALL_PREFIX}/include" CACHE PATH "Installation directory for headers") +set(INSTALL_MAN_DIR "${CMAKE_INSTALL_PREFIX}/share/man" CACHE PATH "Installation directory for manual pages") +set(INSTALL_PKGCONFIG_DIR "${CMAKE_INSTALL_PREFIX}/share/pkgconfig" CACHE PATH "Installation directory for pkgconfig (.pc) files") + +include(CheckTypeSize) +include(CheckFunctionExists) +include(CheckIncludeFile) +include(CheckCSourceCompiles) +enable_testing() + +check_include_file(sys/types.h HAVE_SYS_TYPES_H) +check_include_file(stdint.h HAVE_STDINT_H) +check_include_file(stddef.h HAVE_STDDEF_H) + +# +# Check to see if we have large file support +# +set(CMAKE_REQUIRED_DEFINITIONS -D_LARGEFILE64_SOURCE=1) +# We add these other definitions here because CheckTypeSize.cmake +# in CMake 2.4.x does not automatically do so and we want +# compatibility with CMake 2.4.x. +if(HAVE_SYS_TYPES_H) + list(APPEND CMAKE_REQUIRED_DEFINITIONS -DHAVE_SYS_TYPES_H) +endif() +if(HAVE_STDINT_H) + list(APPEND CMAKE_REQUIRED_DEFINITIONS -DHAVE_STDINT_H) +endif() +if(HAVE_STDDEF_H) + list(APPEND CMAKE_REQUIRED_DEFINITIONS -DHAVE_STDDEF_H) +endif() +check_type_size(off64_t OFF64_T) +if(HAVE_OFF64_T) + add_definitions(-D_LARGEFILE64_SOURCE=1) +endif() +set(CMAKE_REQUIRED_DEFINITIONS) # clear variable + +# +# Check for fseeko +# +check_function_exists(fseeko HAVE_FSEEKO) +if(NOT HAVE_FSEEKO) + add_definitions(-DNO_FSEEKO) +endif() + +# +# Check for unistd.h +# +check_include_file(unistd.h Z_HAVE_UNISTD_H) + +if(MSVC) + set(CMAKE_DEBUG_POSTFIX "d") + add_definitions(-D_CRT_SECURE_NO_DEPRECATE) + add_definitions(-D_CRT_NONSTDC_NO_DEPRECATE) + include_directories(${CMAKE_CURRENT_SOURCE_DIR}) +endif() + +if(NOT CMAKE_CURRENT_SOURCE_DIR STREQUAL CMAKE_CURRENT_BINARY_DIR) + # If we're doing an out of source build and the user has a zconf.h + # in their source tree... + if(EXISTS ${CMAKE_CURRENT_SOURCE_DIR}/zconf.h) + message(STATUS "Renaming") + message(STATUS " ${CMAKE_CURRENT_SOURCE_DIR}/zconf.h") + message(STATUS "to 'zconf.h.included' because this file is included with zlib") + message(STATUS "but CMake generates it automatically in the build directory.") + file(RENAME ${CMAKE_CURRENT_SOURCE_DIR}/zconf.h ${CMAKE_CURRENT_SOURCE_DIR}/zconf.h.included) + endif() +endif() + +set(ZLIB_PC ${CMAKE_CURRENT_BINARY_DIR}/zlib.pc) +configure_file( ${CMAKE_CURRENT_SOURCE_DIR}/zlib.pc.cmakein + ${ZLIB_PC} @ONLY) +configure_file( ${CMAKE_CURRENT_SOURCE_DIR}/zconf.h.cmakein + ${CMAKE_CURRENT_BINARY_DIR}/zconf.h @ONLY) +include_directories(${CMAKE_CURRENT_BINARY_DIR} ${CMAKE_SOURCE_DIR}) + + +#============================================================================ +# zlib +#============================================================================ + +set(ZLIB_PUBLIC_HDRS + ${CMAKE_CURRENT_BINARY_DIR}/zconf.h + zlib.h +) +set(ZLIB_PRIVATE_HDRS + crc32.h + deflate.h + gzguts.h + inffast.h + inffixed.h + inflate.h + inftrees.h + trees.h + zutil.h +) +set(ZLIB_SRCS + adler32.c + compress.c + crc32.c + deflate.c + gzclose.c + gzlib.c + gzread.c + gzwrite.c + inflate.c + infback.c + inftrees.c + inffast.c + trees.c + uncompr.c + zutil.c +) + +if(NOT MINGW) + set(ZLIB_DLL_SRCS + win32/zlib1.rc # If present will override custom build rule below. + ) +endif() + +if(CMAKE_COMPILER_IS_GNUCC) + if(ASM686) + set(ZLIB_ASMS contrib/asm686/match.S) + elseif (AMD64) + set(ZLIB_ASMS contrib/amd64/amd64-match.S) + endif () + + if(ZLIB_ASMS) + add_definitions(-DASMV) + set_source_files_properties(${ZLIB_ASMS} PROPERTIES LANGUAGE C COMPILE_FLAGS -DNO_UNDERLINE) + endif() +endif() + +if(MSVC) + if(ASM686) + ENABLE_LANGUAGE(ASM_MASM) + set(ZLIB_ASMS + contrib/masmx86/inffas32.asm + contrib/masmx86/match686.asm + ) + elseif (AMD64) + ENABLE_LANGUAGE(ASM_MASM) + set(ZLIB_ASMS + contrib/masmx64/gvmat64.asm + contrib/masmx64/inffasx64.asm + ) + endif() + + if(ZLIB_ASMS) + add_definitions(-DASMV -DASMINF) + endif() +endif() + +# parse the full version number from zlib.h and include in ZLIB_FULL_VERSION +file(READ ${CMAKE_CURRENT_SOURCE_DIR}/zlib.h _zlib_h_contents) +string(REGEX REPLACE ".*#define[ \t]+ZLIB_VERSION[ \t]+\"([-0-9A-Za-z.]+)\".*" + "\\1" ZLIB_FULL_VERSION ${_zlib_h_contents}) + +if(MINGW) + # This gets us DLL resource information when compiling on MinGW. + if(NOT CMAKE_RC_COMPILER) + set(CMAKE_RC_COMPILER windres.exe) + endif() + + add_custom_command(OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/zlib1rc.obj + COMMAND ${CMAKE_RC_COMPILER} + -D GCC_WINDRES + -I ${CMAKE_CURRENT_SOURCE_DIR} + -I ${CMAKE_CURRENT_BINARY_DIR} + -o ${CMAKE_CURRENT_BINARY_DIR}/zlib1rc.obj + -i ${CMAKE_CURRENT_SOURCE_DIR}/win32/zlib1.rc) + set(ZLIB_DLL_SRCS ${CMAKE_CURRENT_BINARY_DIR}/zlib1rc.obj) +endif(MINGW) + +add_library(zlib SHARED ${ZLIB_SRCS} ${ZLIB_ASMS} ${ZLIB_DLL_SRCS} ${ZLIB_PUBLIC_HDRS} ${ZLIB_PRIVATE_HDRS}) +add_library(zlibstatic STATIC ${ZLIB_SRCS} ${ZLIB_ASMS} ${ZLIB_PUBLIC_HDRS} ${ZLIB_PRIVATE_HDRS}) +set_target_properties(zlib PROPERTIES DEFINE_SYMBOL ZLIB_DLL) +set_target_properties(zlib PROPERTIES SOVERSION 1) + +if(NOT CYGWIN) + # This property causes shared libraries on Linux to have the full version + # encoded into their final filename. We disable this on Cygwin because + # it causes cygz-${ZLIB_FULL_VERSION}.dll to be created when cygz.dll + # seems to be the default. + # + # This has no effect with MSVC, on that platform the version info for + # the DLL comes from the resource file win32/zlib1.rc + set_target_properties(zlib PROPERTIES VERSION ${ZLIB_FULL_VERSION}) +endif() + +if(UNIX) + # On unix-like platforms the library is almost always called libz + set_target_properties(zlib zlibstatic PROPERTIES OUTPUT_NAME z) + if(NOT APPLE) + set_target_properties(zlib PROPERTIES LINK_FLAGS "-Wl,--version-script,\"${CMAKE_CURRENT_SOURCE_DIR}/zlib.map\"") + endif() +elseif(BUILD_SHARED_LIBS AND WIN32) + # Creates zlib1.dll when building shared library version + set_target_properties(zlib PROPERTIES SUFFIX "1.dll") +endif() + +if(NOT SKIP_INSTALL_LIBRARIES AND NOT SKIP_INSTALL_ALL ) + install(TARGETS zlib zlibstatic + RUNTIME DESTINATION "${INSTALL_BIN_DIR}" + ARCHIVE DESTINATION "${INSTALL_LIB_DIR}" + LIBRARY DESTINATION "${INSTALL_LIB_DIR}" ) +endif() +if(NOT SKIP_INSTALL_HEADERS AND NOT SKIP_INSTALL_ALL ) + install(FILES ${ZLIB_PUBLIC_HDRS} DESTINATION "${INSTALL_INC_DIR}") +endif() +if(NOT SKIP_INSTALL_FILES AND NOT SKIP_INSTALL_ALL ) + install(FILES zlib.3 DESTINATION "${INSTALL_MAN_DIR}/man3") +endif() +if(NOT SKIP_INSTALL_FILES AND NOT SKIP_INSTALL_ALL ) + install(FILES ${ZLIB_PC} DESTINATION "${INSTALL_PKGCONFIG_DIR}") +endif() + +#============================================================================ +# Example binaries +#============================================================================ + +add_executable(example test/example.c) +target_link_libraries(example zlib) +add_test(example example) + +add_executable(minigzip test/minigzip.c) +target_link_libraries(minigzip zlib) + +if(HAVE_OFF64_T) + add_executable(example64 test/example.c) + target_link_libraries(example64 zlib) + set_target_properties(example64 PROPERTIES COMPILE_FLAGS "-D_FILE_OFFSET_BITS=64") + add_test(example64 example64) + + add_executable(minigzip64 test/minigzip.c) + target_link_libraries(minigzip64 zlib) + set_target_properties(minigzip64 PROPERTIES COMPILE_FLAGS "-D_FILE_OFFSET_BITS=64") +endif() diff --git a/dependency-check-core/src/test/resources/cmake/zlib/README b/dependency-check-core/src/test/resources/cmake/zlib/README new file mode 100644 index 000000000..5ca9d127e --- /dev/null +++ b/dependency-check-core/src/test/resources/cmake/zlib/README @@ -0,0 +1,115 @@ +ZLIB DATA COMPRESSION LIBRARY + +zlib 1.2.8 is a general purpose data compression library. All the code is +thread safe. The data format used by the zlib library is described by RFCs +(Request for Comments) 1950 to 1952 in the files +http://tools.ietf.org/html/rfc1950 (zlib format), rfc1951 (deflate format) and +rfc1952 (gzip format). + +All functions of the compression library are documented in the file zlib.h +(volunteer to write man pages welcome, contact zlib@gzip.org). A usage example +of the library is given in the file test/example.c which also tests that +the library is working correctly. Another example is given in the file +test/minigzip.c. The compression library itself is composed of all source +files in the root directory. + +To compile all files and run the test program, follow the instructions given at +the top of Makefile.in. In short "./configure; make test", and if that goes +well, "make install" should work for most flavors of Unix. For Windows, use +one of the special makefiles in win32/ or contrib/vstudio/ . For VMS, use +make_vms.com. + +Questions about zlib should be sent to , or to Gilles Vollant + for the Windows DLL version. The zlib home page is +http://zlib.net/ . Before reporting a problem, please check this site to +verify that you have the latest version of zlib; otherwise get the latest +version and check whether the problem still exists or not. + +PLEASE read the zlib FAQ http://zlib.net/zlib_faq.html before asking for help. + +Mark Nelson wrote an article about zlib for the Jan. 1997 +issue of Dr. Dobb's Journal; a copy of the article is available at +http://marknelson.us/1997/01/01/zlib-engine/ . + +The changes made in version 1.2.8 are documented in the file ChangeLog. + +Unsupported third party contributions are provided in directory contrib/ . + +zlib is available in Java using the java.util.zip package, documented at +http://java.sun.com/developer/technicalArticles/Programming/compression/ . + +A Perl interface to zlib written by Paul Marquess is available +at CPAN (Comprehensive Perl Archive Network) sites, including +http://search.cpan.org/~pmqs/IO-Compress-Zlib/ . + +A Python interface to zlib written by A.M. Kuchling is +available in Python 1.5 and later versions, see +http://docs.python.org/library/zlib.html . + +zlib is built into tcl: http://wiki.tcl.tk/4610 . + +An experimental package to read and write files in .zip format, written on top +of zlib by Gilles Vollant , is available in the +contrib/minizip directory of zlib. + + +Notes for some targets: + +- For Windows DLL versions, please see win32/DLL_FAQ.txt + +- For 64-bit Irix, deflate.c must be compiled without any optimization. With + -O, one libpng test fails. The test works in 32 bit mode (with the -n32 + compiler flag). The compiler bug has been reported to SGI. + +- zlib doesn't work with gcc 2.6.3 on a DEC 3000/300LX under OSF/1 2.1 it works + when compiled with cc. + +- On Digital Unix 4.0D (formely OSF/1) on AlphaServer, the cc option -std1 is + necessary to get gzprintf working correctly. This is done by configure. + +- zlib doesn't work on HP-UX 9.05 with some versions of /bin/cc. It works with + other compilers. Use "make test" to check your compiler. + +- gzdopen is not supported on RISCOS or BEOS. + +- For PalmOs, see http://palmzlib.sourceforge.net/ + + +Acknowledgments: + + The deflate format used by zlib was defined by Phil Katz. The deflate and + zlib specifications were written by L. Peter Deutsch. Thanks to all the + people who reported problems and suggested various improvements in zlib; they + are too numerous to cite here. + +Copyright notice: + + (C) 1995-2013 Jean-loup Gailly and Mark Adler + + This software is provided 'as-is', without any express or implied + warranty. In no event will the authors be held liable for any damages + arising from the use of this software. + + Permission is granted to anyone to use this software for any purpose, + including commercial applications, and to alter it and redistribute it + freely, subject to the following restrictions: + + 1. The origin of this software must not be misrepresented; you must not + claim that you wrote the original software. If you use this software + in a product, an acknowledgment in the product documentation would be + appreciated but is not required. + 2. Altered source versions must be plainly marked as such, and must not be + misrepresented as being the original software. + 3. This notice may not be removed or altered from any source distribution. + + Jean-loup Gailly Mark Adler + jloup@gzip.org madler@alumni.caltech.edu + +If you use the zlib library in a product, we would appreciate *not* receiving +lengthy legal documents to sign. The sources are provided for free but without +warranty of any kind. The library has been entirely written by Jean-loup +Gailly and Mark Adler; it does not include third-party code. + +If you redistribute modified sources, we would appreciate that you include in +the file ChangeLog history information documenting your changes. Please read +the FAQ for more information on the distribution of modified source versions. diff --git a/dependency-check-core/src/test/resources/hibernate3.jar b/dependency-check-core/src/test/resources/hibernate3.jar new file mode 100644 index 000000000..27894ef01 Binary files /dev/null and b/dependency-check-core/src/test/resources/hibernate3.jar differ diff --git a/dependency-check-core/src/test/resources/nvdcve-2.0-2014.xml b/dependency-check-core/src/test/resources/nvdcve-2.0-2014.xml new file mode 100644 index 000000000..9cca2bc49 --- /dev/null +++ b/dependency-check-core/src/test/resources/nvdcve-2.0-2014.xml @@ -0,0 +1,156821 @@ + + + + + + + + + + + cpe:/a:oracle:mysql:- + cpe:/a:mariadb:mariadb:5.5.34 + + CVE-2014-0001 + 2014-01-31T18:55:04.503-05:00 + 2014-03-05T23:50:17.220-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-03T11:10:48.857-05:00 + + + + + CONFIRM + http://bazaar.launchpad.net/~maria-captains/maria/5.5/revision/2502.565.64 + + + CONFIRM + https://mariadb.com/kb/en/mariadb-5535-changelog/ + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1054592 + + + OSVDB + 102714 + + + REDHAT + RHSA-2014:0189 + + + REDHAT + RHSA-2014:0186 + + + REDHAT + RHSA-2014:0173 + + + REDHAT + RHSA-2014:0164 + + + OSVDB + 102713 + + Buffer overflow in client/mysql.cc in Oracle MySQL and MariaDB before 5.5.35 allows remote database servers to cause a denial of service (crash) and possibly execute arbitrary code via a long server version string. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apache:camel:2.10.2 + cpe:/a:apache:camel:2.10.1 + cpe:/a:apache:camel:2.10.0 + cpe:/a:apache:camel:2.12.0 + cpe:/a:apache:camel:1.1.0 + cpe:/a:apache:camel:2.0.0:m3 + cpe:/a:apache:camel:2.0.0:m1 + cpe:/a:apache:camel:1.5.0 + cpe:/a:apache:camel:2.10.3 + cpe:/a:apache:camel:2.10.4 + cpe:/a:apache:camel:2.10.5 + cpe:/a:apache:camel:2.12.1 + cpe:/a:apache:camel:2.12.2 + cpe:/a:apache:camel:1.0.0 + cpe:/a:apache:camel:1.3.0 + cpe:/a:apache:camel:2.11.3 + cpe:/a:apache:camel:2.11.2 + cpe:/a:apache:camel:2.10.7 + cpe:/a:apache:camel:2.10.6 + cpe:/a:apache:camel:1.6.1 + cpe:/a:apache:camel:1.6.0 + cpe:/a:apache:camel:1.6.3 + cpe:/a:apache:camel:1.6.2 + cpe:/a:apache:camel:1.2.0 + cpe:/a:apache:camel:1.6.4 + cpe:/a:apache:camel:2.0.0:m2 + cpe:/a:apache:camel:2.1.0 + cpe:/a:apache:camel:2.11.0 + cpe:/a:apache:camel:1.4.0 + cpe:/a:apache:camel:2.0.0 + cpe:/a:apache:camel:2.11.1 + + CVE-2014-0002 + 2014-03-21T00:38:59.027-04:00 + 2014-04-19T00:45:51.813-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-21T10:58:02.820-04:00 + + + + + BID + 65901 + + + SECUNIA + 57719 + + + SECUNIA + 57716 + + + SECUNIA + 57125 + + + REDHAT + RHSA-2014:0372 + + + REDHAT + RHSA-2014:0371 + + + CONFIRM + http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc + + The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apache:camel:2.10.2 + cpe:/a:apache:camel:2.10.1 + cpe:/a:apache:camel:2.10.0 + cpe:/a:apache:camel:2.12.0 + cpe:/a:apache:camel:1.1.0 + cpe:/a:apache:camel:2.0.0:m3 + cpe:/a:apache:camel:2.0.0:m1 + cpe:/a:apache:camel:1.5.0 + cpe:/a:apache:camel:2.10.3 + cpe:/a:apache:camel:2.10.4 + cpe:/a:apache:camel:2.10.5 + cpe:/a:apache:camel:2.12.1 + cpe:/a:apache:camel:2.12.2 + cpe:/a:apache:camel:1.0.0 + cpe:/a:apache:camel:1.3.0 + cpe:/a:apache:camel:2.11.3 + cpe:/a:apache:camel:2.11.2 + cpe:/a:apache:camel:2.10.7 + cpe:/a:apache:camel:2.10.6 + cpe:/a:apache:camel:1.6.1 + cpe:/a:apache:camel:1.6.0 + cpe:/a:apache:camel:1.6.3 + cpe:/a:apache:camel:1.6.2 + cpe:/a:apache:camel:1.2.0 + cpe:/a:apache:camel:1.6.4 + cpe:/a:apache:camel:2.0.0:m2 + cpe:/a:apache:camel:2.1.0 + cpe:/a:apache:camel:2.11.0 + cpe:/a:apache:camel:1.4.0 + cpe:/a:apache:camel:2.0.0 + cpe:/a:apache:camel:2.11.1 + + CVE-2014-0003 + 2014-03-21T00:38:59.057-04:00 + 2014-04-19T00:45:51.923-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-21T10:58:57.887-04:00 + + + + + BID + 65902 + + + SECUNIA + 57719 + + + SECUNIA + 57716 + + + SECUNIA + 57125 + + + REDHAT + RHSA-2014:0372 + + + REDHAT + RHSA-2014:0371 + + + REDHAT + RHSA-2014:0254 + + + REDHAT + RHSA-2014:0245 + + + CONFIRM + http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc + + The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message. + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:freedesktop:udisks:1.0.1 + cpe:/a:freedesktop:udisks:1.0 + cpe:/o:canonical:ubuntu_linux:12.10 + cpe:/a:freedesktop:udisks:1.0.4 + cpe:/a:freedesktop:udisks:2.1.1 + cpe:/a:freedesktop:udisks:2.1.2 + cpe:/a:freedesktop:udisks:2.0.92 + cpe:/a:freedesktop:udisks:2.0.91 + cpe:/a:freedesktop:udisks:2.0.90 + cpe:/o:canonical:ubuntu_linux:12.04:-:lts + cpe:/a:freedesktop:udisks:2.1.0 + cpe:/o:canonical:ubuntu_linux:13.10 + cpe:/a:freedesktop:udisks:2.0.1 + cpe:/a:freedesktop:udisks:2.0.0 + + CVE-2014-0004 + 2014-03-11T15:37:03.223-04:00 + 2014-03-26T00:55:44.533-04:00 + + + 6.9 + LOCAL + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-12T14:20:58.250-04:00 + + + + + MLIST + [devkit-devel] 20140310 udisks 2.1.3 / 1.0.5 security updates + + + UBUNTU + USN-2142-1 + + + DEBIAN + DSA-2872 + + + REDHAT + RHSA-2014:0293 + + + SUSE + openSUSE-SU-2014:0390 + + + SUSE + openSUSE-SU-2014:0389 + + + SUSE + openSUSE-SU-2014:0388 + + Stack-based buffer overflow in udisks before 1.0.5 and 2.x before 2.1.3 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long mount point. + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:openstack:swift:1.8.0 + cpe:/a:openstack:swift:1.7.0 + cpe:/a:openstack:swift:1.7.2 + cpe:/a:openstack:swift:1.4.7 + cpe:/a:openstack:swift:1.4.8 + cpe:/a:openstack:swift:1.11.0 + cpe:/a:openstack:swift:1.4.6 + cpe:/a:openstack:swift:1.10.0 + cpe:/a:openstack:swift:1.9.0 + cpe:/a:openstack:swift:1.9.1 + cpe:/a:openstack:swift:1.9.2 + cpe:/a:openstack:swift:1.7.6 + cpe:/a:openstack:swift:1.7.4 + cpe:/a:openstack:swift:1.6.0 + cpe:/a:openstack:swift:1.7.5 + cpe:/a:openstack:swift:1.5.0 + + CVE-2014-0006 + 2014-01-22T20:55:04.007-05:00 + 2014-03-08T00:12:30.730-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-23T13:31:05.777-05:00 + + + + + MLIST + [oss-security] 20140117 [OSSA 2014-002] Swift TempURL timing attack (CVE-2014-0006) + + + CONFIRM + https://bugs.launchpad.net/swift/+bug/1265665 + + + REDHAT + RHSA-2014:0232 + + The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a timing side-channel attack. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:moodle:moodle:2.3.11 + cpe:/a:moodle:moodle:2.4.5 + cpe:/a:moodle:moodle:2.4.2 + cpe:/a:moodle:moodle:2.4.1 + cpe:/a:moodle:moodle:2.4.4 + cpe:/a:moodle:moodle:2.4.3 + cpe:/a:moodle:moodle:2.3 + cpe:/a:moodle:moodle:2.5.1 + cpe:/a:moodle:moodle:2.5.2 + cpe:/a:moodle:moodle:2.5.3 + cpe:/a:moodle:moodle:2.3.7 + cpe:/a:moodle:moodle:2.3.1 + cpe:/a:moodle:moodle:2.4.6 + cpe:/a:moodle:moodle:2.3.8 + cpe:/a:moodle:moodle:2.4.7 + cpe:/a:moodle:moodle:2.3.9 + cpe:/a:moodle:moodle:2.3.4 + cpe:/a:moodle:moodle:2.3.5 + cpe:/a:moodle:moodle:2.3.2 + cpe:/a:moodle:moodle:2.3.3 + cpe:/a:moodle:moodle:2.3.6 + cpe:/a:moodle:moodle:2.3.10 + cpe:/a:moodle:moodle:2.4 + cpe:/a:moodle:moodle:2.6 + cpe:/a:moodle:moodle:2.5 + + CVE-2014-0008 + 2014-01-20T10:14:25.437-05:00 + 2014-02-21T00:06:06.437-05:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-22T10:37:56.513-05:00 + + + + + CONFIRM + https://moodle.org/mod/forum/discuss.php?d=252414 + + + CONFIRM + http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-36721 + + + SECTRACK + 1029647 + + + MLIST + [oss-security] 20140120 Moodle security notifications public + + + FEDORA + FEDORA-2014-1396 + + + FEDORA + FEDORA-2014-1377 + + lib/adminlib.php in Moodle through 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 logs cleartext passwords, which allows remote authenticated administrators to obtain sensitive information by reading the Config Changes Report. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:moodle:moodle:2.1.6 + cpe:/a:moodle:moodle:2.0.4 + cpe:/a:moodle:moodle:2.1.7 + cpe:/a:moodle:moodle:2.0.3 + cpe:/a:moodle:moodle:2.1.4 + cpe:/a:moodle:moodle:2.0.2 + cpe:/a:moodle:moodle:2.1.5 + cpe:/a:moodle:moodle:2.1.2 + cpe:/a:moodle:moodle:2.0.8 + cpe:/a:moodle:moodle:2.4.5 + cpe:/a:moodle:moodle:2.1.3 + cpe:/a:moodle:moodle:2.0.7 + cpe:/a:moodle:moodle:2.0.6 + cpe:/a:moodle:moodle:2.1.1 + cpe:/a:moodle:moodle:2.0.5 + cpe:/a:moodle:moodle:2.4.2 + cpe:/a:moodle:moodle:2.4.1 + cpe:/a:moodle:moodle:2.4.4 + cpe:/a:moodle:moodle:2.4.3 + cpe:/a:moodle:moodle:2.0.9 + cpe:/a:moodle:moodle:2.5.1 + cpe:/a:moodle:moodle:2.1.8 + cpe:/a:moodle:moodle:2.5.2 + cpe:/a:moodle:moodle:2.5.3 + cpe:/a:moodle:moodle:2.3.7 + cpe:/a:moodle:moodle:2.0.1 + cpe:/a:moodle:moodle:2.3.8 + cpe:/a:moodle:moodle:2.3.9 + cpe:/a:moodle:moodle:2.2.8 + cpe:/a:moodle:moodle:2.2.9 + cpe:/a:moodle:moodle:2.3.1 + cpe:/a:moodle:moodle:2.1.10 + cpe:/a:moodle:moodle:2.3.4 + cpe:/a:moodle:moodle:2.3.5 + cpe:/a:moodle:moodle:2.3.2 + cpe:/a:moodle:moodle:2.3.3 + cpe:/a:moodle:moodle:2.3.6 + cpe:/a:moodle:moodle:2.2.2 + cpe:/a:moodle:moodle:2.2.1 + cpe:/a:moodle:moodle:2.2.11 + cpe:/a:moodle:moodle:2.2.4 + cpe:/a:moodle:moodle:2.2.3 + cpe:/a:moodle:moodle:2.2.6 + cpe:/a:moodle:moodle:2.2.5 + cpe:/a:moodle:moodle:2.2.7 + cpe:/a:moodle:moodle:2.3 + cpe:/a:moodle:moodle:2.0 + cpe:/a:moodle:moodle:2.4.6 + cpe:/a:moodle:moodle:2.4.7 + cpe:/a:moodle:moodle:2.2 + cpe:/a:moodle:moodle:2.1.9 + cpe:/a:moodle:moodle:2.1 + cpe:/a:moodle:moodle:2.2.10 + cpe:/a:moodle:moodle:2.3.10 + cpe:/a:moodle:moodle:2.4 + cpe:/a:moodle:moodle:2.6 + cpe:/a:moodle:moodle:2.5 + + CVE-2014-0009 + 2014-01-20T10:14:32.313-05:00 + 2014-02-21T00:06:06.530-05:00 + + + 5.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-22T10:37:19.027-05:00 + + + + + CONFIRM + https://moodle.org/mod/forum/discuss.php?d=252415 + + + CONFIRM + http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-42643 + + + SECTRACK + 1029648 + + + MLIST + [oss-security] 20140120 Moodle security notifications public + + + FEDORA + FEDORA-2014-1396 + + + FEDORA + FEDORA-2014-1377 + + course/loginas.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 does not enforce the moodle/site:accessallgroups capability requirement for outside-group users in a SEPARATEGROUPS configuration, which allows remote authenticated users to perform "login as" actions via a direct request. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:moodle:moodle:2.0.4 + cpe:/a:moodle:moodle:2.1.6 + cpe:/a:moodle:moodle:2.0.3 + cpe:/a:moodle:moodle:2.1.7 + cpe:/a:moodle:moodle:2.0.2 + cpe:/a:moodle:moodle:2.1.4 + cpe:/a:moodle:moodle:2.1.5 + cpe:/a:moodle:moodle:2.1.2 + cpe:/a:moodle:moodle:2.0.8 + cpe:/a:moodle:moodle:2.1.3 + cpe:/a:moodle:moodle:2.0.7 + cpe:/a:moodle:moodle:2.4.5 + cpe:/a:moodle:moodle:2.0.6 + cpe:/a:moodle:moodle:2.1.1 + cpe:/a:moodle:moodle:2.0.5 + cpe:/a:moodle:moodle:2.4.2 + cpe:/a:moodle:moodle:2.4.1 + cpe:/a:moodle:moodle:2.4.4 + cpe:/a:moodle:moodle:2.0.9 + cpe:/a:moodle:moodle:2.4.3 + cpe:/a:moodle:moodle:2.5.1 + cpe:/a:moodle:moodle:2.5.2 + cpe:/a:moodle:moodle:2.1.8 + cpe:/a:moodle:moodle:2.5.3 + cpe:/a:moodle:moodle:2.3.7 + cpe:/a:moodle:moodle:2.3.8 + cpe:/a:moodle:moodle:2.0.1 + cpe:/a:moodle:moodle:2.3.9 + cpe:/a:moodle:moodle:2.2.8 + cpe:/a:moodle:moodle:2.2.9 + cpe:/a:moodle:moodle:2.3.1 + cpe:/a:moodle:moodle:2.1.10 + cpe:/a:moodle:moodle:2.3.4 + cpe:/a:moodle:moodle:2.3.5 + cpe:/a:moodle:moodle:2.3.2 + cpe:/a:moodle:moodle:2.3.3 + cpe:/a:moodle:moodle:2.3.6 + cpe:/a:moodle:moodle:2.2.2 + cpe:/a:moodle:moodle:2.2.1 + cpe:/a:moodle:moodle:2.2.11 + cpe:/a:moodle:moodle:2.2.4 + cpe:/a:moodle:moodle:2.2.3 + cpe:/a:moodle:moodle:2.2.6 + cpe:/a:moodle:moodle:2.2.5 + cpe:/a:moodle:moodle:2.2.7 + cpe:/a:moodle:moodle:2.3 + cpe:/a:moodle:moodle:2.0 + cpe:/a:moodle:moodle:2.4.6 + cpe:/a:moodle:moodle:2.4.7 + cpe:/a:moodle:moodle:2.2 + cpe:/a:moodle:moodle:2.1 + cpe:/a:moodle:moodle:2.1.9 + cpe:/a:moodle:moodle:2.2.10 + cpe:/a:moodle:moodle:2.3.10 + cpe:/a:moodle:moodle:2.4 + cpe:/a:moodle:moodle:2.6 + cpe:/a:moodle:moodle:2.5 + + CVE-2014-0010 + 2014-01-20T10:14:32.347-05:00 + 2014-02-21T00:06:06.627-05:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-22T10:39:27.017-05:00 + + + + + CONFIRM + https://moodle.org/mod/forum/discuss.php?d=252416 + + + CONFIRM + http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-42883 + + + SECTRACK + 1029649 + + + MLIST + [oss-security] 20140120 Moodle security notifications public + + + FEDORA + FEDORA-2014-1396 + + + FEDORA + FEDORA-2014-1377 + + Multiple cross-site request forgery (CSRF) vulnerabilities in user/profile/index.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 allow remote attackers to hijack the authentication of administrators for requests that delete (1) categories or (2) fields. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:haxx:libcurl:7.27.0 + cpe:/a:haxx:curl:7.19.4 + cpe:/a:haxx:curl:7.19.3 + cpe:/a:haxx:curl:7.20.1 + cpe:/a:haxx:curl:7.19.2 + cpe:/a:haxx:curl:7.19.1 + cpe:/a:haxx:curl:7.19.6 + cpe:/a:haxx:curl:7.19.5 + cpe:/a:haxx:curl:7.28.0 + cpe:/a:haxx:curl:7.20.0 + cpe:/a:haxx:libcurl:7.31.0 + cpe:/a:haxx:curl:7.24.0 + cpe:/a:haxx:libcurl:7.19.6 + cpe:/a:haxx:curl:7.21.0 + cpe:/a:haxx:curl:7.21.1 + cpe:/a:haxx:curl:7.21.4 + cpe:/a:haxx:curl:7.23.1 + cpe:/a:haxx:libcurl:7.19.1 + cpe:/a:haxx:libcurl:7.10.6 + cpe:/a:haxx:curl:7.21.5 + cpe:/a:haxx:curl:7.23.0 + cpe:/a:haxx:libcurl:7.19.0 + cpe:/a:haxx:curl:7.21.2 + cpe:/a:haxx:curl:7.21.3 + cpe:/a:haxx:libcurl:7.19.5 + cpe:/a:haxx:libcurl:7.19.4 + cpe:/a:haxx:curl:7.21.6 + cpe:/a:haxx:libcurl:7.19.3 + cpe:/a:haxx:curl:7.21.7 + cpe:/a:haxx:libcurl:7.19.2 + cpe:/a:haxx:curl:7.22.0 + cpe:/a:haxx:libcurl:7.19.7 + cpe:/a:haxx:curl:7.10.6 + cpe:/a:haxx:curl:7.10.7 + cpe:/a:haxx:curl:7.19.0 + cpe:/a:haxx:libcurl:7.34.0 + cpe:/a:haxx:libcurl:7.25.0 + cpe:/a:haxx:curl:7.19.7 + cpe:/a:haxx:libcurl:7.11.2 + cpe:/a:haxx:curl:7.28.1 + cpe:/a:haxx:curl:7.16.4 + cpe:/a:haxx:libcurl:7.11.1 + cpe:/a:haxx:libcurl:7.11.0 + cpe:/a:haxx:libcurl:7.10.7 + cpe:/a:haxx:libcurl:7.33.0 + cpe:/a:haxx:libcurl:7.13.0 + cpe:/a:haxx:libcurl:7.16.4 + cpe:/a:haxx:curl:7.26.0 + cpe:/a:haxx:libcurl:7.13.1 + cpe:/a:haxx:libcurl:7.16.3 + cpe:/a:haxx:libcurl:7.13.2 + cpe:/a:haxx:libcurl:7.16.2 + cpe:/a:haxx:curl:7.31.0 + cpe:/a:haxx:libcurl:7.15.0 + cpe:/a:haxx:libcurl:7.15.1 + cpe:/a:haxx:curl:7.29.0 + cpe:/a:haxx:curl:7.16.2 + cpe:/a:haxx:curl:7.16.3 + cpe:/a:haxx:curl:7.27.0 + cpe:/a:haxx:libcurl:7.20.0 + cpe:/a:haxx:libcurl:7.30.0 + cpe:/a:haxx:libcurl:7.10.8 + cpe:/a:haxx:curl:7.18.2 + cpe:/a:haxx:libcurl:7.15.2 + cpe:/a:haxx:curl:7.15.0 + cpe:/a:haxx:curl:7.15.1 + cpe:/a:haxx:libcurl:7.16.1 + cpe:/a:haxx:curl:7.15.2 + cpe:/a:haxx:curl:7.33.0 + cpe:/a:haxx:libcurl:7.21.1 + cpe:/a:haxx:libcurl:7.17.0 + cpe:/a:haxx:libcurl:7.21.2 + cpe:/a:haxx:libcurl:7.21.0 + cpe:/a:haxx:libcurl:7.21.5 + cpe:/a:haxx:libcurl:7.21.6 + cpe:/a:haxx:curl:7.14.0 + cpe:/a:haxx:libcurl:7.21.3 + cpe:/a:haxx:curl:7.14.1 + cpe:/a:haxx:libcurl:7.21.4 + cpe:/a:haxx:libcurl:7.21.7 + cpe:/a:haxx:libcurl:7.24.0 + cpe:/a:haxx:libcurl:7.28.0 + cpe:/a:haxx:libcurl:7.18.1 + cpe:/a:haxx:libcurl:7.22.0 + cpe:/a:haxx:libcurl:7.18.2 + cpe:/a:haxx:curl:7.32.0 + cpe:/a:haxx:libcurl:7.18.0 + cpe:/a:haxx:curl:7.16.0 + cpe:/a:haxx:curl:7.18.1 + cpe:/a:haxx:curl:7.16.1 + cpe:/a:haxx:curl:7.18.0 + cpe:/a:haxx:libcurl:7.20.1 + cpe:/a:haxx:curl:7.34.0 + cpe:/a:haxx:libcurl:7.26.0 + cpe:/a:haxx:curl:7.17.0 + cpe:/a:haxx:curl:7.11.0 + cpe:/a:haxx:curl:7.15.4 + cpe:/a:haxx:curl:7.15.3 + cpe:/a:haxx:libcurl:7.15.5 + cpe:/a:haxx:curl:7.12.3 + cpe:/a:haxx:libcurl:7.15.4 + cpe:/a:haxx:curl:7.12.2 + cpe:/a:haxx:libcurl:7.15.3 + cpe:/a:haxx:curl:7.12.1 + cpe:/a:haxx:curl:7.12.0 + cpe:/a:haxx:curl:7.13.2 + cpe:/a:haxx:curl:7.13.1 + cpe:/a:haxx:curl:7.30.0 + cpe:/a:haxx:curl:7.13.0 + cpe:/a:haxx:libcurl:7.23.0 + cpe:/a:haxx:libcurl:7.17.1 + cpe:/a:haxx:libcurl:7.32.0 + cpe:/a:haxx:libcurl:7.23.1 + cpe:/a:haxx:curl:7.11.2 + cpe:/a:haxx:curl:7.11.1 + cpe:/a:haxx:libcurl:7.12.0 + cpe:/a:haxx:libcurl:7.12.2 + cpe:/a:haxx:curl:7.25.0 + cpe:/a:haxx:libcurl:7.12.1 + cpe:/a:haxx:libcurl:7.12.3 + cpe:/a:haxx:libcurl:7.14.0 + cpe:/a:haxx:libcurl:7.14.1 + cpe:/a:haxx:curl:7.17.1 + cpe:/a:haxx:curl:7.10.8 + cpe:/a:haxx:libcurl:7.29.0 + cpe:/a:haxx:libcurl:7.16.0 + cpe:/a:haxx:curl:7.15.5 + cpe:/a:haxx:libcurl:7.28.1 + + CVE-2014-0015 + 2014-02-01T19:55:05.317-05:00 + 2014-03-05T23:50:17.690-05:00 + + + 4.0 + NETWORK + HIGH + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-03T14:00:05.230-05:00 + + + + + CONFIRM + http://curl.haxx.se/docs/adv_20140129.html + + + UBUNTU + USN-2097-1 + + + SLACKWARE + SSA:2014-044-01 + + + SECTRACK + 1029710 + + + BID + 65270 + + + DEBIAN + DSA-2849 + + + SECUNIA + 56734 + + + SECUNIA + 56731 + + + SECUNIA + 56728 + + + SUSE + openSUSE-SU-2014:0274 + + + FEDORA + FEDORA-2014-1864 + + + FEDORA + FEDORA-2014-1876 + + cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:stunnel:stunnel:3.8:p3 + cpe:/a:stunnel:stunnel:3.8:p2 + cpe:/a:stunnel:stunnel:4.56 + cpe:/a:stunnel:stunnel:3.8:p1 + cpe:/a:stunnel:stunnel:4.52 + cpe:/a:stunnel:stunnel:4.50 + cpe:/a:stunnel:stunnel:4.51 + cpe:/a:stunnel:stunnel:4.53 + cpe:/a:stunnel:stunnel:4.55 + cpe:/a:stunnel:stunnel:3.8p2 + cpe:/a:stunnel:stunnel:4.54 + cpe:/a:stunnel:stunnel:3.4a + cpe:/a:stunnel:stunnel:3.8p1 + cpe:/a:stunnel:stunnel:3.7 + cpe:/a:stunnel:stunnel:3.6 + cpe:/a:stunnel:stunnel:3.9 + cpe:/a:stunnel:stunnel:3.8 + cpe:/a:stunnel:stunnel:3.2 + cpe:/a:stunnel:stunnel:4.00 + cpe:/a:stunnel:stunnel:3.1 + cpe:/a:stunnel:stunnel:3.0 + cpe:/a:stunnel:stunnel:4.05 + cpe:/a:stunnel:stunnel:4.01 + cpe:/a:stunnel:stunnel:4.02 + cpe:/a:stunnel:stunnel:4.03 + cpe:/a:stunnel:stunnel:4.04 + cpe:/a:stunnel:stunnel:3.3 + cpe:/a:stunnel:stunnel:3.8:p4 + cpe:/a:stunnel:stunnel:3.5 + cpe:/a:stunnel:stunnel:3.14 + cpe:/a:stunnel:stunnel:3.13 + cpe:/a:stunnel:stunnel:3.12 + cpe:/a:stunnel:stunnel:3.11 + cpe:/a:stunnel:stunnel:4.17 + cpe:/a:stunnel:stunnel:4.19 + cpe:/a:stunnel:stunnel:4.18 + cpe:/a:stunnel:stunnel:3.15 + cpe:/a:stunnel:stunnel:4.20 + cpe:/a:stunnel:stunnel:4.22 + cpe:/a:stunnel:stunnel:4.21 + cpe:/a:stunnel:stunnel:4.23 + cpe:/a:stunnel:stunnel:4.24 + cpe:/a:stunnel:stunnel:4.25 + cpe:/a:stunnel:stunnel:4.26 + cpe:/a:stunnel:stunnel:4.27 + cpe:/a:stunnel:stunnel:0.1 + cpe:/a:stunnel:stunnel:3.10 + cpe:/a:stunnel:stunnel:4.10 + cpe:/a:stunnel:stunnel:4.11 + cpe:/a:stunnel:stunnel:4.09 + cpe:/a:stunnel:stunnel:4.07 + cpe:/a:stunnel:stunnel:4.08 + cpe:/a:stunnel:stunnel:4.06 + cpe:/a:stunnel:stunnel:4.0 + cpe:/a:stunnel:stunnel:4.16 + cpe:/a:stunnel:stunnel:4.15 + cpe:/a:stunnel:stunnel:4.14 + cpe:/a:stunnel:stunnel:4.13 + cpe:/a:stunnel:stunnel:4.12 + cpe:/a:stunnel:stunnel:4.42 + cpe:/a:stunnel:stunnel:4.43 + cpe:/a:stunnel:stunnel:4.44 + cpe:/a:stunnel:stunnel:2.0 + cpe:/a:stunnel:stunnel:4.39 + cpe:/a:stunnel:stunnel:2.1 + cpe:/a:stunnel:stunnel:4.41 + cpe:/a:stunnel:stunnel:4.40 + cpe:/a:stunnel:stunnel:4.49 + cpe:/a:stunnel:stunnel:3.21b + cpe:/a:stunnel:stunnel:3.21c + cpe:/a:stunnel:stunnel:4.46 + cpe:/a:stunnel:stunnel:4.45 + cpe:/a:stunnel:stunnel:4.48 + cpe:/a:stunnel:stunnel:4.47 + cpe:/a:stunnel:stunnel:4.32 + cpe:/a:stunnel:stunnel:4.33 + cpe:/a:stunnel:stunnel:4.31 + cpe:/a:stunnel:stunnel:1.1 + cpe:/a:stunnel:stunnel:1.0 + cpe:/a:stunnel:stunnel:1.3 + cpe:/a:stunnel:stunnel:1.2 + cpe:/a:stunnel:stunnel:3.0:b1 + cpe:/a:stunnel:stunnel:4.29 + cpe:/a:stunnel:stunnel:1.4 + cpe:/a:stunnel:stunnel:4.28 + cpe:/a:stunnel:stunnel:3.21a + cpe:/a:stunnel:stunnel:3.0:b3 + cpe:/a:stunnel:stunnel:3.0:b2 + cpe:/a:stunnel:stunnel:3.0:b5 + cpe:/a:stunnel:stunnel:3.0:b4 + cpe:/a:stunnel:stunnel:4.30 + cpe:/a:stunnel:stunnel:4.37 + cpe:/a:stunnel:stunnel:4.36 + cpe:/a:stunnel:stunnel:4.35 + cpe:/a:stunnel:stunnel:4.34 + cpe:/a:stunnel:stunnel:3.8p4 + cpe:/a:stunnel:stunnel:3.0:b7 + cpe:/a:stunnel:stunnel:1.5 + cpe:/a:stunnel:stunnel:3.0:b6 + cpe:/a:stunnel:stunnel:1.6 + cpe:/a:stunnel:stunnel:4.38 + cpe:/a:stunnel:stunnel:3.8p3 + cpe:/a:stunnel:stunnel:3.21 + cpe:/a:stunnel:stunnel:3.20 + cpe:/a:stunnel:stunnel:3.19 + cpe:/a:stunnel:stunnel:3.18 + cpe:/a:stunnel:stunnel:3.17 + cpe:/a:stunnel:stunnel:3.16 + cpe:/a:stunnel:stunnel:3.26 + cpe:/a:stunnel:stunnel:3.24 + cpe:/a:stunnel:stunnel:3.25 + cpe:/a:stunnel:stunnel:3.22 + cpe:/a:stunnel:stunnel:3.23 + + CVE-2014-0016 + 2014-03-24T12:31:08.447-04:00 + 2014-03-24T18:28:07.833-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-03-24T12:51:11.537-04:00 + + + + + CONFIRM + https://www.stunnel.org/sdf_ChangeLog.html + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1072180 + + + MISC + https://bugzilla.redhat.com/attachment.cgi?id=870826&action=diff + + + MLIST + [oss-security] 20140305 libssh and stunnel PRNG flaws + + stunnel before 5.00, when using fork threading, does not properly update the state of the OpenSSL pseudo-random number generator (PRNG), which causes subsequent children with the same process ID to use the same entropy pool and allows remote attackers to obtain private keys for EC (ECDSA) or DSA certificates. + + + + + + + + + + + + + + + + + + + + cpe:/a:libssh:libssh:0.4.8 + cpe:/a:libssh:libssh:0.5.2 + cpe:/a:libssh:libssh:0.4.7 + cpe:/a:libssh:libssh:0.5.3 + cpe:/a:libssh:libssh:0.5.4 + cpe:/a:libssh:libssh:0.5.0:rc1 + cpe:/a:libssh:libssh:0.5.5 + cpe:/a:libssh:libssh:0.6.0 + cpe:/a:libssh:libssh:0.6.2 + cpe:/a:libssh:libssh:0.6.1 + cpe:/a:libssh:libssh:0.5.1 + cpe:/a:libssh:libssh:0.5.0 + + CVE-2014-0017 + 2014-03-14T11:55:05.603-04:00 + 2014-03-26T00:55:45.500-04:00 + + + 1.9 + LOCAL + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-03-17T04:53:07.000-04:00 + + + + + CONFIRM + http://www.libssh.org/2014/03/04/libssh-0-6-3-security-release/ + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1072191 + + + UBUNTU + USN-2145-1 + + + MLIST + [oss-security] 20140305 libssh and stunnel PRNG flaws + + + DEBIAN + DSA-2879 + + + SECUNIA + 57407 + + + SUSE + openSUSE-SU-2014:0370 + + + SUSE + openSUSE-SU-2014:0366 + + The RAND_bytes function in libssh before 0.6.3, when forking is enabled, does not properly reset the state of the OpenSSL pseudo-random number generator (PRNG), which causes the state to be shared between children processes and allows local users to obtain sensitive information by leveraging a pid collision. + + + + + + + + + + cpe:/a:redhat:jboss_enterprise_application_platform:6.2.0 + cpe:/a:redhat:jboss_wildfly_application_server:- + + CVE-2014-0018 + 2014-02-14T10:55:05.343-05:00 + 2014-02-18T10:54:09.897-05:00 + + + 1.9 + LOCAL + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-18T10:54:09.803-05:00 + + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1052783 + + + REDHAT + RHSA-2014:0172 + + + REDHAT + RHSA-2014:0171 + + + REDHAT + RHSA-2014:0170 + + Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.0 and JBoss WildFly Application Server, when run under a security manager, do not properly restrict access to the Modular Service Container (MSC) service registry, which allows local users to modify the server via a crafted deployment. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:dest-unreach:socat:2.0.0:b5 + cpe:/a:dest-unreach:socat:2.0.0:b4 + cpe:/a:dest-unreach:socat:1.3.1.0 + cpe:/a:dest-unreach:socat:2.0.0:b3 + cpe:/a:dest-unreach:socat:2.0.0:b2 + cpe:/a:dest-unreach:socat:1.7.1.0 + cpe:/a:dest-unreach:socat:1.4.1.0 + cpe:/a:dest-unreach:socat:1.3.2.2 + cpe:/a:dest-unreach:socat:1.3.0.0 + cpe:/a:dest-unreach:socat:1.3.0.1 + cpe:/a:dest-unreach:socat:1.4.3.0 + cpe:/a:dest-unreach:socat:1.4.3.1 + cpe:/a:dest-unreach:socat:1.7.0.0 + cpe:/a:dest-unreach:socat:2.0.0:b6 + cpe:/a:dest-unreach:socat:1.7.0.1 + cpe:/a:dest-unreach:socat:1.6.0.1 + cpe:/a:dest-unreach:socat:1.7.1.3 + cpe:/a:dest-unreach:socat:1.7.1.2 + cpe:/a:dest-unreach:socat:2.0.0:b1 + cpe:/a:dest-unreach:socat:1.7.1.1 + cpe:/a:dest-unreach:socat:1.4.0.3 + cpe:/a:dest-unreach:socat:1.4.2.0 + cpe:/a:dest-unreach:socat:1.4.0.1 + cpe:/a:dest-unreach:socat:1.4.0.2 + cpe:/a:dest-unreach:socat:1.4.0.0 + cpe:/a:dest-unreach:socat:1.7.2.0 + cpe:/a:dest-unreach:socat:1.7.2.1 + cpe:/a:dest-unreach:socat:1.6.0.0 + cpe:/a:dest-unreach:socat:1.7.2.2 + cpe:/a:dest-unreach:socat:1.5.0.0 + cpe:/a:dest-unreach:socat:1.3.2.1 + cpe:/a:dest-unreach:socat:1.3.2.0 + + CVE-2014-0019 + 2014-02-04T16:55:05.263-05:00 + 2014-02-21T00:06:07.267-05:00 + + + 1.9 + LOCAL + MEDIUM + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-02-05T10:04:41.587-05:00 + + + + + CONFIRM + http://www.dest-unreach.org/socat + + + MLIST + [oss-security] 20140128 Socat security advisory 5 - PROXY-CONNECT address overflow + + + BID + 65201 + + + MANDRIVA + MDVSA-2014:033 + + + MISC + http://www.dest-unreach.org/socat/contrib/socat-secadv5.txt + + + OSVDB + 102612 + + + FEDORA + FEDORA-2014-1795 + + + FEDORA + FEDORA-2014-1811 + + Stack-based buffer overflow in socat 1.3.0.0 through 1.7.2.2 and 2.0.0-b1 through 2.0.0-b6 allows local users to cause a denial of service (segmentation fault) via a long server name in the PROXY-CONNECT address in the command line. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:pidgin:pidgin:2.7.7 + cpe:/a:pidgin:pidgin:2.7.6 + cpe:/a:pidgin:pidgin:2.7.9 + cpe:/a:pidgin:pidgin:2.5.4 + cpe:/a:pidgin:pidgin:2.7.8 + cpe:/a:pidgin:pidgin:2.7.3 + cpe:/a:pidgin:pidgin:2.7.5 + cpe:/a:pidgin:pidgin:2.7.4 + cpe:/a:pidgin:pidgin:2.6.4 + cpe:/a:pidgin:pidgin:2.4.3 + cpe:/a:pidgin:pidgin:2.6.6 + cpe:/a:pidgin:pidgin:2.4.2 + cpe:/a:pidgin:pidgin:2.6.5 + cpe:/a:pidgin:pidgin:2.4.1 + cpe:/a:pidgin:pidgin:2.5.2 + cpe:/a:pidgin:pidgin:2.4.0 + cpe:/a:pidgin:pidgin:2.5.3 + cpe:/a:pidgin:pidgin:2.5.0 + cpe:/a:pidgin:pidgin:2.5.1 + cpe:/a:pidgin:pidgin:2.2.0 + cpe:/a:pidgin:pidgin:2.2.2 + cpe:/a:pidgin:pidgin:2.2.1 + cpe:/a:pidgin:pidgin:2.10.2 + cpe:/a:pidgin:pidgin:2.10.1 + cpe:/a:pidgin:pidgin:2.10.0 + cpe:/a:pidgin:pidgin:2.3.0 + cpe:/a:pidgin:pidgin:2.3.1 + cpe:/a:pidgin:pidgin:2.7.2 + cpe:/a:pidgin:pidgin:2.7.1 + cpe:/a:pidgin:pidgin:2.7.0 + cpe:/a:pidgin:pidgin:2.6.0 + cpe:/a:pidgin:pidgin:2.6.1 + cpe:/a:pidgin:pidgin:2.6.2 + cpe:/a:pidgin:pidgin:2.8.0 + cpe:/a:pidgin:pidgin:2.7.10 + cpe:/a:pidgin:pidgin:2.5.8 + cpe:/a:pidgin:pidgin:2.5.9 + cpe:/a:pidgin:pidgin:2.6.3 + cpe:/a:pidgin:pidgin:2.5.6 + cpe:/a:pidgin:pidgin:2.5.7 + cpe:/a:pidgin:pidgin:2.9.0 + cpe:/a:pidgin:pidgin:2.7.11 + cpe:/a:pidgin:pidgin:2.5.5 + cpe:/a:pidgin:pidgin:2.0.2 + cpe:/a:pidgin:pidgin:2.1.1 + cpe:/a:pidgin:pidgin:2.0.0 + cpe:/a:pidgin:pidgin:2.10.4 + cpe:/a:pidgin:pidgin:2.10.5 + cpe:/a:pidgin:pidgin:2.0.1 + cpe:/a:pidgin:pidgin:2.10.3 + cpe:/a:pidgin:pidgin:2.10.6 + cpe:/a:pidgin:pidgin:2.10.7 + cpe:/a:pidgin:pidgin:2.1.0 + + CVE-2014-0020 + 2014-02-06T11:10:59.217-05:00 + 2014-03-16T00:43:47.157-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-02-06T16:01:56.473-05:00 + + + + + REDHAT + RHSA-2014:0139 + + + UBUNTU + USN-2100-1 + + + DEBIAN + DSA-2859 + + + CONFIRM + http://pidgin.im/news/security/?id=85 + + + SUSE + openSUSE-SU-2014:0326 + + + SUSE + openSUSE-SU-2014:0239 + + + CONFIRM + http://hg.pidgin.im/pidgin/main/rev/a167504359e5 + + + CONFIRM + http://hg.pidgin.im/pidgin/main/rev/9f132a6855cd + + + CONFIRM + http://hg.pidgin.im/pidgin/main/rev/7d0fb0c6d8d4 + + + CONFIRM + http://hg.pidgin.im/pidgin/main/rev/6b0e0566af20 + + + CONFIRM + http://hg.pidgin.im/pidgin/main/rev/5845d9fa7084 + + + CONFIRM + http://hg.pidgin.im/pidgin/main/rev/4d9be297d399 + + The IRC protocol plugin in libpurple in Pidgin before 2.10.8 does not validate argument counts, which allows remote IRC servers to cause a denial of service (application crash) via a crafted message. + + + + + + + + + + + + cpe:/a:baseurl:yum:3.4.3 + cpe:/a:baseurl:yum:3.4.0 + cpe:/a:baseurl:yum:3.4.1 + cpe:/a:baseurl:yum:3.4.2 + + CVE-2014-0022 + 2014-01-26T11:58:11.197-05:00 + 2014-01-27T12:20:03.367-05:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-27T12:20:03.320-05:00 + + + + + CONFIRM + http://yum.baseurl.org/gitweb?p=yum.git;a=commitdiff;h=9df69e5794 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1057377 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1052440 + + + BID + 65119 + + + SECUNIA + 56637 + + The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly check the return value of the sigCheckPkg function, which allows remote attackers to bypass the RMP package signing restriction via an unsigned package. + + + CVE-2014-0025 + 2014-01-28T18:55:03.547-05:00 + 2014-01-28T18:55:03.657-05:00 + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-1690. Reason: This candidate is a reservation duplicate of CVE-2014-1690. Notes: All CVE users should reference CVE-2014-1690 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. + + + + + + + + + cpe:/a:cmu:flite:1.4 + + CVE-2014-0027 + 2014-01-25T20:55:19.877-05:00 + 2014-02-21T00:06:08.030-05:00 + + + 3.3 + LOCAL + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-27T11:06:43.220-05:00 + + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1048678 + + + BID + 64791 + + + OSVDB + 101948 + + + MANDRIVA + MDVSA-2014:032 + + + MLIST + [oss-security] 20140110 temporary file issue in flite + + + FEDORA + FEDORA-2014-0579 + + + FEDORA + FEDORA-2014-0574 + + The play_wave_from_socket function in audio/auserver.c in Flite 1.4 allows local users to modify arbitrary files via a symlink attack on /tmp/awb.wav. NOTE: some of these details are obtained from third party information. + + + + + + + + + + + + + cpe:/a:redhat:libvirt:1.2.0 + cpe:/a:redhat:libvirt:1.1.4 + cpe:/a:redhat:libvirt:1.1.1 + cpe:/a:redhat:libvirt:1.1.3 + cpe:/a:redhat:libvirt:1.1.2 + + CVE-2014-0028 + 2014-01-24T13:55:04.900-05:00 + 2014-03-05T23:50:18.440-05:00 + + + 4.3 + ADJACENT_NETWORK + MEDIUM + NONE + PARTIAL + NONE + PARTIAL + http://nvd.nist.gov + 2014-01-24T17:16:54.207-05:00 + + + + + MLIST + [libvirt] 20140115 [PATCH 0/4] CVE-2014-0028: domain events vs. ACL filtering + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1048637 + + + UBUNTU + USN-2093-1 + + + SUSE + openSUSE-SU-2014:0268 + + + CONFIRM + http://libvirt.org/news.html + + libvirt 1.1.1 through 1.2.0 allows context-dependent attackers to bypass the domain:getattr and connect:search_domains restrictions in ACLs and obtain sensitive domain object information via a request to the (1) virConnectDomainEventRegister and (2) virConnectDomainEventRegisterAny functions in the event registration API. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apache:cloudstack:3.0.0 + cpe:/a:apache:cloudstack:3.0.2 + cpe:/a:apache:cloudstack:3.0.1 + cpe:/a:apache:cloudstack:2.2.5 + cpe:/a:apache:cloudstack:2.2.9 + cpe:/a:apache:cloudstack:2.2.7 + cpe:/a:apache:cloudstack:2.2.8 + cpe:/a:apache:cloudstack:2.2.6 + cpe:/a:apache:cloudstack:2.2.1 + cpe:/a:apache:cloudstack:2.2.0 + cpe:/a:apache:cloudstack:2.2.3 + cpe:/a:apache:cloudstack:2.2.2 + cpe:/a:apache:cloudstack:2.1.10 + cpe:/a:apache:cloudstack:4.0.1 + cpe:/a:apache:cloudstack:4.0.2 + cpe:/a:apache:cloudstack:2.1.0 + cpe:/a:apache:cloudstack:2.1.4 + cpe:/a:apache:cloudstack:2.2.11 + cpe:/a:apache:cloudstack:2.1.3 + cpe:/a:apache:cloudstack:2.2.12 + cpe:/a:apache:cloudstack:2.1.2 + cpe:/a:apache:cloudstack:2.2.13 + cpe:/a:apache:cloudstack:2.1.1 + cpe:/a:apache:cloudstack:2.0:-:community + cpe:/a:apache:cloudstack:2.2.14 + cpe:/a:apache:cloudstack:2.1.8 + cpe:/a:apache:cloudstack:2.1.7 + cpe:/a:apache:cloudstack:2.1.6 + cpe:/a:apache:cloudstack:4.2.0 + cpe:/a:apache:cloudstack:2.1.5 + cpe:/a:apache:cloudstack:2.1.9 + cpe:/a:apache:cloudstack:2.0.1 + cpe:/a:apache:cloudstack:4.1.0 + cpe:/a:apache:cloudstack:4.0.0:incubating + cpe:/a:apache:cloudstack:4.1.1 + + CVE-2014-0031 + 2014-01-15T11:08:04.093-05:00 + 2014-02-25T07:38:36.640-05:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-15T13:09:30.463-05:00 + + + + + CONFIRM + https://issues.apache.org/jira/browse/CLOUDSTACK-5145 + + + CONFIRM + https://blogs.apache.org/cloudstack/entry/cve_2014_0031_cloudstack_listnetworkacl + + + SECUNIA + 55960 + + The (1) ListNetworkACL and (2) listNetworkACLLists APIs in Apache CloudStack before 4.2.1 allow remote authenticated users to list network ACLS for other users via a crafted request. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apache:subversion:1.7.14 + cpe:/a:apache:subversion:1.7.13 + cpe:/a:apache:subversion:1.7.12 + cpe:/a:apache:subversion:1.8.4 + cpe:/a:apache:subversion:1.8.5 + cpe:/a:apache:subversion:1.7.11 + cpe:/a:apache:subversion:1.7.3 + cpe:/a:apache:subversion:1.7.10 + cpe:/a:apache:subversion:1.7.2 + cpe:/a:apache:subversion:1.8.3 + cpe:/a:apache:subversion:1.7.1 + cpe:/a:apache:subversion:1.7.4 + cpe:/a:apache:subversion:1.7.0 + cpe:/a:apache:subversion:1.7.8 + cpe:/a:apache:subversion:1.7.7 + cpe:/a:apache:subversion:1.7.6 + cpe:/a:apache:subversion:1.7.5 + cpe:/a:apache:subversion:1.8.1 + cpe:/a:apache:subversion:1.8.0 + cpe:/a:apache:subversion:1.7.9 + cpe:/a:apache:subversion:1.8.2 + + CVE-2014-0032 + 2014-02-14T10:55:05.907-05:00 + 2014-03-16T00:43:47.830-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-02-18T11:00:47.830-05:00 + + + + + CONFIRM + http://svn.apache.org/viewvc?view=revision&revision=1557320 + + + XF + apache-subversion-cve20140032-dos(90986) + + + BID + 65434 + + + OSVDB + 102927 + + + CONFIRM + http://svn.apache.org/repos/asf/subversion/tags/1.8.6/CHANGES + + + CONFIRM + http://svn.apache.org/repos/asf/subversion/tags/1.7.15/CHANGES + + + SECUNIA + 56822 + + + REDHAT + RHSA-2014:0255 + + + MLIST + [subversion-dev] 20140110 Sin mod_dav_svn with repositories on / + + + MLIST + [subversion-dev] 20140110 Re: Segfault in mod_dav_svn with repositories on / + + + MLIST + [subversion-dev] 20140110 2 Re: Segfault in mod_dav_svn with repositories on / + + + SUSE + openSUSE-SU-2014:0334 + + + SUSE + openSUSE-SU-2014:0307 + + The get_resource function in repos.c in the mod_dav_svn module in Apache Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service (crash) via vectors related to the server root and request methods other than GET, as demonstrated by the "svn ls http://svn.example.com" command. + + + + + + + + + + + + + cpe:/a:apache:tomcat:6.0.34 + cpe:/a:apache:tomcat:6.0.33 + cpe:/a:apache:tomcat:6.0.35 + cpe:/a:apache:tomcat:6.0.36 + cpe:/a:apache:tomcat:6.0.37 + + CVE-2014-0033 + 2014-02-26T09:55:08.537-05:00 + 2014-02-26T14:29:45.393-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-02-26T14:29:45.207-05:00 + + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1069919 + + + CONFIRM + http://tomcat.apache.org/security-6.html + + + CONFIRM + http://svn.apache.org/viewvc?view=revision&revision=1558822 + + org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:amos_benari:rbovirt:0.0.19::~~~ruby~~ + cpe:/a:amos_benari:rbovirt:0.0.20::~~~ruby~~ + cpe:/a:amos_benari:rbovirt:0.0.21::~~~ruby~~ + cpe:/a:amos_benari:rbovirt:0.0.8::~~~ruby~~ + cpe:/a:amos_benari:rbovirt:0.0.9::~~~ruby~~ + cpe:/a:amos_benari:rbovirt:0.0.10::~~~ruby~~ + cpe:/a:amos_benari:rbovirt:0.0.6::~~~ruby~~ + cpe:/a:amos_benari:rbovirt:0.0.11::~~~ruby~~ + cpe:/a:amos_benari:rbovirt:0.0.7::~~~ruby~~ + cpe:/a:amos_benari:rbovirt:0.0.12::~~~ruby~~ + cpe:/a:amos_benari:rbovirt:0.0.4::~~~ruby~~ + cpe:/a:amos_benari:rbovirt:0.0.22::~~~ruby~~ + cpe:/a:amos_benari:rbovirt:0.0.13::~~~ruby~~ + cpe:/a:amos_benari:rbovirt:0.0.5::~~~ruby~~ + cpe:/a:amos_benari:rbovirt:0.0.23::~~~ruby~~ + cpe:/a:amos_benari:rbovirt:0.0.14::~~~ruby~~ + cpe:/a:amos_benari:rbovirt:0.0.17::~~~ruby~~ + cpe:/a:amos_benari:rbovirt:0.0.18::~~~ruby~~ + cpe:/a:amos_benari:rbovirt:0.0.15::~~~ruby~~ + cpe:/a:amos_benari:rbovirt:0.0.16::~~~ruby~~ + cpe:/a:amos_benari:rbovirt:0.0.3::~~~ruby~~ + cpe:/a:amos_benari:rbovirt:0.0.2::~~~ruby~~ + cpe:/a:amos_benari:rbovirt:0.0.1::~~~ruby~~ + + CVE-2014-0036 + 2014-04-17T10:55:06.230-04:00 + 2014-04-18T09:48:54.390-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-18T09:48:54.233-04:00 + + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1058595 + + + MLIST + [oss-security] 20140306 CVE-2014-0036 rubygem-rbovirt: unsafe use of rest-client + + + FEDORA + FEDORA-2014-3526 + + + FEDORA + FEDORA-2014-3573 + + The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:zarafa:zarafa:7.0 + cpe:/a:zarafa:zarafa:6.30.8 + cpe:/a:zarafa:zarafa:6.30.6 + cpe:/a:zarafa:zarafa:6.30.7 + cpe:/a:zarafa:zarafa:7.0.8 + cpe:/a:zarafa:zarafa:6.30.4 + cpe:/a:zarafa:zarafa:7.0.9 + cpe:/a:zarafa:zarafa:6.30.5 + cpe:/a:zarafa:zarafa:7.0.6 + cpe:/a:zarafa:zarafa:7.0.7 + cpe:/a:zarafa:zarafa:6.30.3 + cpe:/a:zarafa:zarafa:7.0.5 + cpe:/a:zarafa:zarafa:6.20.7 + cpe:/a:zarafa:zarafa:6.20.2 + cpe:/a:zarafa:zarafa:6.20.6 + cpe:/a:zarafa:zarafa:6.20.5 + cpe:/a:zarafa:zarafa:6.20.3 + cpe:/a:zarafa:zarafa:6.30.0 + cpe:/a:zarafa:zarafa:6.40.17 + cpe:/a:zarafa:zarafa:7.1.4 + cpe:/a:zarafa:zarafa:7.0.13 + cpe:/a:zarafa:zarafa:5.20 + cpe:/a:zarafa:zarafa:6.30.16 + cpe:/a:zarafa:zarafa:6.00 + cpe:/a:zarafa:zarafa:6.30.13 + cpe:/a:zarafa:zarafa:6.01 + cpe:/a:zarafa:zarafa:6.02 + cpe:/a:zarafa:zarafa:6.30.11 + cpe:/a:zarafa:zarafa:7.0.10 + cpe:/a:zarafa:zarafa:6.03 + cpe:/a:zarafa:zarafa:7.0.12 + cpe:/a:zarafa:zarafa:6.30.10 + cpe:/a:zarafa:zarafa:7.0.11 + cpe:/a:zarafa:zarafa:6.30.17 + cpe:/a:zarafa:zarafa:5.22 + cpe:/a:zarafa:zarafa:5.10 + cpe:/a:zarafa:zarafa:5.11 + cpe:/a:zarafa:zarafa:6.20.11 + cpe:/a:zarafa:zarafa:6.20.12 + cpe:/a:zarafa:zarafa:6.10 + cpe:/a:zarafa:zarafa:7.0.3 + cpe:/a:zarafa:zarafa:7.0.2 + cpe:/a:zarafa:zarafa:6.20.10 + cpe:/a:zarafa:zarafa:7.0.1 + cpe:/a:zarafa:zarafa:6.30.9 + cpe:/a:zarafa:zarafa:6.11 + cpe:/a:zarafa:zarafa:7.0.4 + cpe:/a:zarafa:zarafa:5.00 + cpe:/a:zarafa:zarafa:6.40.5 + cpe:/a:zarafa:zarafa:6.40.6 + cpe:/a:zarafa:zarafa:5.01 + cpe:/a:zarafa:zarafa:6.40.7 + cpe:/a:zarafa:zarafa:6.40.8 + cpe:/a:zarafa:zarafa:6.40.2 + cpe:/a:zarafa:zarafa:6.40.3 + cpe:/a:zarafa:zarafa:5.02 + cpe:/a:zarafa:zarafa:6.40.4 + cpe:/a:zarafa:zarafa:6.40.0 + cpe:/a:zarafa:zarafa:6.40.9 + cpe:/a:zarafa:zarafa:6.40.12 + cpe:/a:zarafa:zarafa:6.40.13 + cpe:/a:zarafa:zarafa:6.40.14 + cpe:/a:zarafa:zarafa:6.40.15 + cpe:/a:zarafa:zarafa:6.40.10 + cpe:/a:zarafa:zarafa:7.1.3 + cpe:/a:zarafa:zarafa:6.40.11 + cpe:/a:zarafa:zarafa:7.1.1 + cpe:/a:zarafa:zarafa:7.1.2 + cpe:/a:zarafa:zarafa:7.1.0 + cpe:/a:zarafa:zarafa:6.20 + cpe:/a:zarafa:zarafa:6.40.16 + + CVE-2014-0037 + 2014-04-28T10:09:06.080-04:00 + 2014-04-29T07:35:51.057-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-29T07:35:50.760-04:00 + + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1059903 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1056767 + + + MLIST + [oss-security] 20140131 Security Flaw CVE-2014-0037 + + + MANDRIVA + MDVSA-2014:044 + + The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 5.00 before 7.1.8 beta2 allows remote attackers to cause a denial of service (crash) via vectors related to "a NULL pointer of the username." + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:linux:linux_kernel:3.0.48 + cpe:/o:linux:linux_kernel:3.0.49 + cpe:/o:linux:linux_kernel:3.0.46 + cpe:/o:linux:linux_kernel:3.0.47 + cpe:/o:linux:linux_kernel:3.0.44 + cpe:/o:linux:linux_kernel:3.0.45 + cpe:/o:linux:linux_kernel:3.0.42 + cpe:/o:linux:linux_kernel:3.0.40 + cpe:/o:linux:linux_kernel:3.0.41 + cpe:/o:linux:linux_kernel:3.0.59 + cpe:/o:linux:linux_kernel:3.0.55 + cpe:/o:linux:linux_kernel:3.0.56 + cpe:/o:linux:linux_kernel:3.0.57 + cpe:/o:linux:linux_kernel:3.0.58 + cpe:/o:linux:linux_kernel:3.0.51 + cpe:/o:linux:linux_kernel:3.0.52 + cpe:/o:linux:linux_kernel:3.0.53 + cpe:/o:linux:linux_kernel:3.11.10 + cpe:/o:linux:linux_kernel:3.0.50 + cpe:/o:linux:linux_kernel:3.0.43 + cpe:/o:linux:linux_kernel:3.10.26 + cpe:/o:linux:linux_kernel:3.0.24 + cpe:/o:linux:linux_kernel:3.0.25 + cpe:/o:linux:linux_kernel:3.0.22 + cpe:/o:linux:linux_kernel:3.1.9 + cpe:/o:linux:linux_kernel:3.0.23 + cpe:/o:linux:linux_kernel:3.10.28 + cpe:/o:linux:linux_kernel:3.0.28 + cpe:/o:linux:linux_kernel:3.10.27 + cpe:/o:linux:linux_kernel:3.0.26 + cpe:/o:linux:linux_kernel:3.10.29 + cpe:/o:linux:linux_kernel:3.0.27 + cpe:/o:linux:linux_kernel:3.10.24 + cpe:/o:linux:linux_kernel:3.10.23 + cpe:/o:linux:linux_kernel:3.10.25 + cpe:/o:linux:linux_kernel:3.10.20 + cpe:/o:linux:linux_kernel:3.1.8 + cpe:/o:linux:linux_kernel:3.0.20 + cpe:/o:linux:linux_kernel:3.10.22 + cpe:/o:linux:linux_kernel:3.10.21 + cpe:/o:linux:linux_kernel:3.4.21 + cpe:/o:linux:linux_kernel:3.4.20 + cpe:/o:linux:linux_kernel:3.4.23 + cpe:/o:linux:linux_kernel:3.4.22 + cpe:/o:linux:linux_kernel:3.4.24 + cpe:/o:linux:linux_kernel:3.4.27 + cpe:/o:linux:linux_kernel:3.4.26 + cpe:/o:linux:linux_kernel:3.4.29 + cpe:/o:linux:linux_kernel:3.10.15 + cpe:/o:linux:linux_kernel:3.4.28 + cpe:/o:linux:linux_kernel:3.0.54 + cpe:/o:linux:linux_kernel:3.0.33 + cpe:/o:linux:linux_kernel:3.0.34 + cpe:/o:linux:linux_kernel:3.0.35 + cpe:/o:linux:linux_kernel:3.0.36 + cpe:/o:linux:linux_kernel:3.10.19 + cpe:/o:linux:linux_kernel:3.0.37 + cpe:/o:linux:linux_kernel:3.10.18 + cpe:/o:linux:linux_kernel:3.0.38 + cpe:/o:linux:linux_kernel:3.4.25 + cpe:/o:linux:linux_kernel:3.10.17 + cpe:/o:linux:linux_kernel:3.0.39 + cpe:/o:linux:linux_kernel:3.10.16 + cpe:/o:linux:linux_kernel:3.10.14 + cpe:/o:linux:linux_kernel:3.10.13 + cpe:/o:linux:linux_kernel:3.10.12 + cpe:/o:linux:linux_kernel:3.10.11 + cpe:/o:linux:linux_kernel:3.10.10 + cpe:/o:linux:linux_kernel:3.0.30 + cpe:/o:linux:linux_kernel:3.0.31 + cpe:/o:linux:linux_kernel:3.9.8 + cpe:/o:linux:linux_kernel:3.4.32 + cpe:/o:linux:linux_kernel:3.5.5 + cpe:/o:linux:linux_kernel:3.9.9 + cpe:/o:linux:linux_kernel:3.4.31 + cpe:/o:linux:linux_kernel:3.5.6 + cpe:/o:linux:linux_kernel:3.4.30 + cpe:/o:linux:linux_kernel:3.5.7 + cpe:/o:linux:linux_kernel:3.7.1 + cpe:/o:linux:linux_kernel:3.9.0 + cpe:/o:linux:linux_kernel:3.0.18 + cpe:/o:linux:linux_kernel:3.9.2 + cpe:/o:linux:linux_kernel:3.9.1 + cpe:/o:linux:linux_kernel:3.0.19 + cpe:/o:linux:linux_kernel:3.9.4 + cpe:/o:linux:linux_kernel:3.9.3 + cpe:/o:linux:linux_kernel:3.9.6 + cpe:/o:linux:linux_kernel:3.9.5 + cpe:/o:linux:linux_kernel:3.0.21 + cpe:/o:linux:linux_kernel:3.9.7 + cpe:/o:linux:linux_kernel:3.5.4 + cpe:/o:linux:linux_kernel:3.0.4 + cpe:/o:linux:linux_kernel:3.0.5 + cpe:/o:linux:linux_kernel:3.0.2 + cpe:/o:linux:linux_kernel:3.0.3 + cpe:/o:linux:linux_kernel:3.0.8 + cpe:/o:linux:linux_kernel:3.0.6 + cpe:/o:linux:linux_kernel:3.0.7 + cpe:/o:linux:linux_kernel:3.13.1 + cpe:/o:linux:linux_kernel:3.6.10 + cpe:/o:linux:linux_kernel:3.6.11 + cpe:/o:linux:linux_kernel:3.4.1 + cpe:/o:linux:linux_kernel:3.4.19 + cpe:/o:linux:linux_kernel:3.4.17 + cpe:/o:linux:linux_kernel:3.4.3 + cpe:/o:linux:linux_kernel:3.4.18 + cpe:/o:linux:linux_kernel:3.4.2 + cpe:/o:linux:linux_kernel:3.2.9 + cpe:/o:linux:linux_kernel:3.4.15 + cpe:/o:linux:linux_kernel:3.2.8 + cpe:/o:linux:linux_kernel:3.4.16 + cpe:/o:linux:linux_kernel:3.4.4 + cpe:/o:linux:linux_kernel:3.2.7 + cpe:/o:linux:linux_kernel:3.4.13 + cpe:/o:linux:linux_kernel:3.12.10 + cpe:/o:linux:linux_kernel:3.4.11 + cpe:/o:linux:linux_kernel:3.4.12 + cpe:/o:linux:linux_kernel:3.4.10 + cpe:/o:linux:linux_kernel:3.0.61 + cpe:/o:linux:linux_kernel:3.3:rc2 + cpe:/o:linux:linux_kernel:3.4:rc7 + cpe:/o:linux:linux_kernel:3.0.60 + cpe:/o:linux:linux_kernel:3.3:rc7 + cpe:/o:linux:linux_kernel:3.4:rc5 + cpe:/o:linux:linux_kernel:3.3:rc5 + cpe:/o:linux:linux_kernel:3.4:rc6 + cpe:/o:linux:linux_kernel:3.3:rc6 + cpe:/o:linux:linux_kernel:3.0.64 + cpe:/o:linux:linux_kernel:3.0.63 + cpe:/o:linux:linux_kernel:3.0.62 + cpe:/o:linux:linux_kernel:3.12.1 + cpe:/o:linux:linux_kernel:3.0.68 + cpe:/o:linux:linux_kernel:3.0.67 + cpe:/o:linux:linux_kernel:3.0.66 + cpe:/o:linux:linux_kernel:3.4.14 + cpe:/o:linux:linux_kernel:3.12.7 + cpe:/o:linux:linux_kernel:3.2:rc2 + cpe:/o:linux:linux_kernel:3.1:rc1 + cpe:/o:linux:linux_kernel:3.0.9 + cpe:/o:linux:linux_kernel:3.0:rc4 + cpe:/o:linux:linux_kernel:3.12.8 + cpe:/o:linux:linux_kernel:3.1:rc4 + cpe:/o:linux:linux_kernel:3.0:rc3 + cpe:/o:linux:linux_kernel:3.12.9 + cpe:/o:linux:linux_kernel:3.0:rc2 + cpe:/o:linux:linux_kernel:3.1:rc2 + cpe:/o:linux:linux_kernel:3.0:rc1 + cpe:/o:linux:linux_kernel:3.2:rc7 + cpe:/o:linux:linux_kernel:3.12.3 + cpe:/o:linux:linux_kernel:3.2:rc6 + cpe:/o:linux:linux_kernel:3.1.10 + cpe:/o:linux:linux_kernel:3.12.4 + cpe:/o:linux:linux_kernel:3.2:rc5 + cpe:/o:linux:linux_kernel:3.0:rc7 + cpe:/o:linux:linux_kernel:3.12.5 + cpe:/o:linux:linux_kernel:3.9:rc3 + cpe:/o:linux:linux_kernel:3.0:rc6 + cpe:/o:linux:linux_kernel:3.12.6 + cpe:/o:linux:linux_kernel:3.0:rc5 + cpe:/o:linux:linux_kernel:3.9:rc1 + cpe:/o:linux:linux_kernel:3.9:rc4 + cpe:/o:linux:linux_kernel:3.9:rc7 + cpe:/o:linux:linux_kernel:3.12.2 + cpe:/o:linux:linux_kernel:3.9:rc2 + cpe:/o:linux:linux_kernel:3.9:rc5 + cpe:/o:linux:linux_kernel:3.3:rc3 + cpe:/o:linux:linux_kernel:3.4:rc4 + cpe:/o:linux:linux_kernel:3.4:rc3 + cpe:/o:linux:linux_kernel:3.3:rc1 + cpe:/o:linux:linux_kernel:3.4:rc2 + cpe:/o:linux:linux_kernel:3.9:rc6 + cpe:/o:linux:linux_kernel:3.3:rc4 + cpe:/o:linux:linux_kernel:3.4:rc1 + cpe:/o:linux:linux_kernel:3.4.5 + cpe:/o:linux:linux_kernel:3.2.2 + cpe:/o:linux:linux_kernel:3.2.3 + cpe:/o:linux:linux_kernel:3.2.1 + cpe:/o:linux:linux_kernel:3.2:rc3 + cpe:/o:linux:linux_kernel:3.2.6 + cpe:/o:linux:linux_kernel:3.4.6 + cpe:/o:linux:linux_kernel:3.2:rc4 + cpe:/o:linux:linux_kernel:3.1:rc3 + cpe:/o:linux:linux_kernel:3.4.7 + cpe:/o:linux:linux_kernel:3.2.4 + cpe:/o:linux:linux_kernel:3.4.8 + cpe:/o:linux:linux_kernel:3.2.5 + cpe:/o:linux:linux_kernel:3.4.9 + cpe:/o:linux:linux_kernel:3.0.65 + cpe:/o:linux:linux_kernel:3.2.12 + cpe:/o:linux:linux_kernel:3.8.10 + cpe:/o:linux:linux_kernel:3.8.12 + cpe:/o:linux:linux_kernel:3.8.11 + cpe:/o:linux:linux_kernel:3.8.13 + cpe:/o:linux:linux_kernel:3.7.9 + cpe:/o:linux:linux_kernel:3.7.8 + cpe:/o:linux:linux_kernel:3.7.7 + cpe:/o:linux:linux_kernel:3.7.6 + cpe:/o:linux:linux_kernel:3.6.3 + cpe:/o:linux:linux_kernel:3.7.5 + cpe:/o:linux:linux_kernel:3.7.4 + cpe:/o:linux:linux_kernel:3.7.3 + cpe:/o:linux:linux_kernel:3.7.2 + cpe:/o:linux:linux_kernel:3.6.7 + cpe:/o:linux:linux_kernel:3.6.6 + cpe:/o:linux:linux_kernel:3.6.5 + cpe:/o:linux:linux_kernel:3.6.4 + cpe:/o:linux:linux_kernel:3.6.9 + cpe:/o:linux:linux_kernel:3.6.8 + cpe:/o:linux:linux_kernel:3.10 + cpe:/o:linux:linux_kernel:3.11 + cpe:/o:linux:linux_kernel:3.12 + cpe:/o:linux:linux_kernel:3.13 + cpe:/o:linux:linux_kernel:3.10.1 + cpe:/o:linux:linux_kernel:3.10.2 + cpe:/o:linux:linux_kernel:3.10.3 + cpe:/o:linux:linux_kernel:3.6.2 + cpe:/o:linux:linux_kernel:3.6.1 + cpe:/o:linux:linux_kernel:3.3.6 + cpe:/o:linux:linux_kernel:3.3.7 + cpe:/o:linux:linux_kernel:3.3.8 + cpe:/o:linux:linux_kernel:3.0.1 + cpe:/o:linux:linux_kernel:3.2 + cpe:/o:linux:linux_kernel:3.1 + cpe:/o:linux:linux_kernel:3.7 + cpe:/o:linux:linux_kernel:3.6 + cpe:/o:linux:linux_kernel:3.4 + cpe:/o:linux:linux_kernel:3.1.6 + cpe:/o:linux:linux_kernel:3.1.5 + cpe:/o:linux:linux_kernel:3.1.7 + cpe:/o:linux:linux_kernel:3.0.32 + cpe:/o:linux:linux_kernel:3.8.9 + cpe:/o:linux:linux_kernel:3.1.2 + cpe:/o:linux:linux_kernel:3.1.1 + cpe:/o:linux:linux_kernel:3.1.4 + cpe:/o:linux:linux_kernel:3.1.3 + cpe:/o:linux:linux_kernel:3.9.10 + cpe:/o:linux:linux_kernel:3.0.29 + cpe:/o:linux:linux_kernel:3.3 + cpe:/o:linux:linux_kernel:3.8.4 + cpe:/o:linux:linux_kernel:3.2.26 + cpe:/o:linux:linux_kernel:3.8.5 + cpe:/o:linux:linux_kernel:3.2.27 + cpe:/o:linux:linux_kernel:3.8.2 + cpe:/o:linux:linux_kernel:3.2.24 + cpe:/o:linux:linux_kernel:3.8.3 + cpe:/o:linux:linux_kernel:3.2.25 + cpe:/o:linux:linux_kernel:3.8.8 + cpe:/o:linux:linux_kernel:3.8.6 + cpe:/o:linux:linux_kernel:3.2.28 + cpe:/o:linux:linux_kernel:3.8.7 + cpe:/o:linux:linux_kernel:3.2.29 + cpe:/o:linux:linux_kernel:3.3.3 + cpe:/o:linux:linux_kernel:3.3.4 + cpe:/o:linux:linux_kernel:3.3.5 + cpe:/o:linux:linux_kernel:3.2.22 + cpe:/o:linux:linux_kernel:3.8.1 + cpe:/o:linux:linux_kernel:3.2.20 + cpe:/o:linux:linux_kernel:3.3.1 + cpe:/o:linux:linux_kernel:3.2.21 + cpe:/o:linux:linux_kernel:3.3.2 + cpe:/o:linux:linux_kernel:3.11.1 + cpe:/o:linux:linux_kernel:3.11.2 + cpe:/o:linux:linux_kernel:3.2.23 + cpe:/o:linux:linux_kernel:3.0.17 + cpe:/o:linux:linux_kernel:3.9.11 + cpe:/o:linux:linux_kernel:3.0.16 + cpe:/o:linux:linux_kernel:3.0.15 + cpe:/o:linux:linux_kernel:3.2.30 + cpe:/o:linux:linux_kernel:3.0.14 + cpe:/o:linux:linux_kernel:3.0.13 + cpe:/o:linux:linux_kernel:3.0.12 + cpe:/o:linux:linux_kernel:3.0.11 + cpe:/o:linux:linux_kernel:3.0.10 + cpe:/o:linux:linux_kernel:3.8.0 + cpe:/o:linux:linux_kernel:3.5.3 + cpe:/o:linux:linux_kernel:3.5.1 + cpe:/o:linux:linux_kernel:3.5.2 + cpe:/o:linux:linux_kernel:3.10.4 + cpe:/o:linux:linux_kernel:3.10.9 + cpe:/o:linux:linux_kernel:3.10.5 + cpe:/o:linux:linux_kernel:3.10.6 + cpe:/o:linux:linux_kernel:3.10.7 + cpe:/o:linux:linux_kernel:3.10.8 + cpe:/o:linux:linux_kernel:3.7.10 + cpe:/o:linux:linux_kernel:3.2.17 + cpe:/o:linux:linux_kernel:3.2.18 + cpe:/o:linux:linux_kernel:3.2.19 + cpe:/o:linux:linux_kernel:3.2.13 + cpe:/o:linux:linux_kernel:3.2.14 + cpe:/o:linux:linux_kernel:3.11.3 + cpe:/o:linux:linux_kernel:3.2.15 + cpe:/o:linux:linux_kernel:3.2.16 + cpe:/o:linux:linux_kernel:3.11.5 + cpe:/o:linux:linux_kernel:3.11.4 + cpe:/o:linux:linux_kernel:3.2.10 + cpe:/o:linux:linux_kernel:3.11.7 + cpe:/o:linux:linux_kernel:3.2.11 + cpe:/o:linux:linux_kernel:3.11.6 + cpe:/o:linux:linux_kernel:3.11.9 + cpe:/o:linux:linux_kernel:3.11.8 + + CVE-2014-0038 + 2014-02-06T17:55:03.327-05:00 + 2014-03-05T23:50:18.923-05:00 + + + 6.9 + LOCAL + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-07T11:05:35.337-05:00 + + + + + CONFIRM + https://github.com/torvalds/linux/commit/2def2ef2ae5f3990aabdbe8a755911902707d268 + + + CONFIRM + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2def2ef2ae5f3990aabdbe8a755911902707d268 + + + MISC + https://github.com/saelo/cve-2014-0038 + + + MISC + https://code.google.com/p/chromium/issues/detail?id=338594 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1060023 + + + UBUNTU + USN-2096-1 + + + UBUNTU + USN-2095-1 + + + UBUNTU + USN-2094-1 + + + MLIST + [oss-security] 20140131 Linux 3.4+: arbitrary write with CONFIG_X86_X32 (CVE-2014-0038) + + + MANDRIVA + MDVSA-2014:038 + + + CONFIRM + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.2 + + + EXPLOIT-DB + 31347 + + + EXPLOIT-DB + 31346 + + + MISC + http://pastebin.com/raw.php?i=DH3Lbg54 + + + SUSE + openSUSE-SU-2014:0205 + + + SUSE + openSUSE-SU-2014:0204 + + The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cipherdyne:fwsnort:0.8.0 + cpe:/a:cipherdyne:fwsnort:0.5 + cpe:/a:cipherdyne:fwsnort:0.8.2 + cpe:/a:cipherdyne:fwsnort:1.0.2 + cpe:/a:cipherdyne:fwsnort:0.8.1 + cpe:/a:cipherdyne:fwsnort:1.0.1 + cpe:/a:cipherdyne:fwsnort:1.0.6 + cpe:/a:cipherdyne:fwsnort:0.6.2 + cpe:/a:cipherdyne:fwsnort:1.0.4 + cpe:/a:cipherdyne:fwsnort:0.6.1 + cpe:/a:cipherdyne:fwsnort:1.0.5 + cpe:/a:cipherdyne:fwsnort:0.6.4 + cpe:/a:cipherdyne:fwsnort:0.7.0 + cpe:/a:cipherdyne:fwsnort:0.6.3 + cpe:/a:cipherdyne:fwsnort:1.5 + cpe:/a:cipherdyne:fwsnort:0.6.5 + cpe:/a:cipherdyne:fwsnort:1.6 + cpe:/a:cipherdyne:fwsnort:1.6.4 + cpe:/a:cipherdyne:fwsnort:1.6.3 + cpe:/a:cipherdyne:fwsnort:0.6 + cpe:/a:cipherdyne:fwsnort:0.9.0 + cpe:/a:cipherdyne:fwsnort:1.6.2 + cpe:/a:cipherdyne:fwsnort:1.6.1 + cpe:/a:cipherdyne:fwsnort:1.0.3 + cpe:/a:cipherdyne:fwsnort:1.0 + + CVE-2014-0039 + 2014-02-07T19:55:06.113-05:00 + 2014-02-21T00:06:09.170-05:00 + + + 4.4 + LOCAL + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-10T10:52:01.240-05:00 + + + + CONFIRM + https://github.com/mrash/fwsnort/commit/fa977453120cc48e1654f373311f9cac468d3348 + + + CONFIRM + https://github.com/mrash/fwsnort/blob/master/ChangeLog + + + BID + 65341 + + + MLIST + [oss-security] 20140203 CVE-2014-0039: fwsnort loaded configuration file from cwd when run as a non-root user + + + OSVDB + 102822 + + + FEDORA + FEDORA-2014-1972 + + + FEDORA + FEDORA-2014-1975 + + Untrusted search path vulnerability in fwsnort before 1.6.4, when not running as root, allows local users to execute arbitrary code via a Trojan horse fwsnort.conf in the current working directory. + + + + + + + + + + + + cpe:/a:light_speed_gaming:mumble:1.2.4 + cpe:/a:light_speed_gaming:mumble:1.2.3:rc2 + cpe:/a:light_speed_gaming:mumble:1.2.3:rc1 + cpe:/a:light_speed_gaming:mumble:1.2.3:rc3 + + CVE-2014-0044 + 2014-02-07T19:55:06.160-05:00 + 2014-03-05T23:50:19.097-05:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-02-10T05:50:21.000-05:00 + + + + + DEBIAN + DSA-2854 + + + OSVDB + 102904 + + + CONFIRM + http://mumble.info/security/Mumble-SA-2014-001.txt + + + SUSE + openSUSE-SU-2014:0271 + + The opus_packet_get_samples_per_frame function in client in Mumble 1.2.4 and the 1.2.3 pre-release snapshots allows remote attackers to cause a denial of service (crash) via a crafted length prefix value, which triggers a NULL pointer dereference or a heap-based buffer over-read (aka "out-of-bounds array access"). + + + + + + + + + + + + + + + + + + + cpe:/a:light_speed_gaming:mumblekit:- + cpe:/a:light_speed_gaming:mumble:1.2.1::~~~iphone_os~~ + cpe:/a:light_speed_gaming:mumble:1.1:rc1:~~~iphone_os~~ + cpe:/a:light_speed_gaming:mumble:1.2.2::~~~iphone_os~~ + cpe:/a:light_speed_gaming:mumble:1.2.4 + cpe:/a:light_speed_gaming:mumble:1.2.3:rc2 + cpe:/a:light_speed_gaming:mumble:1.1.1::~~~iphone_os~~ + cpe:/a:light_speed_gaming:mumble:1.2.3:rc1 + cpe:/a:light_speed_gaming:mumble:1.2.3:rc3 + cpe:/a:light_speed_gaming:mumble:1.1::~~~iphone_os~~ + cpe:/a:light_speed_gaming:mumble:1.2::~~~iphone_os~~ + + CVE-2014-0045 + 2014-02-07T19:55:06.177-05:00 + 2014-03-05T23:50:19.173-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-10T11:33:20.393-05:00 + + + + + DEBIAN + DSA-2854 + + + OSVDB + 102958 + + + OSVDB + 102905 + + + CONFIRM + http://mumble.info/security/Mumble-SA-2014-004.txt + + + CONFIRM + http://mumble.info/security/Mumble-SA-2014-002.txt + + + SUSE + openSUSE-SU-2014:0271 + + The needSamples method in AudioOutputSpeech.cpp in the client in Mumble 1.2.4 and the 1.2.3 pre-release snapshots, Mumble for iOS 1.1 through 1.2.2, and MumbleKit before commit fd190328a9b24d37382b269a5674b0c0c7a7e36d does not check the return value of the opus_decode_float function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted Opus voice packet, which triggers an error in opus_decode_float, a conversion of a negative integer to an unsigned integer, and a heap-based buffer over-read and over-write. + + + + + + + + + + + + + cpe:/a:emberjs:ember.js:1.3.0 + cpe:/a:emberjs:ember.js:1.3.1 + cpe:/a:emberjs:ember.js:1.4.0:beta + cpe:/a:emberjs:ember.js:1.2.1 + cpe:/a:emberjs:ember.js:1.2.0 + + CVE-2014-0046 + 2014-02-27T10:55:04.907-05:00 + 2014-03-05T23:50:19.267-05:00 + + + 2.6 + NETWORK + HIGH + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-28T10:03:58.707-05:00 + + + + + CONFIRM + https://groups.google.com/forum/#!topic/ember-security/1h6FRgr8lXQ + + + XF + emberjs-linkto-xss(91242) + + + MLIST + [oss-security] 20140214 [CVE-2014-0046] XSS Vulnerability With {{link-to}} Helper in Non-block Form + + + SECUNIA + 56965 + + + CONFIRM + http://emberjs.com/blog/2014/02/07/ember-security-releases.html + + Cross-site scripting (XSS) vulnerability in the link-to helper in Ember.js 1.2.x before 1.2.2, 1.3.x before 1.3.2, and 1.4.x before 1.4.0-beta.6, when used in non-block form, allows remote attackers to inject arbitrary web script or HTML via the title attribute. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:linux:linux_kernel:3.0.48 + cpe:/o:linux:linux_kernel:3.0.49 + cpe:/o:linux:linux_kernel:3.0.46 + cpe:/o:linux:linux_kernel:3.0.47 + cpe:/o:linux:linux_kernel:3.0.44 + cpe:/o:linux:linux_kernel:3.0.45 + cpe:/o:linux:linux_kernel:3.0.42 + cpe:/o:linux:linux_kernel:3.4.70 + cpe:/o:linux:linux_kernel:3.4.71 + cpe:/o:linux:linux_kernel:3.0.40 + cpe:/o:linux:linux_kernel:3.0.41 + cpe:/o:linux:linux_kernel:3.4.45 + cpe:/o:linux:linux_kernel:3.4.44 + cpe:/o:linux:linux_kernel:3.4.46 + cpe:/o:linux:linux_kernel:3.4.41 + cpe:/o:linux:linux_kernel:3.4.40 + cpe:/o:linux:linux_kernel:3.4.43 + cpe:/o:linux:linux_kernel:3.4.42 + cpe:/o:linux:linux_kernel:3.4.49 + cpe:/o:linux:linux_kernel:3.4.48 + cpe:/o:linux:linux_kernel:3.0.59 + cpe:/o:linux:linux_kernel:3.4.47 + cpe:/o:linux:linux_kernel:3.0.55 + cpe:/o:linux:linux_kernel:3.0.56 + cpe:/o:linux:linux_kernel:3.0.57 + cpe:/o:linux:linux_kernel:3.0.58 + cpe:/o:linux:linux_kernel:3.0.51 + cpe:/o:linux:linux_kernel:3.0.52 + cpe:/o:linux:linux_kernel:3.0.53 + cpe:/o:linux:linux_kernel:3.11.10 + cpe:/o:linux:linux_kernel:3.0.50 + cpe:/o:linux:linux_kernel:3.4.57 + cpe:/o:linux:linux_kernel:3.4.56 + cpe:/o:linux:linux_kernel:3.4.55 + cpe:/o:linux:linux_kernel:3.4.54 + cpe:/o:linux:linux_kernel:3.4.53 + cpe:/o:linux:linux_kernel:3.4.52 + cpe:/o:linux:linux_kernel:3.4.51 + cpe:/o:linux:linux_kernel:3.4.50 + cpe:/o:linux:linux_kernel:3.0.43 + cpe:/o:linux:linux_kernel:3.10.26 + cpe:/o:linux:linux_kernel:3.4.59 + cpe:/o:linux:linux_kernel:3.0.24 + cpe:/o:linux:linux_kernel:3.0.25 + cpe:/o:linux:linux_kernel:3.0.22 + cpe:/o:linux:linux_kernel:3.1.9 + cpe:/o:linux:linux_kernel:3.0.23 + cpe:/o:linux:linux_kernel:3.10.28 + cpe:/o:linux:linux_kernel:3.0.28 + cpe:/o:linux:linux_kernel:3.10.27 + cpe:/o:linux:linux_kernel:3.0.26 + cpe:/o:linux:linux_kernel:3.10.29 + cpe:/o:linux:linux_kernel:3.4.58 + cpe:/o:linux:linux_kernel:3.0.27 + cpe:/o:linux:linux_kernel:3.10.24 + cpe:/o:linux:linux_kernel:3.10.23 + cpe:/o:linux:linux_kernel:3.10.25 + cpe:/o:linux:linux_kernel:3.10.20 + cpe:/o:linux:linux_kernel:3.1.8 + cpe:/o:linux:linux_kernel:3.0.20 + cpe:/o:linux:linux_kernel:3.10.22 + cpe:/o:linux:linux_kernel:3.10.21 + cpe:/o:linux:linux_kernel:3.4.21 + cpe:/o:linux:linux_kernel:3.4.20 + cpe:/o:linux:linux_kernel:3.4.23 + cpe:/o:linux:linux_kernel:3.4.22 + cpe:/o:linux:linux_kernel:3.4.24 + cpe:/o:linux:linux_kernel:3.4.27 + cpe:/o:linux:linux_kernel:3.4.26 + cpe:/o:linux:linux_kernel:3.4.29 + cpe:/o:linux:linux_kernel:3.10.15 + cpe:/o:linux:linux_kernel:3.4.28 + cpe:/o:linux:linux_kernel:3.0.54 + cpe:/o:linux:linux_kernel:3.0.33 + cpe:/o:linux:linux_kernel:3.0.34 + cpe:/o:linux:linux_kernel:3.0.35 + cpe:/o:linux:linux_kernel:3.0.36 + cpe:/o:linux:linux_kernel:3.10.19 + cpe:/o:linux:linux_kernel:3.0.37 + cpe:/o:linux:linux_kernel:3.10.18 + cpe:/o:linux:linux_kernel:3.0.38 + cpe:/o:linux:linux_kernel:3.4.25 + cpe:/o:linux:linux_kernel:3.10.17 + cpe:/o:linux:linux_kernel:3.0.39 + cpe:/o:linux:linux_kernel:3.10.16 + cpe:/o:linux:linux_kernel:3.10.14 + cpe:/o:linux:linux_kernel:3.10.13 + cpe:/o:linux:linux_kernel:3.10.12 + cpe:/o:linux:linux_kernel:3.10.11 + cpe:/o:linux:linux_kernel:3.10.10 + cpe:/o:linux:linux_kernel:3.0.30 + cpe:/o:linux:linux_kernel:3.0.31 + cpe:/o:linux:linux_kernel:3.9.8 + cpe:/o:linux:linux_kernel:3.5.5 + cpe:/o:linux:linux_kernel:3.4.32 + cpe:/o:linux:linux_kernel:3.9.9 + cpe:/o:linux:linux_kernel:3.5.6 + cpe:/o:linux:linux_kernel:3.4.31 + cpe:/o:linux:linux_kernel:3.5.7 + cpe:/o:linux:linux_kernel:3.4.30 + cpe:/o:linux:linux_kernel:3.7.1 + cpe:/o:linux:linux_kernel:3.4.35 + cpe:/o:linux:linux_kernel:3.9.0 + cpe:/o:linux:linux_kernel:3.0.18 + cpe:/o:linux:linux_kernel:3.4.34 + cpe:/o:linux:linux_kernel:3.4.33 + cpe:/o:linux:linux_kernel:3.9.2 + cpe:/o:linux:linux_kernel:3.9.1 + cpe:/o:linux:linux_kernel:3.0.19 + cpe:/o:linux:linux_kernel:3.4.39 + cpe:/o:linux:linux_kernel:3.9.4 + cpe:/o:linux:linux_kernel:3.4.38 + cpe:/o:linux:linux_kernel:3.9.3 + cpe:/o:linux:linux_kernel:3.4.37 + cpe:/o:linux:linux_kernel:3.9.6 + cpe:/o:linux:linux_kernel:3.9.5 + cpe:/o:linux:linux_kernel:3.0.21 + cpe:/o:linux:linux_kernel:3.9.7 + cpe:/o:linux:linux_kernel:3.5.4 + cpe:/o:linux:linux_kernel:3.0.4 + cpe:/o:linux:linux_kernel:3.0.5 + cpe:/o:linux:linux_kernel:3.0.2 + cpe:/o:linux:linux_kernel:3.0.3 + cpe:/o:linux:linux_kernel:3.0.8 + cpe:/o:linux:linux_kernel:3.0.6 + cpe:/o:linux:linux_kernel:3.0.7 + cpe:/o:linux:linux_kernel:3.4.36 + cpe:/o:linux:linux_kernel:3.13.1 + cpe:/o:linux:linux_kernel:3.6.10 + cpe:/o:linux:linux_kernel:3.6.11 + cpe:/o:linux:linux_kernel:3.13.4 + cpe:/o:linux:linux_kernel:3.13.5 + cpe:/o:linux:linux_kernel:3.13.2 + cpe:/o:linux:linux_kernel:3.13.3 + cpe:/o:linux:linux_kernel:3.4.1 + cpe:/o:linux:linux_kernel:3.4.19 + cpe:/o:linux:linux_kernel:3.4.17 + cpe:/o:linux:linux_kernel:3.4.3 + cpe:/o:linux:linux_kernel:3.4.18 + cpe:/o:linux:linux_kernel:3.4.2 + cpe:/o:linux:linux_kernel:3.2.9 + cpe:/o:linux:linux_kernel:3.4.15 + cpe:/o:linux:linux_kernel:3.2.8 + cpe:/o:linux:linux_kernel:3.4.16 + cpe:/o:linux:linux_kernel:3.4.4 + cpe:/o:linux:linux_kernel:3.12.12 + cpe:/o:linux:linux_kernel:3.2.7 + cpe:/o:linux:linux_kernel:3.4.13 + cpe:/o:linux:linux_kernel:3.12.13 + cpe:/o:linux:linux_kernel:3.12.10 + cpe:/o:linux:linux_kernel:3.4.11 + cpe:/o:linux:linux_kernel:3.12.11 + cpe:/o:linux:linux_kernel:3.4.12 + cpe:/o:linux:linux_kernel:3.4.10 + cpe:/o:linux:linux_kernel:3.0.61 + cpe:/o:linux:linux_kernel:3.3:rc2 + cpe:/o:linux:linux_kernel:3.4:rc7 + cpe:/o:linux:linux_kernel:3.0.60 + cpe:/o:linux:linux_kernel:3.3:rc7 + cpe:/o:linux:linux_kernel:3.4:rc5 + cpe:/o:linux:linux_kernel:3.3:rc5 + cpe:/o:linux:linux_kernel:3.4:rc6 + cpe:/o:linux:linux_kernel:3.3:rc6 + cpe:/o:linux:linux_kernel:3.0.64 + cpe:/o:linux:linux_kernel:3.0.63 + cpe:/o:linux:linux_kernel:3.0.62 + cpe:/o:linux:linux_kernel:3.12.1 + cpe:/o:linux:linux_kernel:3.0.68 + cpe:/o:linux:linux_kernel:3.0.67 + cpe:/o:linux:linux_kernel:3.0.66 + cpe:/o:linux:linux_kernel:3.4.14 + cpe:/o:linux:linux_kernel:3.12.7 + cpe:/o:linux:linux_kernel:3.2:rc2 + cpe:/o:linux:linux_kernel:3.1:rc1 + cpe:/o:linux:linux_kernel:3.0.9 + cpe:/o:linux:linux_kernel:3.0:rc4 + cpe:/o:linux:linux_kernel:3.12.8 + cpe:/o:linux:linux_kernel:3.1:rc4 + cpe:/o:linux:linux_kernel:3.0:rc3 + cpe:/o:linux:linux_kernel:3.12.9 + cpe:/o:linux:linux_kernel:3.0:rc2 + cpe:/o:linux:linux_kernel:3.1:rc2 + cpe:/o:linux:linux_kernel:3.0:rc1 + cpe:/o:linux:linux_kernel:3.2:rc7 + cpe:/o:linux:linux_kernel:3.12.3 + cpe:/o:linux:linux_kernel:3.1.10 + cpe:/o:linux:linux_kernel:3.2:rc6 + cpe:/o:linux:linux_kernel:3.12.4 + cpe:/o:linux:linux_kernel:3.2:rc5 + cpe:/o:linux:linux_kernel:3.0:rc7 + cpe:/o:linux:linux_kernel:3.12.5 + cpe:/o:linux:linux_kernel:3.9:rc3 + cpe:/o:linux:linux_kernel:3.0:rc6 + cpe:/o:linux:linux_kernel:3.12.6 + cpe:/o:linux:linux_kernel:3.0:rc5 + cpe:/o:linux:linux_kernel:3.9:rc1 + cpe:/o:linux:linux_kernel:3.9:rc4 + cpe:/o:linux:linux_kernel:3.9:rc7 + cpe:/o:linux:linux_kernel:3.12.2 + cpe:/o:linux:linux_kernel:3.9:rc2 + cpe:/o:linux:linux_kernel:3.9:rc5 + cpe:/o:linux:linux_kernel:3.3:rc3 + cpe:/o:linux:linux_kernel:3.4:rc4 + cpe:/o:linux:linux_kernel:3.4:rc3 + cpe:/o:linux:linux_kernel:3.3:rc1 + cpe:/o:linux:linux_kernel:3.4:rc2 + cpe:/o:linux:linux_kernel:3.9:rc6 + cpe:/o:linux:linux_kernel:3.3:rc4 + cpe:/o:linux:linux_kernel:3.4:rc1 + cpe:/o:linux:linux_kernel:3.4.5 + cpe:/o:linux:linux_kernel:3.2.2 + cpe:/o:linux:linux_kernel:3.2.3 + cpe:/o:linux:linux_kernel:3.2.1 + cpe:/o:linux:linux_kernel:3.4.6 + cpe:/o:linux:linux_kernel:3.2:rc3 + cpe:/o:linux:linux_kernel:3.2.6 + cpe:/o:linux:linux_kernel:3.4.7 + cpe:/o:linux:linux_kernel:3.2:rc4 + cpe:/o:linux:linux_kernel:3.1:rc3 + cpe:/o:linux:linux_kernel:3.4.8 + cpe:/o:linux:linux_kernel:3.2.4 + cpe:/o:linux:linux_kernel:3.4.9 + cpe:/o:linux:linux_kernel:3.2.5 + cpe:/o:linux:linux_kernel:3.0.65 + cpe:/o:linux:linux_kernel:3.2.12 + cpe:/o:linux:linux_kernel:3.8.10 + cpe:/o:linux:linux_kernel:3.8.12 + cpe:/o:linux:linux_kernel:3.8.11 + cpe:/o:linux:linux_kernel:3.8.13 + cpe:/o:linux:linux_kernel:3.7.9 + cpe:/o:linux:linux_kernel:3.7.8 + cpe:/o:linux:linux_kernel:3.7.7 + cpe:/o:linux:linux_kernel:3.7.6 + cpe:/o:linux:linux_kernel:3.6.3 + cpe:/o:linux:linux_kernel:3.7.5 + cpe:/o:linux:linux_kernel:3.7.4 + cpe:/o:linux:linux_kernel:3.7.3 + cpe:/o:linux:linux_kernel:3.7.2 + cpe:/o:linux:linux_kernel:3.6.7 + cpe:/o:linux:linux_kernel:3.6.6 + cpe:/o:linux:linux_kernel:3.6.5 + cpe:/o:linux:linux_kernel:3.6.4 + cpe:/o:linux:linux_kernel:3.6.9 + cpe:/o:linux:linux_kernel:3.6.8 + cpe:/o:linux:linux_kernel:3.10 + cpe:/o:linux:linux_kernel:3.11 + cpe:/o:linux:linux_kernel:3.12 + cpe:/o:linux:linux_kernel:3.13 + cpe:/o:linux:linux_kernel:3.10.1 + cpe:/o:linux:linux_kernel:3.10.2 + cpe:/o:linux:linux_kernel:3.10.3 + cpe:/o:linux:linux_kernel:3.6.2 + cpe:/o:linux:linux_kernel:3.6.1 + cpe:/o:linux:linux_kernel:3.3.6 + cpe:/o:linux:linux_kernel:3.3.7 + cpe:/o:linux:linux_kernel:3.3.8 + cpe:/o:linux:linux_kernel:3.0.1 + cpe:/o:linux:linux_kernel:3.2 + cpe:/o:linux:linux_kernel:3.1 + cpe:/o:linux:linux_kernel:3.7 + cpe:/o:linux:linux_kernel:3.6 + cpe:/o:linux:linux_kernel:3.4 + cpe:/o:linux:linux_kernel:3.1.6 + cpe:/o:linux:linux_kernel:3.1.5 + cpe:/o:linux:linux_kernel:3.1.7 + cpe:/o:linux:linux_kernel:3.0.32 + cpe:/o:linux:linux_kernel:3.8.9 + cpe:/o:linux:linux_kernel:3.1.2 + cpe:/o:linux:linux_kernel:3.1.1 + cpe:/o:linux:linux_kernel:3.1.4 + cpe:/o:linux:linux_kernel:3.1.3 + cpe:/o:linux:linux_kernel:3.9.10 + cpe:/o:linux:linux_kernel:3.0.29 + cpe:/o:linux:linux_kernel:3.3 + cpe:/o:linux:linux_kernel:3.8.4 + cpe:/o:linux:linux_kernel:3.2.26 + cpe:/o:linux:linux_kernel:3.8.5 + cpe:/o:linux:linux_kernel:3.2.27 + cpe:/o:linux:linux_kernel:3.8.2 + cpe:/o:linux:linux_kernel:3.2.24 + cpe:/o:linux:linux_kernel:3.8.3 + cpe:/o:linux:linux_kernel:3.2.25 + cpe:/o:linux:linux_kernel:3.8.8 + cpe:/o:linux:linux_kernel:3.8.6 + cpe:/o:linux:linux_kernel:3.2.28 + cpe:/o:linux:linux_kernel:3.8.7 + cpe:/o:linux:linux_kernel:3.2.29 + cpe:/o:linux:linux_kernel:3.3.3 + cpe:/o:linux:linux_kernel:3.3.4 + cpe:/o:linux:linux_kernel:3.3.5 + cpe:/o:linux:linux_kernel:3.2.22 + cpe:/o:linux:linux_kernel:3.8.1 + cpe:/o:linux:linux_kernel:3.2.20 + cpe:/o:linux:linux_kernel:3.3.1 + cpe:/o:linux:linux_kernel:3.2.21 + cpe:/o:linux:linux_kernel:3.3.2 + cpe:/o:linux:linux_kernel:3.11.1 + cpe:/o:linux:linux_kernel:3.11.2 + cpe:/o:linux:linux_kernel:3.2.23 + cpe:/o:linux:linux_kernel:3.0.17 + cpe:/o:linux:linux_kernel:3.9.11 + cpe:/o:linux:linux_kernel:3.0.16 + cpe:/o:linux:linux_kernel:3.0.15 + cpe:/o:linux:linux_kernel:3.2.30 + cpe:/o:linux:linux_kernel:3.0.14 + cpe:/o:linux:linux_kernel:3.0.13 + cpe:/o:linux:linux_kernel:3.0.12 + cpe:/o:linux:linux_kernel:3.0.11 + cpe:/o:linux:linux_kernel:3.4.61 + cpe:/o:linux:linux_kernel:3.0.10 + cpe:/o:linux:linux_kernel:3.4.64 + cpe:/o:linux:linux_kernel:3.8.0 + cpe:/o:linux:linux_kernel:3.4.65 + cpe:/o:linux:linux_kernel:3.4.62 + cpe:/o:linux:linux_kernel:3.4.63 + cpe:/o:linux:linux_kernel:3.4.68 + cpe:/o:linux:linux_kernel:3.4.66 + cpe:/o:linux:linux_kernel:3.4.67 + cpe:/o:linux:linux_kernel:3.5.3 + cpe:/o:linux:linux_kernel:3.5.1 + cpe:/o:linux:linux_kernel:3.5.2 + cpe:/o:linux:linux_kernel:3.10.4 + cpe:/o:linux:linux_kernel:3.4.72 + cpe:/o:linux:linux_kernel:3.10.9 + cpe:/o:linux:linux_kernel:3.4.73 + cpe:/o:linux:linux_kernel:3.4.74 + cpe:/o:linux:linux_kernel:3.4.75 + cpe:/o:linux:linux_kernel:3.4.76 + cpe:/o:linux:linux_kernel:3.10.5 + cpe:/o:linux:linux_kernel:3.4.77 + cpe:/o:linux:linux_kernel:3.10.6 + cpe:/o:linux:linux_kernel:3.4.78 + cpe:/o:linux:linux_kernel:3.10.7 + cpe:/o:linux:linux_kernel:3.4.79 + cpe:/o:linux:linux_kernel:3.10.8 + cpe:/o:linux:linux_kernel:3.7.10 + cpe:/o:linux:linux_kernel:3.2.17 + cpe:/o:linux:linux_kernel:3.2.18 + cpe:/o:linux:linux_kernel:3.2.19 + cpe:/o:linux:linux_kernel:3.2.13 + cpe:/o:linux:linux_kernel:3.2.14 + cpe:/o:linux:linux_kernel:3.11.3 + cpe:/o:linux:linux_kernel:3.2.15 + cpe:/o:linux:linux_kernel:3.4.60 + cpe:/o:linux:linux_kernel:3.2.16 + cpe:/o:linux:linux_kernel:3.11.5 + cpe:/o:linux:linux_kernel:3.11.4 + cpe:/o:linux:linux_kernel:3.2.10 + cpe:/o:linux:linux_kernel:3.11.7 + cpe:/o:linux:linux_kernel:3.2.11 + cpe:/o:linux:linux_kernel:3.11.6 + cpe:/o:linux:linux_kernel:3.11.9 + cpe:/o:linux:linux_kernel:3.11.8 + cpe:/o:linux:linux_kernel:3.4.69 + + CVE-2014-0049 + 2014-03-11T09:01:06.060-04:00 + 2014-03-11T10:26:44.843-04:00 + + + 7.4 + ADJACENT_NETWORK + MEDIUM + SINGLE_INSTANCE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-11T10:26:42.767-04:00 + + + + + MLIST + [oss-security] 20140303 CVE-2014-0049 -- Linux kernel: kvm: mmio_fragments out-of-the-bounds access + + + CONFIRM + https://github.com/torvalds/linux/commit/a08d3b3b99efd509133946056531cdf8f3a0c09b + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1062368 + + + CONFIRM + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.6 + + + CONFIRM + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a08d3b3b99efd509133946056531cdf8f3a0c09b + + Buffer overflow in the complete_emulated_mmio function in arch/x86/kvm/x86.c in the Linux kernel before 3.13.6 allows guest OS users to execute arbitrary code on the host OS by leveraging a loop that triggers an invalid memory copy affecting certain cancel_work_item data. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apache:tomcat:7.0.5 + cpe:/a:apache:tomcat:7.0.40 + cpe:/a:apache:tomcat:7.0.41 + cpe:/a:apache:tomcat:7.0.42 + cpe:/a:apache:tomcat:7.0.43 + cpe:/a:apache:tomcat:7.0.44 + cpe:/a:apache:tomcat:7.0.45 + cpe:/a:apache:tomcat:7.0.46 + cpe:/a:apache:tomcat:7.0.37 + cpe:/a:apache:tomcat:7.0.38 + cpe:/a:apache:tomcat:7.0.39 + cpe:/a:apache:commons_fileupload:1.2.1 + cpe:/a:apache:tomcat:7.0.10 + cpe:/a:apache:commons_fileupload:1.2.2 + cpe:/a:apache:tomcat:7.0.8 + cpe:/a:apache:tomcat:7.0.13 + cpe:/a:apache:tomcat:7.0.9 + cpe:/a:apache:tomcat:7.0.6 + cpe:/a:apache:tomcat:7.0.11 + cpe:/a:apache:tomcat:8.0.1 + cpe:/a:apache:tomcat:7.0.7 + cpe:/a:apache:tomcat:7.0.12 + cpe:/a:apache:tomcat:7.0.36 + cpe:/a:apache:tomcat:7.0.4 + cpe:/a:apache:tomcat:7.0.3 + cpe:/a:apache:tomcat:7.0.2 + cpe:/a:apache:tomcat:7.0.1 + cpe:/a:apache:tomcat:7.0.0 + cpe:/a:apache:tomcat:7.0.47 + cpe:/a:apache:tomcat:8.0.0:rc5 + cpe:/a:apache:tomcat:8.0.0:rc2 + cpe:/a:apache:tomcat:7.0.49 + cpe:/a:apache:tomcat:8.0.0:rc10 + cpe:/a:apache:tomcat:7.0.48 + cpe:/a:apache:tomcat:8.0.0:rc1 + cpe:/a:apache:tomcat:7.0.22 + cpe:/a:apache:tomcat:7.0.4:beta + cpe:/a:apache:tomcat:7.0.23 + cpe:/a:apache:tomcat:7.0.24 + cpe:/a:apache:tomcat:7.0.2:beta + cpe:/a:apache:tomcat:7.0.0:beta + cpe:/a:apache:tomcat:7.0.20 + cpe:/a:apache:tomcat:7.0.21 + cpe:/a:apache:tomcat:7.0.50 + cpe:/a:apache:tomcat:7.0.35 + cpe:/a:apache:tomcat:7.0.19 + cpe:/a:apache:tomcat:7.0.33 + cpe:/a:apache:tomcat:7.0.34 + cpe:/a:apache:tomcat:7.0.16 + cpe:/a:apache:tomcat:7.0.31 + cpe:/a:apache:tomcat:7.0.15 + cpe:/a:apache:tomcat:7.0.32 + cpe:/a:apache:tomcat:7.0.18 + cpe:/a:apache:tomcat:7.0.17 + cpe:/a:apache:tomcat:7.0.30 + cpe:/a:apache:commons_fileupload:1.1.1 + cpe:/a:apache:tomcat:7.0.14 + cpe:/a:apache:tomcat:7.0.25 + cpe:/a:apache:commons_fileupload:1.1 + cpe:/a:apache:commons_fileupload:1.0 + cpe:/a:apache:commons_fileupload:1.3 + cpe:/a:apache:commons_fileupload:1.2 + cpe:/a:apache:tomcat:7.0.29 + cpe:/a:apache:tomcat:7.0.28 + cpe:/a:apache:commons_fileupload:1.3.1 + cpe:/a:apache:tomcat:7.0.27 + cpe:/a:apache:tomcat:7.0.26 + + CVE-2014-0050 + 2014-04-01T02:27:51.373-04:00 + 2014-04-24T01:02:52.993-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-01T10:01:08.553-04:00 + + + + + CONFIRM + http://tomcat.apache.org/security-8.html + + + CONFIRM + http://tomcat.apache.org/security-7.html + + + CONFIRM + http://svn.apache.org/r1565143 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1062337 + + + SECUNIA + 57915 + + + REDHAT + RHSA-2014:0400 + + + MLIST + [commons-dev] 20140206 [SECURITY] CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat DoS + + + JVNDB + JVNDB-2014-000017 + + + JVN + JVN#14876762 + + + MISC + http://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.html + + MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:gopivotal:grails:2.0.4 + cpe:/a:gopivotal:grails:2.0.3 + cpe:/a:gopivotal:grails:2.1.5 + cpe:/a:gopivotal:grails-resources:1.2.5 + cpe:/a:gopivotal:grails:2.0.2 + cpe:/a:gopivotal:grails:2.1.4 + cpe:/a:gopivotal:grails:2.1.3 + cpe:/a:gopivotal:grails:2.1.2 + cpe:/a:gopivotal:grails:2.1.1 + cpe:/a:gopivotal:grails-resources:1.2.0 + cpe:/a:gopivotal:grails-resources:1.1.5 + cpe:/a:gopivotal:grails-resources:1.1.4 + cpe:/a:gopivotal:grails-resources:1.1.2 + cpe:/a:gopivotal:grails:2.0.0 + cpe:/a:gopivotal:grails:2.0.1 + cpe:/a:gopivotal:grails-resources:1.1.6 + cpe:/a:gopivotal:grails-resources:1.0.2 + cpe:/a:gopivotal:grails-resources:1.0.0 + cpe:/a:gopivotal:grails-resources:1.2.3 + cpe:/a:gopivotal:grails-resources:1.1.0 + cpe:/a:gopivotal:grails-resources:1.1.1 + cpe:/a:gopivotal:grails-resources:1.2.4 + cpe:/a:gopivotal:grails-resources:1.2.1 + cpe:/a:gopivotal:grails-resources:1.2.2 + cpe:/a:gopivotal:grails:2.1.0 + cpe:/a:gopivotal:grails:2.2.4 + cpe:/a:gopivotal:grails:2.2.5 + cpe:/a:gopivotal:grails:2.2.2 + cpe:/a:gopivotal:grails:2.2.3 + cpe:/a:gopivotal:grails:2.2.0 + cpe:/a:gopivotal:grails:2.2.1 + cpe:/a:gopivotal:grails:2.3.1 + cpe:/a:gopivotal:grails:2.3.2 + cpe:/a:gopivotal:grails:2.3.0 + cpe:/a:gopivotal:grails:2.3.5 + cpe:/a:gopivotal:grails:2.3.3 + cpe:/a:gopivotal:grails:2.3.4 + + CVE-2014-0053 + 2014-04-15T19:55:08.640-04:00 + 2014-04-22T13:54:49.580-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-16T07:39:07.000-04:00 + + + + + MISC + https://twitter.com/Ramsharan065/status/434975409134792704 + + + XF + grails-cve20140053-info-disc(91270) + + + BID + 65678 + + + BUGTRAQ + 20140227 Update: CVE-2014-0053 Information Disclosure when using Grails + + + CONFIRM + http://www.gopivotal.com/security/cve-2014-0053 + + + SECUNIA + 56841 + + + FULLDISC + 20140227 Update: CVE-2014-0053 Information Disclosure when using Grails + + + FULLDISC + 20140219 CVE-2014-0053 Information Disclosure when using Grails + + The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 before 2.3.6 does not properly restrict access to files in the WEB-INF directory, which allows remote attackers to obtain sensitive information via a direct request. NOTE: this identifier has been SPLIT due to different researchers and different vulnerability types. See CVE-2014-2857 for the META-INF variant and CVE-2014-2858 for the directory traversal. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:springsource:spring_framework:3.0.0 + cpe:/a:springsource:spring_framework:4.0.1 + cpe:/a:springsource:spring_framework:3.2.4 + cpe:/a:springsource:spring_framework:3.2.5 + cpe:/a:springsource:spring_framework:3.2.2 + cpe:/a:springsource:spring_framework:3.2.3 + cpe:/a:springsource:spring_framework:3.0.0:rc3 + cpe:/a:springsource:spring_framework:3.0.0:rc1 + cpe:/a:springsource:spring_framework:3.0.0.m1 + cpe:/a:springsource:spring_framework:3.2.6 + cpe:/a:springsource:spring_framework:3.0.0:rc2 + cpe:/a:springsource:spring_framework:3.0.0.m2 + cpe:/a:springsource:spring_framework:3.2.0 + cpe:/a:springsource:spring_framework:3.2.1 + cpe:/a:springsource:spring_framework:3.2.7 + cpe:/a:springsource:spring_framework:3.1.2 + cpe:/a:springsource:spring_framework:3.1.1 + cpe:/a:springsource:spring_framework:3.1.0 + cpe:/a:springsource:spring_framework:4.0.0:rc1 + cpe:/a:springsource:spring_framework:3.1.4 + cpe:/a:springsource:spring_framework:3.1.3 + cpe:/a:springsource:spring_framework:3.0.1 + cpe:/a:springsource:spring_framework:3.0.2 + cpe:/a:springsource:spring_framework:3.0.3 + cpe:/a:springsource:spring_framework:4.0.0:m2 + cpe:/a:springsource:spring_framework:3.0.4 + cpe:/a:springsource:spring_framework:3.0.5 + cpe:/a:springsource:spring_framework:3.0.6 + cpe:/a:springsource:spring_framework:4.0.0:m1 + cpe:/a:springsource:spring_framework:3.0.7 + cpe:/a:springsource:spring_framework:3.0.0:m1 + cpe:/a:springsource:spring_framework:3.0.0:m2 + cpe:/a:springsource:spring_framework:3.0.0:m3 + cpe:/a:springsource:spring_framework:3.0.0:m4 + + CVE-2014-0054 + 2014-04-17T10:55:06.417-04:00 + 2014-04-18T09:56:57.203-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-18T09:56:56.967-04:00 + + + + + CONFIRM + https://jira.spring.io/browse/SPR-11376 + + + SECUNIA + 57915 + + + REDHAT + RHSA-2014:0400 + + The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429. + + + + + + + + + cpe:/o:redhat:enterprise_linux:6 + + CVE-2014-0055 + 2014-03-26T10:55:04.710-04:00 + 2014-04-19T00:45:56.627-04:00 + + + 5.5 + ADJACENT_NETWORK + LOW + SINGLE_INSTANCE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-03-26T14:28:12.737-04:00 + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1062577 + + + REDHAT + RHSA-2014:0339 + + + REDHAT + RHSA-2014:0328 + + The get_rx_bufs function in drivers/vhost/net.c in the vhost-net subsystem in the Linux kernel package before 2.6.32-431.11.2 on Red Hat Enterprise Linux (RHEL) 6 does not properly handle vhost_get_vq_desc errors, which allows guest OS users to cause a denial of service (host OS crash) via unspecified vectors. + + + + + + + + + + cpe:/a:redhat:cloudforms_3.0_management_engine:5.2 + cpe:/a:redhat:cloudforms:3.0 + + CVE-2014-0057 + 2014-03-18T13:02:52.887-04:00 + 2014-03-19T10:03:56.427-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-19T10:03:38.987-04:00 + + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1064140 + + + SECUNIA + 57376 + + + REDHAT + RHSA-2014:0215 + + The x_button method in the ServiceController (vmdb/app/controllers/service_controller.rb) in Red Hat CloudForms 3.0 Management Engine 5.2 allows remote attackers to execute arbitrary methods via unspecified vectors. + + + + + + + + + + + + cpe:/a:redhat:jboss_enterprise_application_platform:6.2.0 + cpe:/a:redhat:jboss_enterprise_application_platform:6.0.0 + cpe:/a:redhat:jboss_enterprise_application_platform:6.0.1 + cpe:/a:redhat:jboss_enterprise_application_platform:6.1.0 + + CVE-2014-0058 + 2014-02-26T10:55:08.953-05:00 + 2014-02-27T10:49:21.817-05:00 + + + 1.9 + LOCAL + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-02-27T10:49:08.287-05:00 + + + + + REDHAT + RHSA-2014:0205 + + + REDHAT + RHSA-2014:0204 + + The security audit functionality in Red Hat JBoss Enterprise Application Platform (EAP) 6.x before 6.2.1 logs request parameters in plaintext, which might allow local users to obtain passwords by reading the log files. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:postgresql:postgresql:9.2.3 + cpe:/a:postgresql:postgresql:9.2.2 + cpe:/a:postgresql:postgresql:9.2.1 + cpe:/a:postgresql:postgresql:9.2.6 + cpe:/a:postgresql:postgresql:9.2.5 + cpe:/a:postgresql:postgresql:9.2.4 + cpe:/a:postgresql:postgresql:9.3 + cpe:/a:postgresql:postgresql:9.2 + cpe:/a:postgresql:postgresql:9.1 + cpe:/a:postgresql:postgresql:9.0 + cpe:/a:postgresql:postgresql:9.0.4 + cpe:/a:postgresql:postgresql:9.0.5 + cpe:/a:postgresql:postgresql:9.1.11 + cpe:/a:postgresql:postgresql:9.1.10 + cpe:/a:postgresql:postgresql:9.0.3 + cpe:/a:postgresql:postgresql:9.0.8 + cpe:/a:postgresql:postgresql:9.0.9 + cpe:/a:postgresql:postgresql:9.0.6 + cpe:/a:postgresql:postgresql:9.0.7 + cpe:/a:postgresql:postgresql:8.4.7 + cpe:/a:postgresql:postgresql:8.4.13 + cpe:/a:postgresql:postgresql:8.4.12 + cpe:/a:postgresql:postgresql:8.4.11 + cpe:/a:postgresql:postgresql:8.4.17 + cpe:/a:postgresql:postgresql:8.4.16 + cpe:/a:postgresql:postgresql:8.4.15 + cpe:/a:postgresql:postgresql:8.4.14 + cpe:/a:postgresql:postgresql:9.0.15 + cpe:/a:postgresql:postgresql:8.4.19 + cpe:/a:postgresql:postgresql:9.1.1 + cpe:/a:postgresql:postgresql:9.1.9 + cpe:/a:postgresql:postgresql:9.0.10 + cpe:/a:postgresql:postgresql:9.0.11 + cpe:/a:postgresql:postgresql:9.0.12 + cpe:/a:postgresql:postgresql:9.0.13 + cpe:/a:postgresql:postgresql:9.0.14 + cpe:/a:postgresql:postgresql:8.4.18 + cpe:/a:postgresql:postgresql:9.0.1 + cpe:/a:postgresql:postgresql:9.3.1 + cpe:/a:postgresql:postgresql:9.3.2 + cpe:/a:postgresql:postgresql:9.1.2 + cpe:/a:postgresql:postgresql:9.1.3 + cpe:/a:postgresql:postgresql:9.1.4 + cpe:/a:postgresql:postgresql:9.1.5 + cpe:/a:postgresql:postgresql:9.1.6 + cpe:/a:postgresql:postgresql:9.1.7 + cpe:/a:postgresql:postgresql:9.0.2 + cpe:/a:postgresql:postgresql:9.1.8 + cpe:/a:postgresql:postgresql:8.4.10 + cpe:/a:postgresql:postgresql:8.4.9 + cpe:/a:postgresql:postgresql:8.4.8 + cpe:/a:postgresql:postgresql:8.4.2 + cpe:/a:postgresql:postgresql:8.4.1 + cpe:/a:postgresql:postgresql:8.4.6 + cpe:/a:postgresql:postgresql:8.4.5 + cpe:/a:postgresql:postgresql:8.4.4 + cpe:/a:postgresql:postgresql:8.4.3 + + CVE-2014-0060 + 2014-03-31T10:58:08.663-04:00 + 2014-03-31T13:47:07.757-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-31T13:47:04.317-04:00 + + + + + CONFIRM + http://www.postgresql.org/about/news/1506/ + + + DEBIAN + DSA-2865 + + + DEBIAN + DSA-2864 + + + CONFIRM + http://wiki.postgresql.org/wiki/20140220securityrelease + + PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows remote authenticated members of a role to add or remove arbitrary users to that role by calling the SET ROLE command before the associated GRANT command. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:postgresql:postgresql:9.2.3 + cpe:/a:postgresql:postgresql:9.2.2 + cpe:/a:postgresql:postgresql:9.2.1 + cpe:/a:postgresql:postgresql:9.2.6 + cpe:/a:postgresql:postgresql:9.2.5 + cpe:/a:postgresql:postgresql:9.2.4 + cpe:/a:postgresql:postgresql:9.3 + cpe:/a:postgresql:postgresql:9.2 + cpe:/a:postgresql:postgresql:9.1 + cpe:/a:postgresql:postgresql:9.0 + cpe:/a:postgresql:postgresql:9.0.4 + cpe:/a:postgresql:postgresql:9.0.5 + cpe:/a:postgresql:postgresql:9.1.11 + cpe:/a:postgresql:postgresql:9.1.10 + cpe:/a:postgresql:postgresql:9.0.3 + cpe:/a:postgresql:postgresql:9.0.8 + cpe:/a:postgresql:postgresql:9.0.9 + cpe:/a:postgresql:postgresql:9.0.6 + cpe:/a:postgresql:postgresql:9.0.7 + cpe:/a:postgresql:postgresql:8.4.7 + cpe:/a:postgresql:postgresql:8.4.13 + cpe:/a:postgresql:postgresql:8.4.12 + cpe:/a:postgresql:postgresql:8.4.11 + cpe:/a:postgresql:postgresql:8.4.17 + cpe:/a:postgresql:postgresql:8.4.16 + cpe:/a:postgresql:postgresql:8.4.15 + cpe:/a:postgresql:postgresql:8.4.14 + cpe:/a:postgresql:postgresql:9.0.15 + cpe:/a:postgresql:postgresql:8.4.19 + cpe:/a:postgresql:postgresql:9.1.1 + cpe:/a:postgresql:postgresql:9.1.9 + cpe:/a:postgresql:postgresql:9.0.10 + cpe:/a:postgresql:postgresql:9.0.11 + cpe:/a:postgresql:postgresql:9.0.12 + cpe:/a:postgresql:postgresql:9.0.13 + cpe:/a:postgresql:postgresql:9.0.14 + cpe:/a:postgresql:postgresql:8.4.18 + cpe:/a:postgresql:postgresql:9.0.1 + cpe:/a:postgresql:postgresql:9.3.1 + cpe:/a:postgresql:postgresql:9.3.2 + cpe:/a:postgresql:postgresql:9.1.2 + cpe:/a:postgresql:postgresql:9.1.3 + cpe:/a:postgresql:postgresql:9.1.4 + cpe:/a:postgresql:postgresql:9.1.5 + cpe:/a:postgresql:postgresql:9.1.6 + cpe:/a:postgresql:postgresql:9.1.7 + cpe:/a:postgresql:postgresql:9.0.2 + cpe:/a:postgresql:postgresql:9.1.8 + cpe:/a:postgresql:postgresql:8.4.10 + cpe:/a:postgresql:postgresql:8.4.9 + cpe:/a:postgresql:postgresql:8.4.8 + cpe:/a:postgresql:postgresql:8.4.2 + cpe:/a:postgresql:postgresql:8.4.1 + cpe:/a:postgresql:postgresql:8.4.6 + cpe:/a:postgresql:postgresql:8.4.5 + cpe:/a:postgresql:postgresql:8.4.4 + cpe:/a:postgresql:postgresql:8.4.3 + + CVE-2014-0061 + 2014-03-31T10:58:15.383-04:00 + 2014-03-31T13:52:06.877-04:00 + + + 6.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-31T13:52:03.813-04:00 + + + + + CONFIRM + http://www.postgresql.org/about/news/1506/ + + + DEBIAN + DSA-2865 + + + DEBIAN + DSA-2864 + + + CONFIRM + http://wiki.postgresql.org/wiki/20140220securityrelease + + The validator functions for the procedural languages (PLs) in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to gain privileges via a function that is (1) defined in another language or (2) not allowed to be directly called by the user due to permissions. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:postgresql:postgresql:9.2.3 + cpe:/a:postgresql:postgresql:9.2.2 + cpe:/a:postgresql:postgresql:9.2.1 + cpe:/a:postgresql:postgresql:9.2.6 + cpe:/a:postgresql:postgresql:9.2.5 + cpe:/a:postgresql:postgresql:9.2.4 + cpe:/a:postgresql:postgresql:9.3 + cpe:/a:postgresql:postgresql:9.2 + cpe:/a:postgresql:postgresql:9.1 + cpe:/a:postgresql:postgresql:9.0 + cpe:/a:postgresql:postgresql:9.0.4 + cpe:/a:postgresql:postgresql:9.0.5 + cpe:/a:postgresql:postgresql:9.1.11 + cpe:/a:postgresql:postgresql:9.1.10 + cpe:/a:postgresql:postgresql:9.0.3 + cpe:/a:postgresql:postgresql:9.0.8 + cpe:/a:postgresql:postgresql:9.0.9 + cpe:/a:postgresql:postgresql:9.0.6 + cpe:/a:postgresql:postgresql:9.0.7 + cpe:/a:postgresql:postgresql:8.4.7 + cpe:/a:postgresql:postgresql:8.4.13 + cpe:/a:postgresql:postgresql:8.4.12 + cpe:/a:postgresql:postgresql:8.4.11 + cpe:/a:postgresql:postgresql:8.4.17 + cpe:/a:postgresql:postgresql:8.4.16 + cpe:/a:postgresql:postgresql:8.4.15 + cpe:/a:postgresql:postgresql:8.4.14 + cpe:/a:postgresql:postgresql:9.0.15 + cpe:/a:postgresql:postgresql:8.4.19 + cpe:/a:postgresql:postgresql:9.1.1 + cpe:/a:postgresql:postgresql:9.1.9 + cpe:/a:postgresql:postgresql:9.0.10 + cpe:/a:postgresql:postgresql:9.0.11 + cpe:/a:postgresql:postgresql:9.0.12 + cpe:/a:postgresql:postgresql:9.0.13 + cpe:/a:postgresql:postgresql:9.0.14 + cpe:/a:postgresql:postgresql:8.4.18 + cpe:/a:postgresql:postgresql:9.0.1 + cpe:/a:postgresql:postgresql:9.3.1 + cpe:/a:postgresql:postgresql:9.3.2 + cpe:/a:postgresql:postgresql:9.1.2 + cpe:/a:postgresql:postgresql:9.1.3 + cpe:/a:postgresql:postgresql:9.1.4 + cpe:/a:postgresql:postgresql:9.1.5 + cpe:/a:postgresql:postgresql:9.1.6 + cpe:/a:postgresql:postgresql:9.1.7 + cpe:/a:postgresql:postgresql:9.0.2 + cpe:/a:postgresql:postgresql:9.1.8 + cpe:/a:postgresql:postgresql:8.4.10 + cpe:/a:postgresql:postgresql:8.4.9 + cpe:/a:postgresql:postgresql:8.4.8 + cpe:/a:postgresql:postgresql:8.4.2 + cpe:/a:postgresql:postgresql:8.4.1 + cpe:/a:postgresql:postgresql:8.4.6 + cpe:/a:postgresql:postgresql:8.4.5 + cpe:/a:postgresql:postgresql:8.4.4 + cpe:/a:postgresql:postgresql:8.4.3 + + CVE-2014-0062 + 2014-03-31T10:58:15.397-04:00 + 2014-03-31T13:54:55.677-04:00 + + + 4.9 + NETWORK + MEDIUM + SINGLE_INSTANCE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-31T13:54:55.317-04:00 + + + + + CONFIRM + http://www.postgresql.org/about/news/1506/ + + + DEBIAN + DSA-2865 + + + DEBIAN + DSA-2864 + + + CONFIRM + http://wiki.postgresql.org/wiki/20140220securityrelease + + Race condition in the (1) CREATE INDEX and (2) unspecified ALTER TABLE commands in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allows remote authenticated users to create an unauthorized index or read portions of unauthorized tables by creating or deleting a table with the same name during the timing window. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:postgresql:postgresql:9.2.3 + cpe:/a:postgresql:postgresql:9.2.2 + cpe:/a:postgresql:postgresql:9.2.1 + cpe:/a:postgresql:postgresql:9.2.6 + cpe:/a:postgresql:postgresql:9.2.5 + cpe:/a:postgresql:postgresql:9.2.4 + cpe:/a:postgresql:postgresql:9.3 + cpe:/a:postgresql:postgresql:9.2 + cpe:/a:postgresql:postgresql:9.1 + cpe:/a:postgresql:postgresql:9.0 + cpe:/a:postgresql:postgresql:9.0.4 + cpe:/a:postgresql:postgresql:9.0.5 + cpe:/a:postgresql:postgresql:9.1.11 + cpe:/a:postgresql:postgresql:9.1.10 + cpe:/a:postgresql:postgresql:9.0.3 + cpe:/a:postgresql:postgresql:9.0.8 + cpe:/a:postgresql:postgresql:9.0.9 + cpe:/a:postgresql:postgresql:9.0.6 + cpe:/a:postgresql:postgresql:9.0.7 + cpe:/a:postgresql:postgresql:8.4.7 + cpe:/a:postgresql:postgresql:8.4.13 + cpe:/a:postgresql:postgresql:8.4.12 + cpe:/a:postgresql:postgresql:8.4.11 + cpe:/a:postgresql:postgresql:8.4.17 + cpe:/a:postgresql:postgresql:8.4.16 + cpe:/a:postgresql:postgresql:8.4.15 + cpe:/a:postgresql:postgresql:8.4.14 + cpe:/a:postgresql:postgresql:9.0.15 + cpe:/a:postgresql:postgresql:8.4.19 + cpe:/a:postgresql:postgresql:9.1.1 + cpe:/a:postgresql:postgresql:9.1.9 + cpe:/a:postgresql:postgresql:9.0.10 + cpe:/a:postgresql:postgresql:9.0.11 + cpe:/a:postgresql:postgresql:9.0.12 + cpe:/a:postgresql:postgresql:9.0.13 + cpe:/a:postgresql:postgresql:9.0.14 + cpe:/a:postgresql:postgresql:8.4.18 + cpe:/a:postgresql:postgresql:9.0.1 + cpe:/a:postgresql:postgresql:9.3.1 + cpe:/a:postgresql:postgresql:9.3.2 + cpe:/a:postgresql:postgresql:9.1.2 + cpe:/a:postgresql:postgresql:9.1.3 + cpe:/a:postgresql:postgresql:9.1.4 + cpe:/a:postgresql:postgresql:9.1.5 + cpe:/a:postgresql:postgresql:9.1.6 + cpe:/a:postgresql:postgresql:9.1.7 + cpe:/a:postgresql:postgresql:9.0.2 + cpe:/a:postgresql:postgresql:9.1.8 + cpe:/a:postgresql:postgresql:8.4.10 + cpe:/a:postgresql:postgresql:8.4.9 + cpe:/a:postgresql:postgresql:8.4.8 + cpe:/a:postgresql:postgresql:8.4.2 + cpe:/a:postgresql:postgresql:8.4.1 + cpe:/a:postgresql:postgresql:8.4.6 + cpe:/a:postgresql:postgresql:8.4.5 + cpe:/a:postgresql:postgresql:8.4.4 + cpe:/a:postgresql:postgresql:8.4.3 + + CVE-2014-0063 + 2014-03-31T10:58:15.710-04:00 + 2014-03-31T13:50:48.670-04:00 + + + 6.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-31T13:50:48.357-04:00 + + + + + CONFIRM + https://github.com/postgres/postgres/commit/4318daecc959886d001a6e79c6ea853e8b1dfb4b + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1065226 + + + CONFIRM + http://www.postgresql.org/support/security/ + + + CONFIRM + http://www.postgresql.org/about/news/1506/ + + + DEBIAN + DSA-2865 + + + DEBIAN + DSA-2864 + + + CONFIRM + http://wiki.postgresql.org/wiki/20140220securityrelease + + Multiple stack-based buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via vectors related to an incorrect MAXDATELEN constant and datetime values involving (1) intervals, (2) timestamps, or (3) timezones, a different vulnerability than CVE-2014-0065. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:postgresql:postgresql:9.2.3 + cpe:/a:postgresql:postgresql:9.2.2 + cpe:/a:postgresql:postgresql:9.2.1 + cpe:/a:postgresql:postgresql:9.2.6 + cpe:/a:postgresql:postgresql:9.2.5 + cpe:/a:postgresql:postgresql:9.2.4 + cpe:/a:postgresql:postgresql:9.3 + cpe:/a:postgresql:postgresql:9.2 + cpe:/a:postgresql:postgresql:9.1 + cpe:/a:postgresql:postgresql:9.0 + cpe:/a:postgresql:postgresql:9.0.4 + cpe:/a:postgresql:postgresql:9.0.5 + cpe:/a:postgresql:postgresql:9.1.11 + cpe:/a:postgresql:postgresql:9.1.10 + cpe:/a:postgresql:postgresql:9.0.3 + cpe:/a:postgresql:postgresql:9.0.8 + cpe:/a:postgresql:postgresql:9.0.9 + cpe:/a:postgresql:postgresql:9.0.6 + cpe:/a:postgresql:postgresql:9.0.7 + cpe:/a:postgresql:postgresql:8.4.7 + cpe:/a:postgresql:postgresql:8.4.13 + cpe:/a:postgresql:postgresql:8.4.12 + cpe:/a:postgresql:postgresql:8.4.11 + cpe:/a:postgresql:postgresql:8.4.17 + cpe:/a:postgresql:postgresql:8.4.16 + cpe:/a:postgresql:postgresql:8.4.15 + cpe:/a:postgresql:postgresql:8.4.14 + cpe:/a:postgresql:postgresql:9.0.15 + cpe:/a:postgresql:postgresql:8.4.19 + cpe:/a:postgresql:postgresql:9.1.1 + cpe:/a:postgresql:postgresql:9.1.9 + cpe:/a:postgresql:postgresql:9.0.10 + cpe:/a:postgresql:postgresql:9.0.11 + cpe:/a:postgresql:postgresql:9.0.12 + cpe:/a:postgresql:postgresql:9.0.13 + cpe:/a:postgresql:postgresql:9.0.14 + cpe:/a:postgresql:postgresql:8.4.18 + cpe:/a:postgresql:postgresql:9.0.1 + cpe:/a:postgresql:postgresql:9.3.1 + cpe:/a:postgresql:postgresql:9.3.2 + cpe:/a:postgresql:postgresql:9.1.2 + cpe:/a:postgresql:postgresql:9.1.3 + cpe:/a:postgresql:postgresql:9.1.4 + cpe:/a:postgresql:postgresql:9.1.5 + cpe:/a:postgresql:postgresql:9.1.6 + cpe:/a:postgresql:postgresql:9.1.7 + cpe:/a:postgresql:postgresql:9.0.2 + cpe:/a:postgresql:postgresql:9.1.8 + cpe:/a:postgresql:postgresql:8.4.10 + cpe:/a:postgresql:postgresql:8.4.9 + cpe:/a:postgresql:postgresql:8.4.8 + cpe:/a:postgresql:postgresql:8.4.2 + cpe:/a:postgresql:postgresql:8.4.1 + cpe:/a:postgresql:postgresql:8.4.6 + cpe:/a:postgresql:postgresql:8.4.5 + cpe:/a:postgresql:postgresql:8.4.4 + cpe:/a:postgresql:postgresql:8.4.3 + + CVE-2014-0064 + 2014-03-31T10:58:15.740-04:00 + 2014-03-31T13:56:29.493-04:00 + + + 6.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-31T13:56:29.087-04:00 + + + + + CONFIRM + https://github.com/postgres/postgres/commit/31400a673325147e1205326008e32135a78b4d8a + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1065230 + + + CONFIRM + http://www.postgresql.org/support/security/ + + + CONFIRM + http://www.postgresql.org/about/news/1506/ + + + DEBIAN + DSA-2865 + + + DEBIAN + DSA-2864 + + + CONFIRM + http://wiki.postgresql.org/wiki/20140220securityrelease + + Multiple integer overflows in the path_in and other unspecified functions in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact and attack vectors, which trigger a buffer overflow. NOTE: this identifier has been SPLIT due to different affected versions; use CVE-2014-2669 for the hstore vector. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:postgresql:postgresql:9.2.3 + cpe:/a:postgresql:postgresql:9.2.2 + cpe:/a:postgresql:postgresql:9.2.1 + cpe:/a:postgresql:postgresql:9.2.6 + cpe:/a:postgresql:postgresql:9.2.5 + cpe:/a:postgresql:postgresql:9.2.4 + cpe:/a:postgresql:postgresql:9.3 + cpe:/a:postgresql:postgresql:9.2 + cpe:/a:postgresql:postgresql:9.1 + cpe:/a:postgresql:postgresql:9.0 + cpe:/a:postgresql:postgresql:9.0.4 + cpe:/a:postgresql:postgresql:9.0.5 + cpe:/a:postgresql:postgresql:9.1.11 + cpe:/a:postgresql:postgresql:9.1.10 + cpe:/a:postgresql:postgresql:9.0.3 + cpe:/a:postgresql:postgresql:9.0.8 + cpe:/a:postgresql:postgresql:9.0.9 + cpe:/a:postgresql:postgresql:9.0.6 + cpe:/a:postgresql:postgresql:9.0.7 + cpe:/a:postgresql:postgresql:8.4.7 + cpe:/a:postgresql:postgresql:8.4.13 + cpe:/a:postgresql:postgresql:8.4.12 + cpe:/a:postgresql:postgresql:8.4.11 + cpe:/a:postgresql:postgresql:8.4.17 + cpe:/a:postgresql:postgresql:8.4.16 + cpe:/a:postgresql:postgresql:8.4.15 + cpe:/a:postgresql:postgresql:8.4.14 + cpe:/a:postgresql:postgresql:9.0.15 + cpe:/a:postgresql:postgresql:8.4.19 + cpe:/a:postgresql:postgresql:9.1.1 + cpe:/a:postgresql:postgresql:9.1.9 + cpe:/a:postgresql:postgresql:9.0.10 + cpe:/a:postgresql:postgresql:9.0.11 + cpe:/a:postgresql:postgresql:9.0.12 + cpe:/a:postgresql:postgresql:9.0.13 + cpe:/a:postgresql:postgresql:9.0.14 + cpe:/a:postgresql:postgresql:8.4.18 + cpe:/a:postgresql:postgresql:9.0.1 + cpe:/a:postgresql:postgresql:9.3.1 + cpe:/a:postgresql:postgresql:9.3.2 + cpe:/a:postgresql:postgresql:9.1.2 + cpe:/a:postgresql:postgresql:9.1.3 + cpe:/a:postgresql:postgresql:9.1.4 + cpe:/a:postgresql:postgresql:9.1.5 + cpe:/a:postgresql:postgresql:9.1.6 + cpe:/a:postgresql:postgresql:9.1.7 + cpe:/a:postgresql:postgresql:9.0.2 + cpe:/a:postgresql:postgresql:9.1.8 + cpe:/a:postgresql:postgresql:8.4.10 + cpe:/a:postgresql:postgresql:8.4.9 + cpe:/a:postgresql:postgresql:8.4.8 + cpe:/a:postgresql:postgresql:8.4.2 + cpe:/a:postgresql:postgresql:8.4.1 + cpe:/a:postgresql:postgresql:8.4.6 + cpe:/a:postgresql:postgresql:8.4.5 + cpe:/a:postgresql:postgresql:8.4.4 + cpe:/a:postgresql:postgresql:8.4.3 + + CVE-2014-0065 + 2014-03-31T10:58:15.757-04:00 + 2014-04-03T13:15:49.360-04:00 + + + 6.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-31T14:04:39.213-04:00 + + + + + CONFIRM + http://www.postgresql.org/about/news/1506/ + + + DEBIAN + DSA-2865 + + + DEBIAN + DSA-2864 + + + CONFIRM + http://wiki.postgresql.org/wiki/20140220securityrelease + + Multiple buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact and attack vectors, a different vulnerability than CVE-2014-0063. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:postgresql:postgresql:9.2.3 + cpe:/a:postgresql:postgresql:9.2.2 + cpe:/a:postgresql:postgresql:9.2.1 + cpe:/a:postgresql:postgresql:9.2.6 + cpe:/a:postgresql:postgresql:9.2.5 + cpe:/a:postgresql:postgresql:9.2.4 + cpe:/a:postgresql:postgresql:9.3 + cpe:/a:postgresql:postgresql:9.2 + cpe:/a:postgresql:postgresql:9.1 + cpe:/a:postgresql:postgresql:9.0 + cpe:/a:postgresql:postgresql:9.0.4 + cpe:/a:postgresql:postgresql:9.0.5 + cpe:/a:postgresql:postgresql:9.1.11 + cpe:/a:postgresql:postgresql:9.1.10 + cpe:/a:postgresql:postgresql:9.0.3 + cpe:/a:postgresql:postgresql:9.0.8 + cpe:/a:postgresql:postgresql:9.0.9 + cpe:/a:postgresql:postgresql:9.0.6 + cpe:/a:postgresql:postgresql:9.0.7 + cpe:/a:postgresql:postgresql:8.4.7 + cpe:/a:postgresql:postgresql:8.4.13 + cpe:/a:postgresql:postgresql:8.4.12 + cpe:/a:postgresql:postgresql:8.4.11 + cpe:/a:postgresql:postgresql:8.4.17 + cpe:/a:postgresql:postgresql:8.4.16 + cpe:/a:postgresql:postgresql:8.4.15 + cpe:/a:postgresql:postgresql:8.4.14 + cpe:/a:postgresql:postgresql:9.0.15 + cpe:/a:postgresql:postgresql:8.4.19 + cpe:/a:postgresql:postgresql:9.1.1 + cpe:/a:postgresql:postgresql:9.1.9 + cpe:/a:postgresql:postgresql:9.0.10 + cpe:/a:postgresql:postgresql:9.0.11 + cpe:/a:postgresql:postgresql:9.0.12 + cpe:/a:postgresql:postgresql:9.0.13 + cpe:/a:postgresql:postgresql:9.0.14 + cpe:/a:postgresql:postgresql:8.4.18 + cpe:/a:postgresql:postgresql:9.0.1 + cpe:/a:postgresql:postgresql:9.3.1 + cpe:/a:postgresql:postgresql:9.3.2 + cpe:/a:postgresql:postgresql:9.1.2 + cpe:/a:postgresql:postgresql:9.1.3 + cpe:/a:postgresql:postgresql:9.1.4 + cpe:/a:postgresql:postgresql:9.1.5 + cpe:/a:postgresql:postgresql:9.1.6 + cpe:/a:postgresql:postgresql:9.1.7 + cpe:/a:postgresql:postgresql:9.0.2 + cpe:/a:postgresql:postgresql:9.1.8 + cpe:/a:postgresql:postgresql:8.4.10 + cpe:/a:postgresql:postgresql:8.4.9 + cpe:/a:postgresql:postgresql:8.4.8 + cpe:/a:postgresql:postgresql:8.4.2 + cpe:/a:postgresql:postgresql:8.4.1 + cpe:/a:postgresql:postgresql:8.4.6 + cpe:/a:postgresql:postgresql:8.4.5 + cpe:/a:postgresql:postgresql:8.4.4 + cpe:/a:postgresql:postgresql:8.4.3 + + CVE-2014-0066 + 2014-03-31T10:58:15.773-04:00 + 2014-04-03T13:53:27.483-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-03-31T14:03:16.430-04:00 + + + + + CONFIRM + http://www.postgresql.org/about/news/1506/ + + + DEBIAN + DSA-2865 + + + DEBIAN + DSA-2864 + + + CONFIRM + http://wiki.postgresql.org/wiki/20140220securityrelease + + The chkpass extension in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly check the return value of the crypt library function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:postgresql:postgresql:9.2.3 + cpe:/a:postgresql:postgresql:9.2.2 + cpe:/a:postgresql:postgresql:9.2.1 + cpe:/a:postgresql:postgresql:9.2.6 + cpe:/a:postgresql:postgresql:9.2.5 + cpe:/a:postgresql:postgresql:9.2.4 + cpe:/a:postgresql:postgresql:9.3 + cpe:/a:postgresql:postgresql:9.2 + cpe:/a:postgresql:postgresql:9.1 + cpe:/a:postgresql:postgresql:9.0 + cpe:/a:postgresql:postgresql:9.0.4 + cpe:/a:postgresql:postgresql:9.0.5 + cpe:/a:postgresql:postgresql:9.1.11 + cpe:/a:postgresql:postgresql:9.1.10 + cpe:/a:postgresql:postgresql:9.0.3 + cpe:/a:postgresql:postgresql:9.0.8 + cpe:/a:postgresql:postgresql:9.0.9 + cpe:/a:postgresql:postgresql:9.0.6 + cpe:/a:postgresql:postgresql:9.0.7 + cpe:/a:postgresql:postgresql:8.4.7 + cpe:/a:postgresql:postgresql:8.4.13 + cpe:/a:postgresql:postgresql:8.4.12 + cpe:/a:postgresql:postgresql:8.4.11 + cpe:/a:postgresql:postgresql:8.4.17 + cpe:/a:postgresql:postgresql:8.4.16 + cpe:/a:postgresql:postgresql:8.4.15 + cpe:/a:postgresql:postgresql:8.4.14 + cpe:/a:postgresql:postgresql:9.0.15 + cpe:/a:postgresql:postgresql:8.4.19 + cpe:/a:postgresql:postgresql:9.1.1 + cpe:/a:postgresql:postgresql:9.1.9 + cpe:/a:postgresql:postgresql:9.0.10 + cpe:/a:postgresql:postgresql:9.0.11 + cpe:/a:postgresql:postgresql:9.0.12 + cpe:/a:postgresql:postgresql:9.0.13 + cpe:/a:postgresql:postgresql:9.0.14 + cpe:/a:postgresql:postgresql:8.4.18 + cpe:/a:postgresql:postgresql:9.0.1 + cpe:/a:postgresql:postgresql:9.3.1 + cpe:/a:postgresql:postgresql:9.3.2 + cpe:/a:postgresql:postgresql:9.1.2 + cpe:/a:postgresql:postgresql:9.1.3 + cpe:/a:postgresql:postgresql:9.1.4 + cpe:/a:postgresql:postgresql:9.1.5 + cpe:/a:postgresql:postgresql:9.1.6 + cpe:/a:postgresql:postgresql:9.1.7 + cpe:/a:postgresql:postgresql:9.0.2 + cpe:/a:postgresql:postgresql:9.1.8 + cpe:/a:postgresql:postgresql:8.4.10 + cpe:/a:postgresql:postgresql:8.4.9 + cpe:/a:postgresql:postgresql:8.4.8 + cpe:/a:postgresql:postgresql:8.4.2 + cpe:/a:postgresql:postgresql:8.4.1 + cpe:/a:postgresql:postgresql:8.4.6 + cpe:/a:postgresql:postgresql:8.4.5 + cpe:/a:postgresql:postgresql:8.4.4 + cpe:/a:postgresql:postgresql:8.4.3 + + CVE-2014-0067 + 2014-03-31T10:58:15.787-04:00 + 2014-03-31T13:58:37.420-04:00 + + + 4.6 + LOCAL + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-31T13:58:37.107-04:00 + + + + + CONFIRM + http://www.postgresql.org/about/news/1506/ + + + DEBIAN + DSA-2865 + + + DEBIAN + DSA-2864 + + + CONFIRM + http://wiki.postgresql.org/wiki/20140220securityrelease + + The "make check" command for the test suites in PostgreSQL 9.3.3 and earlier does not properly invoke initdb to specify the authentication requirements for a database cluster to be used for the tests, which allows local users to gain privileges by leveraging access to this cluster. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:linux:linux_kernel:3.0.48 + cpe:/o:linux:linux_kernel:3.0.49 + cpe:/o:linux:linux_kernel:3.0.46 + cpe:/o:linux:linux_kernel:3.0.47 + cpe:/o:linux:linux_kernel:3.0.44 + cpe:/o:linux:linux_kernel:3.0.45 + cpe:/o:linux:linux_kernel:3.0.42 + cpe:/o:linux:linux_kernel:3.4.70 + cpe:/o:linux:linux_kernel:3.4.71 + cpe:/o:linux:linux_kernel:3.0.40 + cpe:/o:linux:linux_kernel:3.0.41 + cpe:/o:linux:linux_kernel:3.4.45 + cpe:/o:linux:linux_kernel:3.4.44 + cpe:/o:linux:linux_kernel:3.4.46 + cpe:/o:linux:linux_kernel:3.4.41 + cpe:/o:linux:linux_kernel:3.4.40 + cpe:/o:linux:linux_kernel:3.4.43 + cpe:/o:linux:linux_kernel:3.4.42 + cpe:/o:linux:linux_kernel:3.4.49 + cpe:/o:linux:linux_kernel:3.4.48 + cpe:/o:linux:linux_kernel:3.0.59 + cpe:/o:linux:linux_kernel:3.4.47 + cpe:/o:linux:linux_kernel:3.0.55 + cpe:/o:linux:linux_kernel:3.0.56 + cpe:/o:linux:linux_kernel:3.0.57 + cpe:/o:linux:linux_kernel:3.0.58 + cpe:/o:linux:linux_kernel:3.0.51 + cpe:/o:linux:linux_kernel:3.0.52 + cpe:/o:linux:linux_kernel:3.0.53 + cpe:/o:linux:linux_kernel:3.11.10 + cpe:/o:linux:linux_kernel:3.0.50 + cpe:/o:linux:linux_kernel:3.4.57 + cpe:/o:linux:linux_kernel:3.4.56 + cpe:/o:linux:linux_kernel:3.4.55 + cpe:/o:linux:linux_kernel:3.4.54 + cpe:/o:linux:linux_kernel:3.4.53 + cpe:/o:linux:linux_kernel:3.4.52 + cpe:/o:linux:linux_kernel:3.4.51 + cpe:/o:linux:linux_kernel:3.4.50 + cpe:/o:linux:linux_kernel:3.0.43 + cpe:/o:linux:linux_kernel:3.10.26 + cpe:/o:linux:linux_kernel:3.4.59 + cpe:/o:linux:linux_kernel:3.0.24 + cpe:/o:linux:linux_kernel:3.0.25 + cpe:/o:linux:linux_kernel:3.0.22 + cpe:/o:linux:linux_kernel:3.1.9 + cpe:/o:linux:linux_kernel:3.0.23 + cpe:/o:linux:linux_kernel:3.10.28 + cpe:/o:linux:linux_kernel:3.0.28 + cpe:/o:linux:linux_kernel:3.10.27 + cpe:/o:linux:linux_kernel:3.0.26 + cpe:/o:linux:linux_kernel:3.10.29 + cpe:/o:linux:linux_kernel:3.4.58 + cpe:/o:linux:linux_kernel:3.0.27 + cpe:/o:linux:linux_kernel:3.10.24 + cpe:/o:linux:linux_kernel:3.10.23 + cpe:/o:linux:linux_kernel:3.10.25 + cpe:/o:linux:linux_kernel:3.10.20 + cpe:/o:linux:linux_kernel:3.1.8 + cpe:/o:linux:linux_kernel:3.0.20 + cpe:/o:linux:linux_kernel:3.10.22 + cpe:/o:linux:linux_kernel:3.10.21 + cpe:/o:linux:linux_kernel:3.4.21 + cpe:/o:linux:linux_kernel:3.4.20 + cpe:/o:linux:linux_kernel:3.4.23 + cpe:/o:linux:linux_kernel:3.4.22 + cpe:/o:linux:linux_kernel:3.4.24 + cpe:/o:linux:linux_kernel:3.4.27 + cpe:/o:linux:linux_kernel:3.4.26 + cpe:/o:linux:linux_kernel:3.4.29 + cpe:/o:linux:linux_kernel:3.10.15 + cpe:/o:linux:linux_kernel:3.4.28 + cpe:/o:linux:linux_kernel:3.0.54 + cpe:/o:linux:linux_kernel:3.0.33 + cpe:/o:linux:linux_kernel:3.0.34 + cpe:/o:linux:linux_kernel:3.0.35 + cpe:/o:linux:linux_kernel:3.0.36 + cpe:/o:linux:linux_kernel:3.10.19 + cpe:/o:linux:linux_kernel:3.0.37 + cpe:/o:linux:linux_kernel:3.10.18 + cpe:/o:linux:linux_kernel:3.0.38 + cpe:/o:linux:linux_kernel:3.4.25 + cpe:/o:linux:linux_kernel:3.10.17 + cpe:/o:linux:linux_kernel:3.0.39 + cpe:/o:linux:linux_kernel:3.10.16 + cpe:/o:linux:linux_kernel:3.10.14 + cpe:/o:linux:linux_kernel:3.10.13 + cpe:/o:linux:linux_kernel:3.10.12 + cpe:/o:linux:linux_kernel:3.10.11 + cpe:/o:linux:linux_kernel:3.10.10 + cpe:/o:linux:linux_kernel:3.0.30 + cpe:/o:linux:linux_kernel:3.0.31 + cpe:/o:linux:linux_kernel:3.9.8 + cpe:/o:linux:linux_kernel:3.5.5 + cpe:/o:linux:linux_kernel:3.4.32 + cpe:/o:linux:linux_kernel:3.9.9 + cpe:/o:linux:linux_kernel:3.5.6 + cpe:/o:linux:linux_kernel:3.4.31 + cpe:/o:linux:linux_kernel:3.5.7 + cpe:/o:linux:linux_kernel:3.4.30 + cpe:/o:linux:linux_kernel:3.7.1 + cpe:/o:linux:linux_kernel:3.4.35 + cpe:/o:linux:linux_kernel:3.9.0 + cpe:/o:linux:linux_kernel:3.0.18 + cpe:/o:linux:linux_kernel:3.4.34 + cpe:/o:linux:linux_kernel:3.4.33 + cpe:/o:linux:linux_kernel:3.9.2 + cpe:/o:linux:linux_kernel:3.9.1 + cpe:/o:linux:linux_kernel:3.0.19 + cpe:/o:linux:linux_kernel:3.4.39 + cpe:/o:linux:linux_kernel:3.9.4 + cpe:/o:linux:linux_kernel:3.4.38 + cpe:/o:linux:linux_kernel:3.9.3 + cpe:/o:linux:linux_kernel:3.4.37 + cpe:/o:linux:linux_kernel:3.9.6 + cpe:/o:linux:linux_kernel:3.9.5 + cpe:/o:linux:linux_kernel:3.0.21 + cpe:/o:linux:linux_kernel:3.9.7 + cpe:/o:linux:linux_kernel:3.5.4 + cpe:/o:linux:linux_kernel:3.0.4 + cpe:/o:linux:linux_kernel:3.0.5 + cpe:/o:linux:linux_kernel:3.0.2 + cpe:/o:linux:linux_kernel:3.0.3 + cpe:/o:linux:linux_kernel:3.0.8 + cpe:/o:linux:linux_kernel:3.0.6 + cpe:/o:linux:linux_kernel:3.0.7 + cpe:/o:linux:linux_kernel:3.4.36 + cpe:/o:linux:linux_kernel:3.13.1 + cpe:/o:linux:linux_kernel:3.6.10 + cpe:/o:linux:linux_kernel:3.6.11 + cpe:/o:linux:linux_kernel:3.13.4 + cpe:/o:linux:linux_kernel:3.13.5 + cpe:/o:linux:linux_kernel:3.13.2 + cpe:/o:linux:linux_kernel:3.13.3 + cpe:/o:linux:linux_kernel:3.4.1 + cpe:/o:linux:linux_kernel:3.4.19 + cpe:/o:linux:linux_kernel:3.4.17 + cpe:/o:linux:linux_kernel:3.4.3 + cpe:/o:linux:linux_kernel:3.4.18 + cpe:/o:linux:linux_kernel:3.4.2 + cpe:/o:linux:linux_kernel:3.2.9 + cpe:/o:linux:linux_kernel:3.4.15 + cpe:/o:linux:linux_kernel:3.2.8 + cpe:/o:linux:linux_kernel:3.4.16 + cpe:/o:linux:linux_kernel:3.4.4 + cpe:/o:linux:linux_kernel:3.12.12 + cpe:/o:linux:linux_kernel:3.2.7 + cpe:/o:linux:linux_kernel:3.4.13 + cpe:/o:linux:linux_kernel:3.12.13 + cpe:/o:linux:linux_kernel:3.12.10 + cpe:/o:linux:linux_kernel:3.4.11 + cpe:/o:linux:linux_kernel:3.12.11 + cpe:/o:linux:linux_kernel:3.4.12 + cpe:/o:linux:linux_kernel:3.4.10 + cpe:/o:linux:linux_kernel:3.0.61 + cpe:/o:linux:linux_kernel:3.3:rc2 + cpe:/o:linux:linux_kernel:3.4:rc7 + cpe:/o:linux:linux_kernel:3.0.60 + cpe:/o:linux:linux_kernel:3.3:rc7 + cpe:/o:linux:linux_kernel:3.4:rc5 + cpe:/o:linux:linux_kernel:3.3:rc5 + cpe:/o:linux:linux_kernel:3.4:rc6 + cpe:/o:linux:linux_kernel:3.3:rc6 + cpe:/o:linux:linux_kernel:3.0.64 + cpe:/o:linux:linux_kernel:3.0.63 + cpe:/o:linux:linux_kernel:3.0.62 + cpe:/o:linux:linux_kernel:3.12.1 + cpe:/o:linux:linux_kernel:3.0.68 + cpe:/o:linux:linux_kernel:3.0.67 + cpe:/o:linux:linux_kernel:3.0.66 + cpe:/o:linux:linux_kernel:3.4.14 + cpe:/o:linux:linux_kernel:3.12.7 + cpe:/o:linux:linux_kernel:3.2:rc2 + cpe:/o:linux:linux_kernel:3.1:rc1 + cpe:/o:linux:linux_kernel:3.0.9 + cpe:/o:linux:linux_kernel:3.0:rc4 + cpe:/o:linux:linux_kernel:3.12.8 + cpe:/o:linux:linux_kernel:3.1:rc4 + cpe:/o:linux:linux_kernel:3.0:rc3 + cpe:/o:linux:linux_kernel:3.12.9 + cpe:/o:linux:linux_kernel:3.0:rc2 + cpe:/o:linux:linux_kernel:3.1:rc2 + cpe:/o:linux:linux_kernel:3.0:rc1 + cpe:/o:linux:linux_kernel:3.2:rc7 + cpe:/o:linux:linux_kernel:3.12.3 + cpe:/o:linux:linux_kernel:3.2:rc6 + cpe:/o:linux:linux_kernel:3.1.10 + cpe:/o:linux:linux_kernel:3.12.4 + cpe:/o:linux:linux_kernel:3.2:rc5 + cpe:/o:linux:linux_kernel:3.0:rc7 + cpe:/o:linux:linux_kernel:3.12.5 + cpe:/o:linux:linux_kernel:3.9:rc3 + cpe:/o:linux:linux_kernel:3.0:rc6 + cpe:/o:linux:linux_kernel:3.12.6 + cpe:/o:linux:linux_kernel:3.0:rc5 + cpe:/o:linux:linux_kernel:3.9:rc1 + cpe:/o:linux:linux_kernel:3.9:rc4 + cpe:/o:linux:linux_kernel:3.9:rc7 + cpe:/o:linux:linux_kernel:3.12.2 + cpe:/o:linux:linux_kernel:3.9:rc2 + cpe:/o:linux:linux_kernel:3.9:rc5 + cpe:/o:linux:linux_kernel:3.3:rc3 + cpe:/o:linux:linux_kernel:3.4:rc4 + cpe:/o:linux:linux_kernel:3.4:rc3 + cpe:/o:linux:linux_kernel:3.3:rc1 + cpe:/o:linux:linux_kernel:3.4:rc2 + cpe:/o:linux:linux_kernel:3.9:rc6 + cpe:/o:linux:linux_kernel:3.3:rc4 + cpe:/o:linux:linux_kernel:3.4:rc1 + cpe:/o:linux:linux_kernel:3.4.5 + cpe:/o:linux:linux_kernel:3.2.2 + cpe:/o:linux:linux_kernel:3.2.3 + cpe:/o:linux:linux_kernel:3.2.1 + cpe:/o:linux:linux_kernel:3.4.6 + cpe:/o:linux:linux_kernel:3.2:rc3 + cpe:/o:linux:linux_kernel:3.2.6 + cpe:/o:linux:linux_kernel:3.4.7 + cpe:/o:linux:linux_kernel:3.2:rc4 + cpe:/o:linux:linux_kernel:3.1:rc3 + cpe:/o:linux:linux_kernel:3.4.8 + cpe:/o:linux:linux_kernel:3.2.4 + cpe:/o:linux:linux_kernel:3.4.9 + cpe:/o:linux:linux_kernel:3.2.5 + cpe:/o:linux:linux_kernel:3.0.65 + cpe:/o:linux:linux_kernel:3.2.12 + cpe:/o:linux:linux_kernel:3.8.10 + cpe:/o:linux:linux_kernel:3.8.12 + cpe:/o:linux:linux_kernel:3.8.11 + cpe:/o:linux:linux_kernel:3.8.13 + cpe:/o:linux:linux_kernel:3.7.9 + cpe:/o:linux:linux_kernel:3.7.8 + cpe:/o:linux:linux_kernel:3.7.7 + cpe:/o:linux:linux_kernel:3.7.6 + cpe:/o:linux:linux_kernel:3.6.3 + cpe:/o:linux:linux_kernel:3.7.5 + cpe:/o:linux:linux_kernel:3.7.4 + cpe:/o:linux:linux_kernel:3.7.3 + cpe:/o:linux:linux_kernel:3.7.2 + cpe:/o:linux:linux_kernel:3.6.7 + cpe:/o:linux:linux_kernel:3.6.6 + cpe:/o:linux:linux_kernel:3.6.5 + cpe:/o:linux:linux_kernel:3.6.4 + cpe:/o:linux:linux_kernel:3.6.9 + cpe:/o:linux:linux_kernel:3.6.8 + cpe:/o:linux:linux_kernel:3.10 + cpe:/o:linux:linux_kernel:3.11 + cpe:/o:linux:linux_kernel:3.12 + cpe:/o:linux:linux_kernel:3.13 + cpe:/o:linux:linux_kernel:3.10.1 + cpe:/o:linux:linux_kernel:3.10.2 + cpe:/o:linux:linux_kernel:3.10.3 + cpe:/o:linux:linux_kernel:3.6.2 + cpe:/o:linux:linux_kernel:3.6.1 + cpe:/o:linux:linux_kernel:3.3.6 + cpe:/o:linux:linux_kernel:3.3.7 + cpe:/o:linux:linux_kernel:3.3.8 + cpe:/o:linux:linux_kernel:3.0.1 + cpe:/o:linux:linux_kernel:3.2 + cpe:/o:linux:linux_kernel:3.1 + cpe:/o:linux:linux_kernel:3.7 + cpe:/o:linux:linux_kernel:3.6 + cpe:/o:linux:linux_kernel:3.4 + cpe:/o:linux:linux_kernel:3.1.6 + cpe:/o:linux:linux_kernel:3.1.5 + cpe:/o:linux:linux_kernel:3.1.7 + cpe:/o:linux:linux_kernel:3.0.32 + cpe:/o:linux:linux_kernel:3.8.9 + cpe:/o:linux:linux_kernel:3.1.2 + cpe:/o:linux:linux_kernel:3.1.1 + cpe:/o:linux:linux_kernel:3.1.4 + cpe:/o:linux:linux_kernel:3.1.3 + cpe:/o:linux:linux_kernel:3.9.10 + cpe:/o:linux:linux_kernel:3.0.29 + cpe:/o:linux:linux_kernel:3.3 + cpe:/o:linux:linux_kernel:3.8.4 + cpe:/o:linux:linux_kernel:3.2.26 + cpe:/o:linux:linux_kernel:3.8.5 + cpe:/o:linux:linux_kernel:3.2.27 + cpe:/o:linux:linux_kernel:3.8.2 + cpe:/o:linux:linux_kernel:3.2.24 + cpe:/o:linux:linux_kernel:3.8.3 + cpe:/o:linux:linux_kernel:3.2.25 + cpe:/o:linux:linux_kernel:3.8.8 + cpe:/o:linux:linux_kernel:3.8.6 + cpe:/o:linux:linux_kernel:3.2.28 + cpe:/o:linux:linux_kernel:3.8.7 + cpe:/o:linux:linux_kernel:3.2.29 + cpe:/o:linux:linux_kernel:3.3.3 + cpe:/o:linux:linux_kernel:3.3.4 + cpe:/o:linux:linux_kernel:3.3.5 + cpe:/o:linux:linux_kernel:3.2.22 + cpe:/o:linux:linux_kernel:3.8.1 + cpe:/o:linux:linux_kernel:3.2.20 + cpe:/o:linux:linux_kernel:3.3.1 + cpe:/o:linux:linux_kernel:3.2.21 + cpe:/o:linux:linux_kernel:3.3.2 + cpe:/o:linux:linux_kernel:3.11.1 + cpe:/o:linux:linux_kernel:3.11.2 + cpe:/o:linux:linux_kernel:3.2.23 + cpe:/o:linux:linux_kernel:3.0.17 + cpe:/o:linux:linux_kernel:3.9.11 + cpe:/o:linux:linux_kernel:3.0.16 + cpe:/o:linux:linux_kernel:3.0.15 + cpe:/o:linux:linux_kernel:3.2.30 + cpe:/o:linux:linux_kernel:3.0.14 + cpe:/o:linux:linux_kernel:3.0.13 + cpe:/o:linux:linux_kernel:3.0.12 + cpe:/o:linux:linux_kernel:3.0.11 + cpe:/o:linux:linux_kernel:3.4.61 + cpe:/o:linux:linux_kernel:3.0.10 + cpe:/o:linux:linux_kernel:3.4.64 + cpe:/o:linux:linux_kernel:3.8.0 + cpe:/o:linux:linux_kernel:3.4.65 + cpe:/o:linux:linux_kernel:3.4.62 + cpe:/o:linux:linux_kernel:3.4.63 + cpe:/o:linux:linux_kernel:3.4.68 + cpe:/o:linux:linux_kernel:3.4.66 + cpe:/o:linux:linux_kernel:3.4.67 + cpe:/o:linux:linux_kernel:3.5.3 + cpe:/o:linux:linux_kernel:3.5.1 + cpe:/o:linux:linux_kernel:3.5.2 + cpe:/o:linux:linux_kernel:3.10.4 + cpe:/o:linux:linux_kernel:3.4.72 + cpe:/o:linux:linux_kernel:3.10.9 + cpe:/o:linux:linux_kernel:3.4.73 + cpe:/o:linux:linux_kernel:3.4.74 + cpe:/o:linux:linux_kernel:3.4.75 + cpe:/o:linux:linux_kernel:3.4.76 + cpe:/o:linux:linux_kernel:3.10.5 + cpe:/o:linux:linux_kernel:3.4.77 + cpe:/o:linux:linux_kernel:3.10.6 + cpe:/o:linux:linux_kernel:3.4.78 + cpe:/o:linux:linux_kernel:3.10.7 + cpe:/o:linux:linux_kernel:3.4.79 + cpe:/o:linux:linux_kernel:3.10.8 + cpe:/o:linux:linux_kernel:3.7.10 + cpe:/o:linux:linux_kernel:3.2.17 + cpe:/o:linux:linux_kernel:3.2.18 + cpe:/o:linux:linux_kernel:3.2.19 + cpe:/o:linux:linux_kernel:3.2.13 + cpe:/o:linux:linux_kernel:3.2.14 + cpe:/o:linux:linux_kernel:3.11.3 + cpe:/o:linux:linux_kernel:3.2.15 + cpe:/o:linux:linux_kernel:3.4.60 + cpe:/o:linux:linux_kernel:3.2.16 + cpe:/o:linux:linux_kernel:3.11.5 + cpe:/o:linux:linux_kernel:3.11.4 + cpe:/o:linux:linux_kernel:3.2.10 + cpe:/o:linux:linux_kernel:3.11.7 + cpe:/o:linux:linux_kernel:3.2.11 + cpe:/o:linux:linux_kernel:3.11.6 + cpe:/o:linux:linux_kernel:3.11.9 + cpe:/o:linux:linux_kernel:3.11.8 + cpe:/o:linux:linux_kernel:3.4.69 + + CVE-2014-0069 + 2014-02-28T01:18:54.010-05:00 + 2014-04-01T02:27:57.107-04:00 + + + 6.2 + LOCAL + HIGH + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-28T12:03:13.557-05:00 + + + + + CONFIRM + https://github.com/torvalds/linux/commit/5d81de8e8667da7135d3a32a964087c0faf5483f + + + CONFIRM + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=5d81de8e8667da7135d3a32a964087c0faf5483f + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1064253 + + + MLIST + [oss-security] 20140217 CVE-2014-0069 -- kernel: cifs: incorrect handling of bogus user pointers during uncached writes + + + REDHAT + RHSA-2014:0328 + + + MLIST + [linux-cifs] 20140214 [PATCH] cifs: ensure that uncached writes handle unmapped areas correctly + + The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer. + + + CVE-2014-0070 + 2014-02-26T20:55:02.993-05:00 + 2014-02-26T20:55:03.070-05:00 + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. + + + + + + + + + cpe:/a:redhat:openstack:4.0 + + CVE-2014-0071 + 2014-04-17T10:55:06.450-04:00 + 2014-04-17T12:00:04.640-04:00 + + + 6.4 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-17T12:00:04.533-04:00 + + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1064163 + + + BID + 66001 + + + REDHAT + RHSA-2014:0233 + + PackStack in Red Hat OpenStack 4.0 does not enforce the default security groups when deployed to Neutron, which allows remote attackers to bypass intended access restrictions and make unauthorized connections. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:openssl:openssl:1.0.0:beta1 + cpe:/a:openssl:openssl:0.9.8u + cpe:/a:openssl:openssl:0.9.6:beta1 + cpe:/a:openssl:openssl:0.9.7:beta6 + cpe:/a:openssl:openssl:0.9.7k + cpe:/a:openssl:openssl:0.9.7:beta1 + cpe:/a:openssl:openssl:0.9.8w + cpe:/a:openssl:openssl:0.9.6:beta3 + cpe:/a:openssl:openssl:0.9.5:beta2 + cpe:/a:openssl:openssl:0.9.8v + cpe:/a:openssl:openssl:0.9.6:beta2 + cpe:/a:openssl:openssl:0.9.7:beta3 + cpe:/a:openssl:openssl:0.9.7:beta2 + cpe:/a:openssl:openssl:0.9.7h + cpe:/a:openssl:openssl:0.9.8m:beta1 + cpe:/a:openssl:openssl:0.9.3 + cpe:/a:openssl:openssl:0.9.7g + cpe:/a:openssl:openssl:1.0.0:beta3 + cpe:/a:openssl:openssl:0.9.4 + cpe:/a:openssl:openssl:0.9.7j + cpe:/a:openssl:openssl:1.0.0:beta2 + cpe:/a:openssl:openssl:0.9.5 + cpe:/a:openssl:openssl:0.9.7i + cpe:/a:openssl:openssl:0.9.6 + cpe:/a:openssl:openssl:0.9.7d + cpe:/a:openssl:openssl:0.9.7 + cpe:/a:openssl:openssl:0.9.8 + cpe:/a:openssl:openssl:0.9.7f + cpe:/a:openssl:openssl:0.9.7e + cpe:/a:openssl:openssl:1.0.0:beta5 + cpe:/a:openssl:openssl:0.9.8y + cpe:/a:openssl:openssl:1.0.0:beta4 + cpe:/a:openssl:openssl:0.9.8x + cpe:/a:openssl:openssl:0.9.7:beta5 + cpe:/a:openssl:openssl:0.9.7:beta4 + cpe:/a:openssl:openssl:0.9.5:beta1 + cpe:/a:openssl:openssl:0.9.7l + cpe:/a:openssl:openssl:0.9.7m + cpe:/a:openssl:openssl:0.9.5a + cpe:/a:openssl:openssl:1.0.0d + cpe:/a:openssl:openssl:1.0.0a + cpe:/a:openssl:openssl:1.0.0c + cpe:/a:openssl:openssl:1.0.0b + cpe:/a:openssl:openssl:1.0.0l + cpe:/a:openssl:openssl:1.0.0j + cpe:/a:openssl:openssl:1.0.0k + cpe:/a:openssl:openssl:1.0.0h + cpe:/a:openssl:openssl:1.0.0i + cpe:/a:openssl:openssl:1.0.0f + cpe:/a:openssl:openssl:0.9.8o + cpe:/a:openssl:openssl:1.0.0g + cpe:/a:openssl:openssl:0.9.8n + cpe:/a:openssl:openssl:0.9.8m + cpe:/a:openssl:openssl:1.0.0e + cpe:/a:openssl:openssl:0.9.8f + cpe:/a:openssl:openssl:0.9.8g + cpe:/a:openssl:openssl:0.9.8t + cpe:/a:openssl:openssl:0.9.8e + cpe:/a:openssl:openssl:0.9.6a:beta1 + cpe:/a:openssl:openssl:0.9.8r + cpe:/a:openssl:openssl:0.9.3a + cpe:/a:openssl:openssl:0.9.8s + cpe:/a:openssl:openssl:0.9.6a:beta3 + cpe:/a:openssl:openssl:0.9.8p + cpe:/a:openssl:openssl:0.9.6a:beta2 + cpe:/a:openssl:openssl:0.9.8q + cpe:/a:openssl:openssl:0.9.8l + cpe:/a:openssl:openssl:0.9.6b + cpe:/a:openssl:openssl:0.9.8j + cpe:/a:openssl:openssl:0.9.8k + cpe:/a:openssl:openssl:0.9.6a + cpe:/a:openssl:openssl:0.9.8h + cpe:/a:openssl:openssl:0.9.8i + cpe:/a:openssl:openssl:0.9.5a:beta2 + cpe:/a:openssl:openssl:1.0.0 + cpe:/a:openssl:openssl:0.9.7a + cpe:/a:openssl:openssl:0.9.5a:beta1 + cpe:/a:openssl:openssl:0.9.7b + cpe:/a:openssl:openssl:0.9.2b + cpe:/a:openssl:openssl:0.9.7c + cpe:/a:openssl:openssl:0.9.6i + cpe:/a:openssl:openssl:0.9.6h + cpe:/a:openssl:openssl:0.9.6g + cpe:/a:openssl:openssl:0.9.6f + cpe:/a:openssl:openssl:0.9.6j + cpe:/a:openssl:openssl:0.9.6e + cpe:/a:openssl:openssl:0.9.6d + cpe:/a:openssl:openssl:0.9.6c + cpe:/a:openssl:openssl:0.9.6l + cpe:/a:openssl:openssl:0.9.1c + cpe:/a:openssl:openssl:0.9.6m + cpe:/a:openssl:openssl:0.9.6k + cpe:/a:openssl:openssl:0.9.8b + cpe:/a:openssl:openssl:0.9.8c + cpe:/a:openssl:openssl:0.9.8a + cpe:/a:openssl:openssl:0.9.8d + + CVE-2014-0076 + 2014-03-25T09:25:21.977-04:00 + 2014-03-26T00:55:49.000-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-03-25T10:32:53.127-04:00 + + + + + CONFIRM + https://bugzilla.novell.com/show_bug.cgi?id=869945 + + + CONFIRM + https://bugs.gentoo.org/show_bug.cgi?id=505278 + + + CONFIRM + http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=2198be3483259de374f91e57d247d0fc667aef29 + + + MISC + http://eprint.iacr.org/2014/140 + + The Montgomery ladder implementation in OpenSSL through 1.0.0l does not ensure that certain swap operations have a constant-time behavior, which makes it easier for local users to obtain ECDSA nonces via a FLUSH+RELOAD cache side-channel attack. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:linux:linux_kernel:3.0.48 + cpe:/o:linux:linux_kernel:3.0.49 + cpe:/o:linux:linux_kernel:3.0.46 + cpe:/o:linux:linux_kernel:3.0.47 + cpe:/o:linux:linux_kernel:3.0.44 + cpe:/o:linux:linux_kernel:3.0.45 + cpe:/o:linux:linux_kernel:3.0.42 + cpe:/o:linux:linux_kernel:3.4.70 + cpe:/o:linux:linux_kernel:3.4.71 + cpe:/o:linux:linux_kernel:3.0.40 + cpe:/o:linux:linux_kernel:3.0.41 + cpe:/o:linux:linux_kernel:3.4.45 + cpe:/o:linux:linux_kernel:3.4.44 + cpe:/o:linux:linux_kernel:3.4.46 + cpe:/o:linux:linux_kernel:3.4.41 + cpe:/o:linux:linux_kernel:3.4.40 + cpe:/o:linux:linux_kernel:3.4.43 + cpe:/o:linux:linux_kernel:3.4.42 + cpe:/o:linux:linux_kernel:3.4.49 + cpe:/o:linux:linux_kernel:3.4.48 + cpe:/o:linux:linux_kernel:3.0.59 + cpe:/o:linux:linux_kernel:3.4.47 + cpe:/o:linux:linux_kernel:3.0.55 + cpe:/o:linux:linux_kernel:3.0.56 + cpe:/o:linux:linux_kernel:3.0.57 + cpe:/o:linux:linux_kernel:3.0.58 + cpe:/o:linux:linux_kernel:3.0.51 + cpe:/o:linux:linux_kernel:3.0.52 + cpe:/o:linux:linux_kernel:3.0.53 + cpe:/o:linux:linux_kernel:3.11.10 + cpe:/o:linux:linux_kernel:3.0.50 + cpe:/o:linux:linux_kernel:3.4.57 + cpe:/o:linux:linux_kernel:3.4.56 + cpe:/o:linux:linux_kernel:3.4.55 + cpe:/o:linux:linux_kernel:3.4.54 + cpe:/o:linux:linux_kernel:3.4.53 + cpe:/o:linux:linux_kernel:3.4.52 + cpe:/o:linux:linux_kernel:3.4.51 + cpe:/o:linux:linux_kernel:3.4.50 + cpe:/o:linux:linux_kernel:3.0.43 + cpe:/o:linux:linux_kernel:3.10.26 + cpe:/o:linux:linux_kernel:3.4.59 + cpe:/o:linux:linux_kernel:3.0.24 + cpe:/o:linux:linux_kernel:3.0.25 + cpe:/o:linux:linux_kernel:3.0.22 + cpe:/o:linux:linux_kernel:3.1.9 + cpe:/o:linux:linux_kernel:3.0.23 + cpe:/o:linux:linux_kernel:3.10.28 + cpe:/o:linux:linux_kernel:3.0.28 + cpe:/o:linux:linux_kernel:3.10.27 + cpe:/o:linux:linux_kernel:3.0.26 + cpe:/o:linux:linux_kernel:3.10.29 + cpe:/o:linux:linux_kernel:3.4.58 + cpe:/o:linux:linux_kernel:3.0.27 + cpe:/o:linux:linux_kernel:3.10.24 + cpe:/o:linux:linux_kernel:3.10.23 + cpe:/o:linux:linux_kernel:3.10.25 + cpe:/o:linux:linux_kernel:3.10.20 + cpe:/o:linux:linux_kernel:3.1.8 + cpe:/o:linux:linux_kernel:3.0.20 + cpe:/o:linux:linux_kernel:3.10.22 + cpe:/o:linux:linux_kernel:3.10.21 + cpe:/o:linux:linux_kernel:3.4.21 + cpe:/o:linux:linux_kernel:3.4.20 + cpe:/o:linux:linux_kernel:3.4.23 + cpe:/o:linux:linux_kernel:3.4.22 + cpe:/o:linux:linux_kernel:3.4.24 + cpe:/o:linux:linux_kernel:3.4.27 + cpe:/o:linux:linux_kernel:3.4.26 + cpe:/o:linux:linux_kernel:3.4.29 + cpe:/o:linux:linux_kernel:3.10.15 + cpe:/o:linux:linux_kernel:3.4.28 + cpe:/o:linux:linux_kernel:3.0.54 + cpe:/o:linux:linux_kernel:3.0.33 + cpe:/o:linux:linux_kernel:3.0.34 + cpe:/o:linux:linux_kernel:3.0.35 + cpe:/o:linux:linux_kernel:3.0.36 + cpe:/o:linux:linux_kernel:3.10.19 + cpe:/o:linux:linux_kernel:3.0.37 + cpe:/o:linux:linux_kernel:3.10.18 + cpe:/o:linux:linux_kernel:3.0.38 + cpe:/o:linux:linux_kernel:3.4.25 + cpe:/o:linux:linux_kernel:3.10.17 + cpe:/o:linux:linux_kernel:3.0.39 + cpe:/o:linux:linux_kernel:3.10.16 + cpe:/o:linux:linux_kernel:3.10.14 + cpe:/o:linux:linux_kernel:3.10.13 + cpe:/o:linux:linux_kernel:3.10.12 + cpe:/o:linux:linux_kernel:3.10.11 + cpe:/o:linux:linux_kernel:3.10.10 + cpe:/o:linux:linux_kernel:3.0.30 + cpe:/o:linux:linux_kernel:3.0.31 + cpe:/o:linux:linux_kernel:3.9.8 + cpe:/o:linux:linux_kernel:3.5.5 + cpe:/o:linux:linux_kernel:3.4.32 + cpe:/o:linux:linux_kernel:3.9.9 + cpe:/o:linux:linux_kernel:3.5.6 + cpe:/o:linux:linux_kernel:3.4.31 + cpe:/o:linux:linux_kernel:3.5.7 + cpe:/o:linux:linux_kernel:3.4.30 + cpe:/o:linux:linux_kernel:3.7.1 + cpe:/o:linux:linux_kernel:3.4.35 + cpe:/o:linux:linux_kernel:3.9.0 + cpe:/o:linux:linux_kernel:3.0.18 + cpe:/o:linux:linux_kernel:3.4.34 + cpe:/o:linux:linux_kernel:3.4.33 + cpe:/o:linux:linux_kernel:3.9.2 + cpe:/o:linux:linux_kernel:3.9.1 + cpe:/o:linux:linux_kernel:3.0.19 + cpe:/o:linux:linux_kernel:3.4.39 + cpe:/o:linux:linux_kernel:3.9.4 + cpe:/o:linux:linux_kernel:3.4.38 + cpe:/o:linux:linux_kernel:3.9.3 + cpe:/o:linux:linux_kernel:3.4.37 + cpe:/o:linux:linux_kernel:3.9.6 + cpe:/o:linux:linux_kernel:3.9.5 + cpe:/o:linux:linux_kernel:3.0.21 + cpe:/o:linux:linux_kernel:3.9.7 + cpe:/o:linux:linux_kernel:3.5.4 + cpe:/o:linux:linux_kernel:3.0.4 + cpe:/o:linux:linux_kernel:3.0.5 + cpe:/o:linux:linux_kernel:3.0.2 + cpe:/o:linux:linux_kernel:3.0.3 + cpe:/o:linux:linux_kernel:3.0.8 + cpe:/o:linux:linux_kernel:3.0.6 + cpe:/o:linux:linux_kernel:3.0.7 + cpe:/o:linux:linux_kernel:3.13.9 + cpe:/o:linux:linux_kernel:3.4.36 + cpe:/o:linux:linux_kernel:3.12.17 + cpe:/o:linux:linux_kernel:3.13.1 + cpe:/o:linux:linux_kernel:3.6.10 + cpe:/o:linux:linux_kernel:3.6.11 + cpe:/o:linux:linux_kernel:3.13.8 + cpe:/o:linux:linux_kernel:3.13.6 + cpe:/o:linux:linux_kernel:3.13.7 + cpe:/o:linux:linux_kernel:3.13.4 + cpe:/o:linux:linux_kernel:3.13.5 + cpe:/o:linux:linux_kernel:3.13.2 + cpe:/o:linux:linux_kernel:3.13.3 + cpe:/o:linux:linux_kernel:3.4.1 + cpe:/o:linux:linux_kernel:3.4.19 + cpe:/o:linux:linux_kernel:3.4.17 + cpe:/o:linux:linux_kernel:3.4.3 + cpe:/o:linux:linux_kernel:3.4.18 + cpe:/o:linux:linux_kernel:3.4.2 + cpe:/o:linux:linux_kernel:3.2.9 + cpe:/o:linux:linux_kernel:3.4.15 + cpe:/o:linux:linux_kernel:3.2.8 + cpe:/o:linux:linux_kernel:3.4.16 + cpe:/o:linux:linux_kernel:3.4.4 + cpe:/o:linux:linux_kernel:3.12.12 + cpe:/o:linux:linux_kernel:3.2.7 + cpe:/o:linux:linux_kernel:3.4.13 + cpe:/o:linux:linux_kernel:3.12.13 + cpe:/o:linux:linux_kernel:3.12.10 + cpe:/o:linux:linux_kernel:3.4.11 + cpe:/o:linux:linux_kernel:3.12.11 + cpe:/o:linux:linux_kernel:3.4.12 + cpe:/o:linux:linux_kernel:3.12.16 + cpe:/o:linux:linux_kernel:3.4.10 + cpe:/o:linux:linux_kernel:3.12.14 + cpe:/o:linux:linux_kernel:3.12.15 + cpe:/o:linux:linux_kernel:3.0.61 + cpe:/o:linux:linux_kernel:3.3:rc2 + cpe:/o:linux:linux_kernel:3.4:rc7 + cpe:/o:linux:linux_kernel:3.0.60 + cpe:/o:linux:linux_kernel:3.3:rc7 + cpe:/o:linux:linux_kernel:3.4:rc5 + cpe:/o:linux:linux_kernel:3.3:rc5 + cpe:/o:linux:linux_kernel:3.4:rc6 + cpe:/o:linux:linux_kernel:3.3:rc6 + cpe:/o:linux:linux_kernel:3.0.64 + cpe:/o:linux:linux_kernel:3.0.63 + cpe:/o:linux:linux_kernel:3.0.62 + cpe:/o:linux:linux_kernel:3.12.1 + cpe:/o:linux:linux_kernel:3.0.68 + cpe:/o:linux:linux_kernel:3.0.67 + cpe:/o:linux:linux_kernel:3.0.66 + cpe:/o:linux:linux_kernel:3.4.14 + cpe:/o:linux:linux_kernel:3.12.7 + cpe:/o:linux:linux_kernel:3.2:rc2 + cpe:/o:linux:linux_kernel:3.1:rc1 + cpe:/o:linux:linux_kernel:3.0.9 + cpe:/o:linux:linux_kernel:3.0:rc4 + cpe:/o:linux:linux_kernel:3.12.8 + cpe:/o:linux:linux_kernel:3.1:rc4 + cpe:/o:linux:linux_kernel:3.0:rc3 + cpe:/o:linux:linux_kernel:3.12.9 + cpe:/o:linux:linux_kernel:3.0:rc2 + cpe:/o:linux:linux_kernel:3.1:rc2 + cpe:/o:linux:linux_kernel:3.0:rc1 + cpe:/o:linux:linux_kernel:3.2:rc7 + cpe:/o:linux:linux_kernel:3.12.3 + cpe:/o:linux:linux_kernel:3.2:rc6 + cpe:/o:linux:linux_kernel:3.1.10 + cpe:/o:linux:linux_kernel:3.12.4 + cpe:/o:linux:linux_kernel:3.2:rc5 + cpe:/o:linux:linux_kernel:3.0:rc7 + cpe:/o:linux:linux_kernel:3.12.5 + cpe:/o:linux:linux_kernel:3.9:rc3 + cpe:/o:linux:linux_kernel:3.0:rc6 + cpe:/o:linux:linux_kernel:3.12.6 + cpe:/o:linux:linux_kernel:3.0:rc5 + cpe:/o:linux:linux_kernel:3.9:rc1 + cpe:/o:linux:linux_kernel:3.9:rc4 + cpe:/o:linux:linux_kernel:3.9:rc7 + cpe:/o:linux:linux_kernel:3.12.2 + cpe:/o:linux:linux_kernel:3.9:rc2 + cpe:/o:linux:linux_kernel:3.9:rc5 + cpe:/o:linux:linux_kernel:3.3:rc3 + cpe:/o:linux:linux_kernel:3.4:rc4 + cpe:/o:linux:linux_kernel:3.4:rc3 + cpe:/o:linux:linux_kernel:3.3:rc1 + cpe:/o:linux:linux_kernel:3.4:rc2 + cpe:/o:linux:linux_kernel:3.9:rc6 + cpe:/o:linux:linux_kernel:3.3:rc4 + cpe:/o:linux:linux_kernel:3.4:rc1 + cpe:/o:linux:linux_kernel:3.4.5 + cpe:/o:linux:linux_kernel:3.2.2 + cpe:/o:linux:linux_kernel:3.2.3 + cpe:/o:linux:linux_kernel:3.2.1 + cpe:/o:linux:linux_kernel:3.4.6 + cpe:/o:linux:linux_kernel:3.2:rc3 + cpe:/o:linux:linux_kernel:3.2.6 + cpe:/o:linux:linux_kernel:3.4.7 + cpe:/o:linux:linux_kernel:3.2:rc4 + cpe:/o:linux:linux_kernel:3.1:rc3 + cpe:/o:linux:linux_kernel:3.4.8 + cpe:/o:linux:linux_kernel:3.2.4 + cpe:/o:linux:linux_kernel:3.4.9 + cpe:/o:linux:linux_kernel:3.2.5 + cpe:/o:linux:linux_kernel:3.0.65 + cpe:/o:linux:linux_kernel:3.2.12 + cpe:/o:linux:linux_kernel:3.8.10 + cpe:/o:linux:linux_kernel:3.8.12 + cpe:/o:linux:linux_kernel:3.8.11 + cpe:/o:linux:linux_kernel:3.8.13 + cpe:/o:linux:linux_kernel:3.7.9 + cpe:/o:linux:linux_kernel:3.7.8 + cpe:/o:linux:linux_kernel:3.7.7 + cpe:/o:linux:linux_kernel:3.7.6 + cpe:/o:linux:linux_kernel:3.6.3 + cpe:/o:linux:linux_kernel:3.7.5 + cpe:/o:linux:linux_kernel:3.7.4 + cpe:/o:linux:linux_kernel:3.7.3 + cpe:/o:linux:linux_kernel:3.7.2 + cpe:/o:linux:linux_kernel:3.6.7 + cpe:/o:linux:linux_kernel:3.6.6 + cpe:/o:linux:linux_kernel:3.6.5 + cpe:/o:linux:linux_kernel:3.6.4 + cpe:/o:linux:linux_kernel:3.6.9 + cpe:/o:linux:linux_kernel:3.6.8 + cpe:/o:linux:linux_kernel:3.10 + cpe:/o:linux:linux_kernel:3.11 + cpe:/o:linux:linux_kernel:3.12 + cpe:/o:linux:linux_kernel:3.13 + cpe:/o:linux:linux_kernel:3.10.1 + cpe:/o:linux:linux_kernel:3.10.2 + cpe:/o:linux:linux_kernel:3.10.3 + cpe:/o:linux:linux_kernel:3.6.2 + cpe:/o:linux:linux_kernel:3.6.1 + cpe:/o:linux:linux_kernel:3.3.6 + cpe:/o:linux:linux_kernel:3.3.7 + cpe:/o:linux:linux_kernel:3.3.8 + cpe:/o:linux:linux_kernel:3.0.1 + cpe:/o:linux:linux_kernel:3.2 + cpe:/o:linux:linux_kernel:3.1 + cpe:/o:linux:linux_kernel:3.7 + cpe:/o:linux:linux_kernel:3.6 + cpe:/o:linux:linux_kernel:3.4 + cpe:/o:linux:linux_kernel:3.1.6 + cpe:/o:linux:linux_kernel:3.1.5 + cpe:/o:linux:linux_kernel:3.1.7 + cpe:/o:linux:linux_kernel:3.0.32 + cpe:/o:linux:linux_kernel:3.8.9 + cpe:/o:linux:linux_kernel:3.1.2 + cpe:/o:linux:linux_kernel:3.1.1 + cpe:/o:linux:linux_kernel:3.1.4 + cpe:/o:linux:linux_kernel:3.1.3 + cpe:/o:linux:linux_kernel:3.9.10 + cpe:/o:linux:linux_kernel:3.0.29 + cpe:/o:linux:linux_kernel:3.3 + cpe:/o:linux:linux_kernel:3.8.4 + cpe:/o:linux:linux_kernel:3.2.26 + cpe:/o:linux:linux_kernel:3.8.5 + cpe:/o:linux:linux_kernel:3.2.27 + cpe:/o:linux:linux_kernel:3.8.2 + cpe:/o:linux:linux_kernel:3.2.24 + cpe:/o:linux:linux_kernel:3.8.3 + cpe:/o:linux:linux_kernel:3.2.25 + cpe:/o:linux:linux_kernel:3.8.8 + cpe:/o:linux:linux_kernel:3.8.6 + cpe:/o:linux:linux_kernel:3.2.28 + cpe:/o:linux:linux_kernel:3.8.7 + cpe:/o:linux:linux_kernel:3.2.29 + cpe:/o:linux:linux_kernel:3.3.3 + cpe:/o:linux:linux_kernel:3.3.4 + cpe:/o:linux:linux_kernel:3.3.5 + cpe:/o:linux:linux_kernel:3.2.22 + cpe:/o:linux:linux_kernel:3.8.1 + cpe:/o:linux:linux_kernel:3.2.20 + cpe:/o:linux:linux_kernel:3.3.1 + cpe:/o:linux:linux_kernel:3.2.21 + cpe:/o:linux:linux_kernel:3.3.2 + cpe:/o:linux:linux_kernel:3.11.1 + cpe:/o:linux:linux_kernel:3.11.2 + cpe:/o:linux:linux_kernel:3.2.23 + cpe:/o:linux:linux_kernel:3.0.17 + cpe:/o:linux:linux_kernel:3.9.11 + cpe:/o:linux:linux_kernel:3.0.16 + cpe:/o:linux:linux_kernel:3.0.15 + cpe:/o:linux:linux_kernel:3.2.30 + cpe:/o:linux:linux_kernel:3.0.14 + cpe:/o:linux:linux_kernel:3.0.13 + cpe:/o:linux:linux_kernel:3.0.12 + cpe:/o:linux:linux_kernel:3.0.11 + cpe:/o:linux:linux_kernel:3.4.61 + cpe:/o:linux:linux_kernel:3.0.10 + cpe:/o:linux:linux_kernel:3.4.64 + cpe:/o:linux:linux_kernel:3.8.0 + cpe:/o:linux:linux_kernel:3.4.65 + cpe:/o:linux:linux_kernel:3.4.62 + cpe:/o:linux:linux_kernel:3.4.63 + cpe:/o:linux:linux_kernel:3.4.68 + cpe:/o:linux:linux_kernel:3.4.66 + cpe:/o:linux:linux_kernel:3.4.67 + cpe:/o:linux:linux_kernel:3.5.3 + cpe:/o:linux:linux_kernel:3.5.1 + cpe:/o:linux:linux_kernel:3.5.2 + cpe:/o:linux:linux_kernel:3.10.4 + cpe:/o:linux:linux_kernel:3.4.72 + cpe:/o:linux:linux_kernel:3.10.9 + cpe:/o:linux:linux_kernel:3.4.73 + cpe:/o:linux:linux_kernel:3.4.74 + cpe:/o:linux:linux_kernel:3.4.75 + cpe:/o:linux:linux_kernel:3.4.76 + cpe:/o:linux:linux_kernel:3.10.5 + cpe:/o:linux:linux_kernel:3.4.77 + cpe:/o:linux:linux_kernel:3.10.6 + cpe:/o:linux:linux_kernel:3.4.78 + cpe:/o:linux:linux_kernel:3.10.7 + cpe:/o:linux:linux_kernel:3.4.79 + cpe:/o:linux:linux_kernel:3.10.8 + cpe:/o:linux:linux_kernel:3.7.10 + cpe:/o:linux:linux_kernel:3.2.17 + cpe:/o:linux:linux_kernel:3.2.18 + cpe:/o:linux:linux_kernel:3.2.19 + cpe:/o:linux:linux_kernel:3.2.13 + cpe:/o:linux:linux_kernel:3.2.14 + cpe:/o:linux:linux_kernel:3.11.3 + cpe:/o:linux:linux_kernel:3.2.15 + cpe:/o:linux:linux_kernel:3.4.60 + cpe:/o:linux:linux_kernel:3.2.16 + cpe:/o:linux:linux_kernel:3.11.5 + cpe:/o:linux:linux_kernel:3.11.4 + cpe:/o:linux:linux_kernel:3.2.10 + cpe:/o:linux:linux_kernel:3.11.7 + cpe:/o:linux:linux_kernel:3.2.11 + cpe:/o:linux:linux_kernel:3.11.6 + cpe:/o:linux:linux_kernel:3.11.9 + cpe:/o:linux:linux_kernel:3.11.8 + cpe:/o:linux:linux_kernel:3.4.69 + + CVE-2014-0077 + 2014-04-14T19:55:07.530-04:00 + 2014-04-15T10:59:32.337-04:00 + + + 5.5 + ADJACENT_NETWORK + HIGH + SINGLE_INSTANCE + PARTIAL + PARTIAL + COMPLETE + http://nvd.nist.gov + 2014-04-15T10:59:30.133-04:00 + + + + + CONFIRM + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.10 + + + CONFIRM + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d8316f3991d207fe32881a9ac20241be8fa2bad0 + + + CONFIRM + https://github.com/torvalds/linux/commit/d8316f3991d207fe32881a9ac20241be8fa2bad0 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1064440 + + drivers/vhost/net.c in the Linux kernel before 3.13.10, when mergeable buffers are disabled, does not properly validate packet lengths, which allows guest OS users to cause a denial of service (memory corruption and host OS crash) or possibly gain privileges on the host OS via crafted packets, related to the handle_rx and get_rx_bufs functions. + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:zarafa:zarafa:5.00 + cpe:/a:zarafa:zarafa:5.10 + cpe:/a:zarafa:zarafa:5.01 + cpe:/a:zarafa:zarafa:5.11 + cpe:/a:zarafa:zarafa:7.1.8 + cpe:/a:zarafa:zarafa:5.02 + cpe:/a:zarafa:zarafa:6.10 + cpe:/a:zarafa:zarafa:5.20 + cpe:/a:zarafa:zarafa:6.00 + cpe:/a:zarafa:zarafa:6.01 + cpe:/a:zarafa:zarafa:6.02 + cpe:/a:zarafa:zarafa:6.03 + cpe:/a:zarafa:zarafa:6.11 + cpe:/a:zarafa:zarafa:6.20 + cpe:/a:zarafa:zarafa:5.22 + + CVE-2014-0079 + 2014-04-28T10:09:06.157-04:00 + 2014-04-29T07:52:00.900-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-29T07:52:00.807-04:00 + + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1059903 + + + MANDRIVA + MDVSA-2014:044 + + The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 7.1.8, 6.20.0, and earlier, when using certain build conditions, allows remote attackers to cause a denial of service (crash) via vectors related to "a NULL pointer of the password." + + + + + + + + + + + + + + + + + + + cpe:/a:rubyonrails:ruby_on_rails:4.0.0:rc2 + cpe:/a:rubyonrails:ruby_on_rails:4.0.1:rc1 + cpe:/a:rubyonrails:ruby_on_rails:4.0.0:beta + cpe:/a:rubyonrails:ruby_on_rails:4.0.0:- + cpe:/a:rubyonrails:ruby_on_rails:4.0.1:- + cpe:/a:rubyonrails:ruby_on_rails:4.0.0:rc1 + cpe:/a:rubyonrails:ruby_on_rails:4.0.1:rc2 + cpe:/a:rubyonrails:ruby_on_rails:4.0.1:rc3 + cpe:/a:rubyonrails:ruby_on_rails:4.0.1:rc4 + cpe:/a:rubyonrails:ruby_on_rails:4.0.2:- + cpe:/a:rubyonrails:ruby_on_rails:4.1.0:beta1 + + CVE-2014-0080 + 2014-02-20T10:27:02.750-05:00 + 2014-02-20T19:13:30.407-05:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-20T07:47:10.000-05:00 + + + + + MLIST + [rubyonrails-security] 20140218 Data Injection Vulnerability in Active Record (CVE-2014-0080) + + + MLIST + [oss-security] 20140218 Data Injection Vulnerability in Active Record (CVE-2014-0080) + + SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving \ (backslash) characters that are not properly handled in operations on array columns. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:rubyonrails:ruby_on_rails:3.0.9 + cpe:/a:rubyonrails:ruby_on_rails:3.1.8 + cpe:/a:rubyonrails:ruby_on_rails:0.8.0 + cpe:/a:rubyonrails:ruby_on_rails:2.1.0 + cpe:/a:rubyonrails:ruby_on_rails:3.1.9 + cpe:/a:rubyonrails:ruby_on_rails:4.0.0:- + cpe:/a:rubyonrails:ruby_on_rails:3.0.0:rc + cpe:/a:rubyonrails:ruby_on_rails:4.0.1:- + cpe:/a:rubyonrails:ruby_on_rails:0.6.0 + cpe:/a:rubyonrails:ruby_on_rails:3.1.6 + cpe:/a:rubyonrails:ruby_on_rails:3.0.13:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.1.5 + cpe:/a:rubyonrails:ruby_on_rails:3.0.12:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.1.7 + cpe:/a:rubyonrails:ruby_on_rails:3.0.10:rc1 + cpe:/a:rubyonrails:ruby_on_rails:1.2.4 + cpe:/a:rubyonrails:ruby_on_rails:1.2.5 + cpe:/a:rubyonrails:ruby_on_rails:3.0.8:rc3 + cpe:/a:rubyonrails:ruby_on_rails:1.2.2 + cpe:/a:rubyonrails:ruby_on_rails:3.0.8:rc4 + cpe:/a:rubyonrails:ruby_on_rails:3.0.4:rc + cpe:/a:rubyonrails:ruby_on_rails:1.2.3 + cpe:/a:rubyonrails:ruby_on_rails:3.0.8:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.0.2:pre + cpe:/a:rubyonrails:ruby_on_rails:3.0.8:rc2 + cpe:/a:rubyonrails:ruby_on_rails:3.0.7:rc1 + cpe:/a:rubyonrails:ruby_on_rails:1.2.1 + cpe:/a:rubyonrails:ruby_on_rails:0.5.6 + cpe:/a:rubyonrails:ruby_on_rails:3.0.7:rc2 + cpe:/a:rubyonrails:ruby_on_rails:3.0.6:rc1 + cpe:/a:rubyonrails:ruby_on_rails:0.5.5 + cpe:/a:rubyonrails:ruby_on_rails:3.0.6:rc2 + cpe:/a:rubyonrails:ruby_on_rails:3.0.5:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.0.1:pre + cpe:/a:rubyonrails:ruby_on_rails:2.2.0 + cpe:/a:rubyonrails:ruby_on_rails:4.0.2:- + cpe:/a:rubyonrails:ruby_on_rails:3.2.3:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.2.4:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.0.0:rc2 + cpe:/a:rubyonrails:ruby_on_rails:0.10.0 + cpe:/a:rubyonrails:ruby_on_rails:2.2.2 + cpe:/a:rubyonrails:ruby_on_rails:2.2.1 + cpe:/a:rubyonrails:ruby_on_rails:3.2.0:rc1 + cpe:/a:rubyonrails:ruby_on_rails:1.1.2 + cpe:/a:rubyonrails:ruby_on_rails:0.9.4 + cpe:/a:rubyonrails:ruby_on_rails:3.2.0:rc2 + cpe:/a:rubyonrails:ruby_on_rails:3.2.3:rc2 + cpe:/a:rubyonrails:ruby_on_rails:3.2.2:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.2.4 + cpe:/a:rubyonrails:ruby_on_rails:1.1.6 + cpe:/a:rubyonrails:ruby_on_rails:3.2.5 + cpe:/a:rubyonrails:ruby_on_rails:1.1.5 + cpe:/a:rubyonrails:ruby_on_rails:3.2.6 + cpe:/a:rubyonrails:ruby_on_rails:1.1.4 + cpe:/a:rubyonrails:ruby_on_rails:2.3.4 + cpe:/a:rubyonrails:ruby_on_rails:1.1.3 + cpe:/a:rubyonrails:ruby_on_rails:0.9.3 + cpe:/a:rubyonrails:ruby_on_rails:3.0.4:rc1 + cpe:/a:rubyonrails:ruby_on_rails:0.13.1 + cpe:/a:rubyonrails:ruby_on_rails:0.13.0 + cpe:/a:rubyonrails:ruby_on_rails:1.1.0 + cpe:/a:rubyonrails:ruby_on_rails:1.1.1 + cpe:/a:rubyonrails:ruby_on_rails:2.3.1 + cpe:/a:rubyonrails:ruby_on_rails:2.3.0 + cpe:/a:rubyonrails:ruby_on_rails:2.3.3 + cpe:/a:rubyonrails:ruby_on_rails:2.3.2 + cpe:/a:rubyonrails:ruby_on_rails:3.0.9:rc5 + cpe:/a:rubyonrails:ruby_on_rails:3.0.8 + cpe:/a:rubyonrails:ruby_on_rails:3.0.7 + cpe:/a:rubyonrails:ruby_on_rails:3.0.9:rc2 + cpe:/a:rubyonrails:ruby_on_rails:3.0.6 + cpe:/a:rubyonrails:ruby_on_rails:3.0.9:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.0.9:rc4 + cpe:/a:rubyonrails:ruby_on_rails:3.0.9:rc3 + cpe:/a:rubyonrails:ruby_on_rails:3.0.0 + cpe:/a:rubyonrails:ruby_on_rails:0.5.0 + cpe:/a:rubyonrails:ruby_on_rails:3.1.3 + cpe:/a:rubyonrails:ruby_on_rails:3.1.4 + cpe:/a:rubyonrails:ruby_on_rails:4.0.0:rc2 + cpe:/a:rubyonrails:ruby_on_rails:3.2.7 + cpe:/a:rubyonrails:ruby_on_rails:3.1.1 + cpe:/a:rubyonrails:ruby_on_rails:3.1.2 + cpe:/a:rubyonrails:ruby_on_rails:4.0.1:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.2.9 + cpe:/a:rubyonrails:ruby_on_rails:4.0.0:rc1 + cpe:/a:rubyonrails:ruby_on_rails:4.0.1:rc2 + cpe:/a:rubyonrails:ruby_on_rails:3.2.8 + cpe:/a:rubyonrails:ruby_on_rails:3.1.0 + cpe:/a:rubyonrails:ruby_on_rails:4.0.1:rc3 + cpe:/a:rubyonrails:ruby_on_rails:4.0.1:rc4 + cpe:/a:rubyonrails:ruby_on_rails:0.11.1 + cpe:/a:rubyonrails:ruby_on_rails:3.2.15:rc3 + cpe:/a:rubyonrails:ruby_on_rails:3.1.0:beta1 + cpe:/a:rubyonrails:ruby_on_rails:0.11.0 + cpe:/a:rubyonrails:ruby_on_rails:2.0.4 + cpe:/a:rubyonrails:ruby_on_rails:3.2.13:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.2.14:rc2 + cpe:/a:rubyonrails:ruby_on_rails:3.2.13:rc2 + cpe:/a:rubyonrails:ruby_on_rails:3.2.15:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.0.0:beta3 + cpe:/a:rubyonrails:ruby_on_rails:3.2.15:rc2 + cpe:/a:rubyonrails:ruby_on_rails:3.2.14:rc1 + cpe:/a:rubyonrails:ruby_on_rails:2.0.2 + cpe:/a:rubyonrails:ruby_on_rails:3.0.0:beta2 + cpe:/a:rubyonrails:ruby_on_rails:3.2.14 + cpe:/a:rubyonrails:ruby_on_rails:3.2.13 + cpe:/a:rubyonrails:ruby_on_rails:3.2.16 + cpe:/a:rubyonrails:ruby_on_rails:3.2.15 + cpe:/a:rubyonrails:ruby_on_rails:2.1.1 + cpe:/a:rubyonrails:ruby_on_rails:2.1.2 + cpe:/a:rubyonrails:ruby_on_rails:3.0.0:beta4 + cpe:/a:rubyonrails:ruby_on_rails:3.2.12 + cpe:/a:rubyonrails:ruby_on_rails:3.2.11 + cpe:/a:rubyonrails:ruby_on_rails:3.2.10 + cpe:/a:rubyonrails:ruby_on_rails:2.0.1 + cpe:/a:rubyonrails:ruby_on_rails:2.0.0 + cpe:/a:rubyonrails:ruby_on_rails:3.0.18 + cpe:/a:rubyonrails:ruby_on_rails:3.0.19 + cpe:/a:rubyonrails:ruby_on_rails:0.6.5 + cpe:/a:rubyonrails:ruby_on_rails:3.1.0:rc6 + cpe:/a:rubyonrails:ruby_on_rails:3.1.0:rc8 + cpe:/a:rubyonrails:ruby_on_rails:3.0.20 + cpe:/a:rubyonrails:ruby_on_rails:3.1.0:rc5 + cpe:/a:rubyonrails:ruby_on_rails:2.0.0:rc1 + cpe:/a:rubyonrails:ruby_on_rails:2.3.11 + cpe:/a:rubyonrails:ruby_on_rails:3.1.0:rc2 + cpe:/a:rubyonrails:ruby_on_rails:2.0.0:rc2 + cpe:/a:rubyonrails:ruby_on_rails:2.3.10 + cpe:/a:rubyonrails:ruby_on_rails:3.1.0:rc7 + cpe:/a:rubyonrails:ruby_on_rails:3.1.2:rc2 + cpe:/a:rubyonrails:ruby_on_rails:3.1.1:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.1.0:rc4 + cpe:/a:rubyonrails:ruby_on_rails:0.8.5 + cpe:/a:rubyonrails:ruby_on_rails:3.1.1:rc2 + cpe:/a:rubyonrails:ruby_on_rails:3.1.0:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.1.1:rc3 + cpe:/a:rubyonrails:ruby_on_rails:3.1.2:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.1.0:rc3 + cpe:/a:rubyonrails:ruby_on_rails:3.1.4:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.1.5:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.0.14 + cpe:/a:rubyonrails:ruby_on_rails:3.0.13 + cpe:/a:rubyonrails:ruby_on_rails:3.0.12 + cpe:/a:rubyonrails:ruby_on_rails:3.0.11 + cpe:/a:rubyonrails:ruby_on_rails:3.0.10 + cpe:/a:rubyonrails:ruby_on_rails:3.0.16 + cpe:/a:rubyonrails:ruby_on_rails:3.0.17 + cpe:/a:rubyonrails:ruby_on_rails:3.2.2 + cpe:/a:rubyonrails:ruby_on_rails:0.14.1 + cpe:/a:rubyonrails:ruby_on_rails:3.2.3 + cpe:/a:rubyonrails:ruby_on_rails:3.2.0 + cpe:/a:rubyonrails:ruby_on_rails:3.2.1 + cpe:/a:rubyonrails:ruby_on_rails:0.14.4 + cpe:/a:rubyonrails:ruby_on_rails:0.14.3 + cpe:/a:rubyonrails:ruby_on_rails:0.14.2 + cpe:/a:rubyonrails:ruby_on_rails:3.1.10 + cpe:/a:rubyonrails:ruby_on_rails:1.2.6 + cpe:/a:rubyonrails:ruby_on_rails:1.0.0 + cpe:/a:rubyonrails:ruby_on_rails:2.3.13 + cpe:/a:rubyonrails:ruby_on_rails:3.0.1 + cpe:/a:rubyonrails:ruby_on_rails:2.3.14 + cpe:/a:rubyonrails:ruby_on_rails:1.2.0 + cpe:/a:rubyonrails:ruby_on_rails:2.1 + cpe:/a:rubyonrails:ruby_on_rails:2.3.15 + cpe:/a:rubyonrails:ruby_on_rails:2.3.16 + cpe:/a:rubyonrails:ruby_on_rails:3.0.5 + cpe:/a:rubyonrails:ruby_on_rails:3.0.4 + cpe:/a:rubyonrails:ruby_on_rails:1.9.5 + cpe:/a:rubyonrails:ruby_on_rails:3.0.3 + cpe:/a:rubyonrails:ruby_on_rails:3.0.2 + cpe:/a:rubyonrails:ruby_on_rails:2.3.12 + cpe:/a:rubyonrails:ruby_on_rails:0.9.0 + cpe:/a:rubyonrails:ruby_on_rails:0.9.1 + cpe:/a:rubyonrails:ruby_on_rails:0.9.2 + cpe:/a:rubyonrails:ruby_on_rails:0.7.0 + cpe:/a:rubyonrails:ruby_on_rails:4.1.0:beta1 + cpe:/a:rubyonrails:ruby_on_rails:3.0.0:beta + cpe:/a:rubyonrails:ruby_on_rails:0.9.4.1 + cpe:/a:rubyonrails:ruby_on_rails:0.10.1 + cpe:/a:rubyonrails:ruby_on_rails:4.0.0:beta + cpe:/a:rubyonrails:ruby_on_rails:0.5.7 + cpe:/a:rubyonrails:ruby_on_rails:0.12.1 + cpe:/a:rubyonrails:ruby_on_rails:0.12.0 + cpe:/a:rubyonrails:ruby_on_rails:2.3.9 + + CVE-2014-0081 + 2014-02-20T10:27:09.140-05:00 + 2014-03-26T00:55:51.047-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-20T12:51:59.640-05:00 + + + + + MLIST + [rubyonrails-security] 20140218 XSS Vulnerability in number_to_currency, number_to_percentage and number_to_human (CVE-2014-0081) + + + SECUNIA + 57376 + + + REDHAT + RHSA-2014:0306 + + + REDHAT + RHSA-2014:0215 + + + MLIST + [oss-security] 20140218 XSS Vulnerability in number_to_currency, number_to_percentage and number_to_human (CVE-2014-0081) + + + SUSE + openSUSE-SU-2014:0295 + + Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:rubyonrails:ruby_on_rails:3.0.9 + cpe:/a:rubyonrails:ruby_on_rails:3.1.8 + cpe:/a:rubyonrails:ruby_on_rails:3.1.9 + cpe:/a:rubyonrails:ruby_on_rails:3.0.0:rc + cpe:/a:rubyonrails:ruby_on_rails:3.0.13:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.1.6 + cpe:/a:rubyonrails:ruby_on_rails:3.0.12:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.1.5 + cpe:/a:rubyonrails:ruby_on_rails:3.0.10:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.1.7 + cpe:/a:rubyonrails:ruby_on_rails:3.0.8:rc3 + cpe:/a:rubyonrails:ruby_on_rails:3.0.8:rc4 + cpe:/a:rubyonrails:ruby_on_rails:3.0.4:rc + cpe:/a:rubyonrails:ruby_on_rails:3.0.8:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.0.2:pre + cpe:/a:rubyonrails:ruby_on_rails:3.0.8:rc2 + cpe:/a:rubyonrails:ruby_on_rails:3.0.7:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.0.7:rc2 + cpe:/a:rubyonrails:ruby_on_rails:3.0.6:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.0.6:rc2 + cpe:/a:rubyonrails:ruby_on_rails:3.0.5:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.0.1:pre + cpe:/a:rubyonrails:ruby_on_rails:3.2.3:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.2.4:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.0.0:rc2 + cpe:/a:rubyonrails:ruby_on_rails:3.2.0:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.2.0:rc2 + cpe:/a:rubyonrails:ruby_on_rails:3.2.2:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.2.3:rc2 + cpe:/a:rubyonrails:ruby_on_rails:3.2.4 + cpe:/a:rubyonrails:ruby_on_rails:3.2.5 + cpe:/a:rubyonrails:ruby_on_rails:3.2.6 + cpe:/a:rubyonrails:ruby_on_rails:3.0.4:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.0.9:rc5 + cpe:/a:rubyonrails:ruby_on_rails:3.0.8 + cpe:/a:rubyonrails:ruby_on_rails:3.0.7 + cpe:/a:rubyonrails:ruby_on_rails:3.0.6 + cpe:/a:rubyonrails:ruby_on_rails:3.0.9:rc2 + cpe:/a:rubyonrails:ruby_on_rails:3.0.9:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.0.9:rc4 + cpe:/a:rubyonrails:ruby_on_rails:3.0.9:rc3 + cpe:/a:rubyonrails:ruby_on_rails:3.0.0 + cpe:/a:rubyonrails:ruby_on_rails:3.1.3 + cpe:/a:rubyonrails:ruby_on_rails:3.1.4 + cpe:/a:rubyonrails:ruby_on_rails:3.2.7 + cpe:/a:rubyonrails:ruby_on_rails:3.1.1 + cpe:/a:rubyonrails:ruby_on_rails:3.1.2 + cpe:/a:rubyonrails:ruby_on_rails:3.2.9 + cpe:/a:rubyonrails:ruby_on_rails:3.2.8 + cpe:/a:rubyonrails:ruby_on_rails:3.1.0 + cpe:/a:rubyonrails:ruby_on_rails:3.2.15:rc3 + cpe:/a:rubyonrails:ruby_on_rails:3.1.0:beta1 + cpe:/a:rubyonrails:ruby_on_rails:3.2.14:rc2 + cpe:/a:rubyonrails:ruby_on_rails:3.2.13:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.2.13:rc2 + cpe:/a:rubyonrails:ruby_on_rails:3.0.0:beta3 + cpe:/a:rubyonrails:ruby_on_rails:3.2.15:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.0.0:beta2 + cpe:/a:rubyonrails:ruby_on_rails:3.2.15:rc2 + cpe:/a:rubyonrails:ruby_on_rails:3.2.14:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.2.14 + cpe:/a:rubyonrails:ruby_on_rails:3.2.13 + cpe:/a:rubyonrails:ruby_on_rails:3.2.16 + cpe:/a:rubyonrails:ruby_on_rails:3.2.15 + cpe:/a:rubyonrails:ruby_on_rails:3.0.0:beta4 + cpe:/a:rubyonrails:ruby_on_rails:3.2.12 + cpe:/a:rubyonrails:ruby_on_rails:3.2.11 + cpe:/a:rubyonrails:ruby_on_rails:3.2.10 + cpe:/a:rubyonrails:ruby_on_rails:3.0.18 + cpe:/a:rubyonrails:ruby_on_rails:3.0.19 + cpe:/a:rubyonrails:ruby_on_rails:3.1.0:rc6 + cpe:/a:rubyonrails:ruby_on_rails:3.0.20 + cpe:/a:rubyonrails:ruby_on_rails:3.1.0:rc8 + cpe:/a:rubyonrails:ruby_on_rails:3.1.0:rc5 + cpe:/a:rubyonrails:ruby_on_rails:3.1.0:rc2 + cpe:/a:rubyonrails:ruby_on_rails:3.1.0:rc7 + cpe:/a:rubyonrails:ruby_on_rails:3.1.0:rc4 + cpe:/a:rubyonrails:ruby_on_rails:3.1.1:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.1.2:rc2 + cpe:/a:rubyonrails:ruby_on_rails:3.1.0:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.1.1:rc2 + cpe:/a:rubyonrails:ruby_on_rails:3.1.1:rc3 + cpe:/a:rubyonrails:ruby_on_rails:3.1.0:rc3 + cpe:/a:rubyonrails:ruby_on_rails:3.1.2:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.1.4:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.1.5:rc1 + cpe:/a:rubyonrails:ruby_on_rails:3.0.14 + cpe:/a:rubyonrails:ruby_on_rails:3.0.13 + cpe:/a:rubyonrails:ruby_on_rails:3.0.12 + cpe:/a:rubyonrails:ruby_on_rails:3.0.11 + cpe:/a:rubyonrails:ruby_on_rails:3.0.10 + cpe:/a:rubyonrails:ruby_on_rails:3.0.16 + cpe:/a:rubyonrails:ruby_on_rails:3.0.17 + cpe:/a:rubyonrails:ruby_on_rails:3.2.2 + cpe:/a:rubyonrails:ruby_on_rails:3.2.3 + cpe:/a:rubyonrails:ruby_on_rails:3.2.0 + cpe:/a:rubyonrails:ruby_on_rails:3.2.1 + cpe:/a:rubyonrails:ruby_on_rails:3.1.10 + cpe:/a:rubyonrails:ruby_on_rails:3.0.1 + cpe:/a:rubyonrails:ruby_on_rails:3.0.5 + cpe:/a:rubyonrails:ruby_on_rails:3.0.4 + cpe:/a:rubyonrails:ruby_on_rails:3.0.3 + cpe:/a:rubyonrails:ruby_on_rails:3.0.2 + cpe:/a:rubyonrails:ruby_on_rails:3.0.0:beta + + CVE-2014-0082 + 2014-02-20T10:27:09.170-05:00 + 2014-04-24T01:02:56.307-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-02-20T08:01:44.000-05:00 + + + + + MLIST + [rubyonrails-security] 20140218 Denial of Service Vulnerability in Action View when using render :text (CVE-2014-0082) + + + CONFIRM + http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/ + + + SECUNIA + 57836 + + + SECUNIA + 57376 + + + REDHAT + RHSA-2014:0306 + + + REDHAT + RHSA-2014:0215 + + + MLIST + [oss-security] 20140218 Denial of Service Vulnerability in Action View when using render :text (CVE-2014-0082) + + + SUSE + openSUSE-SU-2014:0295 + + actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render method, which allows remote attackers to cause a denial of service (memory consumption) by including these strings in headers. + + + + + + + + + + cpe:/a:redhat:jboss_fuse:6.0.0 + cpe:/a:apache:zookeeper:- + + CVE-2014-0085 + 2014-04-17T10:55:06.467-04:00 + 2014-04-17T12:03:20.257-04:00 + + + 2.1 + LOCAL + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-17T12:03:20.177-04:00 + + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1067265 + + + SECUNIA + 57915 + + + REDHAT + RHSA-2014:0400 + + Apache Zookeeper logs cleartext admin passwords, which allows local users to obtain sensitive information by reading the log. + + + + + + + + + + + + + + cpe:/a:redhat:richfaces:4.3.4 + cpe:/a:redhat:richfaces:5.0.0:alpha3 + cpe:/a:redhat:richfaces:5.0.0:alpha2 + cpe:/a:redhat:jboss_web_framework_kit:2.5.0 + cpe:/a:redhat:richfaces:4.3.5 + cpe:/a:redhat:richfaces:5.0.0:alpha1 + + CVE-2014-0086 + 2014-03-31T10:58:19.587-04:00 + 2014-03-31T13:33:56.620-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-03-31T13:33:56.497-04:00 + + + + + CONFIRM + https://issues.jboss.org/browse/RF-13250 + + + CONFIRM + https://github.com/pslegr/core-1/commit/8131f15003f5bec73d475d2b724472e4b87d0757 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1067268 + + + SECUNIA + 57053 + + The doFilter function in webapp/PushHandlerFilter.java in JBoss RichFaces 4.3.4, 4.3.5, and 5.x allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a large number of malformed atmosphere push requests. + + + + + + + + + cpe:/a:igor_sysoev:nginx:1.5.10 + + CVE-2014-0088 + 2014-04-29T10:38:49.920-04:00 + 2014-04-30T10:10:30.290-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-30T10:10:30.257-04:00 + + + + + MLIST + [nginx-announce] 20140304 nginx security advisory (CVE-2014-0088) + + + SECTRACK + 1030150 + + The SPDY implementation in the ngx_http_spdy_module module in nginx 1.5.10 before 1.5.11, when running on a 32-bit platform, allows remote attackers to execute arbitrary code via a crafted request. + + + + + + + + + + cpe:/a:theforeman:foreman:1.4.1 + cpe:/a:theforeman:foreman:1.4.0 + + CVE-2014-0089 + 2014-03-27T12:55:05.660-04:00 + 2014-03-27T14:59:21.333-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-27T14:59:21.240-04:00 + + + + + CONFIRM + http://projects.theforeman.org/issues/4456 + + + MISC + https://bugzilla.redhat.com/show_bug.cgi?id=1071741 + + + CONFIRM + http://theforeman.org/security.html + + + SECUNIA + 57575 + + Cross-site scripting (XSS) vulnerability in app/views/common/500.html.erb in Foreman 1.4.x before 1.4.2 allows remote authenticated users to inject arbitrary web script or HTML via the bookmark name when adding a bookmark. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:gnu:gnutls:3.1.20 + cpe:/a:gnu:gnutls:3.1.21 + cpe:/a:gnu:gnutls:3.1.1 + cpe:/a:gnu:gnutls:3.1.0 + cpe:/a:gnu:gnutls:3.2.7 + cpe:/a:gnu:gnutls:3.2.8 + cpe:/a:gnu:gnutls:3.1.6 + cpe:/a:gnu:gnutls:3.1.7 + cpe:/a:gnu:gnutls:3.1.19 + cpe:/a:gnu:gnutls:3.1.2 + cpe:/a:gnu:gnutls:3.1.3 + cpe:/a:gnu:gnutls:3.1.4 + cpe:/a:gnu:gnutls:3.2.9 + cpe:/a:gnu:gnutls:3.1.5 + cpe:/a:gnu:gnutls:3.2.8.1 + cpe:/a:gnu:gnutls:3.2.2 + cpe:/a:gnu:gnutls:3.2.1 + cpe:/a:gnu:gnutls:3.2.4 + cpe:/a:gnu:gnutls:3.2.3 + cpe:/a:gnu:gnutls:3.1.10 + cpe:/a:gnu:gnutls:3.1.8 + cpe:/a:gnu:gnutls:3.2.6 + cpe:/a:gnu:gnutls:3.1.9 + cpe:/a:gnu:gnutls:3.2.5 + cpe:/a:gnu:gnutls:3.1.17 + cpe:/a:gnu:gnutls:3.1.18 + cpe:/a:gnu:gnutls:3.1.15 + cpe:/a:gnu:gnutls:3.1.16 + cpe:/a:gnu:gnutls:3.1.13 + cpe:/a:gnu:gnutls:3.1.14 + cpe:/a:gnu:gnutls:3.1.12 + cpe:/a:gnu:gnutls:3.1.11 + cpe:/a:gnu:gnutls:3.2.10 + cpe:/a:gnu:gnutls:3.2.11 + cpe:/a:gnu:gnutls:3.2.0 + + CVE-2014-0092 + 2014-03-06T19:10:53.573-05:00 + 2014-04-19T00:45:58.847-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-07T07:10:31.353-05:00 + + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1069865 + + + UBUNTU + USN-2127-1 + + + DEBIAN + DSA-2869 + + + SECUNIA + 57321 + + + SECUNIA + 57274 + + + SECUNIA + 57260 + + + SECUNIA + 57254 + + + SECUNIA + 57204 + + + SECUNIA + 57103 + + + SECUNIA + 56933 + + + REDHAT + RHSA-2014:0339 + + + REDHAT + RHSA-2014:0288 + + + REDHAT + RHSA-2014:0247 + + + REDHAT + RHSA-2014:0246 + + + SUSE + SUSE-SU-2014:0445 + + + SUSE + openSUSE-SU-2014:0346 + + + SUSE + openSUSE-SU-2014:0328 + + + SUSE + openSUSE-SU-2014:0325 + + + SUSE + SUSE-SU-2014:0324 + + + SUSE + SUSE-SU-2014:0323 + + + SUSE + SUSE-SU-2014:0322 + + + SUSE + SUSE-SU-2014:0321 + + + SUSE + SUSE-SU-2014:0320 + + + SUSE + SUSE-SU-2014:0319 + + + CONFIRM + http://gnutls.org/security.html#GNUTLS-SA-2014-2 + + lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate. + + + + + + + + + cpe:/a:redhat:jboss_enterprise_application_platform:6.2.2 + + CVE-2014-0093 + 2014-04-03T12:15:12.127-04:00 + 2014-04-03T12:51:22.310-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-03T12:51:22.137-04:00 + + + + + SECUNIA + 57675 + + + REDHAT + RHSA-2014:0345 + + + REDHAT + RHSA-2014:0344 + + + REDHAT + RHSA-2014:0343 + + Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.2, when using a Java Security Manager (JSM), does not properly apply permissions defined by a policy file, which causes applications to be granted the java.security.AllPermission permission and allows remote attackers to bypass intended access restrictions. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apache:struts:2.1.8.1 + cpe:/a:apache:struts:2.3.14 + cpe:/a:apache:struts:2.3.15 + cpe:/a:apache:struts:2.3.12 + cpe:/a:apache:struts:2.0.11.2 + cpe:/a:apache:struts:2.3.14.1 + cpe:/a:apache:struts:2.3.16 + cpe:/a:apache:struts:2.3.14.2 + cpe:/a:apache:struts:2.3.14.3 + cpe:/a:apache:struts:2.0.11.1 + cpe:/a:apache:struts:2.3.7 + cpe:/a:apache:struts:2.3.8 + cpe:/a:apache:struts:2.2.3 + cpe:/a:apache:struts:2.3.15.1 + cpe:/a:apache:struts:2.0.14 + cpe:/a:apache:struts:2.3.15.2 + cpe:/a:apache:struts:2.2.1 + cpe:/a:apache:struts:2.0.13 + cpe:/a:apache:struts:2.0.12 + cpe:/a:apache:struts:2.0.11 + cpe:/a:apache:struts:2.0.10 + cpe:/a:apache:struts:2.3.4.1 + cpe:/a:apache:struts:2.0.0 + cpe:/a:apache:struts:2.0.1 + cpe:/a:apache:struts:2.2.3.1 + cpe:/a:apache:struts:2.0.6 + cpe:/a:apache:struts:2.0.7 + cpe:/a:apache:struts:2.3.4 + cpe:/a:apache:struts:2.0.8 + cpe:/a:apache:struts:2.3.15.3 + cpe:/a:apache:struts:2.3.3 + cpe:/a:apache:struts:2.0.9 + cpe:/a:apache:struts:2.0.2 + cpe:/a:apache:struts:2.3.1 + cpe:/a:apache:struts:2.0.3 + cpe:/a:apache:struts:2.0.4 + cpe:/a:apache:struts:2.0.5 + cpe:/a:apache:struts:2.1.1 + cpe:/a:apache:struts:2.1.2 + cpe:/a:apache:struts:2.1.3 + cpe:/a:apache:struts:2.1.4 + cpe:/a:apache:struts:2.1.5 + cpe:/a:apache:struts:2.1.6 + cpe:/a:apache:struts:2.1.8 + cpe:/a:apache:struts:2.3.1.2 + cpe:/a:apache:struts:2.2.1.1 + cpe:/a:apache:struts:2.3.1.1 + cpe:/a:apache:struts:2.1.0 + + CVE-2014-0094 + 2014-03-11T09:00:37.107-04:00 + 2014-03-11T10:00:53.477-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-11T10:00:50.277-04:00 + + + + SECTRACK + 1029876 + + + BID + 65999 + + + BUGTRAQ + 20140306 [ANN] Struts 2.3.16.1 GA release available - security fix + + + CONFIRM + http://struts.apache.org/release/2.3.x/docs/s2-020.html + + + SECUNIA + 56440 + + The ParametersInterceptor in Apache Struts before 2.3.16.1 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apache:http_server:2.4.4 + cpe:/a:apache:http_server:2.4.3 + cpe:/a:apache:http_server:2.4.2 + cpe:/a:apache:http_server:2.4.1 + cpe:/a:apache:http_server:2.0.64 + cpe:/a:apache:http_server:2.4.0 + cpe:/a:apache:http_server:2.0.9 + cpe:/a:apache:http_server:2.2.9 + cpe:/a:apache:http_server:2.2.8 + cpe:/a:apache:http_server:2.0.32:beta + cpe:/a:apache:http_server:2.2.10 + cpe:/a:apache:http_server:2.3.8 + cpe:/a:apache:http_server:2.0.34:beta + cpe:/a:apache:http_server:2.3.9 + cpe:/a:apache:http_server:2.3.7 + cpe:/a:apache:http_server:2.2.18 + cpe:/a:apache:http_server:2.0.38 + cpe:/a:apache:http_server:2.0.28:beta + cpe:/a:apache:http_server:2.1.8 + cpe:/a:apache:http_server:2.1.7 + cpe:/a:apache:http_server:2.0.53 + cpe:/a:apache:http_server:2.1.6 + cpe:/a:apache:http_server:2.0.54 + cpe:/a:apache:http_server:2.1.5 + cpe:/a:apache:http_server:2.0.55 + cpe:/a:apache:http_server:2.1.4 + cpe:/a:apache:http_server:2.0.56 + cpe:/a:apache:http_server:2.1.3 + cpe:/a:apache:http_server:2.0.57 + cpe:/a:apache:http_server:2.1.2 + cpe:/a:apache:http_server:2.0.58 + cpe:/a:apache:http_server:2.1.1 + cpe:/a:apache:http_server:2.0.59 + cpe:/a:apache:http_server:2.0.63 + cpe:/a:apache:http_server:2.0.60 + cpe:/a:apache:http_server:2.0.61 + cpe:/a:apache:http_server:2.0.49 + cpe:/a:apache:http_server:2.3.6 + cpe:/a:apache:http_server:2.0.40 + cpe:/a:apache:http_server:2.2.19 + cpe:/a:apache:http_server:2.1.9 + cpe:/a:apache:http_server:2.0.41 + cpe:/a:apache:http_server:2.2.25 + cpe:/a:apache:http_server:2.2.24 + cpe:/a:apache:http_server:2.2.23 + cpe:/a:apache:http_server:2.2.22 + cpe:/a:apache:http_server:2.0.28 + cpe:/a:apache:http_server:2.3.10 + cpe:/a:apache:http_server:2.4.7 + cpe:/a:apache:http_server:2.4.6 + cpe:/a:apache:http_server:2.0.52 + cpe:/a:apache:http_server:2.2 + cpe:/a:apache:http_server:2.0.51 + cpe:/a:apache:http_server:2.0.32 + cpe:/a:apache:http_server:2.0.50 + cpe:/a:apache:http_server:2.1 + cpe:/a:apache:http_server:2.0 + cpe:/a:apache:http_server:2.3.11 + cpe:/a:apache:http_server:2.0.37 + cpe:/a:apache:http_server:2.0.36 + cpe:/a:apache:http_server:2.0.35 + cpe:/a:apache:http_server:2.2.15 + cpe:/a:apache:http_server:2.3.12 + cpe:/a:apache:http_server:2.2.14 + cpe:/a:apache:http_server:2.3.13 + cpe:/a:apache:http_server:2.2.17 + cpe:/a:apache:http_server:2.3.14 + cpe:/a:apache:http_server:2.2.16 + cpe:/a:apache:http_server:2.3.15 + cpe:/a:apache:http_server:2.2.11 + cpe:/a:apache:http_server:2.3.16 + cpe:/a:apache:http_server:2.2.13 + cpe:/a:apache:http_server:2.2.12 + cpe:/a:apache:http_server:2.2.3 + cpe:/a:apache:http_server:2.0.39 + cpe:/a:apache:http_server:2.2.4 + cpe:/a:apache:http_server:2.2.6 + cpe:/a:apache:http_server:2.2.20 + cpe:/a:apache:http_server:2.2.0 + cpe:/a:apache:http_server:2.2.1 + cpe:/a:apache:http_server:2.2.2 + cpe:/a:apache:http_server:2.0.42 + cpe:/a:apache:http_server:2.3.0 + cpe:/a:apache:http_server:2.0.44 + cpe:/a:apache:http_server:2.3.1 + cpe:/a:apache:http_server:2.0.43 + cpe:/a:apache:http_server:2.3.2 + cpe:/a:apache:http_server:2.2.21 + cpe:/a:apache:http_server:2.0.46 + cpe:/a:apache:http_server:2.3.3 + cpe:/a:apache:http_server:2.0.45 + cpe:/a:apache:http_server:2.3.4 + cpe:/a:apache:http_server:2.0.48 + cpe:/a:apache:http_server:2.3.5 + cpe:/a:apache:http_server:2.0.47 + + CVE-2014-0098 + 2014-03-18T01:18:18.750-04:00 + 2014-04-01T02:27:58.013-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-03-18T08:33:41.000-04:00 + + + + + CONFIRM + http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/loggers/mod_log_config.c?r1=1575394&r2=1575400&diff_format=h + + + UBUNTU + USN-2152-1 + + + CONFIRM + http://www.apache.org/dist/httpd/CHANGES_2.4.9 + + + CONFIRM + http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/loggers/mod_log_config.c + + The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled during truncation. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:linux:linux_kernel:3.0.48 + cpe:/o:linux:linux_kernel:3.0.49 + cpe:/o:linux:linux_kernel:3.0.46 + cpe:/o:linux:linux_kernel:3.0.47 + cpe:/o:linux:linux_kernel:3.0.44 + cpe:/o:linux:linux_kernel:3.0.45 + cpe:/o:linux:linux_kernel:3.0.42 + cpe:/o:linux:linux_kernel:3.4.70 + cpe:/o:linux:linux_kernel:3.4.71 + cpe:/o:linux:linux_kernel:3.0.40 + cpe:/o:linux:linux_kernel:3.0.41 + cpe:/o:linux:linux_kernel:3.4.45 + cpe:/o:linux:linux_kernel:3.4.44 + cpe:/o:linux:linux_kernel:3.4.46 + cpe:/o:linux:linux_kernel:3.4.41 + cpe:/o:linux:linux_kernel:3.4.40 + cpe:/o:linux:linux_kernel:3.4.43 + cpe:/o:linux:linux_kernel:3.4.42 + cpe:/o:linux:linux_kernel:3.4.49 + cpe:/o:linux:linux_kernel:3.4.48 + cpe:/o:linux:linux_kernel:3.0.59 + cpe:/o:linux:linux_kernel:3.4.47 + cpe:/o:linux:linux_kernel:3.0.55 + cpe:/o:linux:linux_kernel:3.0.56 + cpe:/o:linux:linux_kernel:3.0.57 + cpe:/o:linux:linux_kernel:3.0.58 + cpe:/o:linux:linux_kernel:3.0.51 + cpe:/o:linux:linux_kernel:3.0.52 + cpe:/o:linux:linux_kernel:3.0.53 + cpe:/o:linux:linux_kernel:3.11.10 + cpe:/o:linux:linux_kernel:3.0.50 + cpe:/o:linux:linux_kernel:3.4.57 + cpe:/o:linux:linux_kernel:3.4.56 + cpe:/o:linux:linux_kernel:3.4.55 + cpe:/o:linux:linux_kernel:3.4.54 + cpe:/o:linux:linux_kernel:3.4.53 + cpe:/o:linux:linux_kernel:3.4.52 + cpe:/o:linux:linux_kernel:3.4.51 + cpe:/o:linux:linux_kernel:3.4.50 + cpe:/o:linux:linux_kernel:3.0.43 + cpe:/o:linux:linux_kernel:3.10.26 + cpe:/o:linux:linux_kernel:3.4.59 + cpe:/o:linux:linux_kernel:3.0.24 + cpe:/o:linux:linux_kernel:3.0.25 + cpe:/o:linux:linux_kernel:3.0.22 + cpe:/o:linux:linux_kernel:3.1.9 + cpe:/o:linux:linux_kernel:3.0.23 + cpe:/o:linux:linux_kernel:3.10.28 + cpe:/o:linux:linux_kernel:3.0.28 + cpe:/o:linux:linux_kernel:3.10.27 + cpe:/o:linux:linux_kernel:3.0.26 + cpe:/o:linux:linux_kernel:3.10.29 + cpe:/o:linux:linux_kernel:3.4.58 + cpe:/o:linux:linux_kernel:3.0.27 + cpe:/o:linux:linux_kernel:3.10.24 + cpe:/o:linux:linux_kernel:3.10.23 + cpe:/o:linux:linux_kernel:3.10.25 + cpe:/o:linux:linux_kernel:3.10.20 + cpe:/o:linux:linux_kernel:3.1.8 + cpe:/o:linux:linux_kernel:3.0.20 + cpe:/o:linux:linux_kernel:3.10.22 + cpe:/o:linux:linux_kernel:3.10.21 + cpe:/o:linux:linux_kernel:3.4.21 + cpe:/o:linux:linux_kernel:3.4.20 + cpe:/o:linux:linux_kernel:3.4.23 + cpe:/o:linux:linux_kernel:3.4.22 + cpe:/o:linux:linux_kernel:3.4.24 + cpe:/o:linux:linux_kernel:3.4.27 + cpe:/o:linux:linux_kernel:3.4.26 + cpe:/o:linux:linux_kernel:3.4.29 + cpe:/o:linux:linux_kernel:3.10.15 + cpe:/o:linux:linux_kernel:3.4.28 + cpe:/o:linux:linux_kernel:3.0.54 + cpe:/o:linux:linux_kernel:3.0.33 + cpe:/o:linux:linux_kernel:3.0.34 + cpe:/o:linux:linux_kernel:3.0.35 + cpe:/o:linux:linux_kernel:3.0.36 + cpe:/o:linux:linux_kernel:3.10.19 + cpe:/o:linux:linux_kernel:3.0.37 + cpe:/o:linux:linux_kernel:3.10.18 + cpe:/o:linux:linux_kernel:3.0.38 + cpe:/o:linux:linux_kernel:3.4.25 + cpe:/o:linux:linux_kernel:3.10.17 + cpe:/o:linux:linux_kernel:3.0.39 + cpe:/o:linux:linux_kernel:3.10.16 + cpe:/o:linux:linux_kernel:3.10.14 + cpe:/o:linux:linux_kernel:3.10.13 + cpe:/o:linux:linux_kernel:3.10.12 + cpe:/o:linux:linux_kernel:3.10.11 + cpe:/o:linux:linux_kernel:3.10.10 + cpe:/o:linux:linux_kernel:3.0.30 + cpe:/o:linux:linux_kernel:3.0.31 + cpe:/o:linux:linux_kernel:3.9.8 + cpe:/o:linux:linux_kernel:3.5.5 + cpe:/o:linux:linux_kernel:3.4.32 + cpe:/o:linux:linux_kernel:3.9.9 + cpe:/o:linux:linux_kernel:3.5.6 + cpe:/o:linux:linux_kernel:3.4.31 + cpe:/o:linux:linux_kernel:3.5.7 + cpe:/o:linux:linux_kernel:3.4.30 + cpe:/o:linux:linux_kernel:3.7.1 + cpe:/o:linux:linux_kernel:3.4.35 + cpe:/o:linux:linux_kernel:3.9.0 + cpe:/o:linux:linux_kernel:3.0.18 + cpe:/o:linux:linux_kernel:3.4.34 + cpe:/o:linux:linux_kernel:3.4.33 + cpe:/o:linux:linux_kernel:3.9.2 + cpe:/o:linux:linux_kernel:3.9.1 + cpe:/o:linux:linux_kernel:3.0.19 + cpe:/o:linux:linux_kernel:3.4.39 + cpe:/o:linux:linux_kernel:3.9.4 + cpe:/o:linux:linux_kernel:3.4.38 + cpe:/o:linux:linux_kernel:3.9.3 + cpe:/o:linux:linux_kernel:3.4.37 + cpe:/o:linux:linux_kernel:3.9.6 + cpe:/o:linux:linux_kernel:3.9.5 + cpe:/o:linux:linux_kernel:3.0.21 + cpe:/o:linux:linux_kernel:3.9.7 + cpe:/o:linux:linux_kernel:3.5.4 + cpe:/o:linux:linux_kernel:3.0.4 + cpe:/o:linux:linux_kernel:3.0.5 + cpe:/o:linux:linux_kernel:3.0.2 + cpe:/o:linux:linux_kernel:3.0.3 + cpe:/o:linux:linux_kernel:3.0.8 + cpe:/o:linux:linux_kernel:3.0.6 + cpe:/o:linux:linux_kernel:3.0.7 + cpe:/o:linux:linux_kernel:3.4.36 + cpe:/o:linux:linux_kernel:3.13.1 + cpe:/o:linux:linux_kernel:3.6.10 + cpe:/o:linux:linux_kernel:3.6.11 + cpe:/o:linux:linux_kernel:3.13.6 + cpe:/o:linux:linux_kernel:3.13.4 + cpe:/o:linux:linux_kernel:3.13.5 + cpe:/o:linux:linux_kernel:3.13.2 + cpe:/o:linux:linux_kernel:3.13.3 + cpe:/o:linux:linux_kernel:3.4.1 + cpe:/o:linux:linux_kernel:3.4.19 + cpe:/o:linux:linux_kernel:3.4.17 + cpe:/o:linux:linux_kernel:3.4.3 + cpe:/o:linux:linux_kernel:3.4.18 + cpe:/o:linux:linux_kernel:3.4.2 + cpe:/o:linux:linux_kernel:3.2.9 + cpe:/o:linux:linux_kernel:3.4.15 + cpe:/o:linux:linux_kernel:3.2.8 + cpe:/o:linux:linux_kernel:3.4.16 + cpe:/o:linux:linux_kernel:3.4.4 + cpe:/o:linux:linux_kernel:3.12.12 + cpe:/o:linux:linux_kernel:3.2.7 + cpe:/o:linux:linux_kernel:3.4.13 + cpe:/o:linux:linux_kernel:3.12.13 + cpe:/o:linux:linux_kernel:3.12.10 + cpe:/o:linux:linux_kernel:3.4.11 + cpe:/o:linux:linux_kernel:3.12.11 + cpe:/o:linux:linux_kernel:3.4.12 + cpe:/o:linux:linux_kernel:3.4.10 + cpe:/o:linux:linux_kernel:3.0.61 + cpe:/o:linux:linux_kernel:3.3:rc2 + cpe:/o:linux:linux_kernel:3.4:rc7 + cpe:/o:linux:linux_kernel:3.0.60 + cpe:/o:linux:linux_kernel:3.3:rc7 + cpe:/o:linux:linux_kernel:3.4:rc5 + cpe:/o:linux:linux_kernel:3.3:rc5 + cpe:/o:linux:linux_kernel:3.4:rc6 + cpe:/o:linux:linux_kernel:3.3:rc6 + cpe:/o:linux:linux_kernel:3.0.64 + cpe:/o:linux:linux_kernel:3.0.63 + cpe:/o:linux:linux_kernel:3.0.62 + cpe:/o:linux:linux_kernel:3.12.1 + cpe:/o:linux:linux_kernel:3.0.68 + cpe:/o:linux:linux_kernel:3.0.67 + cpe:/o:linux:linux_kernel:3.0.66 + cpe:/o:linux:linux_kernel:3.4.14 + cpe:/o:linux:linux_kernel:3.12.7 + cpe:/o:linux:linux_kernel:3.2:rc2 + cpe:/o:linux:linux_kernel:3.1:rc1 + cpe:/o:linux:linux_kernel:3.0.9 + cpe:/o:linux:linux_kernel:3.0:rc4 + cpe:/o:linux:linux_kernel:3.12.8 + cpe:/o:linux:linux_kernel:3.1:rc4 + cpe:/o:linux:linux_kernel:3.0:rc3 + cpe:/o:linux:linux_kernel:3.12.9 + cpe:/o:linux:linux_kernel:3.0:rc2 + cpe:/o:linux:linux_kernel:3.1:rc2 + cpe:/o:linux:linux_kernel:3.0:rc1 + cpe:/o:linux:linux_kernel:3.2:rc7 + cpe:/o:linux:linux_kernel:3.12.3 + cpe:/o:linux:linux_kernel:3.1.10 + cpe:/o:linux:linux_kernel:3.2:rc6 + cpe:/o:linux:linux_kernel:3.12.4 + cpe:/o:linux:linux_kernel:3.0:rc7 + cpe:/o:linux:linux_kernel:3.2:rc5 + cpe:/o:linux:linux_kernel:3.12.5 + cpe:/o:linux:linux_kernel:3.9:rc3 + cpe:/o:linux:linux_kernel:3.0:rc6 + cpe:/o:linux:linux_kernel:3.12.6 + cpe:/o:linux:linux_kernel:3.0:rc5 + cpe:/o:linux:linux_kernel:3.9:rc1 + cpe:/o:linux:linux_kernel:3.9:rc4 + cpe:/o:linux:linux_kernel:3.9:rc7 + cpe:/o:linux:linux_kernel:3.12.2 + cpe:/o:linux:linux_kernel:3.9:rc2 + cpe:/o:linux:linux_kernel:3.9:rc5 + cpe:/o:linux:linux_kernel:3.3:rc3 + cpe:/o:linux:linux_kernel:3.4:rc4 + cpe:/o:linux:linux_kernel:3.4:rc3 + cpe:/o:linux:linux_kernel:3.3:rc1 + cpe:/o:linux:linux_kernel:3.4:rc2 + cpe:/o:linux:linux_kernel:3.9:rc6 + cpe:/o:linux:linux_kernel:3.3:rc4 + cpe:/o:linux:linux_kernel:3.4:rc1 + cpe:/o:linux:linux_kernel:3.4.5 + cpe:/o:linux:linux_kernel:3.2.2 + cpe:/o:linux:linux_kernel:3.2.3 + cpe:/o:linux:linux_kernel:3.2.1 + cpe:/o:linux:linux_kernel:3.4.6 + cpe:/o:linux:linux_kernel:3.2:rc3 + cpe:/o:linux:linux_kernel:3.2.6 + cpe:/o:linux:linux_kernel:3.4.7 + cpe:/o:linux:linux_kernel:3.2:rc4 + cpe:/o:linux:linux_kernel:3.1:rc3 + cpe:/o:linux:linux_kernel:3.4.8 + cpe:/o:linux:linux_kernel:3.2.4 + cpe:/o:linux:linux_kernel:3.4.9 + cpe:/o:linux:linux_kernel:3.2.5 + cpe:/o:linux:linux_kernel:3.0.65 + cpe:/o:linux:linux_kernel:3.2.12 + cpe:/o:linux:linux_kernel:3.8.10 + cpe:/o:linux:linux_kernel:3.8.12 + cpe:/o:linux:linux_kernel:3.8.11 + cpe:/o:linux:linux_kernel:3.8.13 + cpe:/o:linux:linux_kernel:3.7.9 + cpe:/o:linux:linux_kernel:3.7.8 + cpe:/o:linux:linux_kernel:3.7.7 + cpe:/o:linux:linux_kernel:3.7.6 + cpe:/o:linux:linux_kernel:3.6.3 + cpe:/o:linux:linux_kernel:3.7.5 + cpe:/o:linux:linux_kernel:3.7.4 + cpe:/o:linux:linux_kernel:3.7.3 + cpe:/o:linux:linux_kernel:3.7.2 + cpe:/o:linux:linux_kernel:3.6.7 + cpe:/o:linux:linux_kernel:3.6.6 + cpe:/o:linux:linux_kernel:3.6.5 + cpe:/o:linux:linux_kernel:3.6.4 + cpe:/o:linux:linux_kernel:3.6.9 + cpe:/o:linux:linux_kernel:3.6.8 + cpe:/o:linux:linux_kernel:3.10 + cpe:/o:linux:linux_kernel:3.11 + cpe:/o:linux:linux_kernel:3.12 + cpe:/o:linux:linux_kernel:3.13 + cpe:/o:linux:linux_kernel:3.10.1 + cpe:/o:linux:linux_kernel:3.10.2 + cpe:/o:linux:linux_kernel:3.10.3 + cpe:/o:linux:linux_kernel:3.6.2 + cpe:/o:linux:linux_kernel:3.6.1 + cpe:/o:linux:linux_kernel:3.3.6 + cpe:/o:linux:linux_kernel:3.3.7 + cpe:/o:linux:linux_kernel:3.3.8 + cpe:/o:linux:linux_kernel:3.0.1 + cpe:/o:linux:linux_kernel:3.2 + cpe:/o:linux:linux_kernel:3.1 + cpe:/o:linux:linux_kernel:3.7 + cpe:/o:linux:linux_kernel:3.6 + cpe:/o:linux:linux_kernel:3.4 + cpe:/o:linux:linux_kernel:3.1.6 + cpe:/o:linux:linux_kernel:3.1.5 + cpe:/o:linux:linux_kernel:3.1.7 + cpe:/o:linux:linux_kernel:3.0.32 + cpe:/o:linux:linux_kernel:3.8.9 + cpe:/o:linux:linux_kernel:3.1.2 + cpe:/o:linux:linux_kernel:3.1.1 + cpe:/o:linux:linux_kernel:3.1.4 + cpe:/o:linux:linux_kernel:3.1.3 + cpe:/o:linux:linux_kernel:3.9.10 + cpe:/o:linux:linux_kernel:3.0.29 + cpe:/o:linux:linux_kernel:3.3 + cpe:/o:linux:linux_kernel:3.8.4 + cpe:/o:linux:linux_kernel:3.2.26 + cpe:/o:linux:linux_kernel:3.8.5 + cpe:/o:linux:linux_kernel:3.2.27 + cpe:/o:linux:linux_kernel:3.8.2 + cpe:/o:linux:linux_kernel:3.2.24 + cpe:/o:linux:linux_kernel:3.8.3 + cpe:/o:linux:linux_kernel:3.2.25 + cpe:/o:linux:linux_kernel:3.8.8 + cpe:/o:linux:linux_kernel:3.8.6 + cpe:/o:linux:linux_kernel:3.2.28 + cpe:/o:linux:linux_kernel:3.8.7 + cpe:/o:linux:linux_kernel:3.2.29 + cpe:/o:linux:linux_kernel:3.3.3 + cpe:/o:linux:linux_kernel:3.3.4 + cpe:/o:linux:linux_kernel:3.3.5 + cpe:/o:linux:linux_kernel:3.2.22 + cpe:/o:linux:linux_kernel:3.8.1 + cpe:/o:linux:linux_kernel:3.2.20 + cpe:/o:linux:linux_kernel:3.3.1 + cpe:/o:linux:linux_kernel:3.2.21 + cpe:/o:linux:linux_kernel:3.3.2 + cpe:/o:linux:linux_kernel:3.11.1 + cpe:/o:linux:linux_kernel:3.11.2 + cpe:/o:linux:linux_kernel:3.2.23 + cpe:/o:linux:linux_kernel:3.0.17 + cpe:/o:linux:linux_kernel:3.9.11 + cpe:/o:linux:linux_kernel:3.0.16 + cpe:/o:linux:linux_kernel:3.0.15 + cpe:/o:linux:linux_kernel:3.2.30 + cpe:/o:linux:linux_kernel:3.0.14 + cpe:/o:linux:linux_kernel:3.0.13 + cpe:/o:linux:linux_kernel:3.0.12 + cpe:/o:linux:linux_kernel:3.0.11 + cpe:/o:linux:linux_kernel:3.4.61 + cpe:/o:linux:linux_kernel:3.0.10 + cpe:/o:linux:linux_kernel:3.4.64 + cpe:/o:linux:linux_kernel:3.8.0 + cpe:/o:linux:linux_kernel:3.4.65 + cpe:/o:linux:linux_kernel:3.4.62 + cpe:/o:linux:linux_kernel:3.4.63 + cpe:/o:linux:linux_kernel:3.4.68 + cpe:/o:linux:linux_kernel:3.4.66 + cpe:/o:linux:linux_kernel:3.4.67 + cpe:/o:linux:linux_kernel:3.5.3 + cpe:/o:linux:linux_kernel:3.5.1 + cpe:/o:linux:linux_kernel:3.5.2 + cpe:/o:linux:linux_kernel:3.10.4 + cpe:/o:linux:linux_kernel:3.4.72 + cpe:/o:linux:linux_kernel:3.10.9 + cpe:/o:linux:linux_kernel:3.4.73 + cpe:/o:linux:linux_kernel:3.4.74 + cpe:/o:linux:linux_kernel:3.4.75 + cpe:/o:linux:linux_kernel:3.4.76 + cpe:/o:linux:linux_kernel:3.10.5 + cpe:/o:linux:linux_kernel:3.4.77 + cpe:/o:linux:linux_kernel:3.10.6 + cpe:/o:linux:linux_kernel:3.4.78 + cpe:/o:linux:linux_kernel:3.10.7 + cpe:/o:linux:linux_kernel:3.4.79 + cpe:/o:linux:linux_kernel:3.10.8 + cpe:/o:linux:linux_kernel:3.7.10 + cpe:/o:linux:linux_kernel:3.2.17 + cpe:/o:linux:linux_kernel:3.2.18 + cpe:/o:linux:linux_kernel:3.2.19 + cpe:/o:linux:linux_kernel:3.2.13 + cpe:/o:linux:linux_kernel:3.2.14 + cpe:/o:linux:linux_kernel:3.11.3 + cpe:/o:linux:linux_kernel:3.2.15 + cpe:/o:linux:linux_kernel:3.4.60 + cpe:/o:linux:linux_kernel:3.2.16 + cpe:/o:linux:linux_kernel:3.11.5 + cpe:/o:linux:linux_kernel:3.11.4 + cpe:/o:linux:linux_kernel:3.2.10 + cpe:/o:linux:linux_kernel:3.11.7 + cpe:/o:linux:linux_kernel:3.2.11 + cpe:/o:linux:linux_kernel:3.11.6 + cpe:/o:linux:linux_kernel:3.11.9 + cpe:/o:linux:linux_kernel:3.11.8 + cpe:/o:linux:linux_kernel:3.4.69 + + CVE-2014-0100 + 2014-03-11T09:01:06.733-04:00 + 2014-03-11T10:30:21.320-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-11T10:30:10.773-04:00 + + + + + MLIST + [oss-security] 20140304 CVE-2014-0100 -- Linux kernel: net: inet frag code race condition leading to user-after-free + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1070618 + + + MISC + http://patchwork.ozlabs.org/patch/325844/ + + Race condition in the inet_frag_intern function in net/ipv4/inet_fragment.c in the Linux kernel through 3.13.6 allows remote attackers to cause a denial of service (use-after-free error) or possibly have unspecified other impact via a large series of fragmented ICMP Echo Request packets to a system with a heavy CPU load. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:linux:linux_kernel:3.0.48 + cpe:/o:linux:linux_kernel:3.0.49 + cpe:/o:linux:linux_kernel:3.0.46 + cpe:/o:linux:linux_kernel:3.0.47 + cpe:/o:linux:linux_kernel:3.0.44 + cpe:/o:linux:linux_kernel:3.0.45 + cpe:/o:linux:linux_kernel:3.0.42 + cpe:/o:linux:linux_kernel:3.4.70 + cpe:/o:linux:linux_kernel:3.4.71 + cpe:/o:linux:linux_kernel:3.0.40 + cpe:/o:linux:linux_kernel:3.0.41 + cpe:/o:linux:linux_kernel:3.4.45 + cpe:/o:linux:linux_kernel:3.4.44 + cpe:/o:linux:linux_kernel:3.4.46 + cpe:/o:linux:linux_kernel:3.4.41 + cpe:/o:linux:linux_kernel:3.4.40 + cpe:/o:linux:linux_kernel:3.4.43 + cpe:/o:linux:linux_kernel:3.4.42 + cpe:/o:linux:linux_kernel:3.4.49 + cpe:/o:linux:linux_kernel:3.4.48 + cpe:/o:linux:linux_kernel:3.0.59 + cpe:/o:linux:linux_kernel:3.4.47 + cpe:/o:linux:linux_kernel:3.0.55 + cpe:/o:linux:linux_kernel:3.0.56 + cpe:/o:linux:linux_kernel:3.0.57 + cpe:/o:linux:linux_kernel:3.0.58 + cpe:/o:linux:linux_kernel:3.0.51 + cpe:/o:linux:linux_kernel:3.0.52 + cpe:/o:linux:linux_kernel:3.0.53 + cpe:/o:linux:linux_kernel:3.11.10 + cpe:/o:linux:linux_kernel:3.0.50 + cpe:/o:linux:linux_kernel:3.4.57 + cpe:/o:linux:linux_kernel:3.4.56 + cpe:/o:linux:linux_kernel:3.4.55 + cpe:/o:linux:linux_kernel:3.4.54 + cpe:/o:linux:linux_kernel:3.4.53 + cpe:/o:linux:linux_kernel:3.4.52 + cpe:/o:linux:linux_kernel:3.4.51 + cpe:/o:linux:linux_kernel:3.4.50 + cpe:/o:linux:linux_kernel:3.0.43 + cpe:/o:linux:linux_kernel:3.10.26 + cpe:/o:linux:linux_kernel:3.4.59 + cpe:/o:linux:linux_kernel:3.0.24 + cpe:/o:linux:linux_kernel:3.0.25 + cpe:/o:linux:linux_kernel:3.0.22 + cpe:/o:linux:linux_kernel:3.1.9 + cpe:/o:linux:linux_kernel:3.0.23 + cpe:/o:linux:linux_kernel:3.10.28 + cpe:/o:linux:linux_kernel:3.0.28 + cpe:/o:linux:linux_kernel:3.10.27 + cpe:/o:linux:linux_kernel:3.0.26 + cpe:/o:linux:linux_kernel:3.10.29 + cpe:/o:linux:linux_kernel:3.4.58 + cpe:/o:linux:linux_kernel:3.0.27 + cpe:/o:linux:linux_kernel:3.10.24 + cpe:/o:linux:linux_kernel:3.10.23 + cpe:/o:linux:linux_kernel:3.10.25 + cpe:/o:linux:linux_kernel:3.10.20 + cpe:/o:linux:linux_kernel:3.1.8 + cpe:/o:linux:linux_kernel:3.0.20 + cpe:/o:linux:linux_kernel:3.10.22 + cpe:/o:linux:linux_kernel:3.10.21 + cpe:/o:linux:linux_kernel:3.4.21 + cpe:/o:linux:linux_kernel:3.4.20 + cpe:/o:linux:linux_kernel:3.4.23 + cpe:/o:linux:linux_kernel:3.4.22 + cpe:/o:linux:linux_kernel:3.4.24 + cpe:/o:linux:linux_kernel:3.4.27 + cpe:/o:linux:linux_kernel:3.4.26 + cpe:/o:linux:linux_kernel:3.4.29 + cpe:/o:linux:linux_kernel:3.10.15 + cpe:/o:linux:linux_kernel:3.4.28 + cpe:/o:linux:linux_kernel:3.0.54 + cpe:/o:linux:linux_kernel:3.0.33 + cpe:/o:linux:linux_kernel:3.0.34 + cpe:/o:linux:linux_kernel:3.0.35 + cpe:/o:linux:linux_kernel:3.0.36 + cpe:/o:linux:linux_kernel:3.10.19 + cpe:/o:linux:linux_kernel:3.0.37 + cpe:/o:linux:linux_kernel:3.10.18 + cpe:/o:linux:linux_kernel:3.0.38 + cpe:/o:linux:linux_kernel:3.4.25 + cpe:/o:linux:linux_kernel:3.10.17 + cpe:/o:linux:linux_kernel:3.0.39 + cpe:/o:linux:linux_kernel:3.10.16 + cpe:/o:linux:linux_kernel:3.10.14 + cpe:/o:linux:linux_kernel:3.10.13 + cpe:/o:linux:linux_kernel:3.10.12 + cpe:/o:linux:linux_kernel:3.10.11 + cpe:/o:linux:linux_kernel:3.10.10 + cpe:/o:linux:linux_kernel:3.0.30 + cpe:/o:linux:linux_kernel:3.0.31 + cpe:/o:linux:linux_kernel:3.9.8 + cpe:/o:linux:linux_kernel:3.5.5 + cpe:/o:linux:linux_kernel:3.4.32 + cpe:/o:linux:linux_kernel:3.9.9 + cpe:/o:linux:linux_kernel:3.5.6 + cpe:/o:linux:linux_kernel:3.4.31 + cpe:/o:linux:linux_kernel:3.5.7 + cpe:/o:linux:linux_kernel:3.4.30 + cpe:/o:linux:linux_kernel:3.7.1 + cpe:/o:linux:linux_kernel:3.4.35 + cpe:/o:linux:linux_kernel:3.9.0 + cpe:/o:linux:linux_kernel:3.0.18 + cpe:/o:linux:linux_kernel:3.4.34 + cpe:/o:linux:linux_kernel:3.4.33 + cpe:/o:linux:linux_kernel:3.9.2 + cpe:/o:linux:linux_kernel:3.9.1 + cpe:/o:linux:linux_kernel:3.0.19 + cpe:/o:linux:linux_kernel:3.4.39 + cpe:/o:linux:linux_kernel:3.9.4 + cpe:/o:linux:linux_kernel:3.4.38 + cpe:/o:linux:linux_kernel:3.9.3 + cpe:/o:linux:linux_kernel:3.4.37 + cpe:/o:linux:linux_kernel:3.9.6 + cpe:/o:linux:linux_kernel:3.9.5 + cpe:/o:linux:linux_kernel:3.0.21 + cpe:/o:linux:linux_kernel:3.9.7 + cpe:/o:linux:linux_kernel:3.5.4 + cpe:/o:linux:linux_kernel:3.0.4 + cpe:/o:linux:linux_kernel:3.0.5 + cpe:/o:linux:linux_kernel:3.0.2 + cpe:/o:linux:linux_kernel:3.0.3 + cpe:/o:linux:linux_kernel:3.0.8 + cpe:/o:linux:linux_kernel:3.0.6 + cpe:/o:linux:linux_kernel:3.0.7 + cpe:/o:linux:linux_kernel:3.4.36 + cpe:/o:linux:linux_kernel:3.13.1 + cpe:/o:linux:linux_kernel:3.6.10 + cpe:/o:linux:linux_kernel:3.6.11 + cpe:/o:linux:linux_kernel:3.13.6 + cpe:/o:linux:linux_kernel:3.13.4 + cpe:/o:linux:linux_kernel:3.13.5 + cpe:/o:linux:linux_kernel:3.13.2 + cpe:/o:linux:linux_kernel:3.13.3 + cpe:/o:linux:linux_kernel:3.4.1 + cpe:/o:linux:linux_kernel:3.4.19 + cpe:/o:linux:linux_kernel:3.4.17 + cpe:/o:linux:linux_kernel:3.4.3 + cpe:/o:linux:linux_kernel:3.4.18 + cpe:/o:linux:linux_kernel:3.4.2 + cpe:/o:linux:linux_kernel:3.2.9 + cpe:/o:linux:linux_kernel:3.4.15 + cpe:/o:linux:linux_kernel:3.2.8 + cpe:/o:linux:linux_kernel:3.4.16 + cpe:/o:linux:linux_kernel:3.4.4 + cpe:/o:linux:linux_kernel:3.12.12 + cpe:/o:linux:linux_kernel:3.2.7 + cpe:/o:linux:linux_kernel:3.4.13 + cpe:/o:linux:linux_kernel:3.12.13 + cpe:/o:linux:linux_kernel:3.12.10 + cpe:/o:linux:linux_kernel:3.4.11 + cpe:/o:linux:linux_kernel:3.12.11 + cpe:/o:linux:linux_kernel:3.4.12 + cpe:/o:linux:linux_kernel:3.4.10 + cpe:/o:linux:linux_kernel:3.0.61 + cpe:/o:linux:linux_kernel:3.3:rc2 + cpe:/o:linux:linux_kernel:3.4:rc7 + cpe:/o:linux:linux_kernel:3.0.60 + cpe:/o:linux:linux_kernel:3.3:rc7 + cpe:/o:linux:linux_kernel:3.4:rc5 + cpe:/o:linux:linux_kernel:3.3:rc5 + cpe:/o:linux:linux_kernel:3.4:rc6 + cpe:/o:linux:linux_kernel:3.3:rc6 + cpe:/o:linux:linux_kernel:3.0.64 + cpe:/o:linux:linux_kernel:3.0.63 + cpe:/o:linux:linux_kernel:3.0.62 + cpe:/o:linux:linux_kernel:3.12.1 + cpe:/o:linux:linux_kernel:3.0.68 + cpe:/o:linux:linux_kernel:3.0.67 + cpe:/o:linux:linux_kernel:3.0.66 + cpe:/o:linux:linux_kernel:3.4.14 + cpe:/o:linux:linux_kernel:3.12.7 + cpe:/o:linux:linux_kernel:3.2:rc2 + cpe:/o:linux:linux_kernel:3.1:rc1 + cpe:/o:linux:linux_kernel:3.0.9 + cpe:/o:linux:linux_kernel:3.0:rc4 + cpe:/o:linux:linux_kernel:3.12.8 + cpe:/o:linux:linux_kernel:3.1:rc4 + cpe:/o:linux:linux_kernel:3.0:rc3 + cpe:/o:linux:linux_kernel:3.12.9 + cpe:/o:linux:linux_kernel:3.0:rc2 + cpe:/o:linux:linux_kernel:3.1:rc2 + cpe:/o:linux:linux_kernel:3.0:rc1 + cpe:/o:linux:linux_kernel:3.2:rc7 + cpe:/o:linux:linux_kernel:3.12.3 + cpe:/o:linux:linux_kernel:3.1.10 + cpe:/o:linux:linux_kernel:3.2:rc6 + cpe:/o:linux:linux_kernel:3.12.4 + cpe:/o:linux:linux_kernel:3.0:rc7 + cpe:/o:linux:linux_kernel:3.2:rc5 + cpe:/o:linux:linux_kernel:3.12.5 + cpe:/o:linux:linux_kernel:3.9:rc3 + cpe:/o:linux:linux_kernel:3.0:rc6 + cpe:/o:linux:linux_kernel:3.12.6 + cpe:/o:linux:linux_kernel:3.0:rc5 + cpe:/o:linux:linux_kernel:3.9:rc1 + cpe:/o:linux:linux_kernel:3.9:rc4 + cpe:/o:linux:linux_kernel:3.9:rc7 + cpe:/o:linux:linux_kernel:3.12.2 + cpe:/o:linux:linux_kernel:3.9:rc2 + cpe:/o:linux:linux_kernel:3.9:rc5 + cpe:/o:linux:linux_kernel:3.3:rc3 + cpe:/o:linux:linux_kernel:3.4:rc4 + cpe:/o:linux:linux_kernel:3.4:rc3 + cpe:/o:linux:linux_kernel:3.3:rc1 + cpe:/o:linux:linux_kernel:3.4:rc2 + cpe:/o:linux:linux_kernel:3.9:rc6 + cpe:/o:linux:linux_kernel:3.3:rc4 + cpe:/o:linux:linux_kernel:3.4:rc1 + cpe:/o:linux:linux_kernel:3.4.5 + cpe:/o:linux:linux_kernel:3.2.2 + cpe:/o:linux:linux_kernel:3.2.3 + cpe:/o:linux:linux_kernel:3.2.1 + cpe:/o:linux:linux_kernel:3.4.6 + cpe:/o:linux:linux_kernel:3.2:rc3 + cpe:/o:linux:linux_kernel:3.2.6 + cpe:/o:linux:linux_kernel:3.4.7 + cpe:/o:linux:linux_kernel:3.2:rc4 + cpe:/o:linux:linux_kernel:3.1:rc3 + cpe:/o:linux:linux_kernel:3.4.8 + cpe:/o:linux:linux_kernel:3.2.4 + cpe:/o:linux:linux_kernel:3.4.9 + cpe:/o:linux:linux_kernel:3.2.5 + cpe:/o:linux:linux_kernel:3.0.65 + cpe:/o:linux:linux_kernel:3.2.12 + cpe:/o:linux:linux_kernel:3.8.10 + cpe:/o:linux:linux_kernel:3.8.12 + cpe:/o:linux:linux_kernel:3.8.11 + cpe:/o:linux:linux_kernel:3.8.13 + cpe:/o:linux:linux_kernel:3.7.9 + cpe:/o:linux:linux_kernel:3.7.8 + cpe:/o:linux:linux_kernel:3.7.7 + cpe:/o:linux:linux_kernel:3.7.6 + cpe:/o:linux:linux_kernel:3.6.3 + cpe:/o:linux:linux_kernel:3.7.5 + cpe:/o:linux:linux_kernel:3.7.4 + cpe:/o:linux:linux_kernel:3.7.3 + cpe:/o:linux:linux_kernel:3.7.2 + cpe:/o:linux:linux_kernel:3.6.7 + cpe:/o:linux:linux_kernel:3.6.6 + cpe:/o:linux:linux_kernel:3.6.5 + cpe:/o:linux:linux_kernel:3.6.4 + cpe:/o:linux:linux_kernel:3.6.9 + cpe:/o:linux:linux_kernel:3.6.8 + cpe:/o:linux:linux_kernel:3.10 + cpe:/o:linux:linux_kernel:3.11 + cpe:/o:linux:linux_kernel:3.12 + cpe:/o:linux:linux_kernel:3.13 + cpe:/o:linux:linux_kernel:3.10.1 + cpe:/o:linux:linux_kernel:3.10.2 + cpe:/o:linux:linux_kernel:3.10.3 + cpe:/o:linux:linux_kernel:3.6.2 + cpe:/o:linux:linux_kernel:3.6.1 + cpe:/o:linux:linux_kernel:3.3.6 + cpe:/o:linux:linux_kernel:3.3.7 + cpe:/o:linux:linux_kernel:3.3.8 + cpe:/o:linux:linux_kernel:3.0.1 + cpe:/o:linux:linux_kernel:3.2 + cpe:/o:linux:linux_kernel:3.1 + cpe:/o:linux:linux_kernel:3.7 + cpe:/o:linux:linux_kernel:3.6 + cpe:/o:linux:linux_kernel:3.4 + cpe:/o:linux:linux_kernel:3.1.6 + cpe:/o:linux:linux_kernel:3.1.5 + cpe:/o:linux:linux_kernel:3.1.7 + cpe:/o:linux:linux_kernel:3.0.32 + cpe:/o:linux:linux_kernel:3.8.9 + cpe:/o:linux:linux_kernel:3.1.2 + cpe:/o:linux:linux_kernel:3.1.1 + cpe:/o:linux:linux_kernel:3.1.4 + cpe:/o:linux:linux_kernel:3.1.3 + cpe:/o:linux:linux_kernel:3.9.10 + cpe:/o:linux:linux_kernel:3.0.29 + cpe:/o:linux:linux_kernel:3.3 + cpe:/o:linux:linux_kernel:3.8.4 + cpe:/o:linux:linux_kernel:3.2.26 + cpe:/o:linux:linux_kernel:3.8.5 + cpe:/o:linux:linux_kernel:3.2.27 + cpe:/o:linux:linux_kernel:3.8.2 + cpe:/o:linux:linux_kernel:3.2.24 + cpe:/o:linux:linux_kernel:3.8.3 + cpe:/o:linux:linux_kernel:3.2.25 + cpe:/o:linux:linux_kernel:3.8.8 + cpe:/o:linux:linux_kernel:3.8.6 + cpe:/o:linux:linux_kernel:3.2.28 + cpe:/o:linux:linux_kernel:3.8.7 + cpe:/o:linux:linux_kernel:3.2.29 + cpe:/o:linux:linux_kernel:3.3.3 + cpe:/o:linux:linux_kernel:3.3.4 + cpe:/o:linux:linux_kernel:3.3.5 + cpe:/o:linux:linux_kernel:3.2.22 + cpe:/o:linux:linux_kernel:3.8.1 + cpe:/o:linux:linux_kernel:3.2.20 + cpe:/o:linux:linux_kernel:3.3.1 + cpe:/o:linux:linux_kernel:3.2.21 + cpe:/o:linux:linux_kernel:3.3.2 + cpe:/o:linux:linux_kernel:3.11.1 + cpe:/o:linux:linux_kernel:3.11.2 + cpe:/o:linux:linux_kernel:3.2.23 + cpe:/o:linux:linux_kernel:3.0.17 + cpe:/o:linux:linux_kernel:3.9.11 + cpe:/o:linux:linux_kernel:3.0.16 + cpe:/o:linux:linux_kernel:3.0.15 + cpe:/o:linux:linux_kernel:3.2.30 + cpe:/o:linux:linux_kernel:3.0.14 + cpe:/o:linux:linux_kernel:3.0.13 + cpe:/o:linux:linux_kernel:3.0.12 + cpe:/o:linux:linux_kernel:3.0.11 + cpe:/o:linux:linux_kernel:3.4.61 + cpe:/o:linux:linux_kernel:3.0.10 + cpe:/o:linux:linux_kernel:3.4.64 + cpe:/o:linux:linux_kernel:3.8.0 + cpe:/o:linux:linux_kernel:3.4.65 + cpe:/o:linux:linux_kernel:3.4.62 + cpe:/o:linux:linux_kernel:3.4.63 + cpe:/o:linux:linux_kernel:3.4.68 + cpe:/o:linux:linux_kernel:3.4.66 + cpe:/o:linux:linux_kernel:3.4.67 + cpe:/o:linux:linux_kernel:3.5.3 + cpe:/o:linux:linux_kernel:3.5.1 + cpe:/o:linux:linux_kernel:3.5.2 + cpe:/o:linux:linux_kernel:3.10.4 + cpe:/o:linux:linux_kernel:3.4.72 + cpe:/o:linux:linux_kernel:3.10.9 + cpe:/o:linux:linux_kernel:3.4.73 + cpe:/o:linux:linux_kernel:3.4.74 + cpe:/o:linux:linux_kernel:3.4.75 + cpe:/o:linux:linux_kernel:3.4.76 + cpe:/o:linux:linux_kernel:3.10.5 + cpe:/o:linux:linux_kernel:3.4.77 + cpe:/o:linux:linux_kernel:3.10.6 + cpe:/o:linux:linux_kernel:3.4.78 + cpe:/o:linux:linux_kernel:3.10.7 + cpe:/o:linux:linux_kernel:3.4.79 + cpe:/o:linux:linux_kernel:3.10.8 + cpe:/o:linux:linux_kernel:3.7.10 + cpe:/o:linux:linux_kernel:3.2.17 + cpe:/o:linux:linux_kernel:3.2.18 + cpe:/o:linux:linux_kernel:3.2.19 + cpe:/o:linux:linux_kernel:3.2.13 + cpe:/o:linux:linux_kernel:3.2.14 + cpe:/o:linux:linux_kernel:3.11.3 + cpe:/o:linux:linux_kernel:3.2.15 + cpe:/o:linux:linux_kernel:3.4.60 + cpe:/o:linux:linux_kernel:3.2.16 + cpe:/o:linux:linux_kernel:3.11.5 + cpe:/o:linux:linux_kernel:3.11.4 + cpe:/o:linux:linux_kernel:3.2.10 + cpe:/o:linux:linux_kernel:3.11.7 + cpe:/o:linux:linux_kernel:3.2.11 + cpe:/o:linux:linux_kernel:3.11.6 + cpe:/o:linux:linux_kernel:3.11.9 + cpe:/o:linux:linux_kernel:3.11.8 + cpe:/o:linux:linux_kernel:3.4.69 + + CVE-2014-0101 + 2014-03-11T09:01:06.733-04:00 + 2014-04-01T02:27:58.187-04:00 + + + 7.1 + NETWORK + MEDIUM + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-03-11T10:50:24.897-04:00 + + + + + MLIST + [oss-security] 20140304 CVE-2014-0101 -- Linux kernel: net: sctp: null pointer dereference when processing authenticated cookie_echo chunk + + + CONFIRM + https://github.com/torvalds/linux/commit/ec0223ec48a90cb605244b45f7c62de856403729 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1070705 + + + REDHAT + RHSA-2014:0328 + + + CONFIRM + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ec0223ec48a90cb605244b45f7c62de856403729 + + The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an SCTP handshake with a modified INIT chunk and a crafted AUTH chunk before a COOKIE_ECHO chunk. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:linux:linux_kernel:3.0.48 + cpe:/o:linux:linux_kernel:3.0.49 + cpe:/o:linux:linux_kernel:3.0.46 + cpe:/o:linux:linux_kernel:3.0.47 + cpe:/o:linux:linux_kernel:3.0.44 + cpe:/o:linux:linux_kernel:3.0.45 + cpe:/o:linux:linux_kernel:3.0.42 + cpe:/o:linux:linux_kernel:3.4.70 + cpe:/o:linux:linux_kernel:3.4.71 + cpe:/o:linux:linux_kernel:3.0.40 + cpe:/o:linux:linux_kernel:3.0.41 + cpe:/o:linux:linux_kernel:3.4.45 + cpe:/o:linux:linux_kernel:3.4.44 + cpe:/o:linux:linux_kernel:3.4.46 + cpe:/o:linux:linux_kernel:3.4.41 + cpe:/o:linux:linux_kernel:3.4.40 + cpe:/o:linux:linux_kernel:3.4.43 + cpe:/o:linux:linux_kernel:3.4.42 + cpe:/o:linux:linux_kernel:3.4.49 + cpe:/o:linux:linux_kernel:3.4.48 + cpe:/o:linux:linux_kernel:3.0.59 + cpe:/o:linux:linux_kernel:3.4.47 + cpe:/o:linux:linux_kernel:3.0.55 + cpe:/o:linux:linux_kernel:3.0.56 + cpe:/o:linux:linux_kernel:3.0.57 + cpe:/o:linux:linux_kernel:3.0.58 + cpe:/o:linux:linux_kernel:3.0.51 + cpe:/o:linux:linux_kernel:3.0.52 + cpe:/o:linux:linux_kernel:3.0.53 + cpe:/o:linux:linux_kernel:3.11.10 + cpe:/o:linux:linux_kernel:3.0.50 + cpe:/o:linux:linux_kernel:3.4.57 + cpe:/o:linux:linux_kernel:3.4.56 + cpe:/o:linux:linux_kernel:3.4.55 + cpe:/o:linux:linux_kernel:3.4.54 + cpe:/o:linux:linux_kernel:3.4.53 + cpe:/o:linux:linux_kernel:3.4.52 + cpe:/o:linux:linux_kernel:3.4.51 + cpe:/o:linux:linux_kernel:3.4.50 + cpe:/o:linux:linux_kernel:3.0.43 + cpe:/o:linux:linux_kernel:3.10.26 + cpe:/o:linux:linux_kernel:3.4.59 + cpe:/o:linux:linux_kernel:3.0.24 + cpe:/o:linux:linux_kernel:3.0.25 + cpe:/o:linux:linux_kernel:3.0.22 + cpe:/o:linux:linux_kernel:3.1.9 + cpe:/o:linux:linux_kernel:3.0.23 + cpe:/o:linux:linux_kernel:3.10.28 + cpe:/o:linux:linux_kernel:3.0.28 + cpe:/o:linux:linux_kernel:3.10.27 + cpe:/o:linux:linux_kernel:3.0.26 + cpe:/o:linux:linux_kernel:3.10.29 + cpe:/o:linux:linux_kernel:3.4.58 + cpe:/o:linux:linux_kernel:3.0.27 + cpe:/o:linux:linux_kernel:3.10.24 + cpe:/o:linux:linux_kernel:3.10.23 + cpe:/o:linux:linux_kernel:3.10.25 + cpe:/o:linux:linux_kernel:3.10.20 + cpe:/o:linux:linux_kernel:3.1.8 + cpe:/o:linux:linux_kernel:3.0.20 + cpe:/o:linux:linux_kernel:3.10.22 + cpe:/o:linux:linux_kernel:3.10.21 + cpe:/o:linux:linux_kernel:3.4.21 + cpe:/o:linux:linux_kernel:3.4.20 + cpe:/o:linux:linux_kernel:3.4.23 + cpe:/o:linux:linux_kernel:3.4.22 + cpe:/o:linux:linux_kernel:3.4.24 + cpe:/o:linux:linux_kernel:3.4.27 + cpe:/o:linux:linux_kernel:3.4.26 + cpe:/o:linux:linux_kernel:3.4.29 + cpe:/o:linux:linux_kernel:3.10.15 + cpe:/o:linux:linux_kernel:3.4.28 + cpe:/o:linux:linux_kernel:3.0.54 + cpe:/o:linux:linux_kernel:3.0.33 + cpe:/o:linux:linux_kernel:3.0.34 + cpe:/o:linux:linux_kernel:3.0.35 + cpe:/o:linux:linux_kernel:3.0.36 + cpe:/o:linux:linux_kernel:3.10.19 + cpe:/o:linux:linux_kernel:3.0.37 + cpe:/o:linux:linux_kernel:3.10.18 + cpe:/o:linux:linux_kernel:3.0.38 + cpe:/o:linux:linux_kernel:3.4.25 + cpe:/o:linux:linux_kernel:3.10.17 + cpe:/o:linux:linux_kernel:3.0.39 + cpe:/o:linux:linux_kernel:3.10.16 + cpe:/o:linux:linux_kernel:3.10.14 + cpe:/o:linux:linux_kernel:3.10.13 + cpe:/o:linux:linux_kernel:3.10.12 + cpe:/o:linux:linux_kernel:3.10.11 + cpe:/o:linux:linux_kernel:3.10.10 + cpe:/o:linux:linux_kernel:3.0.30 + cpe:/o:linux:linux_kernel:3.0.31 + cpe:/o:linux:linux_kernel:3.9.8 + cpe:/o:linux:linux_kernel:3.5.5 + cpe:/o:linux:linux_kernel:3.4.32 + cpe:/o:linux:linux_kernel:3.9.9 + cpe:/o:linux:linux_kernel:3.5.6 + cpe:/o:linux:linux_kernel:3.4.31 + cpe:/o:linux:linux_kernel:3.5.7 + cpe:/o:linux:linux_kernel:3.4.30 + cpe:/o:linux:linux_kernel:3.7.1 + cpe:/o:linux:linux_kernel:3.4.35 + cpe:/o:linux:linux_kernel:3.9.0 + cpe:/o:linux:linux_kernel:3.0.18 + cpe:/o:linux:linux_kernel:3.4.34 + cpe:/o:linux:linux_kernel:3.4.33 + cpe:/o:linux:linux_kernel:3.9.2 + cpe:/o:linux:linux_kernel:3.9.1 + cpe:/o:linux:linux_kernel:3.0.19 + cpe:/o:linux:linux_kernel:3.4.39 + cpe:/o:linux:linux_kernel:3.9.4 + cpe:/o:linux:linux_kernel:3.4.38 + cpe:/o:linux:linux_kernel:3.9.3 + cpe:/o:linux:linux_kernel:3.4.37 + cpe:/o:linux:linux_kernel:3.9.6 + cpe:/o:linux:linux_kernel:3.9.5 + cpe:/o:linux:linux_kernel:3.0.21 + cpe:/o:linux:linux_kernel:3.9.7 + cpe:/o:linux:linux_kernel:3.5.4 + cpe:/o:linux:linux_kernel:3.0.4 + cpe:/o:linux:linux_kernel:3.0.5 + cpe:/o:linux:linux_kernel:3.0.2 + cpe:/o:linux:linux_kernel:3.0.3 + cpe:/o:linux:linux_kernel:3.0.8 + cpe:/o:linux:linux_kernel:3.0.6 + cpe:/o:linux:linux_kernel:3.0.7 + cpe:/o:linux:linux_kernel:3.4.36 + cpe:/o:linux:linux_kernel:3.13.1 + cpe:/o:linux:linux_kernel:3.6.10 + cpe:/o:linux:linux_kernel:3.6.11 + cpe:/o:linux:linux_kernel:3.13.6 + cpe:/o:linux:linux_kernel:3.13.4 + cpe:/o:linux:linux_kernel:3.13.5 + cpe:/o:linux:linux_kernel:3.13.2 + cpe:/o:linux:linux_kernel:3.13.3 + cpe:/o:linux:linux_kernel:3.4.1 + cpe:/o:linux:linux_kernel:3.4.19 + cpe:/o:linux:linux_kernel:3.4.17 + cpe:/o:linux:linux_kernel:3.4.3 + cpe:/o:linux:linux_kernel:3.4.18 + cpe:/o:linux:linux_kernel:3.4.2 + cpe:/o:linux:linux_kernel:3.2.9 + cpe:/o:linux:linux_kernel:3.4.15 + cpe:/o:linux:linux_kernel:3.2.8 + cpe:/o:linux:linux_kernel:3.4.16 + cpe:/o:linux:linux_kernel:3.4.4 + cpe:/o:linux:linux_kernel:3.12.12 + cpe:/o:linux:linux_kernel:3.2.7 + cpe:/o:linux:linux_kernel:3.4.13 + cpe:/o:linux:linux_kernel:3.12.13 + cpe:/o:linux:linux_kernel:3.12.10 + cpe:/o:linux:linux_kernel:3.4.11 + cpe:/o:linux:linux_kernel:3.12.11 + cpe:/o:linux:linux_kernel:3.4.12 + cpe:/o:linux:linux_kernel:3.4.10 + cpe:/o:linux:linux_kernel:3.0.61 + cpe:/o:linux:linux_kernel:3.3:rc2 + cpe:/o:linux:linux_kernel:3.4:rc7 + cpe:/o:linux:linux_kernel:3.0.60 + cpe:/o:linux:linux_kernel:3.3:rc7 + cpe:/o:linux:linux_kernel:3.4:rc5 + cpe:/o:linux:linux_kernel:3.3:rc5 + cpe:/o:linux:linux_kernel:3.4:rc6 + cpe:/o:linux:linux_kernel:3.3:rc6 + cpe:/o:linux:linux_kernel:3.0.64 + cpe:/o:linux:linux_kernel:3.0.63 + cpe:/o:linux:linux_kernel:3.0.62 + cpe:/o:linux:linux_kernel:3.12.1 + cpe:/o:linux:linux_kernel:3.0.68 + cpe:/o:linux:linux_kernel:3.0.67 + cpe:/o:linux:linux_kernel:3.0.66 + cpe:/o:linux:linux_kernel:3.4.14 + cpe:/o:linux:linux_kernel:3.12.7 + cpe:/o:linux:linux_kernel:3.2:rc2 + cpe:/o:linux:linux_kernel:3.1:rc1 + cpe:/o:linux:linux_kernel:3.0.9 + cpe:/o:linux:linux_kernel:3.0:rc4 + cpe:/o:linux:linux_kernel:3.12.8 + cpe:/o:linux:linux_kernel:3.1:rc4 + cpe:/o:linux:linux_kernel:3.0:rc3 + cpe:/o:linux:linux_kernel:3.12.9 + cpe:/o:linux:linux_kernel:3.0:rc2 + cpe:/o:linux:linux_kernel:3.1:rc2 + cpe:/o:linux:linux_kernel:3.0:rc1 + cpe:/o:linux:linux_kernel:3.2:rc7 + cpe:/o:linux:linux_kernel:3.12.3 + cpe:/o:linux:linux_kernel:3.1.10 + cpe:/o:linux:linux_kernel:3.2:rc6 + cpe:/o:linux:linux_kernel:3.12.4 + cpe:/o:linux:linux_kernel:3.0:rc7 + cpe:/o:linux:linux_kernel:3.2:rc5 + cpe:/o:linux:linux_kernel:3.12.5 + cpe:/o:linux:linux_kernel:3.9:rc3 + cpe:/o:linux:linux_kernel:3.0:rc6 + cpe:/o:linux:linux_kernel:3.12.6 + cpe:/o:linux:linux_kernel:3.0:rc5 + cpe:/o:linux:linux_kernel:3.9:rc1 + cpe:/o:linux:linux_kernel:3.9:rc4 + cpe:/o:linux:linux_kernel:3.9:rc7 + cpe:/o:linux:linux_kernel:3.12.2 + cpe:/o:linux:linux_kernel:3.9:rc2 + cpe:/o:linux:linux_kernel:3.9:rc5 + cpe:/o:linux:linux_kernel:3.3:rc3 + cpe:/o:linux:linux_kernel:3.4:rc4 + cpe:/o:linux:linux_kernel:3.4:rc3 + cpe:/o:linux:linux_kernel:3.3:rc1 + cpe:/o:linux:linux_kernel:3.4:rc2 + cpe:/o:linux:linux_kernel:3.9:rc6 + cpe:/o:linux:linux_kernel:3.3:rc4 + cpe:/o:linux:linux_kernel:3.4:rc1 + cpe:/o:linux:linux_kernel:3.4.5 + cpe:/o:linux:linux_kernel:3.2.2 + cpe:/o:linux:linux_kernel:3.2.3 + cpe:/o:linux:linux_kernel:3.2.1 + cpe:/o:linux:linux_kernel:3.4.6 + cpe:/o:linux:linux_kernel:3.2:rc3 + cpe:/o:linux:linux_kernel:3.2.6 + cpe:/o:linux:linux_kernel:3.4.7 + cpe:/o:linux:linux_kernel:3.2:rc4 + cpe:/o:linux:linux_kernel:3.1:rc3 + cpe:/o:linux:linux_kernel:3.4.8 + cpe:/o:linux:linux_kernel:3.2.4 + cpe:/o:linux:linux_kernel:3.4.9 + cpe:/o:linux:linux_kernel:3.2.5 + cpe:/o:linux:linux_kernel:3.0.65 + cpe:/o:linux:linux_kernel:3.2.12 + cpe:/o:linux:linux_kernel:3.8.10 + cpe:/o:linux:linux_kernel:3.8.12 + cpe:/o:linux:linux_kernel:3.8.11 + cpe:/o:linux:linux_kernel:3.8.13 + cpe:/o:linux:linux_kernel:3.7.9 + cpe:/o:linux:linux_kernel:3.7.8 + cpe:/o:linux:linux_kernel:3.7.7 + cpe:/o:linux:linux_kernel:3.7.6 + cpe:/o:linux:linux_kernel:3.6.3 + cpe:/o:linux:linux_kernel:3.7.5 + cpe:/o:linux:linux_kernel:3.7.4 + cpe:/o:linux:linux_kernel:3.7.3 + cpe:/o:linux:linux_kernel:3.7.2 + cpe:/o:linux:linux_kernel:3.6.7 + cpe:/o:linux:linux_kernel:3.6.6 + cpe:/o:linux:linux_kernel:3.6.5 + cpe:/o:linux:linux_kernel:3.6.4 + cpe:/o:linux:linux_kernel:3.6.9 + cpe:/o:linux:linux_kernel:3.6.8 + cpe:/o:linux:linux_kernel:3.10 + cpe:/o:linux:linux_kernel:3.11 + cpe:/o:linux:linux_kernel:3.12 + cpe:/o:linux:linux_kernel:3.13 + cpe:/o:linux:linux_kernel:3.10.1 + cpe:/o:linux:linux_kernel:3.10.2 + cpe:/o:linux:linux_kernel:3.10.3 + cpe:/o:linux:linux_kernel:3.6.2 + cpe:/o:linux:linux_kernel:3.6.1 + cpe:/o:linux:linux_kernel:3.3.6 + cpe:/o:linux:linux_kernel:3.3.7 + cpe:/o:linux:linux_kernel:3.3.8 + cpe:/o:linux:linux_kernel:3.0.1 + cpe:/o:linux:linux_kernel:3.2 + cpe:/o:linux:linux_kernel:3.1 + cpe:/o:linux:linux_kernel:3.7 + cpe:/o:linux:linux_kernel:3.6 + cpe:/o:linux:linux_kernel:3.4 + cpe:/o:linux:linux_kernel:3.1.6 + cpe:/o:linux:linux_kernel:3.1.5 + cpe:/o:linux:linux_kernel:3.1.7 + cpe:/o:linux:linux_kernel:3.0.32 + cpe:/o:linux:linux_kernel:3.8.9 + cpe:/o:linux:linux_kernel:3.1.2 + cpe:/o:linux:linux_kernel:3.1.1 + cpe:/o:linux:linux_kernel:3.1.4 + cpe:/o:linux:linux_kernel:3.1.3 + cpe:/o:linux:linux_kernel:3.9.10 + cpe:/o:linux:linux_kernel:3.0.29 + cpe:/o:linux:linux_kernel:3.3 + cpe:/o:linux:linux_kernel:3.8.4 + cpe:/o:linux:linux_kernel:3.2.26 + cpe:/o:linux:linux_kernel:3.8.5 + cpe:/o:linux:linux_kernel:3.2.27 + cpe:/o:linux:linux_kernel:3.8.2 + cpe:/o:linux:linux_kernel:3.2.24 + cpe:/o:linux:linux_kernel:3.8.3 + cpe:/o:linux:linux_kernel:3.2.25 + cpe:/o:linux:linux_kernel:3.8.8 + cpe:/o:linux:linux_kernel:3.8.6 + cpe:/o:linux:linux_kernel:3.2.28 + cpe:/o:linux:linux_kernel:3.8.7 + cpe:/o:linux:linux_kernel:3.2.29 + cpe:/o:linux:linux_kernel:3.3.3 + cpe:/o:linux:linux_kernel:3.3.4 + cpe:/o:linux:linux_kernel:3.3.5 + cpe:/o:linux:linux_kernel:3.2.22 + cpe:/o:linux:linux_kernel:3.8.1 + cpe:/o:linux:linux_kernel:3.2.20 + cpe:/o:linux:linux_kernel:3.3.1 + cpe:/o:linux:linux_kernel:3.2.21 + cpe:/o:linux:linux_kernel:3.3.2 + cpe:/o:linux:linux_kernel:3.11.1 + cpe:/o:linux:linux_kernel:3.11.2 + cpe:/o:linux:linux_kernel:3.2.23 + cpe:/o:linux:linux_kernel:3.0.17 + cpe:/o:linux:linux_kernel:3.9.11 + cpe:/o:linux:linux_kernel:3.0.16 + cpe:/o:linux:linux_kernel:3.0.15 + cpe:/o:linux:linux_kernel:3.2.30 + cpe:/o:linux:linux_kernel:3.0.14 + cpe:/o:linux:linux_kernel:3.0.13 + cpe:/o:linux:linux_kernel:3.0.12 + cpe:/o:linux:linux_kernel:3.0.11 + cpe:/o:linux:linux_kernel:3.4.61 + cpe:/o:linux:linux_kernel:3.0.10 + cpe:/o:linux:linux_kernel:3.4.64 + cpe:/o:linux:linux_kernel:3.8.0 + cpe:/o:linux:linux_kernel:3.4.65 + cpe:/o:linux:linux_kernel:3.4.62 + cpe:/o:linux:linux_kernel:3.4.63 + cpe:/o:linux:linux_kernel:3.4.68 + cpe:/o:linux:linux_kernel:3.4.66 + cpe:/o:linux:linux_kernel:3.4.67 + cpe:/o:linux:linux_kernel:3.5.3 + cpe:/o:linux:linux_kernel:3.5.1 + cpe:/o:linux:linux_kernel:3.5.2 + cpe:/o:linux:linux_kernel:3.10.4 + cpe:/o:linux:linux_kernel:3.4.72 + cpe:/o:linux:linux_kernel:3.10.9 + cpe:/o:linux:linux_kernel:3.4.73 + cpe:/o:linux:linux_kernel:3.4.74 + cpe:/o:linux:linux_kernel:3.4.75 + cpe:/o:linux:linux_kernel:3.4.76 + cpe:/o:linux:linux_kernel:3.10.5 + cpe:/o:linux:linux_kernel:3.4.77 + cpe:/o:linux:linux_kernel:3.10.6 + cpe:/o:linux:linux_kernel:3.4.78 + cpe:/o:linux:linux_kernel:3.10.7 + cpe:/o:linux:linux_kernel:3.4.79 + cpe:/o:linux:linux_kernel:3.10.8 + cpe:/o:linux:linux_kernel:3.7.10 + cpe:/o:linux:linux_kernel:3.2.17 + cpe:/o:linux:linux_kernel:3.2.18 + cpe:/o:linux:linux_kernel:3.2.19 + cpe:/o:linux:linux_kernel:3.2.13 + cpe:/o:linux:linux_kernel:3.2.14 + cpe:/o:linux:linux_kernel:3.11.3 + cpe:/o:linux:linux_kernel:3.2.15 + cpe:/o:linux:linux_kernel:3.4.60 + cpe:/o:linux:linux_kernel:3.2.16 + cpe:/o:linux:linux_kernel:3.11.5 + cpe:/o:linux:linux_kernel:3.11.4 + cpe:/o:linux:linux_kernel:3.2.10 + cpe:/o:linux:linux_kernel:3.11.7 + cpe:/o:linux:linux_kernel:3.2.11 + cpe:/o:linux:linux_kernel:3.11.6 + cpe:/o:linux:linux_kernel:3.11.9 + cpe:/o:linux:linux_kernel:3.11.8 + cpe:/o:linux:linux_kernel:3.4.69 + + CVE-2014-0102 + 2014-03-11T09:01:08.670-04:00 + 2014-03-11T11:03:22.243-04:00 + + + 5.2 + ADJACENT_NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-03-11T11:03:20.897-04:00 + + + + + MLIST + [oss-security] 20140304 CVE-2014-0102 -- Linux kernel: security: keyring cycle detector DoS + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1072419 + + + MISC + http://www.kernelhub.org/?msg=425013&p=2 + + + MLIST + [linux-kernel] 20140227 kernel BUG at security/keys/keyring.c:1003! + + The keyring_detect_cycle_iterator function in security/keys/keyring.c in the Linux kernel through 3.13.6 does not properly determine whether keyrings are identical, which allows local users to cause a denial of service (OOPS) via crafted keyctl commands. + + + + + + + + + + + + + + + cpe:/a:openstack:python-keystoneclient:0.4.2 + cpe:/a:openstack:python-keystoneclient:0.3.2 + cpe:/a:openstack:python-keystoneclient:0.3.1 + cpe:/a:openstack:python-keystoneclient:0.3.0 + cpe:/a:openstack:python-keystoneclient:0.2.3 + cpe:/a:openstack:python-keystoneclient:0.2.4 + cpe:/a:openstack:python-keystoneclient:0.2.2 + + CVE-2014-0105 + 2014-04-15T10:55:03.577-04:00 + 2014-04-16T08:31:00.920-04:00 + + + 6.0 + NETWORK + MEDIUM + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-16T08:31:00.750-04:00 + + + + + MLIST + [oss-security] 20140327 [OSSA 2014-007] Potential context confusion in Keystone middleware (CVE-2014-0105) + + + CONFIRM + https://bugs.launchpad.net/python-keystoneclient/+bug/1282865 + + + REDHAT + RHSA-2014:0382 + + The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached." + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:todd_miller:sudo:1.7.0 + cpe:/a:todd_miller:sudo:1.7.2 + cpe:/a:todd_miller:sudo:1.7.1 + cpe:/a:todd_miller:sudo:1.7.6p1 + cpe:/a:todd_miller:sudo:1.7.6p2 + cpe:/a:todd_miller:sudo:1.7.8p2 + cpe:/a:todd_miller:sudo:1.7.8p1 + cpe:/a:todd_miller:sudo:1.8.3 + cpe:/a:todd_miller:sudo:1.8.4 + cpe:/a:todd_miller:sudo:1.7.9p1 + cpe:/a:todd_miller:sudo:1.8.4p4 + cpe:/a:todd_miller:sudo:1.8.4p5 + cpe:/a:todd_miller:sudo:1.8.4p2 + cpe:/a:todd_miller:sudo:1.8.4p3 + cpe:/a:todd_miller:sudo:1.8.4p1 + cpe:/a:todd_miller:sudo:1.7.2p1 + cpe:/a:todd_miller:sudo:1.7.10p10 + cpe:/a:todd_miller:sudo:1.8.3p2 + cpe:/a:todd_miller:sudo:1.8.3p1 + cpe:/a:todd_miller:sudo:1.8.1p2 + cpe:/a:todd_miller:sudo:1.7.10p4 + cpe:/a:todd_miller:sudo:1.7.4p1 + cpe:/a:todd_miller:sudo:1.7.4p2 + cpe:/a:todd_miller:sudo:1.7.10 + cpe:/a:todd_miller:sudo:1.7.4p5 + cpe:/a:todd_miller:sudo:1.7.10p1 + cpe:/a:todd_miller:sudo:1.7.4p6 + cpe:/a:todd_miller:sudo:1.7.10p2 + cpe:/a:todd_miller:sudo:1.7.4p3 + cpe:/a:todd_miller:sudo:1.7.10p3 + cpe:/a:todd_miller:sudo:1.7.4p4 + cpe:/a:todd_miller:sudo:1.7.10p5 + cpe:/a:todd_miller:sudo:1.7.10p6 + cpe:/a:todd_miller:sudo:1.8.1p1 + cpe:/a:todd_miller:sudo:1.7.10p7 + cpe:/a:todd_miller:sudo:1.7.3b1 + cpe:/a:todd_miller:sudo:1.7.10p8 + cpe:/a:todd_miller:sudo:1.7.10p9 + cpe:/a:todd_miller:sudo:1.7.2p4 + cpe:/a:todd_miller:sudo:1.7.2p3 + cpe:/a:todd_miller:sudo:1.7.2p2 + cpe:/a:todd_miller:sudo:1.7.2p7 + cpe:/a:todd_miller:sudo:1.7.2p6 + cpe:/a:todd_miller:sudo:1.7.2p5 + cpe:/a:todd_miller:sudo:1.8.2 + cpe:/a:todd_miller:sudo:1.8.1 + cpe:/a:todd_miller:sudo:1.8.0 + cpe:/a:todd_miller:sudo:1.6.9 + cpe:/a:todd_miller:sudo:1.6.9p23 + cpe:/a:todd_miller:sudo:1.6.9p22 + cpe:/a:todd_miller:sudo:1.6.9p21 + cpe:/a:todd_miller:sudo:1.6.9p20 + cpe:/a:todd_miller:sudo:1.7.9 + cpe:/a:todd_miller:sudo:1.7.7 + cpe:/a:todd_miller:sudo:1.7.8 + cpe:/a:todd_miller:sudo:1.7.5 + cpe:/a:todd_miller:sudo:1.7.6 + cpe:/a:todd_miller:sudo:1.7.4 + + CVE-2014-0106 + 2014-03-11T15:37:03.240-04:00 + 2014-03-26T00:55:53.157-04:00 + + + 6.6 + LOCAL + MEDIUM + SINGLE_INSTANCE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-12T14:26:24.713-04:00 + + + + + CONFIRM + http://www.sudo.ws/sudo/alerts/env_add.html + + + UBUNTU + USN-2146-1 + + + MLIST + [oss-security] 20140305 sudo: security policy bypass when env_reset is disabled + + + REDHAT + RHSA-2014:0266 + + Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable. + + + + + + + + + + + + + + + + + + + + + cpe:/a:apache:xalan-java:2.5.0 + cpe:/a:apache:xalan-java:2.2.0 + cpe:/a:apache:xalan-java:2.1.0 + cpe:/a:apache:xalan-java:1.0.0 + cpe:/a:apache:xalan-java:2.6.0 + cpe:/a:apache:xalan-java:2.5.2 + cpe:/a:apache:xalan-java:2.5.1 + cpe:/a:apache:xalan-java:2.7.1 + cpe:/a:apache:xalan-java:2.7.0 + cpe:/a:apache:xalan-java:2.4.1 + cpe:/a:apache:xalan-java:2.0.0 + cpe:/a:apache:xalan-java:2.4.0 + cpe:/a:apache:xalan-java:2.0.1 + + CVE-2014-0107 + 2014-04-15T19:13:13.070-04:00 + 2014-04-16T09:45:03.180-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-16T09:45:02.883-04:00 + + + + + MISC + http://www.ocert.org/advisories/ocert-2014-002.html + + + CONFIRM + http://svn.apache.org/viewvc?view=revision&revision=1581058 + + + CONFIRM + https://issues.apache.org/jira/browse/XALANJ-2435 + + + XF + apache-xalanjava-cve20140107-sec-bypass(92023) + + + BID + 66397 + + + SECUNIA + 57563 + + The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function. + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apache:syncope:1.0.6 + cpe:/a:apache:syncope:1.0.5 + cpe:/a:apache:syncope:1.0.8 + cpe:/a:apache:syncope:1.1.2 + cpe:/a:apache:syncope:1.1.3 + cpe:/a:apache:syncope:1.0.7 + cpe:/a:apache:syncope:1.1.4 + cpe:/a:apache:syncope:1.1.5 + cpe:/a:apache:syncope:1.1.6 + cpe:/a:apache:syncope:1.0.4 + cpe:/a:apache:syncope:1.0.3 + cpe:/a:apache:syncope:1.0.0 + cpe:/a:apache:syncope:1.1.1 + cpe:/a:apache:syncope:1.1.0 + cpe:/a:apache:syncope:1.0.1 + cpe:/a:apache:syncope:1.0.2 + + CVE-2014-0111 + 2014-04-17T10:55:06.763-04:00 + 2014-04-18T10:18:45.927-04:00 + + + 6.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-18T10:18:45.803-04:00 + + + + + BUGTRAQ + 20140415 [SECURITY] CVE-2014-0111 Apache Syncope + + + CONFIRM + http://syncope.apache.org/security.html + + + MLIST + [www-announce] 20140415 [SECURITY] CVE-2014-0111 Apache Syncope + + Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, "derived schema definition," "user / role templates," and "account links of resource mappings." + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apache:struts:2.3.14 + cpe:/a:apache:struts:2.3.15 + cpe:/a:apache:struts:2.3.12 + cpe:/a:apache:struts:2.3.14.1 + cpe:/a:apache:struts:2.3.14.2 + cpe:/a:apache:struts:2.3.16 + cpe:/a:apache:struts:2.3.14.3 + cpe:/a:apache:struts:2.3.7 + cpe:/a:apache:struts:2.3.8 + cpe:/a:apache:struts:2.0.14 + cpe:/a:apache:struts:2.3.15.1 + cpe:/a:apache:struts:2.0.13 + cpe:/a:apache:struts:2.3.15.2 + cpe:/a:apache:struts:2.0.12 + cpe:/a:apache:struts:2.0.11 + cpe:/a:apache:struts:2.0.10 + cpe:/a:apache:struts:2.0.0 + cpe:/a:apache:struts:2.3.4.1 + cpe:/a:apache:struts:2.0.1 + cpe:/a:apache:struts:2.0.6 + cpe:/a:apache:struts:2.0.7 + cpe:/a:apache:struts:2.0.8 + cpe:/a:apache:struts:2.0.9 + cpe:/a:apache:struts:2.0.2 + cpe:/a:apache:struts:2.0.3 + cpe:/a:apache:struts:2.0.4 + cpe:/a:apache:struts:2.0.5 + cpe:/a:apache:struts:2.1.1 + cpe:/a:apache:struts:2.1.2 + cpe:/a:apache:struts:2.1.3 + cpe:/a:apache:struts:2.1.4 + cpe:/a:apache:struts:2.1.5 + cpe:/a:apache:struts:2.1.6 + cpe:/a:apache:struts:2.1.8 + cpe:/a:apache:struts:2.2.1.1 + cpe:/a:apache:struts:2.1.0 + cpe:/a:apache:struts:2.1.8.1 + cpe:/a:apache:struts:2.0.11.2 + cpe:/a:apache:struts:2.0.11.1 + cpe:/a:apache:struts:2.2.3 + cpe:/a:apache:struts:2.2.1 + cpe:/a:apache:struts:2.2.3.1 + cpe:/a:apache:struts:2.3.4 + cpe:/a:apache:struts:2.3.15.3 + cpe:/a:apache:struts:2.3.3 + cpe:/a:apache:struts:2.3.1 + cpe:/a:apache:struts:2.3.16.1 + cpe:/a:apache:struts:2.3.1.2 + cpe:/a:apache:struts:2.3.1.1 + + CVE-2014-0112 + 2014-04-29T06:37:03.670-04:00 + 2014-04-29T09:59:24.903-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-29T09:59:24.420-04:00 + + + + + CONFIRM + https://cwiki.apache.org/confluence/display/WW/S2-021 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1091939 + + + JVNDB + JVNDB-2014-000045 + + + JVN + JVN#19294237 + + ParametersInterceptor in Apache Struts before 2.3.16.2 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apache:struts:2.3.14 + cpe:/a:apache:struts:2.3.15 + cpe:/a:apache:struts:2.3.12 + cpe:/a:apache:struts:2.3.14.1 + cpe:/a:apache:struts:2.3.14.2 + cpe:/a:apache:struts:2.3.16 + cpe:/a:apache:struts:2.3.14.3 + cpe:/a:apache:struts:2.3.7 + cpe:/a:apache:struts:2.3.8 + cpe:/a:apache:struts:2.0.14 + cpe:/a:apache:struts:2.3.15.1 + cpe:/a:apache:struts:2.0.13 + cpe:/a:apache:struts:2.3.15.2 + cpe:/a:apache:struts:2.0.12 + cpe:/a:apache:struts:2.0.11 + cpe:/a:apache:struts:2.0.10 + cpe:/a:apache:struts:2.0.0 + cpe:/a:apache:struts:2.3.4.1 + cpe:/a:apache:struts:2.0.1 + cpe:/a:apache:struts:2.0.6 + cpe:/a:apache:struts:2.0.7 + cpe:/a:apache:struts:2.0.8 + cpe:/a:apache:struts:2.0.9 + cpe:/a:apache:struts:2.0.2 + cpe:/a:apache:struts:2.0.3 + cpe:/a:apache:struts:2.0.4 + cpe:/a:apache:struts:2.0.5 + cpe:/a:apache:struts:2.1.1 + cpe:/a:apache:struts:2.1.2 + cpe:/a:apache:struts:2.1.3 + cpe:/a:apache:struts:2.1.4 + cpe:/a:apache:struts:2.1.5 + cpe:/a:apache:struts:2.1.6 + cpe:/a:apache:struts:2.1.8 + cpe:/a:apache:struts:2.2.1.1 + cpe:/a:apache:struts:2.1.0 + cpe:/a:apache:struts:2.1.8.1 + cpe:/a:apache:struts:2.0.11.2 + cpe:/a:apache:struts:2.0.11.1 + cpe:/a:apache:struts:2.2.3 + cpe:/a:apache:struts:2.2.1 + cpe:/a:apache:struts:2.2.3.1 + cpe:/a:apache:struts:2.3.4 + cpe:/a:apache:struts:2.3.15.3 + cpe:/a:apache:struts:2.3.3 + cpe:/a:apache:struts:2.3.1 + cpe:/a:apache:struts:2.3.16.1 + cpe:/a:apache:struts:2.3.1.2 + cpe:/a:apache:struts:2.3.1.1 + + CVE-2014-0113 + 2014-04-29T06:37:03.700-04:00 + 2014-04-29T09:59:31.653-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-29T09:59:30.983-04:00 + + + + + CONFIRM + https://cwiki.apache.org/confluence/display/WW/S2-021 + + CookieInterceptor in Apache Struts before 2.3.16.2, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094. + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apache:struts:1.3.5 + cpe:/a:apache:struts:1.0 + cpe:/a:apache:struts:1.1:b3 + cpe:/a:apache:struts:1.1:b2 + cpe:/a:apache:struts:1.1 + cpe:/a:apache:struts:1.0.2 + cpe:/a:apache:struts:1.3.10 + cpe:/a:apache:struts:1.2.9 + cpe:/a:apache:struts:1.1:rc1 + cpe:/a:apache:struts:1.1:rc2 + cpe:/a:apache:struts:1.1:b1 + cpe:/a:apache:struts:1.2.2 + cpe:/a:apache:struts:1.3.8 + cpe:/a:apache:struts:1.2.4 + cpe:/a:apache:struts:1.2.6 + cpe:/a:apache:struts:1.2.7 + cpe:/a:apache:struts:1.2.8 + + CVE-2014-0114 + 2014-04-30T06:49:03.973-04:00 + 2014-04-30T10:28:16.450-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-30T10:28:16.280-04:00 + + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1091938 + + The ActionForm object in Apache Struts 1.x through 1.3.10 allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, which is passed to the getClass method. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:moodle:moodle:2.1.6 + cpe:/a:moodle:moodle:2.0.4 + cpe:/a:moodle:moodle:2.5.4 + cpe:/a:moodle:moodle:2.1.7 + cpe:/a:moodle:moodle:2.0.3 + cpe:/a:moodle:moodle:2.1.4 + cpe:/a:moodle:moodle:2.0.2 + cpe:/a:moodle:moodle:2.1.5 + cpe:/a:moodle:moodle:2.1.2 + cpe:/a:moodle:moodle:2.0.8 + cpe:/a:moodle:moodle:2.1.3 + cpe:/a:moodle:moodle:2.0.7 + cpe:/a:moodle:moodle:2.4.5 + cpe:/a:moodle:moodle:2.0.6 + cpe:/a:moodle:moodle:2.0.5 + cpe:/a:moodle:moodle:2.1.1 + cpe:/a:moodle:moodle:2.4.2 + cpe:/a:moodle:moodle:2.4.1 + cpe:/a:moodle:moodle:2.4.4 + cpe:/a:moodle:moodle:2.0.9 + cpe:/a:moodle:moodle:2.4.3 + cpe:/a:moodle:moodle:2.5.1 + cpe:/a:moodle:moodle:2.1.8 + cpe:/a:moodle:moodle:2.5.2 + cpe:/a:moodle:moodle:2.5.3 + cpe:/a:moodle:moodle:2.3.7 + cpe:/a:moodle:moodle:2.3.8 + cpe:/a:moodle:moodle:2.0.1 + cpe:/a:moodle:moodle:2.3.9 + cpe:/a:moodle:moodle:2.2.8 + cpe:/a:moodle:moodle:2.2.9 + cpe:/a:moodle:moodle:2.3.1 + cpe:/a:moodle:moodle:2.1.10 + cpe:/a:moodle:moodle:2.3.4 + cpe:/a:moodle:moodle:2.3.5 + cpe:/a:moodle:moodle:2.3.2 + cpe:/a:moodle:moodle:2.3.3 + cpe:/a:moodle:moodle:2.3.6 + cpe:/a:moodle:moodle:2.2.2 + cpe:/a:moodle:moodle:2.2.1 + cpe:/a:moodle:moodle:2.2.11 + cpe:/a:moodle:moodle:2.2.4 + cpe:/a:moodle:moodle:2.3.11 + cpe:/a:moodle:moodle:2.2.3 + cpe:/a:moodle:moodle:2.2.6 + cpe:/a:moodle:moodle:2.2.5 + cpe:/a:moodle:moodle:2.2.7 + cpe:/a:moodle:moodle:2.3 + cpe:/a:moodle:moodle:2.0 + cpe:/a:moodle:moodle:2.6.1 + cpe:/a:moodle:moodle:2.4.6 + cpe:/a:moodle:moodle:2.2 + cpe:/a:moodle:moodle:2.4.7 + cpe:/a:moodle:moodle:2.4.8 + cpe:/a:moodle:moodle:2.1.9 + cpe:/a:moodle:moodle:2.1 + cpe:/a:moodle:moodle:2.2.10 + cpe:/a:moodle:moodle:2.3.10 + cpe:/a:moodle:moodle:2.4 + cpe:/a:moodle:moodle:2.6 + cpe:/a:moodle:moodle:2.5 + + CVE-2014-0122 + 2014-03-24T10:20:39.370-04:00 + 2014-03-24T11:28:28.697-04:00 + + + 4.9 + NETWORK + MEDIUM + SINGLE_INSTANCE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-24T11:28:28.007-04:00 + + + + + CONFIRM + https://moodle.org/mod/forum/discuss.php?d=256418 + + + MLIST + [oss-security] 20140317 Moodle security notifications public + + + CONFIRM + http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-44082 + + mod/chat/chat_ajax.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly check for the mod/chat:chat capability during chat sessions, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by remaining in a chat session after an intra-session capability removal by an administrator. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:moodle:moodle:2.1.6 + cpe:/a:moodle:moodle:2.0.4 + cpe:/a:moodle:moodle:2.5.4 + cpe:/a:moodle:moodle:2.1.7 + cpe:/a:moodle:moodle:2.0.3 + cpe:/a:moodle:moodle:2.1.4 + cpe:/a:moodle:moodle:2.0.2 + cpe:/a:moodle:moodle:2.1.5 + cpe:/a:moodle:moodle:2.1.2 + cpe:/a:moodle:moodle:2.0.8 + cpe:/a:moodle:moodle:2.1.3 + cpe:/a:moodle:moodle:2.0.7 + cpe:/a:moodle:moodle:2.4.5 + cpe:/a:moodle:moodle:2.0.6 + cpe:/a:moodle:moodle:2.0.5 + cpe:/a:moodle:moodle:2.1.1 + cpe:/a:moodle:moodle:2.4.2 + cpe:/a:moodle:moodle:2.4.1 + cpe:/a:moodle:moodle:2.4.4 + cpe:/a:moodle:moodle:2.0.9 + cpe:/a:moodle:moodle:2.4.3 + cpe:/a:moodle:moodle:2.5.1 + cpe:/a:moodle:moodle:2.1.8 + cpe:/a:moodle:moodle:2.5.2 + cpe:/a:moodle:moodle:2.5.3 + cpe:/a:moodle:moodle:2.3.7 + cpe:/a:moodle:moodle:2.3.8 + cpe:/a:moodle:moodle:2.0.1 + cpe:/a:moodle:moodle:2.3.9 + cpe:/a:moodle:moodle:2.2.8 + cpe:/a:moodle:moodle:2.2.9 + cpe:/a:moodle:moodle:2.3.1 + cpe:/a:moodle:moodle:2.1.10 + cpe:/a:moodle:moodle:2.3.4 + cpe:/a:moodle:moodle:2.3.5 + cpe:/a:moodle:moodle:2.3.2 + cpe:/a:moodle:moodle:2.3.3 + cpe:/a:moodle:moodle:2.3.6 + cpe:/a:moodle:moodle:2.2.2 + cpe:/a:moodle:moodle:2.2.1 + cpe:/a:moodle:moodle:2.2.11 + cpe:/a:moodle:moodle:2.2.4 + cpe:/a:moodle:moodle:2.3.11 + cpe:/a:moodle:moodle:2.2.3 + cpe:/a:moodle:moodle:2.2.6 + cpe:/a:moodle:moodle:2.2.5 + cpe:/a:moodle:moodle:2.2.7 + cpe:/a:moodle:moodle:2.3 + cpe:/a:moodle:moodle:2.0 + cpe:/a:moodle:moodle:2.6.1 + cpe:/a:moodle:moodle:2.4.6 + cpe:/a:moodle:moodle:2.2 + cpe:/a:moodle:moodle:2.4.7 + cpe:/a:moodle:moodle:2.4.8 + cpe:/a:moodle:moodle:2.1.9 + cpe:/a:moodle:moodle:2.1 + cpe:/a:moodle:moodle:2.2.10 + cpe:/a:moodle:moodle:2.3.10 + cpe:/a:moodle:moodle:2.4 + cpe:/a:moodle:moodle:2.6 + cpe:/a:moodle:moodle:2.5 + + CVE-2014-0123 + 2014-03-24T10:20:39.370-04:00 + 2014-03-24T18:39:47.670-04:00 + + + 4.9 + NETWORK + MEDIUM + SINGLE_INSTANCE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-24T07:26:46.000-04:00 + + + + + CONFIRM + https://moodle.org/mod/forum/discuss.php?d=256419 + + + MLIST + [oss-security] 20140317 Moodle security notifications public + + + CONFIRM + http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39990 + + The wiki subsystem in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly restrict (1) view and (2) edit access, which allows remote authenticated users to perform wiki operations by leveraging the student role and using the Recent Activity block to reach the individual wiki of an arbitrary student. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:moodle:moodle:2.1.6 + cpe:/a:moodle:moodle:2.0.4 + cpe:/a:moodle:moodle:2.5.4 + cpe:/a:moodle:moodle:2.1.7 + cpe:/a:moodle:moodle:2.0.3 + cpe:/a:moodle:moodle:2.1.4 + cpe:/a:moodle:moodle:2.0.2 + cpe:/a:moodle:moodle:2.1.5 + cpe:/a:moodle:moodle:2.1.2 + cpe:/a:moodle:moodle:2.0.8 + cpe:/a:moodle:moodle:2.1.3 + cpe:/a:moodle:moodle:2.0.7 + cpe:/a:moodle:moodle:2.4.5 + cpe:/a:moodle:moodle:2.0.6 + cpe:/a:moodle:moodle:2.0.5 + cpe:/a:moodle:moodle:2.1.1 + cpe:/a:moodle:moodle:2.4.2 + cpe:/a:moodle:moodle:2.4.1 + cpe:/a:moodle:moodle:2.4.4 + cpe:/a:moodle:moodle:2.0.9 + cpe:/a:moodle:moodle:2.4.3 + cpe:/a:moodle:moodle:2.5.1 + cpe:/a:moodle:moodle:2.1.8 + cpe:/a:moodle:moodle:2.5.2 + cpe:/a:moodle:moodle:2.5.3 + cpe:/a:moodle:moodle:2.3.7 + cpe:/a:moodle:moodle:2.3.8 + cpe:/a:moodle:moodle:2.0.1 + cpe:/a:moodle:moodle:2.3.9 + cpe:/a:moodle:moodle:2.2.8 + cpe:/a:moodle:moodle:2.2.9 + cpe:/a:moodle:moodle:2.3.1 + cpe:/a:moodle:moodle:2.1.10 + cpe:/a:moodle:moodle:2.3.4 + cpe:/a:moodle:moodle:2.3.5 + cpe:/a:moodle:moodle:2.3.2 + cpe:/a:moodle:moodle:2.3.3 + cpe:/a:moodle:moodle:2.3.6 + cpe:/a:moodle:moodle:2.2.2 + cpe:/a:moodle:moodle:2.2.1 + cpe:/a:moodle:moodle:2.2.11 + cpe:/a:moodle:moodle:2.2.4 + cpe:/a:moodle:moodle:2.3.11 + cpe:/a:moodle:moodle:2.2.3 + cpe:/a:moodle:moodle:2.2.6 + cpe:/a:moodle:moodle:2.2.5 + cpe:/a:moodle:moodle:2.2.7 + cpe:/a:moodle:moodle:2.3 + cpe:/a:moodle:moodle:2.0 + cpe:/a:moodle:moodle:2.6.1 + cpe:/a:moodle:moodle:2.4.6 + cpe:/a:moodle:moodle:2.2 + cpe:/a:moodle:moodle:2.4.7 + cpe:/a:moodle:moodle:2.4.8 + cpe:/a:moodle:moodle:2.1.9 + cpe:/a:moodle:moodle:2.1 + cpe:/a:moodle:moodle:2.2.10 + cpe:/a:moodle:moodle:2.3.10 + cpe:/a:moodle:moodle:2.4 + cpe:/a:moodle:moodle:2.6 + cpe:/a:moodle:moodle:2.5 + + CVE-2014-0124 + 2014-03-24T10:20:39.387-04:00 + 2014-03-24T18:37:38.167-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-03-24T11:28:53.027-04:00 + + + + + CONFIRM + https://moodle.org/mod/forum/discuss.php?d=256421 + + + MLIST + [oss-security] 20140317 Moodle security notifications public + + + CONFIRM + http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43916 + + The identity-reporting implementations in mod/forum/renderer.php and mod/quiz/override_form.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 do not properly restrict the display of e-mail addresses, which allows remote authenticated users to obtain sensitive information by using the (1) Forum or (2) Quiz module. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:moodle:moodle:2.1.6 + cpe:/a:moodle:moodle:2.0.4 + cpe:/a:moodle:moodle:2.5.4 + cpe:/a:moodle:moodle:2.1.7 + cpe:/a:moodle:moodle:2.0.3 + cpe:/a:moodle:moodle:2.1.4 + cpe:/a:moodle:moodle:2.0.2 + cpe:/a:moodle:moodle:2.1.5 + cpe:/a:moodle:moodle:2.1.2 + cpe:/a:moodle:moodle:2.0.8 + cpe:/a:moodle:moodle:2.1.3 + cpe:/a:moodle:moodle:2.0.7 + cpe:/a:moodle:moodle:2.4.5 + cpe:/a:moodle:moodle:2.0.6 + cpe:/a:moodle:moodle:2.0.5 + cpe:/a:moodle:moodle:2.1.1 + cpe:/a:moodle:moodle:2.4.2 + cpe:/a:moodle:moodle:2.4.1 + cpe:/a:moodle:moodle:2.4.4 + cpe:/a:moodle:moodle:2.0.9 + cpe:/a:moodle:moodle:2.4.3 + cpe:/a:moodle:moodle:2.5.1 + cpe:/a:moodle:moodle:2.1.8 + cpe:/a:moodle:moodle:2.5.2 + cpe:/a:moodle:moodle:2.5.3 + cpe:/a:moodle:moodle:2.3.7 + cpe:/a:moodle:moodle:2.3.8 + cpe:/a:moodle:moodle:2.0.1 + cpe:/a:moodle:moodle:2.3.9 + cpe:/a:moodle:moodle:2.2.8 + cpe:/a:moodle:moodle:2.2.9 + cpe:/a:moodle:moodle:2.3.1 + cpe:/a:moodle:moodle:2.1.10 + cpe:/a:moodle:moodle:2.3.4 + cpe:/a:moodle:moodle:2.3.5 + cpe:/a:moodle:moodle:2.3.2 + cpe:/a:moodle:moodle:2.3.3 + cpe:/a:moodle:moodle:2.3.6 + cpe:/a:moodle:moodle:2.2.2 + cpe:/a:moodle:moodle:2.2.1 + cpe:/a:moodle:moodle:2.2.11 + cpe:/a:moodle:moodle:2.2.4 + cpe:/a:moodle:moodle:2.3.11 + cpe:/a:moodle:moodle:2.2.3 + cpe:/a:moodle:moodle:2.2.6 + cpe:/a:moodle:moodle:2.2.5 + cpe:/a:moodle:moodle:2.2.7 + cpe:/a:moodle:moodle:2.3 + cpe:/a:moodle:moodle:2.0 + cpe:/a:moodle:moodle:2.6.1 + cpe:/a:moodle:moodle:2.4.6 + cpe:/a:moodle:moodle:2.2 + cpe:/a:moodle:moodle:2.4.7 + cpe:/a:moodle:moodle:2.4.8 + cpe:/a:moodle:moodle:2.1.9 + cpe:/a:moodle:moodle:2.1 + cpe:/a:moodle:moodle:2.2.10 + cpe:/a:moodle:moodle:2.3.10 + cpe:/a:moodle:moodle:2.4 + cpe:/a:moodle:moodle:2.6 + cpe:/a:moodle:moodle:2.5 + + CVE-2014-0125 + 2014-03-24T10:20:39.400-04:00 + 2014-03-24T18:37:09.290-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-24T07:30:13.000-04:00 + + + + + CONFIRM + https://moodle.org/mod/forum/discuss.php?d=256422 + + + MLIST + [oss-security] 20140317 Moodle security notifications public + + + CONFIRM + http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-29409 + + repository/alfresco/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 places a session key in a URL, which allows remote attackers to bypass intended Alfresco Repository file restrictions by impersonating a file's owner. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:moodle:moodle:2.1.6 + cpe:/a:moodle:moodle:2.0.4 + cpe:/a:moodle:moodle:2.5.4 + cpe:/a:moodle:moodle:2.1.7 + cpe:/a:moodle:moodle:2.0.3 + cpe:/a:moodle:moodle:2.1.4 + cpe:/a:moodle:moodle:2.0.2 + cpe:/a:moodle:moodle:2.1.5 + cpe:/a:moodle:moodle:2.1.2 + cpe:/a:moodle:moodle:2.0.8 + cpe:/a:moodle:moodle:2.1.3 + cpe:/a:moodle:moodle:2.0.7 + cpe:/a:moodle:moodle:2.4.5 + cpe:/a:moodle:moodle:2.0.6 + cpe:/a:moodle:moodle:2.0.5 + cpe:/a:moodle:moodle:2.1.1 + cpe:/a:moodle:moodle:2.4.2 + cpe:/a:moodle:moodle:2.4.1 + cpe:/a:moodle:moodle:2.4.4 + cpe:/a:moodle:moodle:2.0.9 + cpe:/a:moodle:moodle:2.4.3 + cpe:/a:moodle:moodle:2.5.1 + cpe:/a:moodle:moodle:2.1.8 + cpe:/a:moodle:moodle:2.5.2 + cpe:/a:moodle:moodle:2.5.3 + cpe:/a:moodle:moodle:2.3.7 + cpe:/a:moodle:moodle:2.3.8 + cpe:/a:moodle:moodle:2.0.1 + cpe:/a:moodle:moodle:2.3.9 + cpe:/a:moodle:moodle:2.2.8 + cpe:/a:moodle:moodle:2.2.9 + cpe:/a:moodle:moodle:2.3.1 + cpe:/a:moodle:moodle:2.1.10 + cpe:/a:moodle:moodle:2.3.4 + cpe:/a:moodle:moodle:2.3.5 + cpe:/a:moodle:moodle:2.3.2 + cpe:/a:moodle:moodle:2.3.3 + cpe:/a:moodle:moodle:2.3.6 + cpe:/a:moodle:moodle:2.2.2 + cpe:/a:moodle:moodle:2.2.1 + cpe:/a:moodle:moodle:2.2.11 + cpe:/a:moodle:moodle:2.2.4 + cpe:/a:moodle:moodle:2.3.11 + cpe:/a:moodle:moodle:2.2.3 + cpe:/a:moodle:moodle:2.2.6 + cpe:/a:moodle:moodle:2.2.5 + cpe:/a:moodle:moodle:2.2.7 + cpe:/a:moodle:moodle:2.3 + cpe:/a:moodle:moodle:2.0 + cpe:/a:moodle:moodle:2.6.1 + cpe:/a:moodle:moodle:2.4.6 + cpe:/a:moodle:moodle:2.2 + cpe:/a:moodle:moodle:2.4.7 + cpe:/a:moodle:moodle:2.4.8 + cpe:/a:moodle:moodle:2.1.9 + cpe:/a:moodle:moodle:2.1 + cpe:/a:moodle:moodle:2.2.10 + cpe:/a:moodle:moodle:2.3.10 + cpe:/a:moodle:moodle:2.4 + cpe:/a:moodle:moodle:2.6 + cpe:/a:moodle:moodle:2.5 + + CVE-2014-0126 + 2014-03-24T10:20:39.400-04:00 + 2014-03-24T18:34:58.520-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-24T11:31:10.233-04:00 + + + + + CONFIRM + https://moodle.org/mod/forum/discuss.php?d=256423 + + + MLIST + [oss-security] 20140317 Moodle security notifications public + + + CONFIRM + http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43146 + + Cross-site request forgery (CSRF) vulnerability in enrol/imsenterprise/importnow.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to hijack the authentication of administrators for requests that import an IMS Enterprise file. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:moodle:moodle:2.1.6 + cpe:/a:moodle:moodle:2.0.4 + cpe:/a:moodle:moodle:2.5.4 + cpe:/a:moodle:moodle:2.1.7 + cpe:/a:moodle:moodle:2.0.3 + cpe:/a:moodle:moodle:2.1.4 + cpe:/a:moodle:moodle:2.0.2 + cpe:/a:moodle:moodle:2.1.5 + cpe:/a:moodle:moodle:2.1.2 + cpe:/a:moodle:moodle:2.0.8 + cpe:/a:moodle:moodle:2.1.3 + cpe:/a:moodle:moodle:2.0.7 + cpe:/a:moodle:moodle:2.4.5 + cpe:/a:moodle:moodle:2.0.6 + cpe:/a:moodle:moodle:2.0.5 + cpe:/a:moodle:moodle:2.1.1 + cpe:/a:moodle:moodle:2.4.2 + cpe:/a:moodle:moodle:2.4.1 + cpe:/a:moodle:moodle:2.4.4 + cpe:/a:moodle:moodle:2.0.9 + cpe:/a:moodle:moodle:2.4.3 + cpe:/a:moodle:moodle:2.5.1 + cpe:/a:moodle:moodle:2.1.8 + cpe:/a:moodle:moodle:2.5.2 + cpe:/a:moodle:moodle:2.5.3 + cpe:/a:moodle:moodle:2.3.7 + cpe:/a:moodle:moodle:2.3.8 + cpe:/a:moodle:moodle:2.0.1 + cpe:/a:moodle:moodle:2.3.9 + cpe:/a:moodle:moodle:2.2.8 + cpe:/a:moodle:moodle:2.2.9 + cpe:/a:moodle:moodle:2.3.1 + cpe:/a:moodle:moodle:2.1.10 + cpe:/a:moodle:moodle:2.3.4 + cpe:/a:moodle:moodle:2.3.5 + cpe:/a:moodle:moodle:2.3.2 + cpe:/a:moodle:moodle:2.3.3 + cpe:/a:moodle:moodle:2.3.6 + cpe:/a:moodle:moodle:2.2.2 + cpe:/a:moodle:moodle:2.2.1 + cpe:/a:moodle:moodle:2.2.11 + cpe:/a:moodle:moodle:2.2.4 + cpe:/a:moodle:moodle:2.3.11 + cpe:/a:moodle:moodle:2.2.3 + cpe:/a:moodle:moodle:2.2.6 + cpe:/a:moodle:moodle:2.2.5 + cpe:/a:moodle:moodle:2.2.7 + cpe:/a:moodle:moodle:2.3 + cpe:/a:moodle:moodle:2.0 + cpe:/a:moodle:moodle:2.6.1 + cpe:/a:moodle:moodle:2.4.6 + cpe:/a:moodle:moodle:2.2 + cpe:/a:moodle:moodle:2.4.7 + cpe:/a:moodle:moodle:2.4.8 + cpe:/a:moodle:moodle:2.1.9 + cpe:/a:moodle:moodle:2.1 + cpe:/a:moodle:moodle:2.2.10 + cpe:/a:moodle:moodle:2.3.10 + cpe:/a:moodle:moodle:2.4 + cpe:/a:moodle:moodle:2.6 + cpe:/a:moodle:moodle:2.5 + + CVE-2014-0127 + 2014-03-24T10:20:39.417-04:00 + 2014-03-24T11:33:00.220-04:00 + + + 4.9 + NETWORK + MEDIUM + SINGLE_INSTANCE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-24T11:32:59.767-04:00 + + + + + CONFIRM + https://moodle.org/mod/forum/discuss.php?d=256417 + + + MLIST + [oss-security] 20140317 Moodle security notifications public + + + CONFIRM + http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43656 + + The time-validation implementation in (1) mod/feedback/complete.php and (2) mod/feedback/complete_guest.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote authenticated users to bypass intended restrictions on starting a Feedback activity by choosing an unavailable time. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:squid-cache:squid:3.1.0.17 + cpe:/a:squid-cache:squid:3.1.14 + cpe:/a:squid-cache:squid:3.2.0.18 + cpe:/a:squid-cache:squid:3.1.0.18 + cpe:/a:squid-cache:squid:3.1.13 + cpe:/a:squid-cache:squid:3.2.0.19 + cpe:/a:squid-cache:squid:3.2.0.6 + cpe:/a:squid-cache:squid:3.1.0.15 + cpe:/a:squid-cache:squid:3.2.0.16 + cpe:/a:squid-cache:squid:3.2.0.5 + cpe:/a:squid-cache:squid:3.1.0.16 + cpe:/a:squid-cache:squid:3.1.15 + cpe:/a:squid-cache:squid:3.2.0.17 + cpe:/a:squid-cache:squid:3.2.3 + cpe:/a:squid-cache:squid:3.2.0.8 + cpe:/a:squid-cache:squid:3.1.0.13 + cpe:/a:squid-cache:squid:3.2.0.14 + cpe:/a:squid-cache:squid:3.2.4 + cpe:/a:squid-cache:squid:3.2.0.7 + cpe:/a:squid-cache:squid:3.1.0.14 + cpe:/a:squid-cache:squid:3.2.0.15 + cpe:/a:squid-cache:squid:3.2.1 + cpe:/a:squid-cache:squid:3.1.12 + cpe:/a:squid-cache:squid:3.2.2 + cpe:/a:squid-cache:squid:3.2.0.9 + cpe:/a:squid-cache:squid:3.1.11 + cpe:/a:squid-cache:squid:3.1.0.10 + cpe:/a:squid-cache:squid:3.2.0.11 + cpe:/a:squid-cache:squid:3.2.0.10 + cpe:/a:squid-cache:squid:3.2.6 + cpe:/a:squid-cache:squid:3.2.5 + cpe:/a:squid-cache:squid:3.4.0.2 + cpe:/a:squid-cache:squid:3.4.0.1 + cpe:/a:squid-cache:squid:3.1.10 + cpe:/a:squid-cache:squid:3.1.0.12 + cpe:/a:squid-cache:squid:3.2.0.13 + cpe:/a:squid-cache:squid:3.1.0.11 + cpe:/a:squid-cache:squid:3.2.0.12 + cpe:/a:squid-cache:squid:3.4.3 + cpe:/a:squid-cache:squid:3.2.8 + cpe:/a:squid-cache:squid:3.2.7 + cpe:/a:squid-cache:squid:3.2.9 + cpe:/a:squid-cache:squid:3.1 + cpe:/a:squid-cache:squid:3.4.0.3 + cpe:/a:squid-cache:squid:3.4.2 + cpe:/a:squid-cache:squid:3.4.1 + cpe:/a:squid-cache:squid:3.1.0.1 + cpe:/a:squid-cache:squid:3.1.5.1 + cpe:/a:squid-cache:squid:3.3.10 + cpe:/a:squid-cache:squid:3.1.0.2 + cpe:/a:squid-cache:squid:3.1.0.3 + cpe:/a:squid-cache:squid:3.2.0.4 + cpe:/a:squid-cache:squid:3.3.11 + cpe:/a:squid-cache:squid:3.2.0.3 + cpe:/a:squid-cache:squid:3.2.12 + cpe:/a:squid-cache:squid:3.3.8 + cpe:/a:squid-cache:squid:3.2.0.1 + cpe:/a:squid-cache:squid:3.3.9 + cpe:/a:squid-cache:squid:3.2.0.2 + cpe:/a:squid-cache:squid:3.3.6 + cpe:/a:squid-cache:squid:3.3.7 + cpe:/a:squid-cache:squid:3.2.11 + cpe:/a:squid-cache:squid:3.1.0.5 + cpe:/a:squid-cache:squid:3.2.10 + cpe:/a:squid-cache:squid:3.1.0.4 + cpe:/a:squid-cache:squid:3.1.9 + cpe:/a:squid-cache:squid:3.1.8 + cpe:/a:squid-cache:squid:3.1.0.9 + cpe:/a:squid-cache:squid:3.1.0.8 + cpe:/a:squid-cache:squid:3.1.0.7 + cpe:/a:squid-cache:squid:3.1.0.6 + cpe:/a:squid-cache:squid:3.1.2 + cpe:/a:squid-cache:squid:3.1.3 + cpe:/a:squid-cache:squid:3.1.4 + cpe:/a:squid-cache:squid:3.1.5 + cpe:/a:squid-cache:squid:3.3.4 + cpe:/a:squid-cache:squid:3.3.5 + cpe:/a:squid-cache:squid:3.1.1 + cpe:/a:squid-cache:squid:3.3.1 + cpe:/a:squid-cache:squid:3.3.0 + cpe:/a:squid-cache:squid:3.3.3 + cpe:/a:squid-cache:squid:3.3.0.3 + cpe:/a:squid-cache:squid:3.3.2 + cpe:/a:squid-cache:squid:3.3.0.2 + cpe:/a:squid-cache:squid:3.1.7 + cpe:/a:squid-cache:squid:3.1.6 + cpe:/o:novell:opensuse:11.4 + + CVE-2014-0128 + 2014-04-14T11:09:05.710-04:00 + 2014-04-15T07:56:35.213-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-15T07:56:32.667-04:00 + + + + + SECUNIA + 57288 + + + CONFIRM + http://www.squid-cache.org/Advisories/SQUID-2014_1.txt + + + SECUNIA + 57889 + + + SUSE + openSUSE-SU-2014:0513 + + Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request, related to state management. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:moodle:moodle:2.1.6 + cpe:/a:moodle:moodle:2.0.4 + cpe:/a:moodle:moodle:2.5.4 + cpe:/a:moodle:moodle:2.1.7 + cpe:/a:moodle:moodle:2.0.3 + cpe:/a:moodle:moodle:2.1.4 + cpe:/a:moodle:moodle:2.0.2 + cpe:/a:moodle:moodle:2.1.5 + cpe:/a:moodle:moodle:2.1.2 + cpe:/a:moodle:moodle:2.0.8 + cpe:/a:moodle:moodle:2.1.3 + cpe:/a:moodle:moodle:2.0.7 + cpe:/a:moodle:moodle:2.4.5 + cpe:/a:moodle:moodle:2.0.6 + cpe:/a:moodle:moodle:2.0.5 + cpe:/a:moodle:moodle:2.1.1 + cpe:/a:moodle:moodle:2.4.2 + cpe:/a:moodle:moodle:2.4.1 + cpe:/a:moodle:moodle:2.4.4 + cpe:/a:moodle:moodle:2.0.9 + cpe:/a:moodle:moodle:2.4.3 + cpe:/a:moodle:moodle:2.5.1 + cpe:/a:moodle:moodle:2.1.8 + cpe:/a:moodle:moodle:2.5.2 + cpe:/a:moodle:moodle:2.5.3 + cpe:/a:moodle:moodle:2.3.7 + cpe:/a:moodle:moodle:2.3.8 + cpe:/a:moodle:moodle:2.0.1 + cpe:/a:moodle:moodle:2.3.9 + cpe:/a:moodle:moodle:2.2.8 + cpe:/a:moodle:moodle:2.2.9 + cpe:/a:moodle:moodle:2.3.1 + cpe:/a:moodle:moodle:2.1.10 + cpe:/a:moodle:moodle:2.3.4 + cpe:/a:moodle:moodle:2.3.5 + cpe:/a:moodle:moodle:2.3.2 + cpe:/a:moodle:moodle:2.3.3 + cpe:/a:moodle:moodle:2.3.6 + cpe:/a:moodle:moodle:2.2.2 + cpe:/a:moodle:moodle:2.2.1 + cpe:/a:moodle:moodle:2.2.11 + cpe:/a:moodle:moodle:2.2.4 + cpe:/a:moodle:moodle:2.3.11 + cpe:/a:moodle:moodle:2.2.3 + cpe:/a:moodle:moodle:2.2.6 + cpe:/a:moodle:moodle:2.2.5 + cpe:/a:moodle:moodle:2.2.7 + cpe:/a:moodle:moodle:2.3 + cpe:/a:moodle:moodle:2.0 + cpe:/a:moodle:moodle:2.6.1 + cpe:/a:moodle:moodle:2.4.6 + cpe:/a:moodle:moodle:2.2 + cpe:/a:moodle:moodle:2.4.7 + cpe:/a:moodle:moodle:2.4.8 + cpe:/a:moodle:moodle:2.1.9 + cpe:/a:moodle:moodle:2.1 + cpe:/a:moodle:moodle:2.2.10 + cpe:/a:moodle:moodle:2.3.10 + cpe:/a:moodle:moodle:2.4 + cpe:/a:moodle:moodle:2.6 + cpe:/a:moodle:moodle:2.5 + + CVE-2014-0129 + 2014-03-24T10:20:39.417-04:00 + 2014-03-24T18:33:25.890-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-24T07:41:34.000-04:00 + + + + + CONFIRM + https://moodle.org/mod/forum/discuss.php?d=256424 + + + MLIST + [oss-security] 20140317 Moodle security notifications public + + + CONFIRM + http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-44140 + + badges/mybadges.php in Moodle 2.5.x before 2.5.5 and 2.6.x before 2.6.2 does not properly track the user to whom a badge was issued, which allows remote authenticated users to modify the visibility of an arbitrary badge via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:linux:linux_kernel:3.0.48 + cpe:/o:linux:linux_kernel:3.0.49 + cpe:/o:linux:linux_kernel:3.0.46 + cpe:/o:linux:linux_kernel:3.0.47 + cpe:/o:linux:linux_kernel:3.0.44 + cpe:/o:linux:linux_kernel:3.0.45 + cpe:/o:linux:linux_kernel:3.0.42 + cpe:/o:linux:linux_kernel:3.4.70 + cpe:/o:linux:linux_kernel:3.4.71 + cpe:/o:linux:linux_kernel:3.0.40 + cpe:/o:linux:linux_kernel:3.0.41 + cpe:/o:linux:linux_kernel:3.4.45 + cpe:/o:linux:linux_kernel:3.4.44 + cpe:/o:linux:linux_kernel:3.4.46 + cpe:/o:linux:linux_kernel:3.4.41 + cpe:/o:linux:linux_kernel:3.4.40 + cpe:/o:linux:linux_kernel:3.4.43 + cpe:/o:linux:linux_kernel:3.4.42 + cpe:/o:linux:linux_kernel:3.4.49 + cpe:/o:linux:linux_kernel:3.4.48 + cpe:/o:linux:linux_kernel:3.0.59 + cpe:/o:linux:linux_kernel:3.4.47 + cpe:/o:linux:linux_kernel:3.0.55 + cpe:/o:linux:linux_kernel:3.0.56 + cpe:/o:linux:linux_kernel:3.0.57 + cpe:/o:linux:linux_kernel:3.0.58 + cpe:/o:linux:linux_kernel:3.0.51 + cpe:/o:linux:linux_kernel:3.0.52 + cpe:/o:linux:linux_kernel:3.0.53 + cpe:/o:linux:linux_kernel:3.11.10 + cpe:/o:linux:linux_kernel:3.0.50 + cpe:/o:linux:linux_kernel:3.4.57 + cpe:/o:linux:linux_kernel:3.4.56 + cpe:/o:linux:linux_kernel:3.4.55 + cpe:/o:linux:linux_kernel:3.4.54 + cpe:/o:linux:linux_kernel:3.4.53 + cpe:/o:linux:linux_kernel:3.4.52 + cpe:/o:linux:linux_kernel:3.4.51 + cpe:/o:linux:linux_kernel:3.4.50 + cpe:/o:linux:linux_kernel:3.0.43 + cpe:/o:linux:linux_kernel:3.10.26 + cpe:/o:linux:linux_kernel:3.4.59 + cpe:/o:linux:linux_kernel:3.0.24 + cpe:/o:linux:linux_kernel:3.0.25 + cpe:/o:linux:linux_kernel:3.0.22 + cpe:/o:linux:linux_kernel:3.1.9 + cpe:/o:linux:linux_kernel:3.0.23 + cpe:/o:linux:linux_kernel:3.10.28 + cpe:/o:linux:linux_kernel:3.0.28 + cpe:/o:linux:linux_kernel:3.10.27 + cpe:/o:linux:linux_kernel:3.0.26 + cpe:/o:linux:linux_kernel:3.10.29 + cpe:/o:linux:linux_kernel:3.4.58 + cpe:/o:linux:linux_kernel:3.0.27 + cpe:/o:linux:linux_kernel:3.10.24 + cpe:/o:linux:linux_kernel:3.10.23 + cpe:/o:linux:linux_kernel:3.10.25 + cpe:/o:linux:linux_kernel:3.10.20 + cpe:/o:linux:linux_kernel:3.1.8 + cpe:/o:linux:linux_kernel:3.0.20 + cpe:/o:linux:linux_kernel:3.10.22 + cpe:/o:linux:linux_kernel:3.10.21 + cpe:/o:linux:linux_kernel:3.4.21 + cpe:/o:linux:linux_kernel:3.4.20 + cpe:/o:linux:linux_kernel:3.4.23 + cpe:/o:linux:linux_kernel:3.4.22 + cpe:/o:linux:linux_kernel:3.4.24 + cpe:/o:linux:linux_kernel:3.4.27 + cpe:/o:linux:linux_kernel:3.4.26 + cpe:/o:linux:linux_kernel:3.4.29 + cpe:/o:linux:linux_kernel:3.10.15 + cpe:/o:linux:linux_kernel:3.4.28 + cpe:/o:linux:linux_kernel:3.0.54 + cpe:/o:linux:linux_kernel:3.0.33 + cpe:/o:linux:linux_kernel:3.0.34 + cpe:/o:linux:linux_kernel:3.0.35 + cpe:/o:linux:linux_kernel:3.0.36 + cpe:/o:linux:linux_kernel:3.10.19 + cpe:/o:linux:linux_kernel:3.0.37 + cpe:/o:linux:linux_kernel:3.10.18 + cpe:/o:linux:linux_kernel:3.0.38 + cpe:/o:linux:linux_kernel:3.4.25 + cpe:/o:linux:linux_kernel:3.10.17 + cpe:/o:linux:linux_kernel:3.0.39 + cpe:/o:linux:linux_kernel:3.10.16 + cpe:/o:linux:linux_kernel:3.10.14 + cpe:/o:linux:linux_kernel:3.10.13 + cpe:/o:linux:linux_kernel:3.10.12 + cpe:/o:linux:linux_kernel:3.10.11 + cpe:/o:linux:linux_kernel:3.10.10 + cpe:/o:linux:linux_kernel:3.0.30 + cpe:/o:linux:linux_kernel:3.0.31 + cpe:/o:linux:linux_kernel:3.9.8 + cpe:/o:linux:linux_kernel:3.5.5 + cpe:/o:linux:linux_kernel:3.4.32 + cpe:/o:linux:linux_kernel:3.9.9 + cpe:/o:linux:linux_kernel:3.5.6 + cpe:/o:linux:linux_kernel:3.4.31 + cpe:/o:linux:linux_kernel:3.5.7 + cpe:/o:linux:linux_kernel:3.4.30 + cpe:/o:linux:linux_kernel:3.7.1 + cpe:/o:linux:linux_kernel:3.4.35 + cpe:/o:linux:linux_kernel:3.9.0 + cpe:/o:linux:linux_kernel:3.0.18 + cpe:/o:linux:linux_kernel:3.4.34 + cpe:/o:linux:linux_kernel:3.4.33 + cpe:/o:linux:linux_kernel:3.9.2 + cpe:/o:linux:linux_kernel:3.9.1 + cpe:/o:linux:linux_kernel:3.0.19 + cpe:/o:linux:linux_kernel:3.4.39 + cpe:/o:linux:linux_kernel:3.9.4 + cpe:/o:linux:linux_kernel:3.4.38 + cpe:/o:linux:linux_kernel:3.9.3 + cpe:/o:linux:linux_kernel:3.4.37 + cpe:/o:linux:linux_kernel:3.9.6 + cpe:/o:linux:linux_kernel:3.9.5 + cpe:/o:linux:linux_kernel:3.0.21 + cpe:/o:linux:linux_kernel:3.9.7 + cpe:/o:linux:linux_kernel:3.5.4 + cpe:/o:linux:linux_kernel:3.0.4 + cpe:/o:linux:linux_kernel:3.0.5 + cpe:/o:linux:linux_kernel:3.0.2 + cpe:/o:linux:linux_kernel:3.0.3 + cpe:/o:linux:linux_kernel:3.0.8 + cpe:/o:linux:linux_kernel:3.0.6 + cpe:/o:linux:linux_kernel:3.0.7 + cpe:/o:linux:linux_kernel:3.4.36 + cpe:/o:linux:linux_kernel:3.13.1 + cpe:/o:linux:linux_kernel:3.6.10 + cpe:/o:linux:linux_kernel:3.6.11 + cpe:/o:linux:linux_kernel:3.13.6 + cpe:/o:linux:linux_kernel:3.13.4 + cpe:/o:linux:linux_kernel:3.13.5 + cpe:/o:linux:linux_kernel:3.13.2 + cpe:/o:linux:linux_kernel:3.13.3 + cpe:/o:linux:linux_kernel:3.4.1 + cpe:/o:linux:linux_kernel:3.4.19 + cpe:/o:linux:linux_kernel:3.4.17 + cpe:/o:linux:linux_kernel:3.4.3 + cpe:/o:linux:linux_kernel:3.4.18 + cpe:/o:linux:linux_kernel:3.4.2 + cpe:/o:linux:linux_kernel:3.2.9 + cpe:/o:linux:linux_kernel:3.4.15 + cpe:/o:linux:linux_kernel:3.2.8 + cpe:/o:linux:linux_kernel:3.4.16 + cpe:/o:linux:linux_kernel:3.4.4 + cpe:/o:linux:linux_kernel:3.12.12 + cpe:/o:linux:linux_kernel:3.2.7 + cpe:/o:linux:linux_kernel:3.4.13 + cpe:/o:linux:linux_kernel:3.12.13 + cpe:/o:linux:linux_kernel:3.12.10 + cpe:/o:linux:linux_kernel:3.4.11 + cpe:/o:linux:linux_kernel:3.12.11 + cpe:/o:linux:linux_kernel:3.4.12 + cpe:/o:linux:linux_kernel:3.4.10 + cpe:/o:linux:linux_kernel:3.0.61 + cpe:/o:linux:linux_kernel:3.3:rc2 + cpe:/o:linux:linux_kernel:3.4:rc7 + cpe:/o:linux:linux_kernel:3.0.60 + cpe:/o:linux:linux_kernel:3.3:rc7 + cpe:/o:linux:linux_kernel:3.4:rc5 + cpe:/o:linux:linux_kernel:3.3:rc5 + cpe:/o:linux:linux_kernel:3.4:rc6 + cpe:/o:linux:linux_kernel:3.3:rc6 + cpe:/o:linux:linux_kernel:3.0.64 + cpe:/o:linux:linux_kernel:3.0.63 + cpe:/o:linux:linux_kernel:3.0.62 + cpe:/o:linux:linux_kernel:3.12.1 + cpe:/o:linux:linux_kernel:3.0.68 + cpe:/o:linux:linux_kernel:3.0.67 + cpe:/o:linux:linux_kernel:3.0.66 + cpe:/o:linux:linux_kernel:3.4.14 + cpe:/o:linux:linux_kernel:3.12.7 + cpe:/o:linux:linux_kernel:3.2:rc2 + cpe:/o:linux:linux_kernel:3.1:rc1 + cpe:/o:linux:linux_kernel:3.0.9 + cpe:/o:linux:linux_kernel:3.0:rc4 + cpe:/o:linux:linux_kernel:3.12.8 + cpe:/o:linux:linux_kernel:3.1:rc4 + cpe:/o:linux:linux_kernel:3.0:rc3 + cpe:/o:linux:linux_kernel:3.12.9 + cpe:/o:linux:linux_kernel:3.0:rc2 + cpe:/o:linux:linux_kernel:3.1:rc2 + cpe:/o:linux:linux_kernel:3.0:rc1 + cpe:/o:linux:linux_kernel:3.2:rc7 + cpe:/o:linux:linux_kernel:3.12.3 + cpe:/o:linux:linux_kernel:3.1.10 + cpe:/o:linux:linux_kernel:3.2:rc6 + cpe:/o:linux:linux_kernel:3.12.4 + cpe:/o:linux:linux_kernel:3.0:rc7 + cpe:/o:linux:linux_kernel:3.2:rc5 + cpe:/o:linux:linux_kernel:3.12.5 + cpe:/o:linux:linux_kernel:3.9:rc3 + cpe:/o:linux:linux_kernel:3.0:rc6 + cpe:/o:linux:linux_kernel:3.12.6 + cpe:/o:linux:linux_kernel:3.0:rc5 + cpe:/o:linux:linux_kernel:3.9:rc1 + cpe:/o:linux:linux_kernel:3.9:rc4 + cpe:/o:linux:linux_kernel:3.9:rc7 + cpe:/o:linux:linux_kernel:3.12.2 + cpe:/o:linux:linux_kernel:3.9:rc2 + cpe:/o:linux:linux_kernel:3.9:rc5 + cpe:/o:linux:linux_kernel:3.3:rc3 + cpe:/o:linux:linux_kernel:3.4:rc4 + cpe:/o:linux:linux_kernel:3.4:rc3 + cpe:/o:linux:linux_kernel:3.3:rc1 + cpe:/o:linux:linux_kernel:3.4:rc2 + cpe:/o:linux:linux_kernel:3.9:rc6 + cpe:/o:linux:linux_kernel:3.3:rc4 + cpe:/o:linux:linux_kernel:3.4:rc1 + cpe:/o:linux:linux_kernel:3.4.5 + cpe:/o:linux:linux_kernel:3.2.2 + cpe:/o:linux:linux_kernel:3.2.3 + cpe:/o:linux:linux_kernel:3.2.1 + cpe:/o:linux:linux_kernel:3.4.6 + cpe:/o:linux:linux_kernel:3.2:rc3 + cpe:/o:linux:linux_kernel:3.2.6 + cpe:/o:linux:linux_kernel:3.4.7 + cpe:/o:linux:linux_kernel:3.2:rc4 + cpe:/o:linux:linux_kernel:3.1:rc3 + cpe:/o:linux:linux_kernel:3.4.8 + cpe:/o:linux:linux_kernel:3.2.4 + cpe:/o:linux:linux_kernel:3.4.9 + cpe:/o:linux:linux_kernel:3.2.5 + cpe:/o:linux:linux_kernel:3.0.65 + cpe:/o:linux:linux_kernel:3.2.12 + cpe:/o:linux:linux_kernel:3.8.10 + cpe:/o:linux:linux_kernel:3.8.12 + cpe:/o:linux:linux_kernel:3.8.11 + cpe:/o:linux:linux_kernel:3.8.13 + cpe:/o:linux:linux_kernel:3.7.9 + cpe:/o:linux:linux_kernel:3.7.8 + cpe:/o:linux:linux_kernel:3.7.7 + cpe:/o:linux:linux_kernel:3.7.6 + cpe:/o:linux:linux_kernel:3.6.3 + cpe:/o:linux:linux_kernel:3.7.5 + cpe:/o:linux:linux_kernel:3.7.4 + cpe:/o:linux:linux_kernel:3.7.3 + cpe:/o:linux:linux_kernel:3.7.2 + cpe:/o:linux:linux_kernel:3.6.7 + cpe:/o:linux:linux_kernel:3.6.6 + cpe:/o:linux:linux_kernel:3.6.5 + cpe:/o:linux:linux_kernel:3.6.4 + cpe:/o:linux:linux_kernel:3.6.9 + cpe:/o:linux:linux_kernel:3.6.8 + cpe:/o:linux:linux_kernel:3.10 + cpe:/o:linux:linux_kernel:3.11 + cpe:/o:linux:linux_kernel:3.12 + cpe:/o:linux:linux_kernel:3.13 + cpe:/o:linux:linux_kernel:3.10.1 + cpe:/o:linux:linux_kernel:3.10.2 + cpe:/o:linux:linux_kernel:3.10.3 + cpe:/o:linux:linux_kernel:3.6.2 + cpe:/o:linux:linux_kernel:3.6.1 + cpe:/o:linux:linux_kernel:3.3.6 + cpe:/o:linux:linux_kernel:3.3.7 + cpe:/o:linux:linux_kernel:3.3.8 + cpe:/o:linux:linux_kernel:3.0.1 + cpe:/o:linux:linux_kernel:3.2 + cpe:/o:linux:linux_kernel:3.1 + cpe:/o:linux:linux_kernel:3.7 + cpe:/o:linux:linux_kernel:3.6 + cpe:/o:linux:linux_kernel:3.4 + cpe:/o:linux:linux_kernel:3.1.6 + cpe:/o:linux:linux_kernel:3.1.5 + cpe:/o:linux:linux_kernel:3.1.7 + cpe:/o:linux:linux_kernel:3.0.32 + cpe:/o:linux:linux_kernel:3.8.9 + cpe:/o:linux:linux_kernel:3.1.2 + cpe:/o:linux:linux_kernel:3.1.1 + cpe:/o:linux:linux_kernel:3.1.4 + cpe:/o:linux:linux_kernel:3.1.3 + cpe:/o:linux:linux_kernel:3.9.10 + cpe:/o:linux:linux_kernel:3.0.29 + cpe:/o:linux:linux_kernel:3.3 + cpe:/o:linux:linux_kernel:3.8.4 + cpe:/o:linux:linux_kernel:3.2.26 + cpe:/o:linux:linux_kernel:3.8.5 + cpe:/o:linux:linux_kernel:3.2.27 + cpe:/o:linux:linux_kernel:3.8.2 + cpe:/o:linux:linux_kernel:3.2.24 + cpe:/o:linux:linux_kernel:3.8.3 + cpe:/o:linux:linux_kernel:3.2.25 + cpe:/o:linux:linux_kernel:3.8.8 + cpe:/o:linux:linux_kernel:3.8.6 + cpe:/o:linux:linux_kernel:3.2.28 + cpe:/o:linux:linux_kernel:3.8.7 + cpe:/o:linux:linux_kernel:3.2.29 + cpe:/o:linux:linux_kernel:3.3.3 + cpe:/o:linux:linux_kernel:3.3.4 + cpe:/o:linux:linux_kernel:3.3.5 + cpe:/o:linux:linux_kernel:3.2.22 + cpe:/o:linux:linux_kernel:3.8.1 + cpe:/o:linux:linux_kernel:3.2.20 + cpe:/o:linux:linux_kernel:3.3.1 + cpe:/o:linux:linux_kernel:3.2.21 + cpe:/o:linux:linux_kernel:3.3.2 + cpe:/o:linux:linux_kernel:3.11.1 + cpe:/o:linux:linux_kernel:3.11.2 + cpe:/o:linux:linux_kernel:3.2.23 + cpe:/o:linux:linux_kernel:3.0.17 + cpe:/o:linux:linux_kernel:3.9.11 + cpe:/o:linux:linux_kernel:3.0.16 + cpe:/o:linux:linux_kernel:3.0.15 + cpe:/o:linux:linux_kernel:3.2.30 + cpe:/o:linux:linux_kernel:3.0.14 + cpe:/o:linux:linux_kernel:3.0.13 + cpe:/o:linux:linux_kernel:3.0.12 + cpe:/o:linux:linux_kernel:3.0.11 + cpe:/o:linux:linux_kernel:3.4.61 + cpe:/o:linux:linux_kernel:3.0.10 + cpe:/o:linux:linux_kernel:3.4.64 + cpe:/o:linux:linux_kernel:3.8.0 + cpe:/o:linux:linux_kernel:3.4.65 + cpe:/o:linux:linux_kernel:3.4.62 + cpe:/o:linux:linux_kernel:3.4.63 + cpe:/o:linux:linux_kernel:3.4.68 + cpe:/o:linux:linux_kernel:3.4.66 + cpe:/o:linux:linux_kernel:3.4.67 + cpe:/o:linux:linux_kernel:3.5.3 + cpe:/o:linux:linux_kernel:3.5.1 + cpe:/o:linux:linux_kernel:3.5.2 + cpe:/o:linux:linux_kernel:3.10.4 + cpe:/o:linux:linux_kernel:3.4.72 + cpe:/o:linux:linux_kernel:3.10.9 + cpe:/o:linux:linux_kernel:3.4.73 + cpe:/o:linux:linux_kernel:3.4.74 + cpe:/o:linux:linux_kernel:3.4.75 + cpe:/o:linux:linux_kernel:3.4.76 + cpe:/o:linux:linux_kernel:3.10.5 + cpe:/o:linux:linux_kernel:3.4.77 + cpe:/o:linux:linux_kernel:3.10.6 + cpe:/o:linux:linux_kernel:3.4.78 + cpe:/o:linux:linux_kernel:3.10.7 + cpe:/o:linux:linux_kernel:3.4.79 + cpe:/o:linux:linux_kernel:3.10.8 + cpe:/o:linux:linux_kernel:3.7.10 + cpe:/o:linux:linux_kernel:3.2.17 + cpe:/o:linux:linux_kernel:3.2.18 + cpe:/o:linux:linux_kernel:3.2.19 + cpe:/o:linux:linux_kernel:3.2.13 + cpe:/o:linux:linux_kernel:3.2.14 + cpe:/o:linux:linux_kernel:3.11.3 + cpe:/o:linux:linux_kernel:3.2.15 + cpe:/o:linux:linux_kernel:3.4.60 + cpe:/o:linux:linux_kernel:3.2.16 + cpe:/o:linux:linux_kernel:3.11.5 + cpe:/o:linux:linux_kernel:3.11.4 + cpe:/o:linux:linux_kernel:3.2.10 + cpe:/o:linux:linux_kernel:3.11.7 + cpe:/o:linux:linux_kernel:3.2.11 + cpe:/o:linux:linux_kernel:3.11.6 + cpe:/o:linux:linux_kernel:3.11.9 + cpe:/o:linux:linux_kernel:3.11.8 + cpe:/o:linux:linux_kernel:3.4.69 + + CVE-2014-0131 + 2014-03-24T12:40:48.093-04:00 + 2014-03-25T15:23:15.607-04:00 + + + 2.9 + ADJACENT_NETWORK + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-03-24T09:37:26.000-04:00 + + + + + CONFIRM + https://github.com/torvalds/linux/commit/1fd819ecb90cc9b822cd84d3056ddba315d3340f + + + CONFIRM + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1fd819ecb90cc9b822cd84d3056ddba315d3340f + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1074589 + + + MLIST + [netdev] 20140310 [PATCH 5/5] skbuff: skb_segment: orphan frags before copying + + + MLIST + [netdev] 20140310 [PATCH 0/5] skbuff: fix skb_segment with zero copy skbs + + + MLIST + [oss-security] 20140310 CVE-2014-0131 -- kernel: net: use-after-free during segmentation with zerocopy + + Use-after-free vulnerability in the skb_segment function in net/core/skbuff.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation. + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:fedoraproject:389_directory_server:1.2.11.14 + cpe:/a:fedoraproject:389_directory_server:1.2.11.15 + cpe:/a:fedoraproject:389_directory_server:1.2.11.17 + cpe:/a:fedoraproject:389_directory_server:1.2.11.19 + cpe:/a:fedoraproject:389_directory_server:1.2.11.25 + cpe:/a:fedoraproject:389_directory_server:1.2.11.22 + cpe:/a:fedoraproject:389_directory_server:1.2.11.23 + cpe:/a:fedoraproject:389_directory_server:1.2.11.20 + cpe:/a:fedoraproject:389_directory_server:1.2.11.21 + cpe:/a:fedoraproject:389_directory_server:1.2.11.10 + cpe:/a:fedoraproject:389_directory_server:1.2.11.11 + cpe:/a:fedoraproject:389_directory_server:1.2.11.12 + cpe:/a:fedoraproject:389_directory_server:1.2.11.13 + cpe:/a:fedoraproject:389_directory_server:1.2.11.8 + cpe:/a:fedoraproject:389_directory_server:1.2.11.9 + cpe:/a:fedoraproject:389_directory_server:1.2.11.6 + cpe:/a:fedoraproject:389_directory_server:1.2.11.1 + cpe:/a:fedoraproject:389_directory_server:1.2.11.5 + + CVE-2014-0132 + 2014-03-18T13:02:53.420-04:00 + 2014-03-19T10:12:09.563-04:00 + + + 6.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-19T10:12:03.673-04:00 + + + + + CONFIRM + https://fedorahosted.org/389/ticket/47739 + + + CONFIRM + https://fedorahosted.org/389/changeset/76acff12a86110d4165f94e2cba13ef5c7ebc38a/ + + + SECUNIA + 57427 + + + SECUNIA + 57412 + + + REDHAT + RHSA-2014:0292 + + The SASL authentication functionality in 389 Directory Server before 1.2.11.26 allows remote authenticated users to connect as an arbitrary user and gain privileges via the authzid parameter in a SASL/GSSAPI bind. + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:igor_sysoev:nginx:1.4.2 + cpe:/a:igor_sysoev:nginx:1.5.7 + cpe:/a:igor_sysoev:nginx:1.4.1 + cpe:/a:igor_sysoev:nginx:1.5.6 + cpe:/a:igor_sysoev:nginx:1.3.16 + cpe:/a:igor_sysoev:nginx:1.4.0 + cpe:/a:igor_sysoev:nginx:1.5.9 + cpe:/a:igor_sysoev:nginx:1.3.15 + cpe:/a:igor_sysoev:nginx:1.5.8 + cpe:/o:novell:opensuse:13.1 + cpe:/a:igor_sysoev:nginx:1.4.3 + cpe:/a:igor_sysoev:nginx:1.5.5 + cpe:/a:igor_sysoev:nginx:1.5.11 + cpe:/a:igor_sysoev:nginx:1.5.4 + cpe:/a:igor_sysoev:nginx:1.5.10 + cpe:/a:igor_sysoev:nginx:1.5.3 + cpe:/a:igor_sysoev:nginx:1.5.2 + cpe:/a:igor_sysoev:nginx:1.5.1 + cpe:/a:igor_sysoev:nginx:1.5.0 + + CVE-2014-0133 + 2014-03-28T11:55:08.607-04:00 + 2014-03-31T10:00:27.687-04:00 + + + 5.1 + NETWORK + HIGH + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-31T10:00:17.577-04:00 + + + + + MLIST + [nginx-announce] 20140318 nginx security advisory (CVE-2014-0133) + + + SUSE + openSUSE-SU-2014:0450 + + Heap-based buffer overflow in the SPDY implementation in nginx 1.3.15 before 1.4.7 and 1.5.x before 1.5.12 allows remote attackers to execute arbitrary code via a crafted request. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:haxx:libcurl:7.27.0 + cpe:/a:haxx:curl:7.19.4 + cpe:/a:haxx:curl:7.20.1 + cpe:/a:haxx:curl:7.19.3 + cpe:/a:haxx:curl:7.19.2 + cpe:/a:haxx:curl:7.19.1 + cpe:/a:haxx:curl:7.19.6 + cpe:/a:haxx:curl:7.19.5 + cpe:/a:haxx:curl:7.28.0 + cpe:/a:haxx:curl:7.20.0 + cpe:/a:haxx:libcurl:7.31.0 + cpe:/a:haxx:curl:7.24.0 + cpe:/a:haxx:libcurl:7.19.6 + cpe:/a:haxx:curl:7.21.0 + cpe:/a:haxx:curl:7.21.1 + cpe:/a:haxx:libcurl:7.19.1 + cpe:/a:haxx:curl:7.21.4 + cpe:/a:haxx:curl:7.23.1 + cpe:/a:haxx:curl:7.21.5 + cpe:/a:haxx:curl:7.23.0 + cpe:/a:haxx:libcurl:7.10.6 + cpe:/a:haxx:libcurl:7.19.0 + cpe:/a:haxx:curl:7.21.2 + cpe:/a:haxx:curl:7.21.3 + cpe:/a:haxx:libcurl:7.19.5 + cpe:/a:haxx:libcurl:7.19.4 + cpe:/a:haxx:libcurl:7.19.3 + cpe:/a:haxx:curl:7.21.6 + cpe:/a:haxx:libcurl:7.19.2 + cpe:/a:haxx:curl:7.21.7 + cpe:/a:haxx:curl:7.22.0 + cpe:/a:haxx:libcurl:7.35.0 + cpe:/a:haxx:libcurl:7.19.7 + cpe:/a:haxx:curl:7.10.6 + cpe:/a:haxx:curl:7.10.7 + cpe:/a:haxx:curl:7.19.0 + cpe:/a:haxx:libcurl:7.34.0 + cpe:/a:haxx:libcurl:7.25.0 + cpe:/a:haxx:curl:7.19.7 + cpe:/a:haxx:curl:7.28.1 + cpe:/a:haxx:libcurl:7.11.2 + cpe:/a:haxx:curl:7.16.4 + cpe:/a:haxx:libcurl:7.11.1 + cpe:/a:haxx:libcurl:7.11.0 + cpe:/a:haxx:libcurl:7.10.7 + cpe:/a:haxx:libcurl:7.33.0 + cpe:/a:haxx:curl:7.26.0 + cpe:/a:haxx:libcurl:7.13.0 + cpe:/a:haxx:libcurl:7.16.4 + cpe:/a:haxx:libcurl:7.13.1 + cpe:/a:haxx:libcurl:7.16.3 + cpe:/a:haxx:libcurl:7.13.2 + cpe:/a:haxx:libcurl:7.16.2 + cpe:/a:haxx:curl:7.31.0 + cpe:/a:haxx:libcurl:7.15.0 + cpe:/a:haxx:libcurl:7.15.1 + cpe:/a:haxx:curl:7.29.0 + cpe:/a:haxx:curl:7.16.2 + cpe:/a:haxx:curl:7.16.3 + cpe:/a:haxx:curl:7.27.0 + cpe:/a:haxx:libcurl:7.20.0 + cpe:/a:haxx:libcurl:7.30.0 + cpe:/a:haxx:libcurl:7.10.8 + cpe:/a:haxx:curl:7.18.2 + cpe:/a:haxx:libcurl:7.15.2 + cpe:/a:haxx:curl:7.15.0 + cpe:/a:haxx:curl:7.15.1 + cpe:/a:haxx:curl:7.15.2 + cpe:/a:haxx:libcurl:7.16.1 + cpe:/a:haxx:libcurl:7.21.1 + cpe:/a:haxx:curl:7.33.0 + cpe:/a:haxx:libcurl:7.21.2 + cpe:/a:haxx:libcurl:7.17.0 + cpe:/a:haxx:libcurl:7.21.0 + cpe:/a:haxx:libcurl:7.21.5 + cpe:/a:haxx:libcurl:7.21.6 + cpe:/a:haxx:libcurl:7.21.3 + cpe:/a:haxx:curl:7.14.0 + cpe:/a:haxx:libcurl:7.21.4 + cpe:/a:haxx:curl:7.14.1 + cpe:/a:haxx:libcurl:7.21.7 + cpe:/a:haxx:libcurl:7.24.0 + cpe:/a:haxx:libcurl:7.28.0 + cpe:/a:haxx:libcurl:7.22.0 + cpe:/a:haxx:libcurl:7.18.1 + cpe:/a:haxx:curl:7.32.0 + cpe:/a:haxx:libcurl:7.18.2 + cpe:/a:haxx:libcurl:7.18.0 + cpe:/a:haxx:curl:7.18.1 + cpe:/a:haxx:curl:7.16.0 + cpe:/a:haxx:curl:7.18.0 + cpe:/a:haxx:curl:7.16.1 + cpe:/a:haxx:libcurl:7.20.1 + cpe:/a:haxx:curl:7.34.0 + cpe:/a:haxx:libcurl:7.26.0 + cpe:/a:haxx:curl:7.17.0 + cpe:/a:haxx:curl:7.11.0 + cpe:/a:haxx:curl:7.15.4 + cpe:/a:haxx:curl:7.15.3 + cpe:/a:haxx:curl:7.12.3 + cpe:/a:haxx:libcurl:7.15.5 + cpe:/a:haxx:curl:7.12.2 + cpe:/a:haxx:libcurl:7.15.4 + cpe:/a:haxx:curl:7.12.1 + cpe:/a:haxx:libcurl:7.15.3 + cpe:/a:haxx:curl:7.12.0 + cpe:/a:haxx:curl:7.13.2 + cpe:/a:haxx:curl:7.13.1 + cpe:/a:haxx:libcurl:7.23.0 + cpe:/a:haxx:curl:7.13.0 + cpe:/a:haxx:curl:7.30.0 + cpe:/a:haxx:libcurl:7.32.0 + cpe:/a:haxx:libcurl:7.23.1 + cpe:/a:haxx:libcurl:7.17.1 + cpe:/a:haxx:curl:7.11.2 + cpe:/a:haxx:curl:7.11.1 + cpe:/a:haxx:curl:7.35.0 + cpe:/a:haxx:libcurl:7.12.0 + cpe:/a:haxx:curl:7.25.0 + cpe:/a:haxx:libcurl:7.12.2 + cpe:/a:haxx:libcurl:7.12.1 + cpe:/a:haxx:libcurl:7.12.3 + cpe:/a:haxx:libcurl:7.14.0 + cpe:/a:haxx:libcurl:7.14.1 + cpe:/a:haxx:curl:7.17.1 + cpe:/a:haxx:curl:7.10.8 + cpe:/a:haxx:libcurl:7.29.0 + cpe:/a:haxx:libcurl:7.16.0 + cpe:/a:haxx:libcurl:7.28.1 + cpe:/a:haxx:curl:7.15.5 + + CVE-2014-0138 + 2014-04-15T10:55:04.107-04:00 + 2014-04-24T01:03:03.573-04:00 + + + 6.4 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-16T08:41:01.737-04:00 + + + + + CONFIRM + http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/ + + + CONFIRM + http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/ + + + CONFIRM + http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/ + + + DEBIAN + DSA-2902 + + + SECUNIA + 57968 + + + SECUNIA + 57966 + + + SECUNIA + 57836 + + + CONFIRM + http://curl.haxx.se/docs/adv_20140326A.html + + The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context-dependent attackers to connect as other users via a request, a similar issue to CVE-2014-0015. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:haxx:libcurl:7.27.0 + cpe:/a:haxx:curl:7.19.4 + cpe:/a:haxx:curl:7.20.1 + cpe:/a:haxx:curl:7.19.3 + cpe:/a:haxx:curl:7.19.2 + cpe:/a:haxx:curl:7.19.1 + cpe:/a:haxx:curl:7.19.6 + cpe:/a:haxx:curl:7.19.5 + cpe:/a:haxx:curl:7.28.0 + cpe:/a:haxx:curl:7.20.0 + cpe:/a:haxx:libcurl:7.31.0 + cpe:/a:haxx:curl:7.24.0 + cpe:/a:haxx:libcurl:7.19.6 + cpe:/a:haxx:curl:7.21.0 + cpe:/a:haxx:curl:7.21.1 + cpe:/a:haxx:libcurl:7.19.1 + cpe:/a:haxx:curl:7.21.4 + cpe:/a:haxx:curl:7.23.1 + cpe:/a:haxx:curl:7.21.5 + cpe:/a:haxx:curl:7.23.0 + cpe:/a:haxx:libcurl:7.10.6 + cpe:/a:haxx:libcurl:7.19.0 + cpe:/a:haxx:curl:7.21.2 + cpe:/a:haxx:curl:7.21.3 + cpe:/a:haxx:libcurl:7.19.5 + cpe:/a:haxx:libcurl:7.19.4 + cpe:/a:haxx:libcurl:7.19.3 + cpe:/a:haxx:curl:7.21.6 + cpe:/a:haxx:libcurl:7.19.2 + cpe:/a:haxx:curl:7.21.7 + cpe:/a:haxx:curl:7.22.0 + cpe:/a:haxx:libcurl:7.35.0 + cpe:/a:haxx:libcurl:7.19.7 + cpe:/a:haxx:curl:7.10.6 + cpe:/a:haxx:curl:7.10.7 + cpe:/a:haxx:curl:7.19.0 + cpe:/a:haxx:libcurl:7.34.0 + cpe:/a:haxx:libcurl:7.25.0 + cpe:/a:haxx:curl:7.19.7 + cpe:/a:haxx:curl:7.28.1 + cpe:/a:haxx:libcurl:7.11.2 + cpe:/a:haxx:curl:7.16.4 + cpe:/a:haxx:libcurl:7.11.1 + cpe:/a:haxx:libcurl:7.11.0 + cpe:/a:haxx:libcurl:7.10.7 + cpe:/a:haxx:libcurl:7.33.0 + cpe:/a:haxx:curl:7.26.0 + cpe:/a:haxx:libcurl:7.13.0 + cpe:/a:haxx:libcurl:7.16.4 + cpe:/a:haxx:libcurl:7.13.1 + cpe:/a:haxx:libcurl:7.16.3 + cpe:/a:haxx:libcurl:7.13.2 + cpe:/a:haxx:libcurl:7.16.2 + cpe:/a:haxx:curl:7.31.0 + cpe:/a:haxx:libcurl:7.15.0 + cpe:/a:haxx:libcurl:7.15.1 + cpe:/a:haxx:curl:7.29.0 + cpe:/a:haxx:curl:7.16.2 + cpe:/a:haxx:curl:7.16.3 + cpe:/a:haxx:curl:7.27.0 + cpe:/a:haxx:libcurl:7.20.0 + cpe:/a:haxx:libcurl:7.30.0 + cpe:/a:haxx:libcurl:7.10.8 + cpe:/a:haxx:curl:7.18.2 + cpe:/a:haxx:libcurl:7.15.2 + cpe:/a:haxx:curl:7.15.0 + cpe:/a:haxx:curl:7.15.1 + cpe:/a:haxx:curl:7.15.2 + cpe:/a:haxx:libcurl:7.16.1 + cpe:/a:haxx:libcurl:7.21.1 + cpe:/a:haxx:curl:7.33.0 + cpe:/a:haxx:libcurl:7.21.2 + cpe:/a:haxx:libcurl:7.17.0 + cpe:/a:haxx:libcurl:7.21.0 + cpe:/a:haxx:libcurl:7.21.5 + cpe:/a:haxx:libcurl:7.21.6 + cpe:/a:haxx:libcurl:7.21.3 + cpe:/a:haxx:curl:7.14.0 + cpe:/a:haxx:libcurl:7.21.4 + cpe:/a:haxx:curl:7.14.1 + cpe:/a:haxx:libcurl:7.21.7 + cpe:/a:haxx:libcurl:7.24.0 + cpe:/a:haxx:libcurl:7.28.0 + cpe:/a:haxx:libcurl:7.22.0 + cpe:/a:haxx:libcurl:7.18.1 + cpe:/a:haxx:curl:7.32.0 + cpe:/a:haxx:libcurl:7.18.2 + cpe:/a:haxx:libcurl:7.18.0 + cpe:/a:haxx:curl:7.18.1 + cpe:/a:haxx:curl:7.16.0 + cpe:/a:haxx:curl:7.18.0 + cpe:/a:haxx:curl:7.16.1 + cpe:/a:haxx:libcurl:7.20.1 + cpe:/a:haxx:curl:7.34.0 + cpe:/a:haxx:libcurl:7.26.0 + cpe:/a:haxx:curl:7.17.0 + cpe:/a:haxx:curl:7.11.0 + cpe:/a:haxx:curl:7.15.4 + cpe:/a:haxx:curl:7.15.3 + cpe:/a:haxx:curl:7.12.3 + cpe:/a:haxx:libcurl:7.15.5 + cpe:/a:haxx:curl:7.12.2 + cpe:/a:haxx:libcurl:7.15.4 + cpe:/a:haxx:curl:7.12.1 + cpe:/a:haxx:libcurl:7.15.3 + cpe:/a:haxx:curl:7.12.0 + cpe:/a:haxx:curl:7.13.2 + cpe:/a:haxx:curl:7.13.1 + cpe:/a:haxx:libcurl:7.23.0 + cpe:/a:haxx:curl:7.13.0 + cpe:/a:haxx:curl:7.30.0 + cpe:/a:haxx:libcurl:7.32.0 + cpe:/a:haxx:libcurl:7.23.1 + cpe:/a:haxx:libcurl:7.17.1 + cpe:/a:haxx:curl:7.11.2 + cpe:/a:haxx:curl:7.11.1 + cpe:/a:haxx:curl:7.35.0 + cpe:/a:haxx:libcurl:7.12.0 + cpe:/a:haxx:curl:7.25.0 + cpe:/a:haxx:libcurl:7.12.2 + cpe:/a:haxx:libcurl:7.12.1 + cpe:/a:haxx:libcurl:7.12.3 + cpe:/a:haxx:libcurl:7.14.0 + cpe:/a:haxx:libcurl:7.14.1 + cpe:/a:haxx:curl:7.17.1 + cpe:/a:haxx:curl:7.10.8 + cpe:/a:haxx:libcurl:7.29.0 + cpe:/a:haxx:libcurl:7.16.0 + cpe:/a:haxx:libcurl:7.28.1 + cpe:/a:haxx:curl:7.15.5 + + CVE-2014-0139 + 2014-04-15T10:55:04.137-04:00 + 2014-04-24T01:03:03.790-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-16T08:46:31.310-04:00 + + + + + CONFIRM + http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/ + + + CONFIRM + http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/ + + + CONFIRM + http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/ + + + DEBIAN + DSA-2902 + + + SECUNIA + 57968 + + + SECUNIA + 57966 + + + SECUNIA + 57836 + + + CONFIRM + http://curl.haxx.se/docs/adv_20140326B.html + + cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recognize a wildcard IP address in the subject's Common Name (CN) field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:qemu:qemu:1.0.1 + cpe:/a:qemu:qemu:1.5.1 + cpe:/a:qemu:qemu:1.5.2 + cpe:/a:qemu:qemu:1.5.3 + cpe:/a:qemu:qemu:1.5.0 + cpe:/a:qemu:qemu:0.9.1-5 + cpe:/a:qemu:qemu:1.4.1 + cpe:/a:qemu:qemu:1.4.2 + cpe:/a:qemu:qemu:0.9.0 + cpe:/a:qemu:qemu:0.9.1 + cpe:/a:qemu:qemu:0.11.0-rc0 + cpe:/a:qemu:qemu:1.6.0 + cpe:/a:qemu:qemu:0.11.0-rc1 + cpe:/a:qemu:qemu:1.6.1 + cpe:/a:qemu:qemu:0.11.0-rc2 + cpe:/a:qemu:qemu:1.6.2 + cpe:/a:qemu:qemu:1.7.1 + cpe:/a:qemu:qemu:0.8.0 + cpe:/a:qemu:qemu:0.8.1 + cpe:/a:qemu:qemu:0.8.2 + cpe:/a:qemu:qemu:0.5.1 + cpe:/a:qemu:qemu:0.5.0 + cpe:/a:qemu:qemu:0.5.5 + cpe:/a:qemu:qemu:0.5.4 + cpe:/a:qemu:qemu:0.1.2 + cpe:/a:qemu:qemu:0.5.3 + cpe:/a:qemu:qemu:0.5.2 + cpe:/a:qemu:qemu:0.14.0:rc0 + cpe:/a:qemu:qemu:0.14.0 + cpe:/a:qemu:qemu:0.14.1 + cpe:/a:qemu:qemu:0.4.3 + cpe:/a:qemu:qemu:0.4.2 + cpe:/a:qemu:qemu:0.4.1 + cpe:/a:qemu:qemu:0.10.0 + cpe:/a:qemu:qemu:0.1.4 + cpe:/a:qemu:qemu:0.1.5 + cpe:/a:qemu:qemu:0.1.3 + cpe:/a:qemu:qemu:0.1.6 + cpe:/a:qemu:qemu:0.15.2 + cpe:/a:qemu:qemu:0.15.1 + cpe:/a:qemu:qemu:0.1.1 + cpe:/o:redhat:enterprise_linux:6 + cpe:/a:qemu:qemu:2.0.0:rc0 + cpe:/a:qemu:qemu:2.0.0:rc2 + cpe:/a:qemu:qemu:1.1 + cpe:/a:qemu:qemu:1.0 + cpe:/a:qemu:qemu:2.0.0:rc3 + cpe:/a:qemu:qemu:2.0.0:rc1 + cpe:/a:qemu:qemu:0.11.0 + cpe:/a:qemu:qemu:0.11.1 + cpe:/a:qemu:qemu:0.11.0:rc0 + cpe:/a:qemu:qemu:2.0 + cpe:/a:qemu:qemu:0.13.0:rc0 + cpe:/a:qemu:qemu:0.13.0 + cpe:/a:qemu:qemu:0.3 + cpe:/a:qemu:qemu:0.10.1 + cpe:/a:qemu:qemu:0.4 + cpe:/a:qemu:qemu:0.10.3 + cpe:/a:qemu:qemu:0.1 + cpe:/a:qemu:qemu:0.2 + cpe:/a:qemu:qemu:0.10.2 + cpe:/a:qemu:qemu:0.12.0:rc1 + cpe:/a:qemu:qemu:0.10.5 + cpe:/a:qemu:qemu:0.12.0:rc2 + cpe:/a:qemu:qemu:0.10.4 + cpe:/a:qemu:qemu:0.10.6 + cpe:/a:qemu:qemu:1.5.0:rc2 + cpe:/a:qemu:qemu:1.5.0:rc1 + cpe:/a:qemu:qemu:1.1:rc1 + cpe:/a:qemu:qemu:1.0:rc4 + cpe:/a:qemu:qemu:1.1:rc4 + cpe:/a:qemu:qemu:1.0:rc3 + cpe:/a:qemu:qemu:1.5.0:rc3 + cpe:/a:qemu:qemu:1.0:rc2 + cpe:/a:qemu:qemu:1.1:rc2 + cpe:/a:qemu:qemu:1.0:rc1 + cpe:/a:qemu:qemu:0.6.1 + cpe:/a:qemu:qemu:1.1:rc3 + cpe:/a:qemu:qemu:0.6.0 + cpe:/a:qemu:qemu:0.7.2 + cpe:/a:qemu:qemu:0.7.0 + cpe:/a:qemu:qemu:0.7.1 + cpe:/a:qemu:qemu:1.6.0:rc1 + cpe:/a:qemu:qemu:1.6.0:rc2 + cpe:/a:qemu:qemu:1.6.0:rc3 + cpe:/a:qemu:qemu:0.11.0:rc2 + cpe:/a:qemu:qemu:0.11.0:rc1 + cpe:/a:qemu:qemu:0.12.1 + cpe:/a:qemu:qemu:0.12.0 + cpe:/a:qemu:qemu:0.14.0:rc2 + cpe:/a:qemu:qemu:0.14.0:rc1 + cpe:/a:qemu:qemu:0.12.5 + cpe:/a:qemu:qemu:0.12.4 + cpe:/a:qemu:qemu:0.13.0:rc1 + cpe:/a:qemu:qemu:0.12.3 + cpe:/a:qemu:qemu:0.12.2 + cpe:/a:qemu:qemu:2.0.0:- + cpe:/a:qemu:qemu:0.15.0:rc1 + cpe:/a:qemu:qemu:0.15.0:rc2 + + CVE-2014-0150 + 2014-04-18T10:55:25.947-04:00 + 2014-04-21T11:04:45.497-04:00 + + + 4.9 + ADJACENT_NETWORK + MEDIUM + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-21T11:04:44.373-04:00 + + + + + MLIST + [Qemu-devel] 20140411 [PATCH for-2.0] virtio-net: fix guest-triggerable buffer overrun + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1078846 + + + SECUNIA + 57878 + + + MLIST + [Qemu-devel] 20140411 Re: [PATCH for-2.0] virtio-net: fix guest-triggerable buffer overrun + + Integer overflow in the virtio_net_handle_mac function in hw/net/virtio-net.c in QEMU 2.0 and earlier allows local guest users to execute arbitrary code via a MAC addresses table update request, which triggers a heap-based buffer overflow. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:linux:linux_kernel:3.0.48 + cpe:/o:linux:linux_kernel:3.0.49 + cpe:/o:linux:linux_kernel:3.0.46 + cpe:/o:linux:linux_kernel:3.0.47 + cpe:/o:linux:linux_kernel:3.0.44 + cpe:/o:linux:linux_kernel:3.0.45 + cpe:/o:linux:linux_kernel:3.0.42 + cpe:/o:linux:linux_kernel:3.4.70 + cpe:/o:linux:linux_kernel:3.4.71 + cpe:/o:linux:linux_kernel:3.0.40 + cpe:/o:linux:linux_kernel:3.0.41 + cpe:/o:linux:linux_kernel:3.4.45 + cpe:/o:linux:linux_kernel:3.4.44 + cpe:/o:linux:linux_kernel:3.4.46 + cpe:/o:linux:linux_kernel:3.4.41 + cpe:/o:linux:linux_kernel:3.4.40 + cpe:/o:linux:linux_kernel:3.4.43 + cpe:/o:linux:linux_kernel:3.4.42 + cpe:/o:linux:linux_kernel:3.4.49 + cpe:/o:linux:linux_kernel:3.4.48 + cpe:/o:linux:linux_kernel:3.0.59 + cpe:/o:linux:linux_kernel:3.4.47 + cpe:/o:linux:linux_kernel:3.0.55 + cpe:/o:linux:linux_kernel:3.0.56 + cpe:/o:linux:linux_kernel:3.0.57 + cpe:/o:linux:linux_kernel:3.0.58 + cpe:/o:linux:linux_kernel:3.0.51 + cpe:/o:linux:linux_kernel:3.0.52 + cpe:/o:linux:linux_kernel:3.0.53 + cpe:/o:linux:linux_kernel:3.11.10 + cpe:/o:linux:linux_kernel:3.0.50 + cpe:/o:linux:linux_kernel:3.4.57 + cpe:/o:linux:linux_kernel:3.4.56 + cpe:/o:linux:linux_kernel:3.4.55 + cpe:/o:linux:linux_kernel:3.4.54 + cpe:/o:linux:linux_kernel:3.4.53 + cpe:/o:linux:linux_kernel:3.4.52 + cpe:/o:linux:linux_kernel:3.4.51 + cpe:/o:linux:linux_kernel:3.4.50 + cpe:/o:linux:linux_kernel:3.0.43 + cpe:/o:linux:linux_kernel:3.10.26 + cpe:/o:linux:linux_kernel:3.4.59 + cpe:/o:linux:linux_kernel:3.0.24 + cpe:/o:linux:linux_kernel:3.0.25 + cpe:/o:linux:linux_kernel:3.0.22 + cpe:/o:linux:linux_kernel:3.1.9 + cpe:/o:linux:linux_kernel:3.0.23 + cpe:/o:linux:linux_kernel:3.10.28 + cpe:/o:linux:linux_kernel:3.0.28 + cpe:/o:linux:linux_kernel:3.10.27 + cpe:/o:linux:linux_kernel:3.0.26 + cpe:/o:linux:linux_kernel:3.10.29 + cpe:/o:linux:linux_kernel:3.4.58 + cpe:/o:linux:linux_kernel:3.0.27 + cpe:/o:linux:linux_kernel:3.10.24 + cpe:/o:linux:linux_kernel:3.10.23 + cpe:/o:linux:linux_kernel:3.10.25 + cpe:/o:linux:linux_kernel:3.10.20 + cpe:/o:linux:linux_kernel:3.1.8 + cpe:/o:linux:linux_kernel:3.0.20 + cpe:/o:linux:linux_kernel:3.10.22 + cpe:/o:linux:linux_kernel:3.10.21 + cpe:/o:linux:linux_kernel:3.4.21 + cpe:/o:linux:linux_kernel:3.4.20 + cpe:/o:linux:linux_kernel:3.4.23 + cpe:/o:linux:linux_kernel:3.4.22 + cpe:/o:linux:linux_kernel:3.4.24 + cpe:/o:linux:linux_kernel:3.4.27 + cpe:/o:linux:linux_kernel:3.4.26 + cpe:/o:linux:linux_kernel:3.4.29 + cpe:/o:linux:linux_kernel:3.10.15 + cpe:/o:linux:linux_kernel:3.4.28 + cpe:/o:linux:linux_kernel:3.0.54 + cpe:/o:linux:linux_kernel:3.0.33 + cpe:/o:linux:linux_kernel:3.0.34 + cpe:/o:linux:linux_kernel:3.0.35 + cpe:/o:linux:linux_kernel:3.0.36 + cpe:/o:linux:linux_kernel:3.10.19 + cpe:/o:linux:linux_kernel:3.0.37 + cpe:/o:linux:linux_kernel:3.10.18 + cpe:/o:linux:linux_kernel:3.0.38 + cpe:/o:linux:linux_kernel:3.4.25 + cpe:/o:linux:linux_kernel:3.10.17 + cpe:/o:linux:linux_kernel:3.0.39 + cpe:/o:linux:linux_kernel:3.10.16 + cpe:/o:linux:linux_kernel:3.10.14 + cpe:/o:linux:linux_kernel:3.10.13 + cpe:/o:linux:linux_kernel:3.10.12 + cpe:/o:linux:linux_kernel:3.10.11 + cpe:/o:linux:linux_kernel:3.10.10 + cpe:/o:linux:linux_kernel:3.0.30 + cpe:/o:linux:linux_kernel:3.0.31 + cpe:/o:linux:linux_kernel:3.9.8 + cpe:/o:linux:linux_kernel:3.5.5 + cpe:/o:linux:linux_kernel:3.4.32 + cpe:/o:linux:linux_kernel:3.9.9 + cpe:/o:linux:linux_kernel:3.5.6 + cpe:/o:linux:linux_kernel:3.4.31 + cpe:/o:linux:linux_kernel:3.5.7 + cpe:/o:linux:linux_kernel:3.4.30 + cpe:/o:linux:linux_kernel:3.7.1 + cpe:/o:linux:linux_kernel:3.4.35 + cpe:/o:linux:linux_kernel:3.9.0 + cpe:/o:linux:linux_kernel:3.0.18 + cpe:/o:linux:linux_kernel:3.4.34 + cpe:/o:linux:linux_kernel:3.4.33 + cpe:/o:linux:linux_kernel:3.9.2 + cpe:/o:linux:linux_kernel:3.9.1 + cpe:/o:linux:linux_kernel:3.0.19 + cpe:/o:linux:linux_kernel:3.4.39 + cpe:/o:linux:linux_kernel:3.9.4 + cpe:/o:linux:linux_kernel:3.4.38 + cpe:/o:linux:linux_kernel:3.9.3 + cpe:/o:linux:linux_kernel:3.4.37 + cpe:/o:linux:linux_kernel:3.9.6 + cpe:/o:linux:linux_kernel:3.9.5 + cpe:/o:linux:linux_kernel:3.0.21 + cpe:/o:linux:linux_kernel:3.9.7 + cpe:/o:linux:linux_kernel:3.5.4 + cpe:/o:linux:linux_kernel:3.0.4 + cpe:/o:linux:linux_kernel:3.0.5 + cpe:/o:linux:linux_kernel:3.0.2 + cpe:/o:linux:linux_kernel:3.0.3 + cpe:/o:linux:linux_kernel:3.0.8 + cpe:/o:linux:linux_kernel:3.0.6 + cpe:/o:linux:linux_kernel:3.0.7 + cpe:/o:linux:linux_kernel:3.13.9 + cpe:/o:linux:linux_kernel:3.4.36 + cpe:/o:linux:linux_kernel:3.12.17 + cpe:/o:linux:linux_kernel:3.13.1 + cpe:/o:linux:linux_kernel:3.6.10 + cpe:/o:linux:linux_kernel:3.6.11 + cpe:/o:linux:linux_kernel:3.13.8 + cpe:/o:linux:linux_kernel:3.13.6 + cpe:/o:linux:linux_kernel:3.13.7 + cpe:/o:linux:linux_kernel:3.13.4 + cpe:/o:linux:linux_kernel:3.13.5 + cpe:/o:linux:linux_kernel:3.13.2 + cpe:/o:linux:linux_kernel:3.13.3 + cpe:/o:linux:linux_kernel:3.4.1 + cpe:/o:linux:linux_kernel:3.4.19 + cpe:/o:linux:linux_kernel:3.4.17 + cpe:/o:linux:linux_kernel:3.4.3 + cpe:/o:linux:linux_kernel:3.4.18 + cpe:/o:linux:linux_kernel:3.4.2 + cpe:/o:linux:linux_kernel:3.2.9 + cpe:/o:linux:linux_kernel:3.4.15 + cpe:/o:linux:linux_kernel:3.2.8 + cpe:/o:linux:linux_kernel:3.4.16 + cpe:/o:linux:linux_kernel:3.4.4 + cpe:/o:linux:linux_kernel:3.12.12 + cpe:/o:linux:linux_kernel:3.2.7 + cpe:/o:linux:linux_kernel:3.4.13 + cpe:/o:linux:linux_kernel:3.12.13 + cpe:/o:linux:linux_kernel:3.12.10 + cpe:/o:linux:linux_kernel:3.4.11 + cpe:/o:linux:linux_kernel:3.12.11 + cpe:/o:linux:linux_kernel:3.4.12 + cpe:/o:linux:linux_kernel:3.12.16 + cpe:/o:linux:linux_kernel:3.4.10 + cpe:/o:linux:linux_kernel:3.12.14 + cpe:/o:linux:linux_kernel:3.12.15 + cpe:/o:linux:linux_kernel:3.0.61 + cpe:/o:linux:linux_kernel:3.3:rc2 + cpe:/o:linux:linux_kernel:3.4:rc7 + cpe:/o:linux:linux_kernel:3.0.60 + cpe:/o:linux:linux_kernel:3.3:rc7 + cpe:/o:linux:linux_kernel:3.4:rc5 + cpe:/o:linux:linux_kernel:3.3:rc5 + cpe:/o:linux:linux_kernel:3.4:rc6 + cpe:/o:linux:linux_kernel:3.3:rc6 + cpe:/o:linux:linux_kernel:3.0.64 + cpe:/o:linux:linux_kernel:3.0.63 + cpe:/o:linux:linux_kernel:3.0.62 + cpe:/o:linux:linux_kernel:3.12.1 + cpe:/o:linux:linux_kernel:3.0.68 + cpe:/o:linux:linux_kernel:3.0.67 + cpe:/o:linux:linux_kernel:3.0.66 + cpe:/o:linux:linux_kernel:3.4.14 + cpe:/o:linux:linux_kernel:3.12.7 + cpe:/o:linux:linux_kernel:3.2:rc2 + cpe:/o:linux:linux_kernel:3.1:rc1 + cpe:/o:linux:linux_kernel:3.0.9 + cpe:/o:linux:linux_kernel:3.0:rc4 + cpe:/o:linux:linux_kernel:3.12.8 + cpe:/o:linux:linux_kernel:3.1:rc4 + cpe:/o:linux:linux_kernel:3.0:rc3 + cpe:/o:linux:linux_kernel:3.12.9 + cpe:/o:linux:linux_kernel:3.0:rc2 + cpe:/o:linux:linux_kernel:3.1:rc2 + cpe:/o:linux:linux_kernel:3.0:rc1 + cpe:/o:linux:linux_kernel:3.2:rc7 + cpe:/o:linux:linux_kernel:3.12.3 + cpe:/o:linux:linux_kernel:3.1.10 + cpe:/o:linux:linux_kernel:3.2:rc6 + cpe:/o:linux:linux_kernel:3.12.4 + cpe:/o:linux:linux_kernel:3.2:rc5 + cpe:/o:linux:linux_kernel:3.0:rc7 + cpe:/o:linux:linux_kernel:3.12.5 + cpe:/o:linux:linux_kernel:3.9:rc3 + cpe:/o:linux:linux_kernel:3.0:rc6 + cpe:/o:linux:linux_kernel:3.12.6 + cpe:/o:linux:linux_kernel:3.0:rc5 + cpe:/o:linux:linux_kernel:3.9:rc1 + cpe:/o:linux:linux_kernel:3.9:rc4 + cpe:/o:linux:linux_kernel:3.9:rc7 + cpe:/o:linux:linux_kernel:3.12.2 + cpe:/o:linux:linux_kernel:3.9:rc2 + cpe:/o:linux:linux_kernel:3.9:rc5 + cpe:/o:linux:linux_kernel:3.3:rc3 + cpe:/o:linux:linux_kernel:3.4:rc4 + cpe:/o:linux:linux_kernel:3.4:rc3 + cpe:/o:linux:linux_kernel:3.3:rc1 + cpe:/o:linux:linux_kernel:3.4:rc2 + cpe:/o:linux:linux_kernel:3.9:rc6 + cpe:/o:linux:linux_kernel:3.3:rc4 + cpe:/o:linux:linux_kernel:3.4:rc1 + cpe:/o:linux:linux_kernel:3.4.5 + cpe:/o:linux:linux_kernel:3.2.2 + cpe:/o:linux:linux_kernel:3.2.3 + cpe:/o:linux:linux_kernel:3.2.1 + cpe:/o:linux:linux_kernel:3.4.6 + cpe:/o:linux:linux_kernel:3.2:rc3 + cpe:/o:linux:linux_kernel:3.2.6 + cpe:/o:linux:linux_kernel:3.4.7 + cpe:/o:linux:linux_kernel:3.2:rc4 + cpe:/o:linux:linux_kernel:3.1:rc3 + cpe:/o:linux:linux_kernel:3.4.8 + cpe:/o:linux:linux_kernel:3.2.4 + cpe:/o:linux:linux_kernel:3.4.9 + cpe:/o:linux:linux_kernel:3.2.5 + cpe:/o:linux:linux_kernel:3.0.65 + cpe:/o:linux:linux_kernel:3.2.12 + cpe:/o:linux:linux_kernel:3.8.10 + cpe:/o:linux:linux_kernel:3.8.12 + cpe:/o:linux:linux_kernel:3.8.11 + cpe:/o:linux:linux_kernel:3.8.13 + cpe:/o:linux:linux_kernel:3.7.9 + cpe:/o:linux:linux_kernel:3.7.8 + cpe:/o:linux:linux_kernel:3.7.7 + cpe:/o:linux:linux_kernel:3.7.6 + cpe:/o:linux:linux_kernel:3.6.3 + cpe:/o:linux:linux_kernel:3.7.5 + cpe:/o:linux:linux_kernel:3.7.4 + cpe:/o:linux:linux_kernel:3.7.3 + cpe:/o:linux:linux_kernel:3.7.2 + cpe:/o:linux:linux_kernel:3.6.7 + cpe:/o:linux:linux_kernel:3.6.6 + cpe:/o:linux:linux_kernel:3.6.5 + cpe:/o:linux:linux_kernel:3.6.4 + cpe:/o:linux:linux_kernel:3.6.9 + cpe:/o:linux:linux_kernel:3.6.8 + cpe:/o:linux:linux_kernel:3.10 + cpe:/o:linux:linux_kernel:3.11 + cpe:/o:linux:linux_kernel:3.12 + cpe:/o:linux:linux_kernel:3.13 + cpe:/o:linux:linux_kernel:3.10.1 + cpe:/o:linux:linux_kernel:3.10.2 + cpe:/o:linux:linux_kernel:3.10.3 + cpe:/o:linux:linux_kernel:3.6.2 + cpe:/o:linux:linux_kernel:3.6.1 + cpe:/o:linux:linux_kernel:3.3.6 + cpe:/o:linux:linux_kernel:3.3.7 + cpe:/o:linux:linux_kernel:3.3.8 + cpe:/o:linux:linux_kernel:3.0.1 + cpe:/o:linux:linux_kernel:3.2 + cpe:/o:linux:linux_kernel:3.1 + cpe:/o:linux:linux_kernel:3.7 + cpe:/o:linux:linux_kernel:3.6 + cpe:/o:linux:linux_kernel:3.4 + cpe:/o:linux:linux_kernel:3.1.6 + cpe:/o:linux:linux_kernel:3.1.5 + cpe:/o:linux:linux_kernel:3.1.7 + cpe:/o:linux:linux_kernel:3.0.32 + cpe:/o:linux:linux_kernel:3.8.9 + cpe:/o:linux:linux_kernel:3.1.2 + cpe:/o:linux:linux_kernel:3.1.1 + cpe:/o:linux:linux_kernel:3.1.4 + cpe:/o:linux:linux_kernel:3.1.3 + cpe:/o:linux:linux_kernel:3.9.10 + cpe:/o:linux:linux_kernel:3.0.29 + cpe:/o:linux:linux_kernel:3.3 + cpe:/o:linux:linux_kernel:3.8.4 + cpe:/o:linux:linux_kernel:3.2.26 + cpe:/o:linux:linux_kernel:3.8.5 + cpe:/o:linux:linux_kernel:3.2.27 + cpe:/o:linux:linux_kernel:3.8.2 + cpe:/o:linux:linux_kernel:3.2.24 + cpe:/o:linux:linux_kernel:3.8.3 + cpe:/o:linux:linux_kernel:3.2.25 + cpe:/o:linux:linux_kernel:3.8.8 + cpe:/o:linux:linux_kernel:3.8.6 + cpe:/o:linux:linux_kernel:3.2.28 + cpe:/o:linux:linux_kernel:3.8.7 + cpe:/o:linux:linux_kernel:3.2.29 + cpe:/o:linux:linux_kernel:3.3.3 + cpe:/o:linux:linux_kernel:3.3.4 + cpe:/o:linux:linux_kernel:3.3.5 + cpe:/o:linux:linux_kernel:3.2.22 + cpe:/o:linux:linux_kernel:3.8.1 + cpe:/o:linux:linux_kernel:3.2.20 + cpe:/o:linux:linux_kernel:3.3.1 + cpe:/o:linux:linux_kernel:3.2.21 + cpe:/o:linux:linux_kernel:3.3.2 + cpe:/o:linux:linux_kernel:3.11.1 + cpe:/o:linux:linux_kernel:3.11.2 + cpe:/o:linux:linux_kernel:3.2.23 + cpe:/o:linux:linux_kernel:3.0.17 + cpe:/o:linux:linux_kernel:3.9.11 + cpe:/o:linux:linux_kernel:3.0.16 + cpe:/o:linux:linux_kernel:3.0.15 + cpe:/o:linux:linux_kernel:3.2.30 + cpe:/o:linux:linux_kernel:3.0.14 + cpe:/o:linux:linux_kernel:3.0.13 + cpe:/o:linux:linux_kernel:3.0.12 + cpe:/o:linux:linux_kernel:3.0.11 + cpe:/o:linux:linux_kernel:3.4.61 + cpe:/o:linux:linux_kernel:3.0.10 + cpe:/o:linux:linux_kernel:3.4.64 + cpe:/o:linux:linux_kernel:3.8.0 + cpe:/o:linux:linux_kernel:3.4.65 + cpe:/o:linux:linux_kernel:3.4.62 + cpe:/o:linux:linux_kernel:3.4.63 + cpe:/o:linux:linux_kernel:3.4.68 + cpe:/o:linux:linux_kernel:3.4.66 + cpe:/o:linux:linux_kernel:3.4.67 + cpe:/o:linux:linux_kernel:3.5.3 + cpe:/o:linux:linux_kernel:3.5.1 + cpe:/o:linux:linux_kernel:3.5.2 + cpe:/o:linux:linux_kernel:3.10.4 + cpe:/o:linux:linux_kernel:3.14.1 + cpe:/o:linux:linux_kernel:3.4.72 + cpe:/o:linux:linux_kernel:3.10.9 + cpe:/o:linux:linux_kernel:3.4.73 + cpe:/o:linux:linux_kernel:3.4.74 + cpe:/o:linux:linux_kernel:3.4.75 + cpe:/o:linux:linux_kernel:3.4.76 + cpe:/o:linux:linux_kernel:3.10.5 + cpe:/o:linux:linux_kernel:3.4.77 + cpe:/o:linux:linux_kernel:3.10.6 + cpe:/o:linux:linux_kernel:3.4.78 + cpe:/o:linux:linux_kernel:3.10.7 + cpe:/o:linux:linux_kernel:3.4.79 + cpe:/o:linux:linux_kernel:3.10.8 + cpe:/o:linux:linux_kernel:3.7.10 + cpe:/o:linux:linux_kernel:3.2.17 + cpe:/o:linux:linux_kernel:3.2.18 + cpe:/o:linux:linux_kernel:3.2.19 + cpe:/o:linux:linux_kernel:3.2.13 + cpe:/o:linux:linux_kernel:3.2.14 + cpe:/o:linux:linux_kernel:3.11.3 + cpe:/o:linux:linux_kernel:3.2.15 + cpe:/o:linux:linux_kernel:3.4.60 + cpe:/o:linux:linux_kernel:3.2.16 + cpe:/o:linux:linux_kernel:3.11.5 + cpe:/o:linux:linux_kernel:3.11.4 + cpe:/o:linux:linux_kernel:3.2.10 + cpe:/o:linux:linux_kernel:3.11.7 + cpe:/o:linux:linux_kernel:3.2.11 + cpe:/o:linux:linux_kernel:3.11.6 + cpe:/o:linux:linux_kernel:3.11.9 + cpe:/o:linux:linux_kernel:3.11.8 + cpe:/o:linux:linux_kernel:3.4.69 + + CVE-2014-0155 + 2014-04-14T19:55:07.577-04:00 + 2014-04-15T11:06:54.553-04:00 + + + 5.5 + ADJACENT_NETWORK + LOW + SINGLE_INSTANCE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-15T11:06:52.443-04:00 + + + + + CONFIRM + http://git.kernel.org/cgit/virt/kvm/kvm.git/commit/?id=5678de3f15010b9022ee45673f33bcfc71d47b60 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1081589 + + + MLIST + [oss-security] 20140407 CVE-2014-0155 -- kernel: kvm: BUG caused by invalid entry in guest ioapic redirection table + + The ioapic_deliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly validate the kvm_irq_delivery_to_apic return value, which allows guest OS users to cause a denial of service (host OS crash) via a crafted entry in the redirection table of an I/O APIC. NOTE: the affected code was moved to the ioapic_service function before the vulnerability was announced. + + + + + + + + + + + + cpe:/a:openstack:horizon:2013.2 + cpe:/a:openstack:horizon:2013.2.1 + cpe:/a:openstack:horizon:2013.2.3 + cpe:/a:openstack:horizon:2013.2.2 + + CVE-2014-0157 + 2014-04-15T10:55:04.187-04:00 + 2014-04-16T08:46:58.483-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-16T08:46:58.437-04:00 + + + + + MLIST + [oss-security] 20140408 [OSSA 2014-010] XSS in Horizon orchestration dashboard (CVE-2014-0157) + + + CONFIRM + https://launchpad.net/bugs/1289033 + + Cross-site scripting (XSS) vulnerability in the Horizon Orchestration dashboard in OpenStack Dashboard (aka Horizon) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to inject arbitrary web script or HTML via the description field of a Heat template. + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:openafs:openafs:1.4.14.1 + cpe:/a:openafs:openafs:1.4.11 + cpe:/a:openafs:openafs:1.6.2 + cpe:/a:openafs:openafs:1.6.3 + cpe:/a:openafs:openafs:1.6.0 + cpe:/a:openafs:openafs:1.6.5.1 + cpe:/a:openafs:openafs:1.6.5.2 + cpe:/a:openafs:openafs:1.6.1 + cpe:/a:openafs:openafs:1.6.2.1 + cpe:/a:openafs:openafs:1.6.4 + cpe:/a:openafs:openafs:1.4.14 + cpe:/a:openafs:openafs:1.4.12 + cpe:/a:openafs:openafs:1.4.15 + cpe:/a:openafs:openafs:1.4.9 + cpe:/a:openafs:openafs:1.4.8 + cpe:/a:openafs:openafs:1.6.6 + cpe:/a:openafs:openafs:1.4.10 + cpe:/a:openafs:openafs:1.6.5 + + CVE-2014-0159 + 2014-04-14T11:09:05.990-04:00 + 2014-04-15T09:13:44.620-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-15T09:13:44.447-04:00 + + + + + CONFIRM + http://www.openafs.org/frameset/dl/openafs/1.6.7/ChangeLog + + + DEBIAN + DSA-2899 + + + SECUNIA + 57832 + + + SECUNIA + 57779 + + + CONFIRM + http://openafs.org/pages/security/OPENAFS-SA-2014-001.txt + + Buffer overflow in the GetStatistics64 remote procedure call (RPC) in OpenAFS 1.4.8 before 1.6.7 allows remote attackers to cause a denial of service (crash) via a crafted statsVersion argument. + + + + + + + + + + + + + + + + + + + cpe:/a:openssl:openssl:1.0.1:beta1 + cpe:/a:openssl:openssl:1.0.1:beta2 + cpe:/a:openssl:openssl:1.0.2:beta1 + cpe:/a:openssl:openssl:1.0.1:beta3 + cpe:/a:openssl:openssl:1.0.1d + cpe:/a:openssl:openssl:1.0.1 + cpe:/a:openssl:openssl:1.0.1c + cpe:/a:openssl:openssl:1.0.1f + cpe:/a:openssl:openssl:1.0.1b + cpe:/a:openssl:openssl:1.0.1a + cpe:/a:openssl:openssl:1.0.1e + + CVE-2014-0160 + 2014-04-07T18:55:03.893-04:00 + 2014-04-24T07:52:23.313-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-24T07:52:20.860-04:00 + + + + + CERT + TA14-098A + + + CERT-VN + VU#720951 + + + MISC + https://www.cert.fi/en/reports/2014/vulnerability788210.html + + + MLIST + [syslog-ng-announce] 20140411 syslog-ng Premium Edition 5 LTS (5.0.4a) has been released + + + MISC + https://gist.github.com/chapmajs/10473815 + + + CONFIRM + https://code.google.com/p/mod-spdy/issues/detail?id=85 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1084875 + + + MISC + https://blog.torproject.org/blog/openssl-bug-cve-2014-0160 + + + CONFIRM + http://www.splunk.com/view/SP-CAAAMB3 + + + SECTRACK + 1030082 + + + SECTRACK + 1030081 + + + SECTRACK + 1030080 + + + SECTRACK + 1030079 + + + SECTRACK + 1030078 + + + SECTRACK + 1030077 + + + SECTRACK + 1030074 + + + SECTRACK + 1030026 + + + BID + 66690 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/opensslheartbleedcve-2014-0160-2188454.html + + + CONFIRM + http://www.openssl.org/news/secadv_20140407.txt + + + CONFIRM + http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/ + + + CONFIRM + http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/ + + + CONFIRM + http://www.getchef.com/blog/2014/04/09/chef-server-heartbleed-cve-2014-0160-releases/ + + + CONFIRM + http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/ + + + CONFIRM + http://www.f-secure.com/en/web/labs_global/fsc-2014-1 + + + EXPLOIT-DB + 32764 + + + EXPLOIT-DB + 32745 + + + DEBIAN + DSA-2896 + + + CONFIRM + http://www.blackberry.com/btsc/KB35882 + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21670161 + + + CISCO + 20140409 OpenSSL Heartbeat Extension Vulnerability in Multiple Cisco Products + + + SECUNIA + 57968 + + + SECUNIA + 57966 + + + SECUNIA + 57836 + + + SECUNIA + 57721 + + + SECUNIA + 57483 + + + SECUNIA + 57347 + + + FULLDISC + 20140408 Re: heartbleed OpenSSL bug CVE-2014-0160 + + + FULLDISC + 20140408 heartbleed OpenSSL bug CVE-2014-0160 + + + FULLDISC + 20140412 Re: heartbleed OpenSSL bug CVE-2014-0160 + + + FULLDISC + 20140411 MRI Rubies may contain statically linked, vulnerable OpenSSL + + + FULLDISC + 20140409 Re: heartbleed OpenSSL bug CVE-2014-0160 + + + REDHAT + RHSA-2014:0396 + + + REDHAT + RHSA-2014:0378 + + + REDHAT + RHSA-2014:0377 + + + REDHAT + RHSA-2014:0376 + + + HP + HPSBMU02995 + + + SUSE + SUSE-SA:2014:002 + + + SUSE + openSUSE-SU-2014:0492 + + + FEDORA + FEDORA-2014-4910 + + + FEDORA + FEDORA-2014-4879 + + + MISC + http://heartbleed.com/ + + + CONFIRM + http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=96db9023b881d7cd9f379b0c154650d6c108e9a3 + + + MISC + http://blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/ + + The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug. + + + + + + + + + + + + + cpe:/a:openstack:image_registry_and_delivery_service_%28glance%29:2013.2.1 + cpe:/a:openstack:image_registry_and_delivery_service_%28glance%29:2013.2.2 + cpe:/a:openstack:icehouse:rc-1 + cpe:/a:openstack:image_registry_and_delivery_service_%28glance%29:2013.2 + cpe:/a:openstack:image_registry_and_delivery_service_%28glance%29:2013.2.3 + + CVE-2014-0162 + 2014-04-27T16:55:23.667-04:00 + 2014-04-28T14:09:33.227-04:00 + + + 6.0 + NETWORK + MEDIUM + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-28T14:09:33.180-04:00 + + + + + CONFIRM + https://launchpad.net/bugs/1298698 + + + MLIST + [oss-security] 20140410 [OSSA 2014-012] Remote code execution in Glance Sheepdog backend (CVE-2014-0162) + + The Sheepdog backend in OpenStack Image Registry and Delivery Service (Glance) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote authenticated users with permission to insert or modify an image to execute arbitrary commands via a crafted location. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:wordpress:wordpress:1.0.2 + cpe:/a:wordpress:wordpress:1.3.3 + cpe:/a:wordpress:wordpress:1.3.2 + cpe:/a:wordpress:wordpress:3.4.2 + cpe:/a:wordpress:wordpress:3.4.0 + cpe:/a:wordpress:wordpress:3.4.1 + cpe:/a:wordpress:wordpress:1.2.5:a + cpe:/a:wordpress:wordpress:2.1.3 + cpe:/a:wordpress:wordpress:2.1.2 + cpe:/a:wordpress:wordpress:2.1.1 + cpe:/a:wordpress:wordpress:1.5.2 + cpe:/a:wordpress:wordpress:1.5.1 + cpe:/a:wordpress:wordpress:2.8.5.1 + cpe:/a:wordpress:wordpress:2.6.3 + cpe:/a:wordpress:wordpress:3.2 + cpe:/a:wordpress:wordpress:1.5 + cpe:/a:wordpress:wordpress:1.0 + cpe:/a:wordpress:wordpress:3.0.3 + cpe:/a:wordpress:wordpress:3.0.2 + cpe:/a:wordpress:wordpress:3.0.1 + cpe:/a:wordpress:wordpress:2.6.1 + cpe:/a:wordpress:wordpress:1.2 + cpe:/a:wordpress:wordpress:2.6.2 + cpe:/a:wordpress:wordpress:1.3 + cpe:/a:wordpress:wordpress:3.0.6 + cpe:/a:wordpress:wordpress:3.0.5 + cpe:/a:wordpress:wordpress:3.0.4 + cpe:/a:wordpress:wordpress:2.9.1.1 + cpe:/a:wordpress:wordpress:2.2.2 + cpe:/a:wordpress:wordpress:2.2.1 + cpe:/a:wordpress:wordpress:3.8.1 + cpe:/a:wordpress:wordpress:2.8.5.2 + cpe:/a:wordpress:wordpress:2.2.3 + cpe:/a:wordpress:wordpress:3.7.1 + cpe:/a:wordpress:wordpress:3.6.1 + cpe:/a:wordpress:wordpress:2.0.1 + cpe:/a:wordpress:wordpress:3.2.1 + cpe:/a:wordpress:wordpress:1.5.1.2 + cpe:/a:wordpress:wordpress:2.9.2 + cpe:/a:wordpress:wordpress:2.9.1 + cpe:/a:wordpress:wordpress:1.1.1 + cpe:/a:wordpress:wordpress:2.8.1 + cpe:/a:wordpress:wordpress:1.5.1.1 + cpe:/a:wordpress:wordpress:3.5.1 + cpe:/a:wordpress:wordpress:3.5.0 + cpe:/a:wordpress:wordpress:2.0.7 + cpe:/a:wordpress:wordpress:2.0.8 + cpe:/a:wordpress:wordpress:2.0.5 + cpe:/a:wordpress:wordpress:2.0.6 + cpe:/a:wordpress:wordpress:2.0.4 + cpe:/a:wordpress:wordpress:2.0.2 + cpe:/a:wordpress:wordpress:0.71 + cpe:/a:wordpress:wordpress:1.6.2 + cpe:/a:wordpress:wordpress:2.0.9 + cpe:/a:wordpress:wordpress:1.0.1 + cpe:/a:wordpress:wordpress:2.2 + cpe:/a:wordpress:wordpress:2.1 + cpe:/a:wordpress:wordpress:2.0 + cpe:/a:wordpress:wordpress:2.9 + cpe:/a:wordpress:wordpress:2.8 + cpe:/a:wordpress:wordpress:2.7 + cpe:/a:wordpress:wordpress:2.6 + cpe:/a:wordpress:wordpress:2.5 + cpe:/a:wordpress:wordpress:3.0 + cpe:/a:wordpress:wordpress:3.1 + cpe:/a:wordpress:wordpress:3.3 + cpe:/a:wordpress:wordpress:3.8 + cpe:/a:wordpress:wordpress:3.6 + cpe:/a:wordpress:wordpress:3.7 + cpe:/a:wordpress:wordpress:2.8.5 + cpe:/a:wordpress:wordpress:2.3.3 + cpe:/a:wordpress:wordpress:2.8.6 + cpe:/a:wordpress:wordpress:2.3.2 + cpe:/a:wordpress:wordpress:2.8.3 + cpe:/a:wordpress:wordpress:2.3.1 + cpe:/a:wordpress:wordpress:2.8.4 + cpe:/a:wordpress:wordpress:2.8.2 + cpe:/a:wordpress:wordpress:3.3.3 + cpe:/a:wordpress:wordpress:2.6.5 + cpe:/a:wordpress:wordpress:3.3.1 + cpe:/a:wordpress:wordpress:3.3.2 + cpe:/a:wordpress:wordpress:3.1.4 + cpe:/a:wordpress:wordpress:3.1.3 + cpe:/a:wordpress:wordpress:3.1.2 + cpe:/a:wordpress:wordpress:3.1.1 + cpe:/a:wordpress:wordpress:2.7.1 + cpe:/a:wordpress:wordpress:2.3 + cpe:/a:wordpress:wordpress:2.5.1 + cpe:/a:wordpress:wordpress:2.8.4:a + cpe:/a:wordpress:wordpress:2.0.10 + cpe:/a:wordpress:wordpress:2.0.11 + cpe:/a:wordpress:wordpress:1.2.2 + cpe:/a:wordpress:wordpress:1.2.3 + cpe:/a:wordpress:wordpress:1.2.1 + cpe:/a:wordpress:wordpress:1.2.4 + cpe:/a:wordpress:wordpress:1.2.5 + cpe:/a:wordpress:wordpress:3.2:beta1 + cpe:/a:wordpress:wordpress:1.5.1.3 + + CVE-2014-0165 + 2014-04-09T20:55:06.267-04:00 + 2014-04-10T10:18:56.427-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-10T10:18:45.597-04:00 + + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1085866 + + + CONFIRM + http://core.trac.wordpress.org/changeset/27976 + + + CONFIRM + http://codex.wordpress.org/Version_3.8.2 + + + CONFIRM + http://codex.wordpress.org/Version_3.7.2 + + WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:wordpress:wordpress:1.0.2 + cpe:/a:wordpress:wordpress:1.3.3 + cpe:/a:wordpress:wordpress:1.3.2 + cpe:/a:wordpress:wordpress:3.4.2 + cpe:/a:wordpress:wordpress:3.4.0 + cpe:/a:wordpress:wordpress:3.4.1 + cpe:/a:wordpress:wordpress:1.2.5:a + cpe:/a:wordpress:wordpress:2.1.3 + cpe:/a:wordpress:wordpress:2.1.2 + cpe:/a:wordpress:wordpress:2.1.1 + cpe:/a:wordpress:wordpress:1.5.2 + cpe:/a:wordpress:wordpress:1.5.1 + cpe:/a:wordpress:wordpress:2.8.5.1 + cpe:/a:wordpress:wordpress:2.6.3 + cpe:/a:wordpress:wordpress:3.2 + cpe:/a:wordpress:wordpress:1.5 + cpe:/a:wordpress:wordpress:1.0 + cpe:/a:wordpress:wordpress:3.0.3 + cpe:/a:wordpress:wordpress:3.0.2 + cpe:/a:wordpress:wordpress:3.0.1 + cpe:/a:wordpress:wordpress:2.6.1 + cpe:/a:wordpress:wordpress:1.2 + cpe:/a:wordpress:wordpress:2.6.2 + cpe:/a:wordpress:wordpress:1.3 + cpe:/a:wordpress:wordpress:3.0.6 + cpe:/a:wordpress:wordpress:3.0.5 + cpe:/a:wordpress:wordpress:3.0.4 + cpe:/a:wordpress:wordpress:2.9.1.1 + cpe:/a:wordpress:wordpress:2.2.2 + cpe:/a:wordpress:wordpress:2.2.1 + cpe:/a:wordpress:wordpress:3.8.1 + cpe:/a:wordpress:wordpress:2.8.5.2 + cpe:/a:wordpress:wordpress:2.2.3 + cpe:/a:wordpress:wordpress:3.7.1 + cpe:/a:wordpress:wordpress:3.6.1 + cpe:/a:wordpress:wordpress:2.0.1 + cpe:/a:wordpress:wordpress:3.2.1 + cpe:/a:wordpress:wordpress:1.5.1.2 + cpe:/a:wordpress:wordpress:2.9.2 + cpe:/a:wordpress:wordpress:2.9.1 + cpe:/a:wordpress:wordpress:1.1.1 + cpe:/a:wordpress:wordpress:2.8.1 + cpe:/a:wordpress:wordpress:1.5.1.1 + cpe:/a:wordpress:wordpress:3.5.1 + cpe:/a:wordpress:wordpress:3.5.0 + cpe:/a:wordpress:wordpress:2.0.7 + cpe:/a:wordpress:wordpress:2.0.8 + cpe:/a:wordpress:wordpress:2.0.5 + cpe:/a:wordpress:wordpress:2.0.6 + cpe:/a:wordpress:wordpress:2.0.4 + cpe:/a:wordpress:wordpress:2.0.2 + cpe:/a:wordpress:wordpress:0.71 + cpe:/a:wordpress:wordpress:1.6.2 + cpe:/a:wordpress:wordpress:2.0.9 + cpe:/a:wordpress:wordpress:1.0.1 + cpe:/a:wordpress:wordpress:2.2 + cpe:/a:wordpress:wordpress:2.1 + cpe:/a:wordpress:wordpress:2.0 + cpe:/a:wordpress:wordpress:2.9 + cpe:/a:wordpress:wordpress:2.8 + cpe:/a:wordpress:wordpress:2.7 + cpe:/a:wordpress:wordpress:2.6 + cpe:/a:wordpress:wordpress:2.5 + cpe:/a:wordpress:wordpress:3.0 + cpe:/a:wordpress:wordpress:3.1 + cpe:/a:wordpress:wordpress:3.3 + cpe:/a:wordpress:wordpress:3.8 + cpe:/a:wordpress:wordpress:3.6 + cpe:/a:wordpress:wordpress:3.7 + cpe:/a:wordpress:wordpress:2.8.5 + cpe:/a:wordpress:wordpress:2.3.3 + cpe:/a:wordpress:wordpress:2.8.6 + cpe:/a:wordpress:wordpress:2.3.2 + cpe:/a:wordpress:wordpress:2.8.3 + cpe:/a:wordpress:wordpress:2.3.1 + cpe:/a:wordpress:wordpress:2.8.4 + cpe:/a:wordpress:wordpress:2.8.2 + cpe:/a:wordpress:wordpress:3.3.3 + cpe:/a:wordpress:wordpress:2.6.5 + cpe:/a:wordpress:wordpress:3.3.1 + cpe:/a:wordpress:wordpress:3.3.2 + cpe:/a:wordpress:wordpress:3.1.4 + cpe:/a:wordpress:wordpress:3.1.3 + cpe:/a:wordpress:wordpress:3.1.2 + cpe:/a:wordpress:wordpress:3.1.1 + cpe:/a:wordpress:wordpress:2.7.1 + cpe:/a:wordpress:wordpress:2.3 + cpe:/a:wordpress:wordpress:2.5.1 + cpe:/a:wordpress:wordpress:2.8.4:a + cpe:/a:wordpress:wordpress:2.0.10 + cpe:/a:wordpress:wordpress:2.0.11 + cpe:/a:wordpress:wordpress:1.2.2 + cpe:/a:wordpress:wordpress:1.2.3 + cpe:/a:wordpress:wordpress:1.2.1 + cpe:/a:wordpress:wordpress:1.2.4 + cpe:/a:wordpress:wordpress:1.2.5 + cpe:/a:wordpress:wordpress:3.2:beta1 + cpe:/a:wordpress:wordpress:1.5.1.3 + + CVE-2014-0166 + 2014-04-09T20:55:09.530-04:00 + 2014-04-10T10:20:58.303-04:00 + + + 6.4 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-10T10:20:57.740-04:00 + + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1085858 + + + CONFIRM + http://core.trac.wordpress.org/changeset/28054 + + + CONFIRM + http://codex.wordpress.org/Version_3.8.2 + + + CONFIRM + http://codex.wordpress.org/Version_3.7.2 + + The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determine the validity of authentication cookies, which makes it easier for remote attackers to obtain access via a forged cookie. + + + + + + + + + + + + + + + + + cpe:/a:openstack:compute:2013.1.3 + cpe:/a:openstack:compute:2013.2 + cpe:/a:openstack:compute:2013.2.1 + cpe:/a:openstack:compute:2013.2.3 + cpe:/a:openstack:compute:2013.2.2 + cpe:/a:openstack:compute:2013.1.2 + cpe:/a:openstack:compute:2013.1.1 + cpe:/a:openstack:compute:2013.1 + cpe:/a:openstack:icehouse:- + + CVE-2014-0167 + 2014-04-15T10:55:04.200-04:00 + 2014-04-16T09:15:02.540-04:00 + + + 6.0 + NETWORK + MEDIUM + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-16T09:15:02.447-04:00 + + + + + MLIST + [oss-security] 20140409 [OSSA 2014-011] RBAC policy not properly enforced in Nova EC2 API (CVE-2014-0167) + + + CONFIRM + https://launchpad.net/bugs/1290537 + + The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not enforce RBAC policies for (1) add_rules, (2) remove_rules, (3) destroy, and other unspecified methods in compute/api.py when using non-default policies, which allows remote authenticated users to gain privileges via these API requests. + + + + + + + + + + + + + + cpe:/a:elfutils_project:elfutils:0.154 + cpe:/a:elfutils_project:elfutils:0.153 + cpe:/a:elfutils_project:elfutils:0.156 + cpe:/a:elfutils_project:elfutils:0.155 + cpe:/a:elfutils_project:elfutils:0.157 + cpe:/a:elfutils_project:elfutils:0.158 + + CVE-2014-0172 + 2014-04-11T11:55:18.757-04:00 + 2014-04-14T11:12:23.983-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-14T11:12:23.903-04:00 + + + + + MLIST + [elfutils-devel] 20140409 [PATCH] CVE-2014-0172 Check for overflow before calling malloc to uncompress data. + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1085663 + + + BID + 66714 + + + MLIST + [oss-security] 20140409 Heap-based buffer overflow in libdw/elfutils (CVE-2014-0172) + + Integer overflow in the check_section function in dwarf_begin_elf.c in the libdw library, as used in elfutils 0.153 and possibly through 0.158 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed compressed debug section in an ELF file, which triggers a heap-based buffer overflow. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:automattic:jetpack:2.3.3::~~~wordpress~~ + cpe:/a:automattic:jetpack:2.3.4::~~~wordpress~~ + cpe:/a:automattic:jetpack:2.3.5::~~~wordpress~~ + cpe:/a:automattic:jetpack:1.9::~~~wordpress~~ + cpe:/a:automattic:jetpack:2.0.3::~~~wordpress~~ + cpe:/a:automattic:jetpack:2.2.2::~~~wordpress~~ + cpe:/a:automattic:jetpack:2.0.2::~~~wordpress~~ + cpe:/a:automattic:jetpack:2.2.3::~~~wordpress~~ + cpe:/a:automattic:jetpack:2.0.4::~~~wordpress~~ + cpe:/a:automattic:jetpack:2.2.1::~~~wordpress~~ + cpe:/a:automattic:jetpack:2.6.1::~~~wordpress~~ + cpe:/a:automattic:jetpack:2.5::~~~wordpress~~ + cpe:/a:automattic:jetpack:2.4::~~~wordpress~~ + cpe:/a:automattic:jetpack:2.7::~~~wordpress~~ + cpe:/a:automattic:jetpack:2.6::~~~wordpress~~ + cpe:/a:automattic:jetpack:2.9.3::~~~wordpress~~ + cpe:/a:automattic:jetpack:2.9.1::~~~wordpress~~ + cpe:/a:automattic:jetpack:2.9.2::~~~wordpress~~ + cpe:/a:automattic:jetpack:2.4.1::~~~wordpress~~ + cpe:/a:automattic:jetpack:2.4.2::~~~wordpress~~ + cpe:/a:automattic:jetpack:2.9::~~~wordpress~~ + cpe:/a:automattic:jetpack:2.8::~~~wordpress~~ + cpe:/a:automattic:jetpack:1.9.2::~~~wordpress~~ + cpe:/a:automattic:jetpack:2.3::~~~wordpress~~ + cpe:/a:automattic:jetpack:2.2::~~~wordpress~~ + cpe:/a:automattic:jetpack:2.1::~~~wordpress~~ + cpe:/a:automattic:jetpack:2.1.1::~~~wordpress~~ + cpe:/a:automattic:jetpack:2.0::~~~wordpress~~ + cpe:/a:automattic:jetpack:2.1.2::~~~wordpress~~ + cpe:/a:automattic:jetpack:2.3.1::~~~wordpress~~ + cpe:/a:automattic:jetpack:2.3.2::~~~wordpress~~ + cpe:/a:automattic:jetpack:2.0.1::~~~wordpress~~ + cpe:/a:automattic:jetpack:2.2.5::~~~wordpress~~ + cpe:/a:automattic:jetpack:2.2.4::~~~wordpress~~ + cpe:/a:automattic:jetpack:1.9.1::~~~wordpress~~ + + CVE-2014-0173 + 2014-04-22T09:06:27.023-04:00 + 2014-04-22T12:05:00.417-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-22T12:04:55.887-04:00 + + + + + XF + jetpack-wordpress-cve20140173-sec-bypass(92560) + + + BID + 66789 + + + SECUNIA + 57729 + + + CONFIRM + http://jetpack.me/2014/04/10/jetpack-security-update/ + + The Jetpack plugin before 1.9 before 1.9.4, 2.0.x before 2.0.9, 2.1.x before 2.1.4, 2.2.x before 2.2.7, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.2, 2.6.x before 2.6.3, 2.7.x before 2.7.2, 2.8.x before 2.8.2, and 2.9.x before 2.9.3 for WordPress does not properly restrict access to the XML-RPC service, which allows remote attackers to bypass intended restrictions and publish posts via unspecified vectors. NOTE: some of these details are obtained from third party information. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:linux:linux_kernel:3.0.48 + cpe:/o:linux:linux_kernel:3.0.49 + cpe:/o:linux:linux_kernel:3.0.46 + cpe:/o:linux:linux_kernel:3.0.47 + cpe:/o:linux:linux_kernel:3.0.44 + cpe:/o:linux:linux_kernel:3.0.45 + cpe:/o:linux:linux_kernel:3.0.42 + cpe:/o:linux:linux_kernel:3.4.70 + cpe:/o:linux:linux_kernel:3.4.71 + cpe:/o:linux:linux_kernel:3.0.40 + cpe:/o:linux:linux_kernel:3.0.41 + cpe:/o:linux:linux_kernel:3.4.45 + cpe:/o:linux:linux_kernel:3.4.44 + cpe:/o:linux:linux_kernel:3.4.46 + cpe:/o:linux:linux_kernel:3.4.41 + cpe:/o:linux:linux_kernel:3.4.40 + cpe:/o:linux:linux_kernel:3.4.43 + cpe:/o:linux:linux_kernel:3.4.42 + cpe:/o:linux:linux_kernel:3.4.49 + cpe:/o:linux:linux_kernel:3.4.48 + cpe:/o:linux:linux_kernel:3.0.59 + cpe:/o:linux:linux_kernel:3.4.47 + cpe:/o:linux:linux_kernel:3.0.55 + cpe:/o:linux:linux_kernel:3.0.56 + cpe:/o:linux:linux_kernel:3.0.57 + cpe:/o:linux:linux_kernel:3.0.58 + cpe:/o:linux:linux_kernel:3.0.51 + cpe:/o:linux:linux_kernel:3.0.52 + cpe:/o:linux:linux_kernel:3.0.53 + cpe:/o:linux:linux_kernel:3.11.10 + cpe:/o:linux:linux_kernel:3.0.50 + cpe:/o:linux:linux_kernel:3.4.57 + cpe:/o:linux:linux_kernel:3.4.56 + cpe:/o:linux:linux_kernel:3.4.55 + cpe:/o:linux:linux_kernel:3.4.54 + cpe:/o:linux:linux_kernel:3.4.53 + cpe:/o:linux:linux_kernel:3.4.52 + cpe:/o:linux:linux_kernel:3.4.51 + cpe:/o:linux:linux_kernel:3.4.50 + cpe:/o:linux:linux_kernel:3.0.43 + cpe:/o:linux:linux_kernel:3.10.26 + cpe:/o:linux:linux_kernel:3.4.59 + cpe:/o:linux:linux_kernel:3.0.24 + cpe:/o:linux:linux_kernel:3.0.25 + cpe:/o:linux:linux_kernel:3.0.22 + cpe:/o:linux:linux_kernel:3.1.9 + cpe:/o:linux:linux_kernel:3.0.23 + cpe:/o:linux:linux_kernel:3.10.28 + cpe:/o:linux:linux_kernel:3.0.28 + cpe:/o:linux:linux_kernel:3.10.27 + cpe:/o:linux:linux_kernel:3.0.26 + cpe:/o:linux:linux_kernel:3.10.29 + cpe:/o:linux:linux_kernel:3.4.58 + cpe:/o:linux:linux_kernel:3.0.27 + cpe:/o:linux:linux_kernel:3.10.24 + cpe:/o:linux:linux_kernel:3.10.23 + cpe:/o:linux:linux_kernel:3.10.25 + cpe:/o:linux:linux_kernel:3.10.20 + cpe:/o:linux:linux_kernel:3.1.8 + cpe:/o:linux:linux_kernel:3.0.20 + cpe:/o:linux:linux_kernel:3.10.22 + cpe:/o:linux:linux_kernel:3.10.21 + cpe:/o:linux:linux_kernel:3.4.21 + cpe:/o:linux:linux_kernel:3.4.20 + cpe:/o:linux:linux_kernel:3.4.23 + cpe:/o:linux:linux_kernel:3.4.22 + cpe:/o:linux:linux_kernel:3.4.24 + cpe:/o:linux:linux_kernel:3.4.27 + cpe:/o:linux:linux_kernel:3.4.26 + cpe:/o:linux:linux_kernel:3.4.29 + cpe:/o:linux:linux_kernel:3.10.15 + cpe:/o:linux:linux_kernel:3.4.28 + cpe:/o:linux:linux_kernel:3.0.54 + cpe:/o:linux:linux_kernel:3.0.33 + cpe:/o:linux:linux_kernel:3.0.34 + cpe:/o:linux:linux_kernel:3.0.35 + cpe:/o:linux:linux_kernel:3.0.36 + cpe:/o:linux:linux_kernel:3.10.19 + cpe:/o:linux:linux_kernel:3.0.37 + cpe:/o:linux:linux_kernel:3.10.18 + cpe:/o:linux:linux_kernel:3.0.38 + cpe:/o:linux:linux_kernel:3.4.25 + cpe:/o:linux:linux_kernel:3.10.17 + cpe:/o:linux:linux_kernel:3.0.39 + cpe:/o:linux:linux_kernel:3.10.16 + cpe:/o:linux:linux_kernel:3.10.14 + cpe:/o:linux:linux_kernel:3.10.13 + cpe:/o:linux:linux_kernel:3.10.12 + cpe:/o:linux:linux_kernel:3.10.11 + cpe:/o:linux:linux_kernel:3.10.10 + cpe:/o:linux:linux_kernel:3.0.30 + cpe:/o:linux:linux_kernel:3.0.31 + cpe:/o:linux:linux_kernel:3.9.8 + cpe:/o:linux:linux_kernel:3.5.5 + cpe:/o:linux:linux_kernel:3.4.32 + cpe:/o:linux:linux_kernel:3.9.9 + cpe:/o:linux:linux_kernel:3.5.6 + cpe:/o:linux:linux_kernel:3.4.31 + cpe:/o:linux:linux_kernel:3.5.7 + cpe:/o:linux:linux_kernel:3.4.30 + cpe:/o:linux:linux_kernel:3.7.1 + cpe:/o:linux:linux_kernel:3.4.35 + cpe:/o:linux:linux_kernel:3.9.0 + cpe:/o:linux:linux_kernel:3.0.18 + cpe:/o:linux:linux_kernel:3.4.34 + cpe:/o:linux:linux_kernel:3.4.33 + cpe:/o:linux:linux_kernel:3.9.2 + cpe:/o:linux:linux_kernel:3.9.1 + cpe:/o:linux:linux_kernel:3.0.19 + cpe:/o:linux:linux_kernel:3.4.39 + cpe:/o:linux:linux_kernel:3.9.4 + cpe:/o:linux:linux_kernel:3.4.38 + cpe:/o:linux:linux_kernel:3.9.3 + cpe:/o:linux:linux_kernel:3.4.37 + cpe:/o:linux:linux_kernel:3.9.6 + cpe:/o:linux:linux_kernel:3.9.5 + cpe:/o:linux:linux_kernel:3.0.21 + cpe:/o:linux:linux_kernel:3.9.7 + cpe:/o:linux:linux_kernel:3.5.4 + cpe:/o:linux:linux_kernel:3.0.4 + cpe:/o:linux:linux_kernel:3.0.5 + cpe:/o:linux:linux_kernel:3.0.2 + cpe:/o:linux:linux_kernel:3.0.3 + cpe:/o:linux:linux_kernel:3.0.8 + cpe:/o:linux:linux_kernel:3.0.6 + cpe:/o:linux:linux_kernel:3.0.7 + cpe:/o:linux:linux_kernel:3.13.9 + cpe:/o:linux:linux_kernel:3.4.36 + cpe:/o:linux:linux_kernel:3.12.17 + cpe:/o:linux:linux_kernel:3.13.1 + cpe:/o:linux:linux_kernel:3.6.10 + cpe:/o:linux:linux_kernel:3.6.11 + cpe:/o:linux:linux_kernel:3.13.8 + cpe:/o:linux:linux_kernel:3.13.6 + cpe:/o:linux:linux_kernel:3.13.7 + cpe:/o:linux:linux_kernel:3.13.4 + cpe:/o:linux:linux_kernel:3.13.5 + cpe:/o:linux:linux_kernel:3.13.2 + cpe:/o:linux:linux_kernel:3.13.3 + cpe:/o:linux:linux_kernel:3.4.1 + cpe:/o:linux:linux_kernel:3.4.19 + cpe:/o:linux:linux_kernel:3.4.17 + cpe:/o:linux:linux_kernel:3.4.3 + cpe:/o:linux:linux_kernel:3.4.18 + cpe:/o:linux:linux_kernel:3.4.2 + cpe:/o:linux:linux_kernel:3.2.9 + cpe:/o:linux:linux_kernel:3.4.15 + cpe:/o:linux:linux_kernel:3.2.8 + cpe:/o:linux:linux_kernel:3.4.16 + cpe:/o:linux:linux_kernel:3.4.4 + cpe:/o:linux:linux_kernel:3.12.12 + cpe:/o:linux:linux_kernel:3.2.7 + cpe:/o:linux:linux_kernel:3.4.13 + cpe:/o:linux:linux_kernel:3.12.13 + cpe:/o:linux:linux_kernel:3.12.10 + cpe:/o:linux:linux_kernel:3.4.11 + cpe:/o:linux:linux_kernel:3.12.11 + cpe:/o:linux:linux_kernel:3.4.12 + cpe:/o:linux:linux_kernel:3.12.16 + cpe:/o:linux:linux_kernel:3.4.10 + cpe:/o:linux:linux_kernel:3.12.14 + cpe:/o:linux:linux_kernel:3.12.15 + cpe:/o:linux:linux_kernel:3.0.61 + cpe:/o:linux:linux_kernel:3.3:rc2 + cpe:/o:linux:linux_kernel:3.4:rc7 + cpe:/o:linux:linux_kernel:3.0.60 + cpe:/o:linux:linux_kernel:3.3:rc7 + cpe:/o:linux:linux_kernel:3.4:rc5 + cpe:/o:linux:linux_kernel:3.3:rc5 + cpe:/o:linux:linux_kernel:3.4:rc6 + cpe:/o:linux:linux_kernel:3.3:rc6 + cpe:/o:linux:linux_kernel:3.0.64 + cpe:/o:linux:linux_kernel:3.0.63 + cpe:/o:linux:linux_kernel:3.0.62 + cpe:/o:linux:linux_kernel:3.12.1 + cpe:/o:linux:linux_kernel:3.0.68 + cpe:/o:linux:linux_kernel:3.0.67 + cpe:/o:linux:linux_kernel:3.0.66 + cpe:/o:linux:linux_kernel:3.4.14 + cpe:/o:linux:linux_kernel:3.12.7 + cpe:/o:linux:linux_kernel:3.2:rc2 + cpe:/o:linux:linux_kernel:3.1:rc1 + cpe:/o:linux:linux_kernel:3.0.9 + cpe:/o:linux:linux_kernel:3.0:rc4 + cpe:/o:linux:linux_kernel:3.12.8 + cpe:/o:linux:linux_kernel:3.1:rc4 + cpe:/o:linux:linux_kernel:3.0:rc3 + cpe:/o:linux:linux_kernel:3.12.9 + cpe:/o:linux:linux_kernel:3.0:rc2 + cpe:/o:linux:linux_kernel:3.1:rc2 + cpe:/o:linux:linux_kernel:3.0:rc1 + cpe:/o:linux:linux_kernel:3.2:rc7 + cpe:/o:linux:linux_kernel:3.12.3 + cpe:/o:linux:linux_kernel:3.1.10 + cpe:/o:linux:linux_kernel:3.2:rc6 + cpe:/o:linux:linux_kernel:3.12.4 + cpe:/o:linux:linux_kernel:3.2:rc5 + cpe:/o:linux:linux_kernel:3.0:rc7 + cpe:/o:linux:linux_kernel:3.12.5 + cpe:/o:linux:linux_kernel:3.9:rc3 + cpe:/o:linux:linux_kernel:3.0:rc6 + cpe:/o:linux:linux_kernel:3.12.6 + cpe:/o:linux:linux_kernel:3.0:rc5 + cpe:/o:linux:linux_kernel:3.9:rc1 + cpe:/o:linux:linux_kernel:3.9:rc4 + cpe:/o:linux:linux_kernel:3.9:rc7 + cpe:/o:linux:linux_kernel:3.12.2 + cpe:/o:linux:linux_kernel:3.9:rc2 + cpe:/o:linux:linux_kernel:3.9:rc5 + cpe:/o:linux:linux_kernel:3.3:rc3 + cpe:/o:linux:linux_kernel:3.4:rc4 + cpe:/o:linux:linux_kernel:3.4:rc3 + cpe:/o:linux:linux_kernel:3.3:rc1 + cpe:/o:linux:linux_kernel:3.4:rc2 + cpe:/o:linux:linux_kernel:3.9:rc6 + cpe:/o:linux:linux_kernel:3.3:rc4 + cpe:/o:linux:linux_kernel:3.4:rc1 + cpe:/o:linux:linux_kernel:3.4.5 + cpe:/o:linux:linux_kernel:3.2.2 + cpe:/o:linux:linux_kernel:3.2.3 + cpe:/o:linux:linux_kernel:3.2.1 + cpe:/o:linux:linux_kernel:3.4.6 + cpe:/o:linux:linux_kernel:3.2:rc3 + cpe:/o:linux:linux_kernel:3.2.6 + cpe:/o:linux:linux_kernel:3.4.7 + cpe:/o:linux:linux_kernel:3.2:rc4 + cpe:/o:linux:linux_kernel:3.1:rc3 + cpe:/o:linux:linux_kernel:3.4.8 + cpe:/o:linux:linux_kernel:3.2.4 + cpe:/o:linux:linux_kernel:3.4.9 + cpe:/o:linux:linux_kernel:3.2.5 + cpe:/o:linux:linux_kernel:3.0.65 + cpe:/o:linux:linux_kernel:3.2.12 + cpe:/o:linux:linux_kernel:3.8.10 + cpe:/o:linux:linux_kernel:3.8.12 + cpe:/o:linux:linux_kernel:3.8.11 + cpe:/o:linux:linux_kernel:3.8.13 + cpe:/o:linux:linux_kernel:3.7.9 + cpe:/o:linux:linux_kernel:3.7.8 + cpe:/o:linux:linux_kernel:3.7.7 + cpe:/o:linux:linux_kernel:3.7.6 + cpe:/o:linux:linux_kernel:3.6.3 + cpe:/o:linux:linux_kernel:3.7.5 + cpe:/o:linux:linux_kernel:3.7.4 + cpe:/o:linux:linux_kernel:3.7.3 + cpe:/o:linux:linux_kernel:3.7.2 + cpe:/o:linux:linux_kernel:3.6.7 + cpe:/o:linux:linux_kernel:3.6.6 + cpe:/o:linux:linux_kernel:3.6.5 + cpe:/o:linux:linux_kernel:3.6.4 + cpe:/o:linux:linux_kernel:3.6.9 + cpe:/o:linux:linux_kernel:3.6.8 + cpe:/o:linux:linux_kernel:3.10 + cpe:/o:linux:linux_kernel:3.11 + cpe:/o:linux:linux_kernel:3.12 + cpe:/o:linux:linux_kernel:3.13 + cpe:/o:linux:linux_kernel:3.10.1 + cpe:/o:linux:linux_kernel:3.10.2 + cpe:/o:linux:linux_kernel:3.10.3 + cpe:/o:linux:linux_kernel:3.6.2 + cpe:/o:linux:linux_kernel:3.6.1 + cpe:/o:linux:linux_kernel:3.3.6 + cpe:/o:linux:linux_kernel:3.3.7 + cpe:/o:linux:linux_kernel:3.3.8 + cpe:/o:linux:linux_kernel:3.0.1 + cpe:/o:linux:linux_kernel:3.2 + cpe:/o:linux:linux_kernel:3.1 + cpe:/o:linux:linux_kernel:3.7 + cpe:/o:linux:linux_kernel:3.6 + cpe:/o:linux:linux_kernel:3.4 + cpe:/o:linux:linux_kernel:3.1.6 + cpe:/o:linux:linux_kernel:3.1.5 + cpe:/o:linux:linux_kernel:3.1.7 + cpe:/o:linux:linux_kernel:3.0.32 + cpe:/o:linux:linux_kernel:3.8.9 + cpe:/o:linux:linux_kernel:3.1.2 + cpe:/o:linux:linux_kernel:3.1.1 + cpe:/o:linux:linux_kernel:3.1.4 + cpe:/o:linux:linux_kernel:3.1.3 + cpe:/o:linux:linux_kernel:3.9.10 + cpe:/o:linux:linux_kernel:3.0.29 + cpe:/o:linux:linux_kernel:3.3 + cpe:/o:linux:linux_kernel:3.8.4 + cpe:/o:linux:linux_kernel:3.2.26 + cpe:/o:linux:linux_kernel:3.8.5 + cpe:/o:linux:linux_kernel:3.2.27 + cpe:/o:linux:linux_kernel:3.8.2 + cpe:/o:linux:linux_kernel:3.2.24 + cpe:/o:linux:linux_kernel:3.8.3 + cpe:/o:linux:linux_kernel:3.2.25 + cpe:/o:linux:linux_kernel:3.8.8 + cpe:/o:linux:linux_kernel:3.8.6 + cpe:/o:linux:linux_kernel:3.2.28 + cpe:/o:linux:linux_kernel:3.8.7 + cpe:/o:linux:linux_kernel:3.2.29 + cpe:/o:linux:linux_kernel:3.3.3 + cpe:/o:linux:linux_kernel:3.3.4 + cpe:/o:linux:linux_kernel:3.3.5 + cpe:/o:linux:linux_kernel:3.2.22 + cpe:/o:linux:linux_kernel:3.8.1 + cpe:/o:linux:linux_kernel:3.2.20 + cpe:/o:linux:linux_kernel:3.3.1 + cpe:/o:linux:linux_kernel:3.2.21 + cpe:/o:linux:linux_kernel:3.3.2 + cpe:/o:linux:linux_kernel:3.11.1 + cpe:/o:linux:linux_kernel:3.11.2 + cpe:/o:linux:linux_kernel:3.2.23 + cpe:/o:linux:linux_kernel:3.0.17 + cpe:/o:linux:linux_kernel:3.9.11 + cpe:/o:linux:linux_kernel:3.0.16 + cpe:/o:linux:linux_kernel:3.0.15 + cpe:/o:linux:linux_kernel:3.2.30 + cpe:/o:linux:linux_kernel:3.0.14 + cpe:/o:linux:linux_kernel:3.0.13 + cpe:/o:linux:linux_kernel:3.0.12 + cpe:/o:linux:linux_kernel:3.0.11 + cpe:/o:linux:linux_kernel:3.4.61 + cpe:/o:linux:linux_kernel:3.0.10 + cpe:/o:linux:linux_kernel:3.4.64 + cpe:/o:linux:linux_kernel:3.8.0 + cpe:/o:linux:linux_kernel:3.4.65 + cpe:/o:linux:linux_kernel:3.4.62 + cpe:/o:linux:linux_kernel:3.4.63 + cpe:/o:linux:linux_kernel:3.4.68 + cpe:/o:linux:linux_kernel:3.4.66 + cpe:/o:linux:linux_kernel:3.4.67 + cpe:/o:linux:linux_kernel:3.5.3 + cpe:/o:linux:linux_kernel:3.5.1 + cpe:/o:linux:linux_kernel:3.5.2 + cpe:/o:linux:linux_kernel:3.10.4 + cpe:/o:linux:linux_kernel:3.14.1 + cpe:/o:linux:linux_kernel:3.4.72 + cpe:/o:linux:linux_kernel:3.10.9 + cpe:/o:linux:linux_kernel:3.4.73 + cpe:/o:linux:linux_kernel:3.4.74 + cpe:/o:linux:linux_kernel:3.4.75 + cpe:/o:linux:linux_kernel:3.4.76 + cpe:/o:linux:linux_kernel:3.10.5 + cpe:/o:linux:linux_kernel:3.4.77 + cpe:/o:linux:linux_kernel:3.10.6 + cpe:/o:linux:linux_kernel:3.4.78 + cpe:/o:linux:linux_kernel:3.10.7 + cpe:/o:linux:linux_kernel:3.4.79 + cpe:/o:linux:linux_kernel:3.10.8 + cpe:/o:linux:linux_kernel:3.7.10 + cpe:/o:linux:linux_kernel:3.2.17 + cpe:/o:linux:linux_kernel:3.2.18 + cpe:/o:linux:linux_kernel:3.2.19 + cpe:/o:linux:linux_kernel:3.2.13 + cpe:/o:linux:linux_kernel:3.2.14 + cpe:/o:linux:linux_kernel:3.11.3 + cpe:/o:linux:linux_kernel:3.2.15 + cpe:/o:linux:linux_kernel:3.4.60 + cpe:/o:linux:linux_kernel:3.2.16 + cpe:/o:linux:linux_kernel:3.11.5 + cpe:/o:linux:linux_kernel:3.11.4 + cpe:/o:linux:linux_kernel:3.2.10 + cpe:/o:linux:linux_kernel:3.11.7 + cpe:/o:linux:linux_kernel:3.2.11 + cpe:/o:linux:linux_kernel:3.11.6 + cpe:/o:linux:linux_kernel:3.11.9 + cpe:/o:linux:linux_kernel:3.11.8 + cpe:/o:linux:linux_kernel:3.4.69 + + CVE-2014-0181 + 2014-04-26T20:55:05.750-04:00 + 2014-04-28T11:50:11.293-04:00 + + + 2.1 + LOCAL + LOW + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-28T11:50:05.183-04:00 + + + + + CONFIRM + https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=90f62cf30a78721641e08737bda787552428061e + + + MLIST + [oss-security] 20140423 Re: CVE-2014-0181: Linux network reconfiguration due to incorrect netlink checks + + + MLIST + [netdev] 20140423 [PATCH 0/5]: Preventing abuse when passing file descriptors + + The Netlink implementation in the Linux kernel through 3.14.1 does not provide a mechanism for authorizing socket operations based on the opener of a socket, which allows local users to bypass intended access restrictions and modify network configurations by using a Netlink socket for the (1) stdout or (2) stderr of a setuid program. + + + + + + + + + + + + + + + + + + + cpe:/a:openstack:neutron:2013.2.3 + cpe:/a:openstack:neutron:2013.1.1 + cpe:/a:openstack:neutron:2013.2.2 + cpe:/a:openstack:neutron:2013.1.2 + cpe:/a:openstack:neutron:2013.2 + cpe:/a:openstack:neutron:2013.1 + cpe:/a:openstack:neutron:2013.1.4 + cpe:/a:openstack:neutron:2013.2.1 + cpe:/a:openstack:neutron:2013.1.3 + cpe:/a:openstack:neutron:2013.1.5 + cpe:/a:openstack:neutron:2014.1 + + CVE-2014-0187 + 2014-04-28T10:09:06.237-04:00 + 2014-04-29T10:26:22.943-04:00 + + + 9.0 + NETWORK + LOW + SINGLE_INSTANCE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-29T10:26:22.817-04:00 + + + + + CONFIRM + https://bugs.launchpad.net/neutron/+bug/1300785 + + + MLIST + [oss-security] 20140422 [OSSA 2014-014] Neutron security groups bypass through invalid CIDR (CVE-2014-0187) + + The openvswitch-agent process in OpenStack Neutron 2013.1 before 2013.2.4 and 2014.1 before 2014.1.1 allows remote authenticated users to bypass security group restrictions via an invalid CIDR in a security group rule, which prevents further rules from being applied. + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:redhat:openshift:1.0:-:enterprise + cpe:/a:redhat:openshift:1.1:-:enterprise + cpe:/a:redhat:openshift:1.2::enterprise + cpe:/a:redhat:openshift:2.0.2::enterprise + cpe:/a:redhat:openshift:1.2.5::enterprise + cpe:/a:redhat:openshift:1.2.4::enterprise + cpe:/a:redhat:openshift:1.2.3::enterprise + cpe:/a:redhat:openshift:1.2.7::enterprise + cpe:/a:redhat:openshift:1.2.6::enterprise + cpe:/a:redhat:openshift:1.2.1::enterprise + cpe:/a:redhat:openshift:2.0.1::enterprise + cpe:/a:redhat:openshift:2.0.4::enterprise + cpe:/a:redhat:openshift:2.0.3::enterprise + cpe:/a:redhat:openshift:2.0.5::enterprise + cpe:/a:redhat:openshift:2.0::enterprise + cpe:/a:redhat:openshift:1.2.2:-:enterprise + + CVE-2014-0188 + 2014-04-24T10:55:04.263-04:00 + 2014-04-24T15:06:46.787-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-24T15:06:46.570-04:00 + + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1090120 + + + REDHAT + RHSA-2014:0423 + + + REDHAT + RHSA-2014:0422 + + The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to a passthrough trigger. + + + CVE-2014-0189 + 2014-05-02T10:55:05.823-04:00 + 2014-05-02T10:55:05.823-04:00 + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1088732 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1081286 + + + BID + 67089 + + + MLIST + [oss-security] 20140428 CVE-2014-0189: /etc/sysconfig/virt-who is world-readable (contains unencrypted passwords) + + virt-who uses world-readable permissions for /etc/sysconfig/virt-who, which allows local users to obtain password for hypervisors by reading the file. + + + + + + + + + cpe:/a:microsoft:internet_explorer:9 + + CVE-2014-0235 + 2014-04-08T19:55:05.400-04:00 + 2014-04-09T11:45:45.060-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-09T11:45:02.277-04:00 + + + + + MS + MS14-018 + + Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1751 and CVE-2014-1755. + + + + + + + + + + + + + + + cpe:/a:microsoft:.net_framework:3.5.1 + cpe:/a:microsoft:.net_framework:4.5 + cpe:/a:microsoft:.net_framework:4.0 + cpe:/a:microsoft:.net_framework:4.5.1 + cpe:/a:microsoft:.net_framework:1.1:sp1 + cpe:/a:microsoft:.net_framework:2.0:sp2 + cpe:/a:microsoft:.net_framework:3.5 + + CVE-2014-0253 + 2014-02-11T23:50:39.937-05:00 + 2014-02-12T09:17:57.830-05:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-02-12T09:17:57.767-05:00 + + + + + MS + MS14-009 + + Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine TCP connection states, which allows remote attackers to cause a denial of service (ASP.NET daemon hang) via crafted HTTP requests that trigger persistent resource consumption for a (1) stale or (2) closed connection, as exploited in the wild in February 2014, aka "POST Request DoS Vulnerability." + + + + + + + + + + + + cpe:/o:microsoft:windows_server_2012:- + cpe:/o:microsoft:windows_8:-:-:x86 + cpe:/o:microsoft:windows_rt:- + cpe:/o:microsoft:windows_8:-:-:x64 + + CVE-2014-0254 + 2014-02-11T23:50:39.970-05:00 + 2014-02-12T09:24:07.187-05:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-02-12T09:24:06.330-05:00 + + + + + MS + MS14-006 + + The IPv6 implementation in Microsoft Windows 8, Windows Server 2012, and Windows RT does not properly validate packets, which allows remote attackers to cause a denial of service (system hang) via crafted ICMPv6 Router Advertisement packets, aka "TCP/IP Version 6 (IPv6) Denial of Service Vulnerability." + + + + + + + + + + + + + + + + cpe:/a:microsoft:.net_framework:3.5.1 + cpe:/a:microsoft:.net_framework:4.5 + cpe:/a:microsoft:.net_framework:4.0 + cpe:/a:microsoft:.net_framework:4.5.1 + cpe:/a:microsoft:.net_framework:1.0:sp3 + cpe:/a:microsoft:.net_framework:1.1:sp1 + cpe:/a:microsoft:.net_framework:2.0:sp2 + cpe:/a:microsoft:.net_framework:3.5 + + CVE-2014-0257 + 2014-02-11T23:50:39.987-05:00 + 2014-02-12T09:37:47.970-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-12T09:37:47.907-05:00 + + + + + MS + MS14-009 + + Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine whether it is safe to execute a method, which allows remote attackers to execute arbitrary code via (1) a crafted web site or (2) a crafted .NET Framework application that exposes a COM server endpoint, aka "Type Traversal Vulnerability." + + + + + + + + + + + + cpe:/a:microsoft:word:2007:sp3 + cpe:/a:microsoft:word_viewer + cpe:/a:microsoft:word:2003:sp3 + cpe:/a:microsoft:office_compatibility_pack::sp3 + + CVE-2014-0258 + 2014-01-15T11:13:03.837-05:00 + 2014-02-06T23:51:40.223-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-01-15T15:54:15.187-05:00 + + + + + MS + MS14-001 + + + SECTRACK + 1029599 + + + SECTRACK + 1029598 + + Microsoft Word 2003 SP3 and 2007 SP3, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability." + + + + + + + + + + cpe:/a:microsoft:word:2007:sp3 + cpe:/a:microsoft:office_compatibility_pack::sp3 + + CVE-2014-0259 + 2014-01-15T11:13:03.850-05:00 + 2014-02-06T23:51:40.300-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-01-15T15:54:48.907-05:00 + + + + + MS + MS14-001 + + + SECTRACK + 1029599 + + + SECTRACK + 1029598 + + Microsoft Word 2007 SP3 and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability." + + + + + + + + + + + + + + + + + + + + + + cpe:/a:microsoft:word:2007:sp3 + cpe:/a:microsoft:word:2003:sp3 + cpe:/a:microsoft:word:2013:-:~-~-~rt~~ + cpe:/a:microsoft:sharepoint_server:2013 + cpe:/a:microsoft:sharepoint_server:2010:sp1 + cpe:/a:microsoft:word:2010:sp2 + cpe:/a:microsoft:sharepoint_server:2010:sp2 + cpe:/a:microsoft:word:2010:sp1 + cpe:/a:microsoft:word_viewer + cpe:/a:microsoft:office_web_apps:2010:sp1 + cpe:/a:microsoft:office_web_apps:2010:sp2 + cpe:/a:microsoft:word:2013 + cpe:/a:microsoft:office_compatibility_pack::sp3 + cpe:/a:microsoft:office_web_apps_server:2013 + + CVE-2014-0260 + 2014-01-15T11:13:03.883-05:00 + 2014-02-06T23:51:40.397-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-01-15T16:14:49.357-05:00 + + + + + MS + MS14-001 + + + SECTRACK + 1029599 + + + SECTRACK + 1029598 + + Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office Compatibility Pack SP3; Word Viewer; SharePoint Server 2010 SP1 and SP2 and 2013; Office Web Apps 2010 SP1 and SP2; and Office Web Apps Server 2013 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability." + + + + + + + + + + + + cpe:/a:microsoft:dynamics_ax:2012 + cpe:/a:microsoft:dynamics_ax:2009:sp1 + cpe:/a:microsoft:dynamics_ax:4.0:sp2 + cpe:/a:microsoft:dynamics_ax:2012:r2 + + CVE-2014-0261 + 2014-01-15T11:13:03.913-05:00 + 2014-02-06T23:51:40.473-05:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-01-15T16:28:51.907-05:00 + + + + + MS + MS14-004 + + + SECTRACK + 1029601 + + Microsoft Dynamics AX 4.0 SP2, 2009 SP1, 2012, and 2012 R2 allows remote authenticated users to cause a denial of service (instance outage) via crafted data to an Application Object Server (AOS) instance, aka "Query Filter DoS Vulnerability." + + + + + + + + + + + + cpe:/o:microsoft:windows_7::sp1:x64 + cpe:/o:microsoft:windows_7::sp1:x86 + cpe:/o:microsoft:windows_server_2008:r2:sp1:itanium + cpe:/o:microsoft:windows_server_2008:r2:sp1:x64 + + CVE-2014-0262 + 2014-01-15T11:13:03.930-05:00 + 2014-02-21T00:06:10.437-05:00 + + + 7.2 + LOCAL + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-01-15T16:36:09.010-05:00 + + + + + MS + MS14-003 + + + SECTRACK + 1029600 + + + BID + 64725 + + win32k.sys in the kernel-mode drivers in Microsoft Windows 7 SP1 and Server 2008 R2 SP1 does not properly consider thread-owned objects during the processing of window handles, which allows local users to gain privileges via a crafted application, aka "Win32k Window Handle Vulnerability." + + + + + + + + + + + + + + + + + + + + + cpe:/o:microsoft:windows_7::sp1:x64 + cpe:/o:microsoft:windows_server_2012:- + cpe:/o:microsoft:windows_server_2012:r2:-:~-~essentials~~~ + cpe:/o:microsoft:windows_8:-:-:x86 + cpe:/o:microsoft:windows_7::sp1:x86 + cpe:/o:microsoft:windows_rt:- + cpe:/o:microsoft:windows_8:-:-:x64 + cpe:/o:microsoft:windows_8.1:-:-:~-~-~-~x64~ + cpe:/o:microsoft:windows_8.1:-:-:~-~-~-~x86~ + cpe:/o:microsoft:windows_server_2008:r2:sp1:x64 + cpe:/o:microsoft:windows_rt_8.1:- + cpe:/o:microsoft:windows_server_2012:r2:-:~-~standard~~~ + cpe:/o:microsoft:windows_server_2012:r2:-:~-~datacenter~~~ + + CVE-2014-0263 + 2014-02-11T23:50:40.033-05:00 + 2014-02-12T10:05:35.597-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-12T10:05:35.397-05:00 + + + + + MS + MS14-007 + + The Direct2D implementation in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a large 2D geometric figure that is encountered with Internet Explorer, aka "Microsoft Graphics Component Memory Corruption Vulnerability." + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:microsoft:windows_xp:-:sp2:x64 + cpe:/o:microsoft:windows_server_2012:- + cpe:/o:microsoft:windows_8:-:-:x86 + cpe:/o:microsoft:windows_server_2012:r2:-:~-~essentials~~~ + cpe:/o:microsoft:windows_8:-:-:x64 + cpe:/o:microsoft:windows_server_2008::sp2:x64 + cpe:/o:microsoft:windows_server_2008:r2:sp1:x64 + cpe:/o:microsoft:windows_server_2008::sp2:x86 + cpe:/o:microsoft:windows_rt_8.1:- + cpe:/o:microsoft:windows_vista::sp2:x64 + cpe:/o:microsoft:windows_server_2012:r2:-:~-~standard~~~ + cpe:/o:microsoft:windows_server_2003::sp2:x64 + cpe:/o:microsoft:windows_7::sp1:x64 + cpe:/o:microsoft:windows_xp::sp3 + cpe:/o:microsoft:windows_7::sp1:x86 + cpe:/o:microsoft:windows_rt:- + cpe:/o:microsoft:windows_8.1:-:-:~-~-~-~x64~ + cpe:/o:microsoft:windows_8.1:-:-:~-~-~-~x86~ + cpe:/o:microsoft:windows_vista::sp2 + cpe:/o:microsoft:windows_server_2003::sp2 + cpe:/a:microsoft:xml_core_services:3.0 + cpe:/o:microsoft:windows_server_2003::sp2:itanium + cpe:/o:microsoft:windows_server_2008:r2:sp1:itanium + cpe:/o:microsoft:windows_server_2008::sp2:itanium + cpe:/o:microsoft:windows_server_2012:r2:-:~-~datacenter~~~ + + CVE-2014-0266 + 2014-02-11T23:50:40.063-05:00 + 2014-02-12T10:16:06.827-05:00 + + + 7.1 + NETWORK + MEDIUM + NONE + COMPLETE + NONE + NONE + http://nvd.nist.gov + 2014-02-12T10:15:57.247-05:00 + + + + + MS + MS14-005 + + The XMLHTTP ActiveX controls in XML Core Services 3.0 in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to bypass the Same Origin Policy via a web page that is visited in Internet Explorer, aka "MSXML Information Disclosure Vulnerability." + + + + + + + + + cpe:/a:microsoft:internet_explorer:11:- + + CVE-2014-0267 + 2014-02-11T23:50:40.077-05:00 + 2014-02-12T10:24:27.297-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-12T10:23:59.703-05:00 + + + + + MS + MS14-010 + + Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0289 and CVE-2014-0290. + + + + + + + + + + + + cpe:/a:microsoft:internet_explorer:8 + cpe:/a:microsoft:internet_explorer:9 + cpe:/a:microsoft:internet_explorer:11:- + cpe:/a:microsoft:internet_explorer:10 + + CVE-2014-0268 + 2014-02-11T23:50:40.110-05:00 + 2014-02-12T12:37:47.780-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-12T10:33:18.007-05:00 + + + + + MS + MS14-010 + + Microsoft Internet Explorer 8 through 11 does not properly restrict file installation and registry-key creation, which allows remote attackers to bypass the Mandatory Integrity Control protection mechanism via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability." + + + + + + + + + + + + + cpe:/a:microsoft:internet_explorer:8 + cpe:/a:microsoft:internet_explorer:7 + cpe:/a:microsoft:internet_explorer:9 + cpe:/a:microsoft:internet_explorer:6 + cpe:/a:microsoft:internet_explorer:10 + + CVE-2014-0269 + 2014-02-11T23:50:40.140-05:00 + 2014-02-12T10:56:28.060-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-12T10:56:11.310-05:00 + + + + + MS + MS14-010 + + Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." + + + + + + + + + + + cpe:/a:microsoft:internet_explorer:9 + cpe:/a:microsoft:internet_explorer:11:- + cpe:/a:microsoft:internet_explorer:10 + + CVE-2014-0270 + 2014-02-11T23:50:40.157-05:00 + 2014-02-12T10:50:09.967-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-12T10:50:09.920-05:00 + + + + + MS + MS14-010 + + Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0273, CVE-2014-0274, and CVE-2014-0288. + + + + + + + + + + + + + + + + + + + + + cpe:/a:microsoft:internet_explorer:8 + cpe:/a:microsoft:internet_explorer:7 + cpe:/a:microsoft:internet_explorer:9 + cpe:/a:microsoft:internet_explorer:11:- + cpe:/a:microsoft:internet_explorer:6 + cpe:/a:microsoft:internet_explorer:10 + cpe:/a:microsoft:vbscript:5.7 + cpe:/a:microsoft:vbscript:5.8 + cpe:/a:microsoft:vbscript:5.6 + + CVE-2014-0271 + 2014-02-11T23:50:40.187-05:00 + 2014-02-12T10:55:45.167-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-12T10:55:30.337-05:00 + + + + + MS + MS14-011 + + + MS + MS14-010 + + The VBScript engine in Microsoft Internet Explorer 6 through 11, and VBScript 5.6 through 5.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "VBScript Memory Corruption Vulnerability." + + + + + + + + + + + cpe:/a:microsoft:internet_explorer:8 + cpe:/a:microsoft:internet_explorer:9 + cpe:/a:microsoft:internet_explorer:10 + + CVE-2014-0272 + 2014-02-11T23:50:40.220-05:00 + 2014-02-12T11:10:52.750-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-12T11:10:52.687-05:00 + + + + + MS + MS14-010 + + Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." + + + + + + + + + + + cpe:/a:microsoft:internet_explorer:9 + cpe:/a:microsoft:internet_explorer:11:- + cpe:/a:microsoft:internet_explorer:10 + + CVE-2014-0273 + 2014-02-11T23:50:40.237-05:00 + 2014-02-12T11:12:40.707-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-12T11:12:39.800-05:00 + + + + + MS + MS14-010 + + Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0270, CVE-2014-0274, and CVE-2014-0288. + + + + + + + + + + + cpe:/a:microsoft:internet_explorer:9 + cpe:/a:microsoft:internet_explorer:11:- + cpe:/a:microsoft:internet_explorer:10 + + CVE-2014-0274 + 2014-02-11T23:50:40.267-05:00 + 2014-02-13T12:23:54.710-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-12T11:28:52.573-05:00 + + + + + MS + MS14-010 + + Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0270, CVE-2014-0273, and CVE-2014-0288. + + + + + + + + + + + + + + cpe:/a:microsoft:internet_explorer:8 + cpe:/a:microsoft:internet_explorer:7 + cpe:/a:microsoft:internet_explorer:9 + cpe:/a:microsoft:internet_explorer:11:- + cpe:/a:microsoft:internet_explorer:6 + cpe:/a:microsoft:internet_explorer:10 + + CVE-2014-0275 + 2014-02-11T23:50:40.283-05:00 + 2014-02-12T11:18:26.453-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-12T11:18:25.847-05:00 + + + + + MS + MS14-010 + + Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0285 and CVE-2014-0286. + + + + + + + + + + cpe:/a:microsoft:internet_explorer:8 + cpe:/a:microsoft:internet_explorer:9 + + CVE-2014-0276 + 2014-02-11T23:50:40.313-05:00 + 2014-02-12T11:30:51.483-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-12T11:30:43.170-05:00 + + + + + MS + MS14-010 + + Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." + + + + + + + + + cpe:/a:microsoft:internet_explorer:8 + + CVE-2014-0277 + 2014-02-11T23:50:40.327-05:00 + 2014-02-13T12:23:40.693-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-12T11:36:02.823-05:00 + + + + + MS + MS14-010 + + Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0278 and CVE-2014-0279. + + + + + + + + + cpe:/a:microsoft:internet_explorer:8 + + CVE-2014-0278 + 2014-02-11T23:50:40.360-05:00 + 2014-02-13T12:22:47.973-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-12T11:37:27.373-05:00 + + + + + MS + MS14-010 + + Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0277 and CVE-2014-0279. + + + + + + + + + cpe:/a:microsoft:internet_explorer:8 + + CVE-2014-0279 + 2014-02-11T23:50:40.377-05:00 + 2014-02-13T12:22:08.970-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-12T12:03:21.357-05:00 + + + + + MS + MS14-010 + + Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0277 and CVE-2014-0278. + + + + + + + + + + + cpe:/a:microsoft:internet_explorer:8 + cpe:/a:microsoft:internet_explorer:7 + cpe:/a:microsoft:internet_explorer:6 + + CVE-2014-0280 + 2014-02-11T23:50:40.407-05:00 + 2014-02-12T11:47:48.537-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-12T11:47:48.287-05:00 + + + + + MS + MS14-010 + + Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." + + + + + + + + + + + + cpe:/a:microsoft:internet_explorer:8 + cpe:/a:microsoft:internet_explorer:9 + cpe:/a:microsoft:internet_explorer:11:- + cpe:/a:microsoft:internet_explorer:10 + + CVE-2014-0281 + 2014-02-11T23:50:40.423-05:00 + 2014-02-13T12:21:54.957-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-12T12:05:35.547-05:00 + + + + + MS + MS14-010 + + Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0287. + + + + + + + + + cpe:/a:microsoft:internet_explorer:9 + + CVE-2014-0283 + 2014-02-11T23:50:40.453-05:00 + 2014-02-13T12:17:10.193-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-12T12:06:26.223-05:00 + + + + + MS + MS14-010 + + Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." + + + + + + + + + + cpe:/a:microsoft:internet_explorer:9 + cpe:/a:microsoft:internet_explorer:10 + + CVE-2014-0284 + 2014-02-11T23:50:40.470-05:00 + 2014-02-12T13:18:03.483-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-12T12:07:13.270-05:00 + + + + + MS + MS14-010 + + Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." + + + + + + + + + + + + + + cpe:/a:microsoft:internet_explorer:7 + cpe:/a:microsoft:internet_explorer:8 + cpe:/a:microsoft:internet_explorer:9 + cpe:/a:microsoft:internet_explorer:11:- + cpe:/a:microsoft:internet_explorer:6 + cpe:/a:microsoft:internet_explorer:10 + + CVE-2014-0285 + 2014-02-11T23:50:40.500-05:00 + 2014-02-12T13:17:31.247-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-12T12:08:07.087-05:00 + + + + + MS + MS14-010 + + Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0275 and CVE-2014-0286. + + + + + + + + + + + + + + cpe:/a:microsoft:internet_explorer:7 + cpe:/a:microsoft:internet_explorer:8 + cpe:/a:microsoft:internet_explorer:9 + cpe:/a:microsoft:internet_explorer:11:- + cpe:/a:microsoft:internet_explorer:6 + cpe:/a:microsoft:internet_explorer:10 + + CVE-2014-0286 + 2014-02-11T23:50:40.517-05:00 + 2014-02-12T13:15:50.350-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-12T12:08:51.727-05:00 + + + + + MS + MS14-010 + + Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0275 and CVE-2014-0285. + + + + + + + + + + + + cpe:/a:microsoft:internet_explorer:8 + cpe:/a:microsoft:internet_explorer:9 + cpe:/a:microsoft:internet_explorer:11:- + cpe:/a:microsoft:internet_explorer:10 + + CVE-2014-0287 + 2014-02-11T23:50:40.547-05:00 + 2014-02-12T13:12:59.847-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-12T12:09:35.510-05:00 + + + + + MS + MS14-010 + + Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0281. + + + + + + + + + + + cpe:/a:microsoft:internet_explorer:9 + cpe:/a:microsoft:internet_explorer:11:- + cpe:/a:microsoft:internet_explorer:10 + + CVE-2014-0288 + 2014-02-11T23:50:40.563-05:00 + 2014-02-12T13:12:30.093-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-12T12:10:17.467-05:00 + + + + + MS + MS14-010 + + Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0270, CVE-2014-0273, and CVE-2014-0274. + + + + + + + + + cpe:/a:microsoft:internet_explorer:11:- + + CVE-2014-0289 + 2014-02-11T23:50:40.593-05:00 + 2014-02-12T13:12:15.627-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-12T12:11:10.890-05:00 + + + + + MS + MS14-010 + + Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0267 and CVE-2014-0290. + + + + + + + + + cpe:/a:microsoft:internet_explorer:11:- + + CVE-2014-0290 + 2014-02-11T23:50:40.627-05:00 + 2014-02-12T13:11:15.107-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-12T12:12:13.813-05:00 + + + + + MS + MS14-010 + + Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0267 and CVE-2014-0289. + + + + + + + + + + + cpe:/a:microsoft:internet_explorer:9 + cpe:/a:microsoft:internet_explorer:11:- + cpe:/a:microsoft:internet_explorer:10 + + CVE-2014-0293 + 2014-02-11T23:50:40.640-05:00 + 2014-02-12T13:11:01.577-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-02-12T12:14:12.817-05:00 + + + + + MS + MS14-010 + + Microsoft Internet Explorer 9 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Internet Explorer Cross-domain Information Disclosure Vulnerability." + + + + + + + + + cpe:/a:microsoft:microsoft_forefront_protection_2010:-::~~~exchange_server~~ + + CVE-2014-0294 + 2014-02-11T23:50:40.673-05:00 + 2014-02-12T12:15:29.807-05:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-12T12:14:22.427-05:00 + + + + + MS + MS14-008 + + Microsoft Forefront Protection 2010 for Exchange Server does not properly parse e-mail content, which might allow remote attackers to execute arbitrary code via a crafted message, aka "RCE Vulnerability." + + + + + + + + + + cpe:/a:microsoft:.net_framework:3.5.1 + cpe:/a:microsoft:.net_framework:2.0:sp2 + + CVE-2014-0295 + 2014-02-11T23:50:41.283-05:00 + 2014-02-12T12:41:52.257-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-12T12:25:19.577-05:00 + + + + + MS + MS14-009 + + + MISC + http://www.greyhathacker.net/?p=585 + + VsaVb7rt.dll in Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not implement the ASLR protection mechanism, which makes it easier for remote attackers to execute arbitrary code via a crafted web site, as exploited in the wild in February 2014, aka "VSAVB7RT ASLR Vulnerability." + + + + + + + + + + + + cpe:/a:microsoft:internet_explorer:8 + cpe:/a:microsoft:internet_explorer:9 + cpe:/a:microsoft:internet_explorer:11:- + cpe:/a:microsoft:internet_explorer:10 + + CVE-2014-0297 + 2014-03-12T01:15:19.333-04:00 + 2014-03-12T15:04:17.427-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-12T15:04:13.253-04:00 + + + + + MS + MS14-012 + + Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0308, CVE-2014-0312, and CVE-2014-0324. + + + + + + + + + + + cpe:/a:microsoft:internet_explorer:9 + cpe:/a:microsoft:internet_explorer:11:- + cpe:/a:microsoft:internet_explorer:10 + + CVE-2014-0298 + 2014-03-12T01:15:19.367-04:00 + 2014-03-12T15:05:44.977-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-12T15:05:44.943-04:00 + + + + + MS + MS14-012 + + Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." + + + + + + + + + + + + + + cpe:/a:microsoft:internet_explorer:8 + cpe:/a:microsoft:internet_explorer:7 + cpe:/a:microsoft:internet_explorer:9 + cpe:/a:microsoft:internet_explorer:11:- + cpe:/a:microsoft:internet_explorer:6 + cpe:/a:microsoft:internet_explorer:10 + + CVE-2014-0299 + 2014-03-12T01:15:19.397-04:00 + 2014-03-12T15:14:52.597-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-12T15:14:52.347-04:00 + + + + + MS + MS14-012 + + Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0305 and CVE-2014-0311. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:microsoft:windows_xp:-:sp2:x64 + cpe:/o:microsoft:windows_7::sp1:x64 + cpe:/o:microsoft:windows_server_2012:- + cpe:/o:microsoft:windows_xp::sp3 + cpe:/o:microsoft:windows_server_2012:r2:-:~-~essentials~~~ + cpe:/o:microsoft:windows_8:-:-:x86 + cpe:/o:microsoft:windows_7::sp1:x86 + cpe:/o:microsoft:windows_rt:- + cpe:/o:microsoft:windows_8:-:-:x64 + cpe:/o:microsoft:windows_server_2008::sp2:x64 + cpe:/o:microsoft:windows_8.1:-:-:~-~-~-~x64~ + cpe:/o:microsoft:windows_server_2008::sp2:x86 + cpe:/o:microsoft:windows_8.1:-:-:~-~-~-~x86~ + cpe:/o:microsoft:windows_server_2008:r2:sp1:x64 + cpe:/o:microsoft:windows_vista::sp2 + cpe:/o:microsoft:windows_rt_8.1:- + cpe:/o:microsoft:windows_server_2003::sp2 + cpe:/o:microsoft:windows_vista::sp2:x64 + cpe:/o:microsoft:windows_server_2003::sp2:itanium + cpe:/o:microsoft:windows_server_2012:r2:-:~-~standard~~~ + cpe:/o:microsoft:windows_server_2008:r2:sp1:itanium + cpe:/o:microsoft:windows_server_2003::sp2:x64 + cpe:/o:microsoft:windows_server_2008::sp2:itanium + cpe:/o:microsoft:windows_server_2012:r2:-:~-~datacenter~~~ + + CVE-2014-0300 + 2014-03-12T01:15:19.413-04:00 + 2014-03-12T16:14:32.030-04:00 + + + 7.2 + LOCAL + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-12T16:14:31.017-04:00 + + + + + MS + MS14-015 + + win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability." + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:microsoft:windows_xp:-:sp2:x64 + cpe:/o:microsoft:windows_7::sp1:x64 + cpe:/o:microsoft:windows_server_2012:- + cpe:/o:microsoft:windows_xp::sp3 + cpe:/o:microsoft:windows_server_2012:r2:-:~-~essentials~~~ + cpe:/o:microsoft:windows_8:-:-:x86 + cpe:/o:microsoft:windows_7::sp1:x86 + cpe:/o:microsoft:windows_8:-:-:x64 + cpe:/o:microsoft:windows_server_2008::sp2:x64 + cpe:/o:microsoft:windows_8.1:-:-:~-~-~-~x64~ + cpe:/o:microsoft:windows_server_2008::sp2:x86 + cpe:/o:microsoft:windows_8.1:-:-:~-~-~-~x86~ + cpe:/o:microsoft:windows_server_2008:r2:sp1:x64 + cpe:/o:microsoft:windows_vista::sp2 + cpe:/o:microsoft:windows_server_2003::sp2 + cpe:/o:microsoft:windows_vista::sp2:x64 + cpe:/o:microsoft:windows_server_2003::sp2:itanium + cpe:/o:microsoft:windows_server_2012:r2:-:~-~standard~~~ + cpe:/o:microsoft:windows_server_2003::sp2:x64 + cpe:/o:microsoft:windows_server_2008::sp2:itanium + cpe:/o:microsoft:windows_server_2012:r2:-:~-~datacenter~~~ + + CVE-2014-0301 + 2014-03-12T01:15:19.443-04:00 + 2014-03-12T17:36:34.620-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-12T17:36:34.200-04:00 + + + + + MS + MS14-013 + + Double free vulnerability in qedit.dll in DirectShow in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via a crafted JPEG image, aka "DirectShow Memory Corruption Vulnerability." + + + + + + + + + + + cpe:/a:microsoft:internet_explorer:8 + cpe:/a:microsoft:internet_explorer:7 + cpe:/a:microsoft:internet_explorer:6 + + CVE-2014-0302 + 2014-03-12T01:15:19.460-04:00 + 2014-03-12T15:16:43.177-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-12T15:16:38.070-04:00 + + + + + MS + MS14-012 + + Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0303. + + + + + + + + + + + cpe:/a:microsoft:internet_explorer:8 + cpe:/a:microsoft:internet_explorer:7 + cpe:/a:microsoft:internet_explorer:6 + + CVE-2014-0303 + 2014-03-12T01:15:19.473-04:00 + 2014-03-12T15:18:50.433-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-12T15:18:50.230-04:00 + + + + + MS + MS14-012 + + Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0302. + + + + + + + + + cpe:/a:microsoft:internet_explorer:11:- + + CVE-2014-0304 + 2014-03-12T01:15:19.507-04:00 + 2014-03-12T15:20:17.560-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-12T15:20:00.683-04:00 + + + + + MS + MS14-012 + + Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." + + + + + + + + + + + + + + cpe:/a:microsoft:internet_explorer:8 + cpe:/a:microsoft:internet_explorer:7 + cpe:/a:microsoft:internet_explorer:9 + cpe:/a:microsoft:internet_explorer:11:- + cpe:/a:microsoft:internet_explorer:6 + cpe:/a:microsoft:internet_explorer:10 + + CVE-2014-0305 + 2014-03-12T01:15:19.520-04:00 + 2014-03-12T15:21:09.153-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-12T15:21:08.887-04:00 + + + + + MS + MS14-012 + + Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0299 and CVE-2014-0311. + + + + + + + + + + cpe:/a:microsoft:internet_explorer:8 + cpe:/a:microsoft:internet_explorer:9 + + CVE-2014-0306 + 2014-03-12T01:15:19.553-04:00 + 2014-03-12T15:22:37.173-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-12T15:22:36.983-04:00 + + + + + MS + MS14-012 + + Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." + + + + + + + + + cpe:/a:microsoft:internet_explorer:9 + + CVE-2014-0307 + 2014-03-12T01:15:19.567-04:00 + 2014-03-26T00:56:05.470-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-12T15:24:08.610-04:00 + + + + + MS + MS14-012 + + + EXPLOIT-DB + 32438 + + Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a certain sequence of manipulations of a TextRange element, aka "Internet Explorer Memory Corruption Vulnerability." + + + + + + + + + + + + cpe:/a:microsoft:internet_explorer:8 + cpe:/a:microsoft:internet_explorer:9 + cpe:/a:microsoft:internet_explorer:11:- + cpe:/a:microsoft:internet_explorer:10 + + CVE-2014-0308 + 2014-03-12T01:15:19.600-04:00 + 2014-03-12T15:58:22.070-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-12T15:58:22.007-04:00 + + + + + MS + MS14-012 + + Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0297, CVE-2014-0312, and CVE-2014-0324. + + + + + + + + + + + cpe:/a:microsoft:internet_explorer:8 + cpe:/a:microsoft:internet_explorer:9 + cpe:/a:microsoft:internet_explorer:10 + + CVE-2014-0309 + 2014-03-12T01:15:19.630-04:00 + 2014-03-12T15:59:09.850-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-12T15:59:09.803-04:00 + + + + + MS + MS14-012 + + Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." + + + + + + + + + + + + + + cpe:/a:microsoft:internet_explorer:8 + cpe:/a:microsoft:internet_explorer:7 + cpe:/a:microsoft:internet_explorer:9 + cpe:/a:microsoft:internet_explorer:11:- + cpe:/a:microsoft:internet_explorer:6 + cpe:/a:microsoft:internet_explorer:10 + + CVE-2014-0311 + 2014-03-12T01:15:19.677-04:00 + 2014-03-12T16:00:10.680-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-12T16:00:02.040-04:00 + + + + + MS + MS14-012 + + Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0299 and CVE-2014-0305. + + + + + + + + + + + + cpe:/a:microsoft:internet_explorer:8 + cpe:/a:microsoft:internet_explorer:9 + cpe:/a:microsoft:internet_explorer:11:- + cpe:/a:microsoft:internet_explorer:10 + + CVE-2014-0312 + 2014-03-12T01:15:19.723-04:00 + 2014-03-12T16:01:06.183-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-12T16:01:05.073-04:00 + + + + + MS + MS14-012 + + Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0297, CVE-2014-0308, and CVE-2014-0324. + + + + + + + + + + cpe:/a:microsoft:internet_explorer:11:- + cpe:/a:microsoft:internet_explorer:10 + + CVE-2014-0313 + 2014-03-12T01:15:19.770-04:00 + 2014-03-12T16:02:27.310-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-12T16:01:45.760-04:00 + + + + + MS + MS14-012 + + Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0321. + + + + + + + + + + cpe:/a:microsoft:internet_explorer:9 + cpe:/a:microsoft:internet_explorer:10 + + CVE-2014-0314 + 2014-03-12T01:15:19.833-04:00 + 2014-03-12T16:03:43.093-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-12T16:03:42.997-04:00 + + + + + MS + MS14-012 + + Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:microsoft:windows_xp:-:sp2:x64 + cpe:/o:microsoft:windows_7::sp1:x64 + cpe:/o:microsoft:windows_server_2012:- + cpe:/o:microsoft:windows_xp::sp3 + cpe:/o:microsoft:windows_server_2012:r2:-:~-~essentials~~~ + cpe:/o:microsoft:windows_8:-:-:x86 + cpe:/o:microsoft:windows_7::sp1:x86 + cpe:/o:microsoft:windows_rt:- + cpe:/o:microsoft:windows_8:-:-:x64 + cpe:/o:microsoft:windows_server_2008::sp2:x64 + cpe:/o:microsoft:windows_8.1:-:-:~-~-~-~x64~ + cpe:/o:microsoft:windows_server_2008::sp2:x86 + cpe:/o:microsoft:windows_8.1:-:-:~-~-~-~x86~ + cpe:/o:microsoft:windows_server_2008:r2:sp1:x64 + cpe:/o:microsoft:windows_vista::sp2 + cpe:/o:microsoft:windows_rt_8.1:- + cpe:/o:microsoft:windows_server_2003::sp2 + cpe:/o:microsoft:windows_vista::sp2:x64 + cpe:/o:microsoft:windows_server_2003::sp2:itanium + cpe:/o:microsoft:windows_server_2012:r2:-:~-~standard~~~ + cpe:/o:microsoft:windows_server_2008:r2:sp1:itanium + cpe:/o:microsoft:windows_server_2003::sp2:x64 + cpe:/o:microsoft:windows_server_2008::sp2:itanium + cpe:/o:microsoft:windows_server_2012:r2:-:~-~datacenter~~~ + + CVE-2014-0315 + 2014-04-08T19:55:05.853-04:00 + 2014-04-09T19:21:46.920-04:00 + + + 6.9 + LOCAL + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-09T19:21:37.497-04:00 + + + + MS + MS14-019 + + + CONFIRM + http://blogs.technet.com/b/srd/archive/2014/04/08/ms14-019-fixing-a-binary-hijacking-via-cmd-or-bat-file.aspx + + Untrusted search path vulnerability in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a Trojan horse cmd.exe file in the current working directory, as demonstrated by a directory that contains a .bat or .cmd file, aka "Windows File Handling Vulnerability." + + + + + + + + + + + + + + + + + + + + + + cpe:/o:microsoft:windows_xp:-:sp2:x64 + cpe:/o:microsoft:windows_server_2012:- + cpe:/o:microsoft:windows_xp::sp3 + cpe:/o:microsoft:windows_server_2012:r2:-:~-~essentials~~~ + cpe:/o:microsoft:windows_server_2008::sp2:x64 + cpe:/o:microsoft:windows_server_2008:r2:sp1:x64 + cpe:/o:microsoft:windows_server_2008::sp2:x86 + cpe:/o:microsoft:windows_vista::sp2 + cpe:/o:microsoft:windows_vista::sp2:x64 + cpe:/o:microsoft:windows_server_2003::sp2 + cpe:/o:microsoft:windows_server_2003::sp2:itanium + cpe:/o:microsoft:windows_server_2012:r2:-:~-~standard~~~ + cpe:/o:microsoft:windows_server_2003::sp2:x64 + cpe:/o:microsoft:windows_server_2012:r2:-:~-~datacenter~~~ + + CVE-2014-0317 + 2014-03-12T01:15:19.897-04:00 + 2014-03-12T17:43:58.897-04:00 + + + 5.4 + NETWORK + HIGH + NONE + NONE + COMPLETE + NONE + http://nvd.nist.gov + 2014-03-12T17:43:58.430-04:00 + + + + + + MS + MS14-016 + + The Security Account Manager Remote (SAMR) protocol implementation in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 Gold and R2 does not properly determine the user-lockout state, which makes it easier for remote attackers to bypass the account lockout policy and obtain access via a brute-force attack, aka "SAMR Security Feature Bypass Vulnerability." + + + + + + + + + + + + + + + + cpe:/a:microsoft:silverlight:5.1.20513.0 + cpe:/a:microsoft:silverlight:5.0.60401.0 + cpe:/a:microsoft:silverlight:5.0.60818.0:rc + cpe:/a:microsoft:silverlight:5.1.20913.0 + cpe:/a:microsoft:silverlight:5.0.60818.0 + cpe:/a:microsoft:silverlight:5.1.20125.0 + cpe:/a:microsoft:silverlight:5.0.61118.0 + cpe:/a:microsoft:silverlight:5.1.10411.0 + + CVE-2014-0319 + 2014-03-12T01:15:19.943-04:00 + 2014-03-12T17:59:11.997-04:00 + + + 7.1 + NETWORK + MEDIUM + NONE + NONE + COMPLETE + NONE + http://nvd.nist.gov + 2014-03-12T17:59:10.920-04:00 + + + + + MS + MS14-014 + + Microsoft Silverlight 5 before 5.1.30214.0 and Silverlight 5 Developer Runtime before 5.1.30214.0 allow attackers to bypass the DEP and ASLR protection mechanisms via unspecified vectors, aka "Silverlight DEP/ASLR Bypass Vulnerability." + + + + + + + + + + cpe:/a:microsoft:internet_explorer:11:- + cpe:/a:microsoft:internet_explorer:10 + + CVE-2014-0321 + 2014-03-12T01:15:20.007-04:00 + 2014-03-12T16:05:42.407-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-12T16:05:42.313-04:00 + + + + + MS + MS14-012 + + Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0313. + + + + + + + + + cpe:/a:microsoft:internet_explorer:10 + + CVE-2014-0322 + 2014-02-14T11:55:07.500-05:00 + 2014-03-16T00:44:01.910-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-18T11:33:47.520-05:00 + + + + + CERT-VN + VU#732479 + + + MISC + https://www.dropbox.com/s/pyxjgycmudirbqe/CVE-2014-0322.zip + + + MISC + http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html + + + MISC + http://www.fireeye.com/blog/technical/cyber-exploits/2014/02/new-ie-zero-day-found-in-watering-hole-attack-2.html + + + MISC + http://twitter.com/nanoc0re/statuses/434251658344673281 + + + MS + MS14-012 + + + CONFIRM + http://technet.microsoft.com/security/advisory/2934088 + + + MISC + http://community.websense.com/blogs/securitylabs/archive/2014/02/13/msie-0-day-exploit-cve-2014-0322-possibly-targeting-french-aerospace-organization.aspx + + Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, as exploited in the wild in January and February 2014. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:microsoft:windows_xp:-:sp2:x64 + cpe:/o:microsoft:windows_7::sp1:x64 + cpe:/o:microsoft:windows_server_2012:- + cpe:/o:microsoft:windows_xp::sp3 + cpe:/o:microsoft:windows_server_2012:r2:-:~-~essentials~~~ + cpe:/o:microsoft:windows_8:-:-:x86 + cpe:/o:microsoft:windows_7::sp1:x86 + cpe:/o:microsoft:windows_rt:- + cpe:/o:microsoft:windows_8:-:-:x64 + cpe:/o:microsoft:windows_server_2008::sp2:x64 + cpe:/o:microsoft:windows_8.1:-:-:~-~-~-~x64~ + cpe:/o:microsoft:windows_server_2008::sp2:x86 + cpe:/o:microsoft:windows_8.1:-:-:~-~-~-~x86~ + cpe:/o:microsoft:windows_server_2008:r2:sp1:x64 + cpe:/o:microsoft:windows_vista::sp2 + cpe:/o:microsoft:windows_rt_8.1:- + cpe:/o:microsoft:windows_server_2003::sp2 + cpe:/o:microsoft:windows_vista::sp2:x64 + cpe:/o:microsoft:windows_server_2003::sp2:itanium + cpe:/o:microsoft:windows_server_2012:r2:-:~-~standard~~~ + cpe:/o:microsoft:windows_server_2008:r2:sp1:itanium + cpe:/o:microsoft:windows_server_2003::sp2:x64 + cpe:/o:microsoft:windows_server_2008::sp2:itanium + cpe:/o:microsoft:windows_server_2012:r2:-:~-~datacenter~~~ + + CVE-2014-0323 + 2014-03-12T01:15:20.037-04:00 + 2014-03-12T16:16:17.063-04:00 + + + 6.6 + LOCAL + LOW + NONE + COMPLETE + NONE + COMPLETE + http://nvd.nist.gov + 2014-03-12T16:16:15.847-04:00 + + + + + MS + MS14-015 + + win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (system hang) via a crafted application, aka "Win32k Information Disclosure Vulnerability." + + + + + + + + + + + + cpe:/a:microsoft:internet_explorer:8 + cpe:/a:microsoft:internet_explorer:9 + cpe:/a:microsoft:internet_explorer:11:- + cpe:/a:microsoft:internet_explorer:10 + + CVE-2014-0324 + 2014-03-12T01:15:20.067-04:00 + 2014-03-12T16:06:18.347-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-12T16:06:18.237-04:00 + + + + + MS + MS14-012 + + Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0297, CVE-2014-0308, and CVE-2014-0312. + + + + + + + + + cpe:/h:zte:zxv10_w300:2.1.0 + + CVE-2014-0329 + 2014-02-04T00:39:08.450-05:00 + 2014-03-13T10:13:58.487-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-04T07:45:18.000-05:00 + + + + + CERT-VN + VU#228886 + + + XF + zxv10-w300-cve20140329-sec-bypass(90958) + + + BID + 65310 + + + MISC + http://packetstormsecurity.com/files/125142/ZTE-ZXV10-W300-Hardcoded-Credentials.html + + + OSVDB + 102816 + + + MISC + http://blog.alguien.at/2014/02/hackeando-el-router-zte-zxv10-w300-v21.html + + The TELNET service on the ZTE ZXV10 W300 router 2.1.0 has a hardcoded password ending with airocon for the admin account, which allows remote attackers to obtain administrative access by leveraging knowledge of the MAC address characters present at the beginning of the password. + + + + + + + + + + + + + + cpe:/h:dell:kace_k1000_systems_management_appliance:- + cpe:/a:dell:kace_k1000_systems_management_appliance_software:5.5.90545 + + CVE-2014-0330 + 2014-02-06T18:55:03.993-05:00 + 2014-02-07T13:09:12.020-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-07T13:09:11.940-05:00 + + + + + CERT-VN + VU#813382 + + Cross-site scripting (XSS) vulnerability in adminui/user_list.php on the Dell KACE K1000 management appliance 5.5.90545 allows remote attackers to inject arbitrary web script or HTML via the LABEL_ID parameter. + + + + + + + + + + + + + + + + + + + + + cpe:/h:fortinet:fortiadc-300e:- + cpe:/h:fortinet:fortiadc-400e:- + cpe:/o:fortinet:fortiadc_firmware:3.2.0 + cpe:/h:fortinet:fortiadc-200d:- + cpe:/h:fortinet:fortiadc-1500d:- + cpe:/h:fortinet:fortiadc-1000e:- + cpe:/h:fortinet:fortiadc-4000d:- + cpe:/h:fortinet:fortiadc-2000d:- + cpe:/h:fortinet:fortiadc-600e:- + + CVE-2014-0331 + 2014-04-10T16:29:20.440-04:00 + 2014-04-11T11:35:42.060-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-11T11:35:33.557-04:00 + + + + + CONFIRM + http://www.fortiguard.com/advisory/FG-IR-14-004 + + + FULLDISC + 20140403 XSS Reflected vulnerabilities in OS of FortiADC v3.2 (CVE-2014-0331) + + Cross-site scripting (XSS) vulnerability in the web administration interface in FortiADC with firmware before 3.2.1 allows remote attackers to inject arbitrary web script or HTML via the locale parameter to gui_partA/. + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:dell:sonicwall_universal_management_appliance_e5000:7.0:sp1 + cpe:/a:dell:sonicwall_universal_management_appliance_e5000:7.1:sp1 + cpe:/a:dell:sonicwall_analyzer:7.1 + cpe:/a:dell:sonicwall_analyzer:7.0 + cpe:/a:dell:sonicwall_global_management_system:7.1 + cpe:/a:dell:sonicwall_global_management_system:7.0 + cpe:/a:dell:sonicwall_universal_management_appliance_e5000:7.1 + cpe:/a:dell:sonicwall_analyzer:7.1:sp1 + cpe:/a:dell:sonicwall_global_management_system:7.1:sp1 + + CVE-2014-0332 + 2014-02-14T11:55:08.030-05:00 + 2014-03-05T23:50:23.533-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-18T12:14:29.720-05:00 + + + + + CERT-VN + VU#727318 + + + XF + sonicwall-cve20140332-nodeid-xss(91062) + + + CONFIRM + http://www.sonicwall.com/us/shared/download/Support_Bulletin_GMS_Vulnerability_XSS_Resolved_in_7.1_SP2_and_7.2.pdf + + Cross-site scripting (XSS) vulnerability in mainPage in Dell SonicWALL GMS before 7.1 SP2, SonicWALL Analyzer before 7.1 SP2, and SonicWALL UMA E5000 before 7.1 SP2 might allow remote attackers to inject arbitrary web script or HTML via the node_id parameter in a ScreenDisplayManager genNetwork action. + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:libpng:libpng:1.6.2:beta + cpe:/a:libpng:libpng:1.6.5 + cpe:/a:libpng:libpng:1.6.1:beta + cpe:/a:libpng:libpng:1.6.7 + cpe:/a:libpng:libpng:1.6.0:beta + cpe:/a:libpng:libpng:1.6.6 + cpe:/a:libpng:libpng:1.6.9 + cpe:/a:libpng:libpng:1.6.8 + cpe:/a:libpng:libpng:1.6.4:beta + cpe:/a:libpng:libpng:1.6.3:beta + cpe:/a:libpng:libpng:1.6.4 + cpe:/a:libpng:libpng:1.6.9:beta + cpe:/a:libpng:libpng:1.6.8:beta + cpe:/a:libpng:libpng:1.6.7:beta + cpe:/a:libpng:libpng:1.6.0 + cpe:/a:libpng:libpng:1.6.1 + cpe:/a:libpng:libpng:1.6.2 + cpe:/a:libpng:libpng:1.6.3 + + CVE-2014-0333 + 2014-02-27T15:55:04.850-05:00 + 2014-03-26T00:56:09.813-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-02-28T10:45:31.003-05:00 + + + + + CERT-VN + VU#684412 + + + CONFIRM + ftp://ftp.simplesystems.org/pub/png/src/libpng16/patch-libpng16-vu684412.diff + + + CONFIRM + https://sourceforge.net/projects/libpng/files/libpng16/patch-libpng16-vu684412.diff + + + SUSE + openSUSE-SU-2014:0358 + + The png_push_read_chunk function in pngpread.c in the progressive decoder in libpng 1.6.x through 1.6.9 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an IDAT chunk with a length of zero. + + + + + + + + + cpe:/a:cmsmadesimple:cms_made_simple + + CVE-2014-0334 + 2014-03-02T12:55:02.720-05:00 + 2014-03-03T15:58:20.833-05:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-03T11:56:51.667-05:00 + + + + + CERT-VN + VU#526062 + + Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple allow remote authenticated users to inject arbitrary web script or HTML via (1) the group parameter to admin/addgroup.php, (2) the htmlblob parameter to admin/addhtmlblob.php, the (3) title or (4) url parameter to admin/addbookmark.php, (5) the stylesheet_name parameter to admin/copystylesheet.php, (6) the template_name parameter to admin/copytemplate.php, the (7) title or (8) url parameter to admin/editbookmark.php, (9) the template parameter to admin/listtemplates.php, or (10) the css_name parameter to admin/listcss.php, a different issue than CVE-2014-2092. + + + + + + + + + cpe:/a:serena:dimensions_cm:12.2:build7.199.0 + + CVE-2014-0335 + 2014-03-06T06:55:05.130-05:00 + 2014-03-07T14:19:21.430-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-06T11:21:03.383-05:00 + + + + + CERT-VN + VU#823452 + + Multiple cross-site scripting (XSS) vulnerabilities in the web client in Serena Dimensions CM 12.2 build 7.199.0 allow remote attackers to inject arbitrary web script or HTML via the (1) DB_CONN, (2) DB_NAME, (3) DM_HOST, (4) MAN_DB_NAME, (5) framecmd, (6) identifier, (7) merant.adm.adapters.AdmDialogPropertyMgr, (8) nav_frame, (9) nav_jsp, (10) target_frame, (11) id, or (12) type parameter to the dimensions/ URI. + + + + + + + + + cpe:/a:serena:dimensions_cm:12.2:build7.199.0 + + CVE-2014-0336 + 2014-03-06T06:55:05.147-05:00 + 2014-03-07T14:19:02.663-05:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-06T11:24:31.217-05:00 + + + + + CERT-VN + VU#823452 + + Cross-site request forgery (CSRF) vulnerability in the web client in Serena Dimensions CM 12.2 build 7.199.0 allows remote attackers to hijack the authentication of administrators for requests that use the user_new_master parameter to the adminconsole/ URI. + + + + + + + + + + + + + + cpe:/h:huawei:echo_life:hg8247 + cpe:/o:huawei:echo_life_hg8247_firmware:v1r006c00s120 + + CVE-2014-0337 + 2014-04-05T00:01:37.547-04:00 + 2014-04-07T10:36:28.637-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-07T10:36:28.573-04:00 + + + + + CERT-VN + VU#917700 + + Cross-site scripting (XSS) vulnerability in the web interface on Huawei Echo Life HG8247 routers with software before V100R006C00SPC127 allows remote attackers to inject arbitrary web script or HTML via an invalid TELNET connection attempt with a crafted username that is not properly handled during construction of the "failed log-in attempts over telnet" log view. + + + + + + + + + + + + + + + + + + + cpe:/o:watchguard:fireware:11.6.3 + cpe:/o:watchguard:fireware:11.7.4 + cpe:/o:watchguard:fireware:11.6.1 + cpe:/o:watchguard:fireware:11.7.3 + cpe:/o:watchguard:fireware:11.6 + cpe:/o:watchguard:fireware:11.7 + cpe:/o:watchguard:fireware:11.8.1 + cpe:/o:watchguard:fireware:11.7.2 + cpe:/o:watchguard:fireware:11.6.6 + cpe:/o:watchguard:fireware:11.8 + cpe:/o:watchguard:fireware:11.6.5 + + CVE-2014-0338 + 2014-03-16T10:06:45.117-04:00 + 2014-03-17T14:05:17.487-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-17T14:05:13.097-04:00 + + + + + CERT-VN + VU#807134 + + + CONFIRM + http://watchguardsecuritycenter.com/2014/03/13/fireware-xtm-11-8-3-update-corrects-xss-flaw/ + + Multiple cross-site scripting (XSS) vulnerabilities in the firewall policy management pages in WatchGuard Fireware XTM before 11.8.3 allow remote attackers to inject arbitrary web script or HTML via the pol_name parameter. + + + + + + + + + + + + + + + + cpe:/a:webmin:webmin:1.620 + cpe:/a:webmin:webmin:1.650 + cpe:/a:webmin:webmin:1.600 + cpe:/a:webmin:webmin:1.640 + cpe:/a:webmin:webmin:1.670 + cpe:/a:webmin:webmin:1.610 + cpe:/a:webmin:webmin:1.630 + cpe:/a:webmin:webmin:1.660 + + CVE-2014-0339 + 2014-03-16T10:06:45.147-04:00 + 2014-03-17T14:12:07.793-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-17T14:12:07.310-04:00 + + + + + CERT-VN + VU#381692 + + + CONFIRM + http://www.webmin.com/changes.html + + Cross-site scripting (XSS) vulnerability in view.cgi in Webmin before 1.680 allows remote attackers to inject arbitrary web script or HTML via the search parameter. + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:pivotx:pivotx:2.1.0 + cpe:/a:pivotx:pivotx:2.3.7 + cpe:/a:pivotx:pivotx:2.3.8 + cpe:/a:pivotx:pivotx:2.3.6 + cpe:/a:pivotx:pivotx:2.3.5 + cpe:/a:pivotx:pivotx:2.3.3 + cpe:/a:pivotx:pivotx:2.3.2 + cpe:/a:pivotx:pivotx:2.2.0:b1 + cpe:/a:pivotx:pivotx:2.2.0:b2 + cpe:/a:pivotx:pivotx:2.1.1 + cpe:/a:pivotx:pivotx:2.3.0 + cpe:/a:pivotx:pivotx:2.1.2 + cpe:/a:pivotx:pivotx:2.2.3 + cpe:/a:pivotx:pivotx:2.2.0 + cpe:/a:pivotx:pivotx:2.2.5 + cpe:/a:pivotx:pivotx:2.2.1 + cpe:/a:pivotx:pivotx:2.2.2 + cpe:/a:pivotx:pivotx:2.2.0:rc + + CVE-2014-0341 + 2014-04-15T06:55:11.870-04:00 + 2014-04-15T12:36:29.267-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-15T12:36:29.093-04:00 + + + + + CERT-VN + VU#901156 + + + CONFIRM + http://sourceforge.net/p/pivot-weblog/code/4349/ + + + CONFIRM + http://sourceforge.net/p/pivot-weblog/code/4345/ + + + CONFIRM + http://pivotx.net/page/security + + + CONFIRM + http://blog.pivotx.net/archive/2014/03/03/pivotx-239-released + + Multiple cross-site scripting (XSS) vulnerabilities in PivotX before 2.3.9 allow remote authenticated users to inject arbitrary web script or HTML via the title field to (1) templates_internal/pages.tpl, (2) templates_internal/home.tpl, or (3) templates_internal/entries.tpl; (4) an event field to objects.php; or the (5) email or (6) nickname field to pages.php, related to templates_internal/users.tpl. + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:pivotx:pivotx:2.1.0 + cpe:/a:pivotx:pivotx:2.3.7 + cpe:/a:pivotx:pivotx:2.3.8 + cpe:/a:pivotx:pivotx:2.3.6 + cpe:/a:pivotx:pivotx:2.3.5 + cpe:/a:pivotx:pivotx:2.3.3 + cpe:/a:pivotx:pivotx:2.3.2 + cpe:/a:pivotx:pivotx:2.2.0:b1 + cpe:/a:pivotx:pivotx:2.2.0:b2 + cpe:/a:pivotx:pivotx:2.1.1 + cpe:/a:pivotx:pivotx:2.3.0 + cpe:/a:pivotx:pivotx:2.1.2 + cpe:/a:pivotx:pivotx:2.2.3 + cpe:/a:pivotx:pivotx:2.2.0 + cpe:/a:pivotx:pivotx:2.2.5 + cpe:/a:pivotx:pivotx:2.2.1 + cpe:/a:pivotx:pivotx:2.2.2 + cpe:/a:pivotx:pivotx:2.2.0:rc + + CVE-2014-0342 + 2014-04-15T06:55:11.900-04:00 + 2014-04-15T12:39:56.837-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-15T12:39:56.727-04:00 + + + + CERT-VN + VU#901156 + + + CONFIRM + http://sourceforge.net/p/pivot-weblog/code/4347/ + + + CONFIRM + http://pivotx.net/page/security + + + CONFIRM + http://blog.pivotx.net/archive/2014/03/03/pivotx-239-released + + Multiple unrestricted file upload vulnerabilities in fileupload.php in PivotX before 2.3.9 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) .php or (2) .php# extension, and then accessing it via unspecified vectors. + + + + + + + + + + + + + + + + cpe:/o:virtualaccess:gw6110a_firmware:9.50 + cpe:/o:virtualaccess:gw6110a_firmware:9.00 + cpe:/h:virtualaccess:gw6110a:- + cpe:/o:virtualaccess:gw6110a_firmware:10.00 + + CVE-2014-0343 + 2014-03-25T16:55:07.027-04:00 + 2014-03-26T11:48:18.507-04:00 + + + 4.9 + ADJACENT_NETWORK + MEDIUM + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-26T11:48:18.443-04:00 + + + + CERT-VN + VU#213046 + + The web interface on Virtual Access GW6110A routers with software 9.00 before 9.09.27, 9.50 before 9.50.21, and 10.00 before 10.00.21 allows remote authenticated users to gain privileges via a modified JavaScript variable. + + + + + + + + + cpe:/a:zohocorp:manageengine_opstor:8.3 + + CVE-2014-0344 + 2014-03-29T16:55:04.060-04:00 + 2014-03-31T13:20:03.827-04:00 + + + 6.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-31T13:20:01.483-04:00 + + + + + CERT-VN + VU#140886 + + Properties.do in ZOHO ManageEngine OpStor before build 8500 does not properly check privilege levels, which allows remote authenticated users to obtain Admin access by using the name parameter in conjunction with a true value of the edit parameter. + + + CVE-2014-0346 + 2014-04-07T18:55:03.940-04:00 + 2014-04-07T18:55:04.020-04:00 + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-0160. Reason: This candidate is a reservation duplicate of CVE-2014-0160. Notes: All CVE users should reference CVE-2014-0160 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. + + + + + + + + + + + + + cpe:/a:websense:triton_web_filter:7.7.3 + cpe:/a:websense:triton_unified_security_center:7.7.3 + cpe:/a:websense:triton_web_security_gateway_anywhere:7.7.3 + cpe:/a:websense:triton_web_security:7.7.3 + cpe:/a:websense:triton_web_security_gateway:7.7.3 + + CVE-2014-0347 + 2014-04-12T00:37:31.377-04:00 + 2014-04-14T13:39:34.860-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-14T13:39:23.983-04:00 + + + + + CERT-VN + VU#568252 + + + CONFIRM + https://www.websense.com/content/mywebsense-hotfixes.aspx?patchid=894&prodidx=20&osidx=0&intidx=0&versionidx=0 + + The Settings module in Websense Triton Unified Security Center 7.7.3 before Hotfix 31, Web Filter 7.7.3 before Hotfix 31, Web Security 7.7.3 before Hotfix 31, Web Security Gateway 7.7.3 before Hotfix 31, and Web Security Gateway Anywhere 7.7.3 before Hotfix 31 allows remote authenticated users to read cleartext passwords by replacing type="password" with type="text" in an INPUT element in the (1) Log Database or (2) User Directories component. + + + + + + + + + + + + cpe:/a:ontariosystems:artiva_healthcare:5.2:mr5 + cpe:/a:ontariosystems:artiva_architect:3.2:mr5 + cpe:/a:ontariosystems:artiva_rm:3.1:mr7 + cpe:/a:ontariosystems:artiva_workstation:1.3.0 + + CVE-2014-0348 + 2014-04-15T06:55:11.947-04:00 + 2014-04-15T12:57:11.933-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-15T12:57:11.637-04:00 + + + + + CERT-VN + VU#215284 + + The Artiva Agency Single Sign-On (SSO) implementation in Artiva Workstation 1.3.x before 1.3.9, Artiva Rm 3.1 MR7, Artiva Healthcare 5.2 MR5, and Artiva Architect 3.2 MR5, when the domain-name option is enabled, allows remote attackers to login to arbitrary domain accounts by using the corresponding username on a Windows client machine. + + + + + + + + + cpe:/a:j2k-codec:j2k-codec:- + + CVE-2014-0349 + 2014-04-12T00:37:31.423-04:00 + 2014-04-14T13:47:35.313-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-14T13:47:35.283-04:00 + + + + CERT-VN + VU#345337 + + Multiple unspecified vulnerabilities in J2k-Codec allow remote attackers to execute arbitrary code via a crafted JPEG 2000 file. + + + + + + + + + + + + + cpe:/a:pocoproject:poco_c%2b%2b_libraries:1.4.6:p2 + cpe:/a:pocoproject:poco_c%2b%2b_libraries:1.4.6:p1 + cpe:/a:pocoproject:poco_c%2b%2b_libraries:1.4.6:p3 + cpe:/a:pocoproject:poco_c%2b%2b_libraries:1.4.6:- + cpe:/a:pocoproject:poco_c%2b%2b_libraries:1.4.5 + + CVE-2014-0350 + 2014-04-25T21:55:04.967-04:00 + 2014-04-28T09:03:33.290-04:00 + + + 6.4 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-28T09:03:33.243-04:00 + + + + + CERT-VN + VU#118748 + + + CONFIRM + https://raw.githubusercontent.com/pocoproject/poco/poco-1.4.6p4-release/CHANGELOG + + The Poco::Net::X509Certificate::verify method in the NetSSL library in POCO C++ Libraries before 1.4.6p4 allows man-in-the-middle attackers to spoof SSL servers via crafted DNS PTR records that are requested during comparison of a server name to a wildcard domain name in an X.509 certificate. + + + + + + + + + + + + + + cpe:/o:zyxel:n300_netusb_nbg-419n_firmware:1.00%28bfq_6%29c0 + cpe:/h:zyxel:n300_netusb_nbg-419n:- + + CVE-2014-0353 + 2014-04-15T06:55:11.963-04:00 + 2014-04-15T13:55:05.707-04:00 + + + 6.1 + ADJACENT_NETWORK + LOW + NONE + COMPLETE + NONE + NONE + http://nvd.nist.gov + 2014-04-15T13:55:01.190-04:00 + + + + + CERT-VN + VU#939260 + + The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allows remote attackers to bypass authentication by using %2F sequences in place of / (slash) characters. + + + + + + + + + + + + + + cpe:/o:zyxel:n300_netusb_nbg-419n_firmware:1.00%28bfq_6%29c0 + cpe:/h:zyxel:n300_netusb_nbg-419n:- + + CVE-2014-0354 + 2014-04-15T06:55:11.993-04:00 + 2014-04-15T13:56:13.817-04:00 + + + 7.8 + ADJACENT_NETWORK + LOW + NONE + COMPLETE + COMPLETE + NONE + http://nvd.nist.gov + 2014-04-15T13:56:13.740-04:00 + + + + + CERT-VN + VU#939260 + + The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 has a hardcoded password of qweasdzxc for an unspecified account, which allows remote attackers to obtain index.asp login access via an HTTP request. + + + + + + + + + + + + + + cpe:/o:zyxel:n300_netusb_nbg-419n_firmware:1.00%28bfq_6%29c0 + cpe:/h:zyxel:n300_netusb_nbg-419n:- + + CVE-2014-0355 + 2014-04-15T06:55:12.027-04:00 + 2014-04-15T13:56:33.943-04:00 + + + 7.9 + ADJACENT_NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-15T13:56:33.850-04:00 + + + + + CERT-VN + VU#939260 + + Multiple stack-based buffer overflows on the ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allow man-in-the-middle attackers to execute arbitrary code via (1) a long temp attribute in a yweather:condition element in a forecastrss file that is processed by the checkWeather function; the (2) WeatherCity or (3) WeatherDegree variable to the detectWeather function; unspecified input to the (4) UpnpAddRunRLQoS, (5) UpnpDeleteRunRLQoS, or (6) UpnpDeletePortCheckType function; or (7) the SET COUNTRY udps command. + + + + + + + + + + + + + + cpe:/o:zyxel:n300_netusb_nbg-419n_firmware:1.00%28bfq_6%29c0 + cpe:/h:zyxel:n300_netusb_nbg-419n:- + + CVE-2014-0356 + 2014-04-15T06:55:12.057-04:00 + 2014-04-15T13:56:38.117-04:00 + + + 7.9 + ADJACENT_NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-15T13:56:38.067-04:00 + + + + + CERT-VN + VU#939260 + + The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allows remote attackers to execute arbitrary code via shell metacharacters in input to the (1) detectWeather, (2) set_language, (3) SystemCommand, or (4) NTPSyncWithHost function in management.c, or a (5) SET COUNTRY, (6) SET WLAN SSID, (7) SET WLAN CHANNEL, (8) SET WLAN STATUS, or (9) SET WLAN COUNTRY udps command. + + + + + + + + + cpe:/a:amtelco:misecuremessages:- + + CVE-2014-0357 + 2014-04-15T06:55:12.087-04:00 + 2014-04-15T14:11:47.333-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-15T14:11:47.270-04:00 + + + + + CERT-VN + VU#251628 + + Amtelco miSecureMessages allows remote attackers to read the messages of arbitrary users via an XML request containing a valid license key and a modified contactID value, as demonstrated by a request from the iOS or Android application. + + + + + + + + + + cpe:/a:xangati:xangati_software_release:- + cpe:/a:xangati:xangati_xnr:- + + CVE-2014-0358 + 2014-04-15T06:55:12.120-04:00 + 2014-04-15T15:07:08.633-04:00 + + + 7.8 + NETWORK + LOW + NONE + COMPLETE + NONE + NONE + http://nvd.nist.gov + 2014-04-15T15:07:08.600-04:00 + + + + + CERT-VN + VU#657622 + + Multiple directory traversal vulnerabilities in Xangati XSR before 11 and XNR before 7 allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the file parameter in a getUpgradeStatus action to servlet/MGConfigData, (2) the download parameter in a download action to servlet/MGConfigData, (3) the download parameter in a port_svc action to servlet/MGConfigData, (4) the file parameter in a getfile action to servlet/Installer, or (5) the binfile parameter to servlet/MGConfigData. + + + + + + + + + + cpe:/a:xangati:xangati_software_release:- + cpe:/a:xangati:xangati_xnr:- + + CVE-2014-0359 + 2014-04-15T06:55:12.150-04:00 + 2014-04-15T15:11:04.623-04:00 + + + 9.0 + NETWORK + LOW + SINGLE_INSTANCE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-15T15:11:04.563-04:00 + + + + + CERT-VN + VU#657622 + + Xangati XSR before 11 and XNR before 7 allows remote attackers to execute arbitrary commands via shell metacharacters in a gui_input_test.pl params parameter to servlet/Installer. + + + CVE-2014-0360 + 2014-04-23T16:55:06.703-04:00 + 2014-04-23T16:55:06.890-04:00 + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-2741. Reason: This candidate is a duplicate of CVE-2014-2741. Notes: All CVE users should reference CVE-2014-2741 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. + + + + + + + + + + + cpe:/o:toshibacommerce:4690_point_of_sale_operating_system:6.2 + cpe:/o:toshibacommerce:4690_point_of_sale_operating_system:6.3 + cpe:/o:toshibacommerce:4690_point_of_sale_operating_system:6.4 + + CVE-2014-0361 + 2014-04-21T18:55:08.240-04:00 + 2014-04-22T09:58:31.083-04:00 + + + 3.0 + LOCAL + MEDIUM + SINGLE_INSTANCE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-22T09:58:30.973-04:00 + + + + + CERT-VN + VU#622950 + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=pos1R1005054 + + The default configuration of IBM 4690 OS, as used in Toshiba Global Commerce Solutions 4690 POS and other products, hashes passwords with the ADXCRYPT algorithm, which makes it easier for context-dependent attackers to obtain sensitive information via a brute-force attack against an ADXCSOUF.DAT file. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-02-20 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-02 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-02-21 + cpe:/a:igniterealtime:smack:3.4.0 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-04-15 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-04-13 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-02-23 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-02-19 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-03 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-16 + cpe:/a:igniterealtime:smack:2.2.1 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-18 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-13 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-04-06 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-04-09 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-29 + cpe:/a:igniterealtime:smack:3.0.0 + cpe:/a:igniterealtime:smack:3.1.0 + cpe:/a:igniterealtime:smack:2.2.0 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-21 + cpe:/a:igniterealtime:smack:3.0.3 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-25 + cpe:/a:igniterealtime:smack:3.0.2 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-26 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-02-18 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-11 + cpe:/a:igniterealtime:smack:3.3.1 + cpe:/a:igniterealtime:smack:3.0.1 + cpe:/a:igniterealtime:smack:3.3.0 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-10 + cpe:/a:igniterealtime:smack:3.2.2 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-12 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-02-16 + cpe:/a:igniterealtime:smack:3.2.0 + cpe:/a:igniterealtime:smack:3.2.1 + + CVE-2014-0363 + 2014-04-30T06:49:04.490-04:00 + 2014-04-30T10:47:23.507-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-30T10:47:22.397-04:00 + + + + CERT-VN + VU#489228 + + + CONFIRM + http://issues.igniterealtime.org/browse/SMACK-410 + + + CONFIRM + http://community.igniterealtime.org/blogs/ignite/2014/04/17/asmack-400-rc1-has-been-released + + The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate chain. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-02-20 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-02 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-02-21 + cpe:/a:igniterealtime:smack:3.4.0 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-04-15 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-04-13 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-02-23 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-02-19 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-03 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-16 + cpe:/a:igniterealtime:smack:2.2.1 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-18 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-13 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-04-06 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-04-09 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-29 + cpe:/a:igniterealtime:smack:3.0.0 + cpe:/a:igniterealtime:smack:3.1.0 + cpe:/a:igniterealtime:smack:2.2.0 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-21 + cpe:/a:igniterealtime:smack:3.0.3 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-25 + cpe:/a:igniterealtime:smack:3.0.2 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-26 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-02-18 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-11 + cpe:/a:igniterealtime:smack:3.3.1 + cpe:/a:igniterealtime:smack:3.0.1 + cpe:/a:igniterealtime:smack:3.3.0 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-10 + cpe:/a:igniterealtime:smack:3.2.2 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-12 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-02-16 + cpe:/a:igniterealtime:smack:3.2.0 + cpe:/a:igniterealtime:smack:3.2.1 + + CVE-2014-0364 + 2014-04-30T06:49:04.520-04:00 + 2014-04-30T11:07:13.453-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-30T11:07:13.203-04:00 + + + + CERT-VN + VU#489228 + + + CONFIRM + http://community.igniterealtime.org/blogs/ignite/2014/04/17/asmack-400-rc1-has-been-released + + The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to spoof IQ responses via a crafted attribute. + + + + + + + + + + + + cpe:/a:oracle:e-business_suite:12.2.2 + cpe:/a:oracle:e-business_suite:12.1.3 + cpe:/a:oracle:e-business_suite:12.0.6 + cpe:/a:oracle:e-business_suite:11.5.10.2 + + CVE-2014-0366 + 2014-01-15T11:08:06.610-05:00 + 2014-02-06T23:51:40.737-05:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-15T13:42:05.773-05:00 + + + + SECTRACK + 1029619 + + + BID + 64828 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56471 + + + OSVDB + 102090 + + Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, and 12.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Attachments. + + + + + + + + + + + cpe:/a:oracle:hyperion:11.1.2.3 + cpe:/a:oracle:hyperion:11.1.2.2 + cpe:/a:oracle:hyperion:11.1.2.1 + + CVE-2014-0367 + 2014-01-15T11:08:06.657-05:00 + 2014-02-06T23:51:40.833-05:00 + + + 5.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-15T13:46:24.590-05:00 + + + + BID + 64814 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56469 + + + OSVDB + 102114 + + Unspecified vulnerability in the Hyperion Essbase Administration Services component in Oracle Hyperion 11.1.2.1, 11.1.2.2, and 11.1.2.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Admin Console. + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.7.0:update_45 + cpe:/a:oracle:jdk:1.7.0:update_45 + cpe:/a:oracle:jre:1.6.0:update_65 + cpe:/a:oracle:jre:1.5.0:update_55 + cpe:/a:oracle:jdk:1.5.0:update_55 + cpe:/a:oracle:jdk:1.6.0:update_65 + + CVE-2014-0368 + 2014-01-15T11:08:06.687-05:00 + 2014-04-01T02:28:09.497-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-15T13:51:14.270-05:00 + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1052919 + + + UBUNTU + USN-2124-1 + + + UBUNTU + USN-2089-1 + + + SECTRACK + 1029608 + + + BID + 64930 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56535 + + + SECUNIA + 56486 + + + SECUNIA + 56485 + + + SECUNIA + 56432 + + + REDHAT + RHSA-2014:0136 + + + REDHAT + RHSA-2014:0135 + + + REDHAT + RHSA-2014:0134 + + + REDHAT + RHSA-2014:0097 + + + REDHAT + RHSA-2014:0030 + + + REDHAT + RHSA-2014:0027 + + + REDHAT + RHSA-2014:0026 + + + HP + SSRT101455 + + + HP + HPSBUX02973 + + + HP + HPSBUX02972 + + + HP + SSRT101454 + + + SUSE + openSUSE-SU-2014:0180 + + + SUSE + openSUSE-SU-2014:0177 + + + SUSE + openSUSE-SU-2014:0174 + + + SUSE + SUSE-SU-2014:0451 + + + SUSE + SUSE-SU-2014:0266 + + + SUSE + SUSE-SU-2014:0246 + + + MISC + http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/e6160aedadd5 + + Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45, and Java SE Embedded 7u45, allows remote attackers to affect confidentiality via unknown vectors related to Networking. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to incorrect permission checks when listening on a socket, which allows attackers to escape the sandbox. + + + + + + + + + + cpe:/a:oracle:siebel_crm:8.1.1 + cpe:/a:oracle:siebel_crm:8.2.2 + + CVE-2014-0369 + 2014-01-15T11:08:06.720-05:00 + 2014-02-06T23:51:41.003-05:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-15T13:53:21.960-05:00 + + + + SECTRACK + 1029622 + + + BID + 64832 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56480 + + + OSVDB + 102107 + + Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Java Integration. + + + + + + + + + + cpe:/a:oracle:siebel_crm:8.1.1 + cpe:/a:oracle:siebel_crm:8.2.2 + + CVE-2014-0370 + 2014-01-15T11:08:06.767-05:00 + 2014-02-06T23:51:41.083-05:00 + + + 2.8 + NETWORK + MEDIUM + MULTIPLE_INSTANCES + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-01-15T13:54:58.023-05:00 + + + + SECTRACK + 1029622 + + + BID + 64837 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56481 + + + OSVDB + 102108 + + Unspecified vulnerability in the Siebel Life Sciences component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect availability via unknown vectors related to Clinical Trip Report. + + + + + + + + + + + + + + cpe:/a:oracle:supply_chain_products_suite_sql-server:7.3.1 + cpe:/a:oracle:supply_chain_products_suite:7.2.0.3 + cpe:/a:oracle:supply_chain_products_suite_sql-server:7.3.0 + cpe:/a:oracle:supply_chain_products_suite_sql-server:12.2.1 + cpe:/a:oracle:supply_chain_products_suite_sql-server:12.2.0 + cpe:/a:oracle:supply_chain_products_suite_sql-server:12.2.2 + + CVE-2014-0371 + 2014-01-15T11:08:06.797-05:00 + 2014-02-06T23:51:41.177-05:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-15T14:02:04.567-05:00 + + + + SECTRACK + 1029620 + + + BID + 64886 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56474 + + + OSVDB + 102098 + + Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 7.2.0.3 SQL-Server, 7.3.0.x, 7.3.1.x, 12.2.0, 12.2.1, and 12.2.2 allows remote authenticated users to affect integrity via unknown vectors related to DM Others. + + + + + + + + + + + + + + cpe:/a:oracle:supply_chain_products_suite_sql-server:7.3.1 + cpe:/a:oracle:supply_chain_products_suite:7.2.0.3 + cpe:/a:oracle:supply_chain_products_suite_sql-server:7.3.0 + cpe:/a:oracle:supply_chain_products_suite_sql-server:12.2.1 + cpe:/a:oracle:supply_chain_products_suite_sql-server:12.2.0 + cpe:/a:oracle:supply_chain_products_suite_sql-server:12.2.2 + + CVE-2014-0372 + 2014-01-15T11:08:06.830-05:00 + 2014-02-06T23:51:41.253-05:00 + + + 5.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-15T14:03:53.757-05:00 + + + + SECTRACK + 1029620 + + + BID + 64826 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56474 + + + OSVDB + 102103 + + Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 7.2.0.3 SQL-Server, 7.3.0, 7.3.1, 12.2.1, and 12.2.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to DM Others. + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.7.0:update_45 + cpe:/a:oracle:jdk:1.7.0:update_45 + cpe:/a:oracle:jre:1.6.0:update_65 + cpe:/a:oracle:jre:1.5.0:update_55 + cpe:/a:oracle:jdk:1.5.0:update_55 + cpe:/a:oracle:jdk:1.6.0:update_65 + + CVE-2014-0373 + 2014-01-15T11:08:06.860-05:00 + 2014-04-01T02:28:09.873-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-15T14:15:37.270-05:00 + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1051699 + + + UBUNTU + USN-2124-1 + + + UBUNTU + USN-2089-1 + + + SECTRACK + 1029608 + + + BID + 64922 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56535 + + + SECUNIA + 56485 + + + SECUNIA + 56432 + + + REDHAT + RHSA-2014:0136 + + + REDHAT + RHSA-2014:0135 + + + REDHAT + RHSA-2014:0134 + + + REDHAT + RHSA-2014:0097 + + + REDHAT + RHSA-2014:0030 + + + REDHAT + RHSA-2014:0027 + + + REDHAT + RHSA-2014:0026 + + + HP + SSRT101455 + + + HP + HPSBUX02973 + + + HP + HPSBUX02972 + + + HP + SSRT101454 + + + SUSE + openSUSE-SU-2014:0180 + + + SUSE + openSUSE-SU-2014:0177 + + + SUSE + openSUSE-SU-2014:0174 + + + SUSE + SUSE-SU-2014:0451 + + + SUSE + SUSE-SU-2014:0266 + + + SUSE + SUSE-SU-2014:0246 + + + MISC + http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/496c51673dec + + Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serviceability. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to throwing of an incorrect exception when SnmpStatusException should have been used in the SNMP implementation, which allows attackers to escape the sandbox. + + + + + + + + + cpe:/a:oracle:fusion_middleware:11.1.1.6.0 + + CVE-2014-0374 + 2014-01-15T11:08:06.890-05:00 + 2014-02-06T23:51:41.427-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-15T14:18:18.510-05:00 + + + + SECTRACK + 1029613 + + + BID + 64830 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56464 + + + OSVDB + 102093 + + Unspecified vulnerability in the Oracle Portal component in Oracle Fusion Middleware 11.1.1.6 allows remote attackers to affect integrity via unknown vectors related to Page Parameters and Events. + + + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.7.0:update_45 + cpe:/a:oracle:jdk:1.7.0:update_45 + cpe:/a:oracle:jre:1.6.0:update_65 + cpe:/a:oracle:jdk:1.6.0:update_65 + + CVE-2014-0375 + 2014-01-15T11:08:06.923-05:00 + 2014-04-01T02:28:10.043-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-15T14:18:17.307-05:00 + + + + XF + oracle-cpujan2014-cve20140375(90339) + + + SECTRACK + 1029608 + + + BID + 64916 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56535 + + + SECUNIA + 56485 + + + REDHAT + RHSA-2014:0135 + + + REDHAT + RHSA-2014:0134 + + + REDHAT + RHSA-2014:0030 + + + OSVDB + 102007 + + + HP + SSRT101455 + + + HP + HPSBUX02973 + + + HP + HPSBUX02972 + + + HP + SSRT101454 + + + SUSE + SUSE-SU-2014:0451 + + + SUSE + SUSE-SU-2014:0266 + + + SUSE + SUSE-SU-2014:0246 + + Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5898 and CVE-2014-0403. + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.7.0:update_45 + cpe:/a:oracle:jdk:1.7.0:update_45 + cpe:/a:oracle:jre:1.6.0:update_65 + cpe:/a:oracle:jre:1.5.0:update_55 + cpe:/a:oracle:jdk:1.5.0:update_55 + cpe:/a:oracle:jdk:1.6.0:update_65 + + CVE-2014-0376 + 2014-01-15T11:08:06.953-05:00 + 2014-04-01T02:28:10.123-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-15T14:31:50.107-05:00 + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1051923 + + + XF + oracle-cpujan2014-cve20140376(90350) + + + UBUNTU + USN-2124-1 + + + UBUNTU + USN-2089-1 + + + SECTRACK + 1029608 + + + BID + 64907 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56535 + + + SECUNIA + 56486 + + + SECUNIA + 56485 + + + SECUNIA + 56432 + + + REDHAT + RHSA-2014:0136 + + + REDHAT + RHSA-2014:0135 + + + REDHAT + RHSA-2014:0134 + + + REDHAT + RHSA-2014:0097 + + + REDHAT + RHSA-2014:0030 + + + REDHAT + RHSA-2014:0027 + + + REDHAT + RHSA-2014:0026 + + + OSVDB + 102018 + + + HP + SSRT101455 + + + HP + HPSBUX02973 + + + HP + HPSBUX02972 + + + HP + SSRT101454 + + + SUSE + openSUSE-SU-2014:0180 + + + SUSE + openSUSE-SU-2014:0177 + + + SUSE + openSUSE-SU-2014:0174 + + + SUSE + SUSE-SU-2014:0451 + + + SUSE + SUSE-SU-2014:0266 + + + SUSE + SUSE-SU-2014:0246 + + + MISC + http://hg.openjdk.java.net/jdk7u/jdk7u/jaxp/rev/783ceae9b736 + + + MISC + http://hg.openjdk.java.net/jdk7u/jdk7u/jaxp/rev/42be8e6266ab + + Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect integrity via vectors related to JAXP. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to an improper check for "code permissions when creating document builder factories." + + + + + + + + + + + + cpe:/a:oracle:database_server:11.1.0.7 + cpe:/a:oracle:database_server:11.2.0.4 + cpe:/a:oracle:database_server:11.2.0.3 + cpe:/a:oracle:database_server:12.1.0.1 + + CVE-2014-0377 + 2014-01-15T11:08:06.987-05:00 + 2014-03-05T23:50:24.753-05:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-15T14:10:57.517-05:00 + + + + SECTRACK + 1029607 + + + BID + 64824 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56452 + + + OSVDB + 102081 + + + SUSE + SUSE-SU-2014:0130 + + Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, and 12.1.0.1 allows remote authenticated users to affect confidentiality via vectors related to SYS tables. + + + + + + + + + + + + cpe:/a:oracle:database_server:11.1.0.7 + cpe:/a:oracle:database_server:11.2.0.4 + cpe:/a:oracle:database_server:11.2.0.3 + cpe:/a:oracle:database_server:12.1.0.1 + + CVE-2014-0378 + 2014-01-15T11:08:07.033-05:00 + 2014-03-05T23:50:24.830-05:00 + + + 4.1 + LOCAL + MEDIUM + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-15T14:22:17.483-05:00 + + + + SECTRACK + 1029607 + + + BID + 64812 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56452 + + + OSVDB + 102080 + + + SUSE + SUSE-SU-2014:0130 + + Unspecified vulnerability in the Spatial component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, and 12.1.0.1 allows local users to affect confidentiality, integrity, and availability via unknown vectors. + + + + + + + + + + + + + + cpe:/a:oracle:supply_chain_products_suite_sql-server:7.3.1 + cpe:/a:oracle:supply_chain_products_suite:7.2.0.3 + cpe:/a:oracle:supply_chain_products_suite_sql-server:7.3.0 + cpe:/a:oracle:supply_chain_products_suite_sql-server:12.2.1 + cpe:/a:oracle:supply_chain_products_suite_sql-server:12.2.0 + cpe:/a:oracle:supply_chain_products_suite_sql-server:12.2.2 + + CVE-2014-0379 + 2014-01-15T11:08:07.080-05:00 + 2014-02-06T23:51:41.847-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-15T14:24:21.017-05:00 + + + + SECTRACK + 1029620 + + + BID + 64857 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56474 + + + OSVDB + 102097 + + Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 7.2.0.3 SQL-Server, 7.3.0.x, 7.3.1.x, 12.2.0, 12.2.1, and 12.2.2 allows remote attackers to affect integrity via unknown vectors related to DM Others. + + + + + + + + + + cpe:/a:oracle:peoplesoft_products:8.53 + cpe:/a:oracle:peoplesoft_products:8.52 + + CVE-2014-0380 + 2014-01-15T11:08:07.110-05:00 + 2014-02-06T23:51:41.943-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-15T14:27:25.740-05:00 + + + + SECTRACK + 1029623 + + + BID + 64865 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56478 + + + OSVDB + 102037 + + Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect integrity via vectors related to MultiChannel Framework (MCF). + + + + + + + + + + cpe:/a:oracle:peoplesoft_products:8.53 + cpe:/a:oracle:peoplesoft_products:8.52 + + CVE-2014-0381 + 2014-01-15T11:08:07.127-05:00 + 2014-02-06T23:51:42.020-05:00 + + + 2.6 + NETWORK + HIGH + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-15T14:28:45.053-05:00 + + + + SECTRACK + 1029623 + + + BID + 64892 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56478 + + + OSVDB + 102045 + + Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect integrity via vectors related to PIA Core Technology, a different vulnerability than CVE-2014-0445. + + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.7.0:update_45 + cpe:/a:oracle:jdk:1.7.0:update_45 + cpe:/a:oracle:javafx:2.2.45 + + CVE-2014-0382 + 2014-01-15T11:08:07.157-05:00 + 2014-03-16T00:44:15.643-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-01-15T14:31:11.933-05:00 + + + + XF + oracle-cpujan2014-cve20140382(90355) + + + SECTRACK + 1029608 + + + BID + 64936 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56535 + + + SECUNIA + 56485 + + + SECUNIA + 56484 + + + REDHAT + RHSA-2014:0030 + + + OSVDB + 102026 + + + HP + SSRT101454 + + + HP + HPSBUX02972 + + Unspecified vulnerability in Oracle Java SE 7u45 and JavaFX 2.2.45 allows remote attackers to affect availability via unknown vectors related to JavaFX. + + + + + + + + + + cpe:/a:oracle:fusion_middleware:11.1.2.1.0 + cpe:/a:oracle:fusion_middleware:11.1.2.0 + + CVE-2014-0383 + 2014-01-15T11:08:07.203-05:00 + 2014-02-06T23:51:42.193-05:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-15T14:33:18.467-05:00 + + + + SECTRACK + 1029613 + + + BID + 64842 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56459 + + + OSVDB + 102102 + + Unspecified vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.2.0 and 11.1.2.1 allows remote authenticated users to affect confidentiality via unknown vectors related to Identity Console. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:mysql:5.6.1 + cpe:/a:oracle:mysql:5.6.3 + cpe:/a:oracle:mysql:5.6.2 + cpe:/a:oracle:mysql:5.6.5 + cpe:/a:oracle:mysql:5.5.16 + cpe:/a:oracle:mysql:5.6.4 + cpe:/a:oracle:mysql:5.6.7 + cpe:/a:oracle:mysql:5.6.6 + cpe:/a:oracle:mysql:5.6.9 + cpe:/a:mysql:mysql:5.5.0 + cpe:/a:mysql:mysql:5.5.1 + cpe:/a:mysql:mysql:5.5.7 + cpe:/a:mysql:mysql:5.5.8 + cpe:/a:mysql:mysql:5.5.5 + cpe:/a:mysql:mysql:5.5.6 + cpe:/a:oracle:mysql:5.5.17 + cpe:/a:oracle:mysql:5.5.18 + cpe:/a:mysql:mysql:5.5.9 + cpe:/a:oracle:mysql:5.5.19 + cpe:/a:oracle:mysql:5.5.12 + cpe:/a:oracle:mysql:5.5.13 + cpe:/a:oracle:mysql:5.5.14 + cpe:/a:oracle:mysql:5.5.15 + cpe:/a:mysql:mysql:5.5.3 + cpe:/a:mysql:mysql:5.5.4 + cpe:/a:oracle:mysql:5.5.10 + cpe:/a:mysql:mysql:5.5.2 + cpe:/a:oracle:mysql:5.5.11 + cpe:/a:oracle:mysql:5.5.27 + cpe:/a:oracle:mysql:5.6.10 + cpe:/a:oracle:mysql:5.6.12 + cpe:/a:oracle:mysql:5.6.11 + cpe:/a:oracle:mysql:5.6.14 + cpe:/a:oracle:mysql:5.6.13 + cpe:/a:oracle:mysql:5.6.15 + cpe:/a:oracle:mysql:5.5.29 + cpe:/a:oracle:mysql:5.5.28 + cpe:/a:oracle:mysql:5.5.25 + cpe:/a:oracle:mysql:5.5.26 + cpe:/a:oracle:mysql:5.6.8 + cpe:/a:oracle:mysql:5.5.23 + cpe:/a:oracle:mysql:5.5.24 + cpe:/a:oracle:mysql:5.5.21 + cpe:/a:oracle:mysql:5.5.22 + cpe:/a:oracle:mysql:5.5.20 + cpe:/a:oracle:mysql:5.5.31 + cpe:/a:oracle:mysql:5.5.33 + cpe:/a:oracle:mysql:5.5.32 + cpe:/a:oracle:mysql:5.5.35 + cpe:/a:oracle:mysql:5.5.34 + cpe:/a:oracle:mysql:5.5.30 + cpe:/a:oracle:mysql:5.5.25:a + cpe:/a:oracle:mysql:5.6.0 + + CVE-2014-0384 + 2014-04-15T20:55:23.777-04:00 + 2014-04-16T11:58:24.497-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-16T11:58:24.137-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.35 and earlier and 5.6.15 and earlier allows remote authenticated users to affect availability via vectors related to XML. + + + + + + + + + + cpe:/a:oracle:jre:1.7.0:update_45 + cpe:/a:oracle:jdk:1.7.0:update_45 + + CVE-2014-0385 + 2014-01-15T11:08:07.237-05:00 + 2014-02-06T23:51:42.287-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-01-15T14:34:08.420-05:00 + + + + SECTRACK + 1029608 + + + BID + 64901 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56485 + + + OSVDB + 101998 + + Unspecified vulnerability in Oracle Java SE 7u45, when installing on OS X, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Install. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mysql:mysql:5.5.0 + cpe:/a:oracle:mysql:5.1.52:sp1 + cpe:/a:mysql:mysql:5.5.1 + cpe:/a:mysql:mysql:5.5.7 + cpe:/a:mysql:mysql:5.5.8 + cpe:/a:mysql:mysql:5.5.5 + cpe:/a:mysql:mysql:5.5.6 + cpe:/a:mysql:mysql:5.1.49:sp1 + cpe:/a:mysql:mysql:5.1.46:sp1 + cpe:/a:mysql:mysql:5.5.9 + cpe:/a:mysql:mysql:5.5.3 + cpe:/a:mysql:mysql:5.5.4 + cpe:/a:mysql:mysql:5.5.2 + cpe:/a:oracle:mysql:5.6.10 + cpe:/a:mysql:mysql:5.1.40:sp1 + cpe:/a:oracle:mysql:5.6.12 + cpe:/a:mysql:mysql:5.1.43:sp1 + cpe:/a:oracle:mysql:5.6.11 + cpe:/a:oracle:mysql:5.6.13 + cpe:/a:mysql:mysql:5.1.37:sp1 + cpe:/a:oracle:mysql:5.1.62 + cpe:/a:oracle:mysql:5.1.61 + cpe:/a:oracle:mysql:5.1.60 + cpe:/a:mysql:mysql:5.1.34:sp1 + cpe:/a:oracle:mysql:5.1.66 + cpe:/a:oracle:mysql:5.1.65 + cpe:/a:oracle:mysql:5.1.64 + cpe:/a:oracle:mysql:5.1.63 + cpe:/a:oracle:mysql:5.1.69 + cpe:/a:oracle:mysql:5.1.68 + cpe:/a:mysql:mysql:5.1.23_bk + cpe:/a:mysql:mysql:5.1.31:sp1 + cpe:/a:oracle:mysql:5.5.31 + cpe:/a:oracle:mysql:5.5.33 + cpe:/a:mysql:mysql:5.1.5 + cpe:/a:oracle:mysql:5.5.32 + cpe:/a:mysql:mysql:5.1.3 + cpe:/a:mysql:mysql:5.1 + cpe:/a:mysql:mysql:5.1.4 + cpe:/a:mysql:mysql:5.1.1 + cpe:/a:mysql:mysql:5.1.2 + cpe:/a:mysql:mysql:5.1.23:a + cpe:/a:oracle:mysql:5.1.67 + cpe:/a:mysql:mysql:5.1.24 + cpe:/a:oracle:mysql:5.1.51 + cpe:/a:oracle:mysql:5.5.30 + cpe:/a:mysql:mysql:5.1.26 + cpe:/a:mysql:mysql:5.1.25 + cpe:/a:oracle:mysql:5.1.53 + cpe:/a:oracle:mysql:5.1.52 + cpe:/a:oracle:mysql:5.1.55 + cpe:/a:oracle:mysql:5.1.54 + cpe:/a:oracle:mysql:5.1.57 + cpe:/a:oracle:mysql:5.1.59 + cpe:/a:oracle:mysql:5.6.0 + cpe:/a:oracle:mysql:5.1.58 + cpe:/a:oracle:mysql:5.1.56 + cpe:/a:oracle:mysql:5.6.1 + cpe:/a:oracle:mysql:5.6.3 + cpe:/a:oracle:mysql:5.6.2 + cpe:/a:oracle:mysql:5.6.5 + cpe:/a:oracle:mysql:5.6.4 + cpe:/a:oracle:mysql:5.5.16 + cpe:/a:oracle:mysql:5.6.7 + cpe:/a:oracle:mysql:5.6.6 + cpe:/a:oracle:mysql:5.6.9 + cpe:/a:mysql:mysql:5.1.14 + cpe:/a:mysql:mysql:5.1.15 + cpe:/a:mysql:mysql:5.1.13 + cpe:/a:mysql:mysql:5.1.9 + cpe:/a:mysql:mysql:5.1.29 + cpe:/a:mysql:mysql:5.1.28 + cpe:/a:mysql:mysql:5.1.27 + cpe:/a:oracle:mysql:5.5.17 + cpe:/a:oracle:mysql:5.5.18 + cpe:/a:oracle:mysql:5.5.19 + cpe:/a:oracle:mysql:5.5.12 + cpe:/a:mysql:mysql:5.1.22 + cpe:/a:oracle:mysql:5.5.13 + cpe:/a:mysql:mysql:5.1.21 + cpe:/a:oracle:mysql:5.5.14 + cpe:/a:mysql:mysql:5.1.20 + cpe:/a:oracle:mysql:5.5.15 + cpe:/a:mysql:mysql:5.1.6 + cpe:/a:oracle:mysql:5.5.10 + cpe:/a:mysql:mysql:5.1.7 + cpe:/a:oracle:mysql:5.1.70 + cpe:/a:mysql:mysql:5.1.8 + cpe:/a:oracle:mysql:5.5.11 + cpe:/a:mysql:mysql:5.1.23 + cpe:/a:mysql:mysql:5.1.5a + cpe:/a:oracle:mysql:5.5.27 + cpe:/a:oracle:mysql:5.1.71 + cpe:/a:mysql:mysql:5.1.46 + cpe:/a:mysql:mysql:5.1.47 + cpe:/a:mysql:mysql:5.1.48 + cpe:/a:mysql:mysql:5.1.17 + cpe:/a:mysql:mysql:5.1.16 + cpe:/a:mysql:mysql:5.1.19 + cpe:/a:mysql:mysql:5.1.18 + cpe:/a:oracle:mysql:5.5.29 + cpe:/a:oracle:mysql:5.5.28 + cpe:/a:oracle:mysql:5.5.25 + cpe:/a:oracle:mysql:5.5.26 + cpe:/a:oracle:mysql:5.6.8 + cpe:/a:mysql:mysql:5.1.11 + cpe:/a:oracle:mysql:5.5.23 + cpe:/a:mysql:mysql:5.1.10 + cpe:/a:oracle:mysql:5.5.24 + cpe:/a:oracle:mysql:5.5.21 + cpe:/a:mysql:mysql:5.1.12 + cpe:/a:oracle:mysql:5.5.22 + cpe:/a:oracle:mysql:5.5.20 + cpe:/a:mysql:mysql:5.1.32-bzr + cpe:/a:mysql:mysql:5.1.36 + cpe:/a:mysql:mysql:5.1.37 + cpe:/a:mysql:mysql:5.1.35 + cpe:/a:mysql:mysql:5.1.23a + cpe:/a:mysql:mysql:5.1.40 + cpe:/a:mysql:mysql:5.1.50 + cpe:/a:mysql:mysql:5.1.49 + cpe:/a:mysql:mysql:5.1.45 + cpe:/a:mysql:mysql:5.1.44 + cpe:/a:mysql:mysql:5.1.43 + cpe:/a:mysql:mysql:5.1.42 + cpe:/a:mysql:mysql:5.1.41 + cpe:/a:oracle:mysql:5.5.25:a + cpe:/a:mysql:mysql:5.1.39 + cpe:/a:mysql:mysql:5.1.38 + cpe:/a:mysql:mysql:5.1.34 + cpe:/a:mysql:mysql:5.1.31 + cpe:/a:mysql:mysql:5.1.30 + cpe:/a:mysql:mysql:5.1.33 + cpe:/a:mysql:mysql:5.1.32 + + CVE-2014-0386 + 2014-01-15T11:08:07.267-05:00 + 2014-03-05T23:50:25.407-05:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-01-15T14:38:20.693-05:00 + + + + XF + oracle-cpujan2014-cve20140386(90380) + + + BID + 64904 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + DEBIAN + DSA-2848 + + + DEBIAN + DSA-2845 + + + UBUNTU + USN-2086-1 + + + SECUNIA + 56580 + + + SECUNIA + 56541 + + + SECUNIA + 56491 + + + REDHAT + RHSA-2014:0189 + + + REDHAT + RHSA-2014:0186 + + + REDHAT + RHSA-2014:0173 + + + REDHAT + RHSA-2014:0164 + + + OSVDB + 102069 + + Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.71 and earlier, 5.5.33 and earlier, and 5.6.13 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. + + + + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.7.0:update_45 + cpe:/a:oracle:jdk:1.7.0:update_45 + cpe:/a:oracle:jre:1.6.0:update_65 + cpe:/a:oracle:jdk:1.6.0:update_65 + + CVE-2014-0387 + 2014-01-15T11:08:07.330-05:00 + 2014-04-01T02:28:10.903-04:00 + + + 7.6 + NETWORK + HIGH + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-01-15T14:57:30.327-05:00 + + + + SECTRACK + 1029608 + + + BID + 64882 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56535 + + + SECUNIA + 56485 + + + REDHAT + RHSA-2014:0135 + + + REDHAT + RHSA-2014:0134 + + + REDHAT + RHSA-2014:0030 + + + OSVDB + 102002 + + + HP + SSRT101455 + + + HP + HPSBUX02973 + + + HP + HPSBUX02972 + + + HP + SSRT101454 + + + SUSE + SUSE-SU-2014:0451 + + + SUSE + SUSE-SU-2014:0266 + + + SUSE + SUSE-SU-2014:0246 + + Unspecified vulnerability in Oracle Java SE 6u65 and Java SE 7u45, when running on Firefox, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. + + + + + + + + + + cpe:/a:oracle:peoplesoft_products:9.2 + cpe:/a:oracle:peoplesoft_products:9.1 + + CVE-2014-0388 + 2014-01-15T11:08:07.360-05:00 + 2014-02-06T23:51:42.550-05:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-15T14:48:18.597-05:00 + + + + SECTRACK + 1029623 + + + BID + 64878 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56477 + + + OSVDB + 102040 + + Unspecified vulnerability in the PeopleSoft Enterprise HRMS Human Resources component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Org and Workforce Dev. + + + + + + + + + cpe:/a:oracle:ilearning:6.0 + + CVE-2014-0389 + 2014-01-15T11:08:07.390-05:00 + 2014-02-06T23:51:42.630-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-15T14:49:58.147-05:00 + + + + SECTRACK + 1029621 + + + BID + 64845 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56482 + + + OSVDB + 102109 + + Unspecified vulnerability in Oracle iLearning 6.0 allows remote attackers to affect integrity via unknown vectors related to Learner Pages. + + + + + + + + + cpe:/o:sun:sunos:5.10 + + CVE-2014-0390 + 2014-01-15T11:08:07.423-05:00 + 2014-02-06T23:51:42.723-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-15T14:51:23.540-05:00 + + + + XF + oracle-cpujan2014-cve20140390(90362) + + + BID + 64859 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56488 + + + OSVDB + 102052 + + Unspecified vulnerability in Oracle Solaris 10 allows remote attackers to affect integrity via unknown vectors related to Java Web Console. + + + + + + + + + + + + cpe:/a:oracle:fusion_middleware:11.1.2.1.0 + cpe:/a:oracle:fusion_middleware:11.1.1.5.0 + cpe:/a:oracle:fusion_middleware:11.1.1.7.0 + cpe:/a:oracle:fusion_middleware:11.1.2.0 + + CVE-2014-0391 + 2014-01-15T11:08:07.437-05:00 + 2014-02-06T23:51:42.800-05:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-15T15:00:05.080-05:00 + + + + SECTRACK + 1029613 + + + BID + 64829 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56459 + + + OSVDB + 102099 + + Unspecified vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.1.2.0, and 11.1.2.1 allows remote attackers to affect confidentiality via unknown vectors related to End User Self Service. + + + + + + + + + + cpe:/a:oracle:peoplesoft_products:9.2 + cpe:/a:oracle:peoplesoft_products:9.1 + + CVE-2014-0392 + 2014-01-15T11:08:07.470-05:00 + 2014-02-06T23:51:42.897-05:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-15T14:52:38.853-05:00 + + + + SECTRACK + 1029623 + + + BID + 64874 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56477 + + + OSVDB + 102039 + + Unspecified vulnerability in the PeopleSoft Enterprise HRMS component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Security. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mysql:mysql:5.5.0 + cpe:/a:oracle:mysql:5.1.52:sp1 + cpe:/a:mysql:mysql:5.5.1 + cpe:/a:mysql:mysql:5.5.7 + cpe:/a:mysql:mysql:5.5.8 + cpe:/a:mysql:mysql:5.5.5 + cpe:/a:mysql:mysql:5.5.6 + cpe:/a:mysql:mysql:5.1.49:sp1 + cpe:/a:mysql:mysql:5.1.46:sp1 + cpe:/a:mysql:mysql:5.5.9 + cpe:/a:mysql:mysql:5.5.3 + cpe:/a:mysql:mysql:5.5.4 + cpe:/a:mysql:mysql:5.5.2 + cpe:/a:oracle:mysql:5.6.10 + cpe:/a:mysql:mysql:5.1.40:sp1 + cpe:/a:oracle:mysql:5.6.12 + cpe:/a:mysql:mysql:5.1.43:sp1 + cpe:/a:oracle:mysql:5.6.11 + cpe:/a:oracle:mysql:5.6.13 + cpe:/a:mysql:mysql:5.1.37:sp1 + cpe:/a:oracle:mysql:5.1.62 + cpe:/a:oracle:mysql:5.1.61 + cpe:/a:mysql:mysql:5.1.34:sp1 + cpe:/a:oracle:mysql:5.1.60 + cpe:/a:oracle:mysql:5.1.66 + cpe:/a:oracle:mysql:5.1.65 + cpe:/a:oracle:mysql:5.1.64 + cpe:/a:oracle:mysql:5.1.63 + cpe:/a:oracle:mysql:5.1.69 + cpe:/a:mysql:mysql:5.1.23_bk + cpe:/a:oracle:mysql:5.1.68 + cpe:/a:mysql:mysql:5.1.31:sp1 + cpe:/a:oracle:mysql:5.5.31 + cpe:/a:oracle:mysql:5.5.33 + cpe:/a:mysql:mysql:5.1.5 + cpe:/a:oracle:mysql:5.5.32 + cpe:/a:mysql:mysql:5.1.3 + cpe:/a:mysql:mysql:5.1 + cpe:/a:mysql:mysql:5.1.4 + cpe:/a:mysql:mysql:5.1.1 + cpe:/a:mysql:mysql:5.1.2 + cpe:/a:mysql:mysql:5.1.23:a + cpe:/a:oracle:mysql:5.1.67 + cpe:/a:mysql:mysql:5.1.24 + cpe:/a:oracle:mysql:5.5.30 + cpe:/a:mysql:mysql:5.1.26 + cpe:/a:oracle:mysql:5.1.51 + cpe:/a:mysql:mysql:5.1.25 + cpe:/a:oracle:mysql:5.1.53 + cpe:/a:oracle:mysql:5.1.52 + cpe:/a:oracle:mysql:5.1.55 + cpe:/a:oracle:mysql:5.1.54 + cpe:/a:oracle:mysql:5.1.57 + cpe:/a:oracle:mysql:5.1.59 + cpe:/a:oracle:mysql:5.6.0 + cpe:/a:oracle:mysql:5.1.58 + cpe:/a:oracle:mysql:5.1.56 + cpe:/a:oracle:mysql:5.6.1 + cpe:/a:oracle:mysql:5.6.3 + cpe:/a:oracle:mysql:5.6.2 + cpe:/a:oracle:mysql:5.6.5 + cpe:/a:oracle:mysql:5.5.16 + cpe:/a:oracle:mysql:5.6.4 + cpe:/a:oracle:mysql:5.6.7 + cpe:/a:oracle:mysql:5.6.6 + cpe:/a:oracle:mysql:5.6.9 + cpe:/a:mysql:mysql:5.1.14 + cpe:/a:mysql:mysql:5.1.15 + cpe:/a:mysql:mysql:5.1.13 + cpe:/a:mysql:mysql:5.1.9 + cpe:/a:mysql:mysql:5.1.29 + cpe:/a:mysql:mysql:5.1.28 + cpe:/a:mysql:mysql:5.1.27 + cpe:/a:oracle:mysql:5.5.17 + cpe:/a:oracle:mysql:5.5.18 + cpe:/a:oracle:mysql:5.5.19 + cpe:/a:oracle:mysql:5.5.12 + cpe:/a:mysql:mysql:5.1.22 + cpe:/a:oracle:mysql:5.5.13 + cpe:/a:mysql:mysql:5.1.21 + cpe:/a:oracle:mysql:5.5.14 + cpe:/a:mysql:mysql:5.1.20 + cpe:/a:oracle:mysql:5.5.15 + cpe:/a:mysql:mysql:5.1.6 + cpe:/a:oracle:mysql:5.5.10 + cpe:/a:mysql:mysql:5.1.7 + cpe:/a:oracle:mysql:5.5.11 + cpe:/a:oracle:mysql:5.1.70 + cpe:/a:mysql:mysql:5.1.23 + cpe:/a:mysql:mysql:5.1.8 + cpe:/a:mysql:mysql:5.1.5a + cpe:/a:oracle:mysql:5.5.27 + cpe:/a:oracle:mysql:5.1.71 + cpe:/a:mysql:mysql:5.1.46 + cpe:/a:mysql:mysql:5.1.47 + cpe:/a:mysql:mysql:5.1.48 + cpe:/a:mysql:mysql:5.1.17 + cpe:/a:mysql:mysql:5.1.16 + cpe:/a:mysql:mysql:5.1.19 + cpe:/a:mysql:mysql:5.1.18 + cpe:/a:oracle:mysql:5.5.29 + cpe:/a:oracle:mysql:5.5.28 + cpe:/a:oracle:mysql:5.5.25 + cpe:/a:oracle:mysql:5.5.26 + cpe:/a:oracle:mysql:5.5.23 + cpe:/a:oracle:mysql:5.6.8 + cpe:/a:mysql:mysql:5.1.11 + cpe:/a:oracle:mysql:5.5.24 + cpe:/a:mysql:mysql:5.1.10 + cpe:/a:oracle:mysql:5.5.21 + cpe:/a:oracle:mysql:5.5.22 + cpe:/a:mysql:mysql:5.1.12 + cpe:/a:oracle:mysql:5.5.20 + cpe:/a:mysql:mysql:5.1.32-bzr + cpe:/a:mysql:mysql:5.1.36 + cpe:/a:mysql:mysql:5.1.37 + cpe:/a:mysql:mysql:5.1.35 + cpe:/a:mysql:mysql:5.1.23a + cpe:/a:mysql:mysql:5.1.40 + cpe:/a:mysql:mysql:5.1.50 + cpe:/a:mysql:mysql:5.1.49 + cpe:/a:mysql:mysql:5.1.45 + cpe:/a:mysql:mysql:5.1.44 + cpe:/a:mysql:mysql:5.1.43 + cpe:/a:mysql:mysql:5.1.42 + cpe:/a:mysql:mysql:5.1.41 + cpe:/a:oracle:mysql:5.5.25:a + cpe:/a:mysql:mysql:5.1.39 + cpe:/a:mysql:mysql:5.1.38 + cpe:/a:mysql:mysql:5.1.34 + cpe:/a:mysql:mysql:5.1.31 + cpe:/a:mysql:mysql:5.1.30 + cpe:/a:mysql:mysql:5.1.33 + cpe:/a:mysql:mysql:5.1.32 + + CVE-2014-0393 + 2014-01-15T11:08:07.500-05:00 + 2014-03-05T23:50:25.987-05:00 + + + 3.3 + NETWORK + LOW + MULTIPLE_INSTANCES + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-15T15:25:06.477-05:00 + + + + XF + oracle-cpujan2014-cve20140393(90386) + + + BID + 64877 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + DEBIAN + DSA-2848 + + + DEBIAN + DSA-2845 + + + UBUNTU + USN-2086-1 + + + SECUNIA + 56580 + + + SECUNIA + 56541 + + + SECUNIA + 56491 + + + REDHAT + RHSA-2014:0189 + + + REDHAT + RHSA-2014:0186 + + + REDHAT + RHSA-2014:0173 + + + REDHAT + RHSA-2014:0164 + + + OSVDB + 102075 + + Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.71 and earlier, 5.5.33 and earlier, and 5.6.13 and earlier allows remote authenticated users to affect integrity via unknown vectors related to InnoDB. + + + + + + + + + + cpe:/a:oracle:peoplesoft_products:8.53 + cpe:/a:oracle:peoplesoft_products:8.52 + + CVE-2014-0394 + 2014-01-15T11:08:07.533-05:00 + 2014-02-06T23:51:43.067-05:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-15T15:34:54.940-05:00 + + + + SECTRACK + 1029623 + + + BID + 64848 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56478 + + + OSVDB + 102033 + + Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Updates Environment Mgmt, a different vulnerability than CVE-2014-0395. + + + + + + + + + + cpe:/a:oracle:peoplesoft_products:8.53 + cpe:/a:oracle:peoplesoft_products:8.52 + + CVE-2014-0395 + 2014-01-15T11:08:07.563-05:00 + 2014-02-06T23:51:43.147-05:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-15T15:38:06.210-05:00 + + + + SECTRACK + 1029623 + + + BID + 64852 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56478 + + + OSVDB + 102034 + + Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Updates Environment Mgmt, a different vulnerability than CVE-2014-0394. + + + + + + + + + + cpe:/a:oracle:peoplesoft_products:8.53 + cpe:/a:oracle:peoplesoft_products:8.52 + + CVE-2014-0396 + 2014-01-15T11:08:07.627-05:00 + 2014-02-06T23:51:43.237-05:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-15T15:40:32.463-05:00 + + + + SECTRACK + 1029623 + + + BID + 64841 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56478 + + + OSVDB + 102031 + + Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Portal - Web Services. + + + + + + + + + + + + cpe:/a:oracle:e-business_suite:12.2.2 + cpe:/a:oracle:e-business_suite:12.1.3 + cpe:/a:oracle:e-business_suite:12.0.6 + cpe:/a:oracle:e-business_suite:11.5.10.2 + + CVE-2014-0398 + 2014-01-15T11:08:07.657-05:00 + 2014-02-06T23:51:43.333-05:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-15T22:07:17.520-05:00 + + + + SECTRACK + 1029619 + + + BID + 64818 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56471 + + + OSVDB + 102105 + + Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, and 12.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Discoverer. + + + + + + + + + + + + cpe:/a:oracle:supply_chain_products_suite:6.2.0 + cpe:/a:oracle:supply_chain_products_suite:6.3.1 + cpe:/a:oracle:supply_chain_products_suite:6.3.2 + cpe:/a:oracle:supply_chain_products_suite:6.3.0 + + CVE-2014-0399 + 2014-01-15T11:08:07.687-05:00 + 2014-02-06T23:51:43.410-05:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-15T22:41:34.580-05:00 + + + + SECTRACK + 1029620 + + + BID + 64861 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + OSVDB + 102085 + + Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.2, 6.3, 6.3.1, and 6.3.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Data, Domain & Function Security. + + + + + + + + + + cpe:/a:oracle:fusion_middleware:11.1.1.7.0 + cpe:/a:oracle:fusion_middleware:11.1.1.6.0 + + CVE-2014-0400 + 2014-01-15T11:08:09.673-05:00 + 2014-02-06T23:51:43.487-05:00 + + + 6.3 + NETWORK + MEDIUM + SINGLE_INSTANCE + COMPLETE + NONE + NONE + http://nvd.nist.gov + 2014-01-15T22:55:29.977-05:00 + + + + SECTRACK + 1029618 + + + BID + 64822 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56460 + + + OSVDB + 102112 + + Unspecified vulnerability in the Oracle Internet Directory component in Oracle Fusion Middleware 11.1.1.6 and 11.1.1.7 allows remote authenticated users to affect confidentiality via vectors related to OID LDAP server. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mysql:mysql:5.5.0 + cpe:/a:oracle:mysql:5.1.52:sp1 + cpe:/a:mysql:mysql:5.5.1 + cpe:/a:mysql:mysql:5.5.7 + cpe:/a:mysql:mysql:5.5.8 + cpe:/a:mysql:mysql:5.5.5 + cpe:/a:mysql:mysql:5.1.49:sp1 + cpe:/a:mysql:mysql:5.5.6 + cpe:/a:mysql:mysql:5.1.46:sp1 + cpe:/a:mysql:mysql:5.5.9 + cpe:/a:mysql:mysql:5.5.3 + cpe:/a:mysql:mysql:5.5.4 + cpe:/a:mysql:mysql:5.5.2 + cpe:/a:oracle:mysql:5.6.10 + cpe:/a:mysql:mysql:5.1.40:sp1 + cpe:/a:mysql:mysql:5.1.43:sp1 + cpe:/a:oracle:mysql:5.6.12 + cpe:/a:oracle:mysql:5.6.11 + cpe:/a:oracle:mysql:5.6.14 + cpe:/a:oracle:mysql:5.6.13 + cpe:/a:mysql:mysql:5.1.37:sp1 + cpe:/a:oracle:mysql:5.1.62 + cpe:/a:oracle:mysql:5.1.61 + cpe:/a:oracle:mysql:5.1.60 + cpe:/a:mysql:mysql:5.1.34:sp1 + cpe:/a:oracle:mysql:5.1.66 + cpe:/a:oracle:mysql:5.1.65 + cpe:/a:oracle:mysql:5.1.64 + cpe:/a:oracle:mysql:5.1.63 + cpe:/a:oracle:mysql:5.1.69 + cpe:/a:oracle:mysql:5.1.68 + cpe:/a:mysql:mysql:5.1.23_bk + cpe:/a:mysql:mysql:5.1.31:sp1 + cpe:/a:oracle:mysql:5.5.31 + cpe:/a:mysql:mysql:5.1.5 + cpe:/a:oracle:mysql:5.5.33 + cpe:/a:oracle:mysql:5.5.32 + cpe:/a:mysql:mysql:5.1.3 + cpe:/a:oracle:mysql:5.5.34 + cpe:/a:mysql:mysql:5.1 + cpe:/a:mysql:mysql:5.1.4 + cpe:/a:mysql:mysql:5.1.1 + cpe:/a:mysql:mysql:5.1.2 + cpe:/a:mysql:mysql:5.1.23:a + cpe:/a:oracle:mysql:5.1.67 + cpe:/a:mysql:mysql:5.1.24 + cpe:/a:oracle:mysql:5.1.51 + cpe:/a:oracle:mysql:5.5.30 + cpe:/a:mysql:mysql:5.1.26 + cpe:/a:mysql:mysql:5.1.25 + cpe:/a:oracle:mysql:5.1.53 + cpe:/a:oracle:mysql:5.1.52 + cpe:/a:oracle:mysql:5.1.55 + cpe:/a:oracle:mysql:5.1.54 + cpe:/a:oracle:mysql:5.1.57 + cpe:/a:oracle:mysql:5.1.59 + cpe:/a:oracle:mysql:5.1.58 + cpe:/a:oracle:mysql:5.6.0 + cpe:/a:oracle:mysql:5.1.56 + cpe:/a:oracle:mysql:5.6.1 + cpe:/a:oracle:mysql:5.6.3 + cpe:/a:oracle:mysql:5.6.2 + cpe:/a:oracle:mysql:5.6.5 + cpe:/a:oracle:mysql:5.5.16 + cpe:/a:oracle:mysql:5.6.4 + cpe:/a:oracle:mysql:5.6.7 + cpe:/a:oracle:mysql:5.6.6 + cpe:/a:oracle:mysql:5.6.9 + cpe:/a:mysql:mysql:5.1.14 + cpe:/a:mysql:mysql:5.1.15 + cpe:/a:mysql:mysql:5.1.13 + cpe:/a:mysql:mysql:5.1.9 + cpe:/a:mysql:mysql:5.1.29 + cpe:/a:mysql:mysql:5.1.28 + cpe:/a:mysql:mysql:5.1.27 + cpe:/a:oracle:mysql:5.5.17 + cpe:/a:oracle:mysql:5.5.18 + cpe:/a:oracle:mysql:5.5.19 + cpe:/a:oracle:mysql:5.5.12 + cpe:/a:mysql:mysql:5.1.22 + cpe:/a:oracle:mysql:5.5.13 + cpe:/a:mysql:mysql:5.1.21 + cpe:/a:oracle:mysql:5.5.14 + cpe:/a:mysql:mysql:5.1.20 + cpe:/a:oracle:mysql:5.5.15 + cpe:/a:mysql:mysql:5.1.6 + cpe:/a:mysql:mysql:5.1.7 + cpe:/a:oracle:mysql:5.5.10 + cpe:/a:oracle:mysql:5.1.70 + cpe:/a:mysql:mysql:5.1.8 + cpe:/a:oracle:mysql:5.5.11 + cpe:/a:mysql:mysql:5.1.23 + cpe:/a:mysql:mysql:5.1.5a + cpe:/a:oracle:mysql:5.5.27 + cpe:/a:oracle:mysql:5.1.71 + cpe:/a:mysql:mysql:5.1.46 + cpe:/a:oracle:mysql:5.1.72 + cpe:/a:mysql:mysql:5.1.47 + cpe:/a:mysql:mysql:5.1.48 + cpe:/a:mysql:mysql:5.1.17 + cpe:/a:mysql:mysql:5.1.16 + cpe:/a:mysql:mysql:5.1.19 + cpe:/a:mysql:mysql:5.1.18 + cpe:/a:oracle:mysql:5.5.29 + cpe:/a:oracle:mysql:5.5.28 + cpe:/a:oracle:mysql:5.5.25 + cpe:/a:oracle:mysql:5.5.26 + cpe:/a:oracle:mysql:5.5.23 + cpe:/a:oracle:mysql:5.6.8 + cpe:/a:mysql:mysql:5.1.11 + cpe:/a:oracle:mysql:5.5.24 + cpe:/a:mysql:mysql:5.1.10 + cpe:/a:oracle:mysql:5.5.21 + cpe:/a:oracle:mysql:5.5.22 + cpe:/a:mysql:mysql:5.1.12 + cpe:/a:oracle:mysql:5.5.20 + cpe:/a:mysql:mysql:5.1.32-bzr + cpe:/a:mysql:mysql:5.1.36 + cpe:/a:mysql:mysql:5.1.37 + cpe:/a:mysql:mysql:5.1.35 + cpe:/a:mysql:mysql:5.1.23a + cpe:/a:mysql:mysql:5.1.50 + cpe:/a:mysql:mysql:5.1.40 + cpe:/a:mysql:mysql:5.1.49 + cpe:/a:mysql:mysql:5.1.45 + cpe:/a:mysql:mysql:5.1.44 + cpe:/a:mysql:mysql:5.1.43 + cpe:/a:mysql:mysql:5.1.42 + cpe:/a:mysql:mysql:5.1.41 + cpe:/a:oracle:mysql:5.5.25:a + cpe:/a:mysql:mysql:5.1.39 + cpe:/a:mysql:mysql:5.1.38 + cpe:/a:mysql:mysql:5.1.34 + cpe:/a:mysql:mysql:5.1.31 + cpe:/a:mysql:mysql:5.1.30 + cpe:/a:mysql:mysql:5.1.33 + cpe:/a:mysql:mysql:5.1.32 + + CVE-2014-0401 + 2014-01-15T11:08:09.703-05:00 + 2014-03-05T23:50:26.550-05:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-01-15T23:01:40.640-05:00 + + + + XF + oracle-cpujan2014-cve20140401(90382) + + + BID + 64898 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + DEBIAN + DSA-2848 + + + DEBIAN + DSA-2845 + + + UBUNTU + USN-2086-1 + + + SECUNIA + 56580 + + + SECUNIA + 56541 + + + SECUNIA + 56491 + + + REDHAT + RHSA-2014:0189 + + + REDHAT + RHSA-2014:0186 + + + REDHAT + RHSA-2014:0173 + + + REDHAT + RHSA-2014:0164 + + + OSVDB + 102071 + + Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mysql:mysql:5.5.0 + cpe:/a:oracle:mysql:5.1.52:sp1 + cpe:/a:mysql:mysql:5.5.1 + cpe:/a:mysql:mysql:5.5.7 + cpe:/a:mysql:mysql:5.5.8 + cpe:/a:mysql:mysql:5.5.5 + cpe:/a:mysql:mysql:5.5.6 + cpe:/a:mysql:mysql:5.1.49:sp1 + cpe:/a:mysql:mysql:5.1.46:sp1 + cpe:/a:mysql:mysql:5.5.9 + cpe:/a:mysql:mysql:5.5.3 + cpe:/a:mysql:mysql:5.5.4 + cpe:/a:mysql:mysql:5.5.2 + cpe:/a:oracle:mysql:5.6.10 + cpe:/a:mysql:mysql:5.1.40:sp1 + cpe:/a:mysql:mysql:5.1.43:sp1 + cpe:/a:oracle:mysql:5.6.12 + cpe:/a:oracle:mysql:5.6.11 + cpe:/a:oracle:mysql:5.6.13 + cpe:/a:mysql:mysql:5.1.37:sp1 + cpe:/a:oracle:mysql:5.1.62 + cpe:/a:oracle:mysql:5.1.61 + cpe:/a:mysql:mysql:5.1.34:sp1 + cpe:/a:oracle:mysql:5.1.60 + cpe:/a:oracle:mysql:5.1.66 + cpe:/a:oracle:mysql:5.1.65 + cpe:/a:oracle:mysql:5.1.64 + cpe:/a:oracle:mysql:5.1.63 + cpe:/a:oracle:mysql:5.1.69 + cpe:/a:mysql:mysql:5.1.23_bk + cpe:/a:oracle:mysql:5.1.68 + cpe:/a:mysql:mysql:5.1.31:sp1 + cpe:/a:oracle:mysql:5.5.31 + cpe:/a:oracle:mysql:5.5.33 + cpe:/a:mysql:mysql:5.1.5 + cpe:/a:oracle:mysql:5.5.32 + cpe:/a:mysql:mysql:5.1.3 + cpe:/a:mysql:mysql:5.1.4 + cpe:/a:mysql:mysql:5.1 + cpe:/a:mysql:mysql:5.1.1 + cpe:/a:mysql:mysql:5.1.2 + cpe:/a:mysql:mysql:5.1.23:a + cpe:/a:oracle:mysql:5.1.67 + cpe:/a:mysql:mysql:5.1.24 + cpe:/a:oracle:mysql:5.5.30 + cpe:/a:mysql:mysql:5.1.26 + cpe:/a:oracle:mysql:5.1.51 + cpe:/a:mysql:mysql:5.1.25 + cpe:/a:oracle:mysql:5.1.53 + cpe:/a:oracle:mysql:5.1.52 + cpe:/a:oracle:mysql:5.1.55 + cpe:/a:oracle:mysql:5.1.54 + cpe:/a:oracle:mysql:5.1.57 + cpe:/a:oracle:mysql:5.1.59 + cpe:/a:oracle:mysql:5.1.58 + cpe:/a:oracle:mysql:5.6.0 + cpe:/a:oracle:mysql:5.1.56 + cpe:/a:oracle:mysql:5.6.1 + cpe:/a:oracle:mysql:5.6.3 + cpe:/a:oracle:mysql:5.6.2 + cpe:/a:oracle:mysql:5.6.5 + cpe:/a:oracle:mysql:5.5.16 + cpe:/a:oracle:mysql:5.6.4 + cpe:/a:oracle:mysql:5.6.7 + cpe:/a:oracle:mysql:5.6.6 + cpe:/a:oracle:mysql:5.6.9 + cpe:/a:mysql:mysql:5.1.14 + cpe:/a:mysql:mysql:5.1.15 + cpe:/a:mysql:mysql:5.1.13 + cpe:/a:mysql:mysql:5.1.9 + cpe:/a:mysql:mysql:5.1.29 + cpe:/a:mysql:mysql:5.1.28 + cpe:/a:mysql:mysql:5.1.27 + cpe:/a:oracle:mysql:5.5.17 + cpe:/a:oracle:mysql:5.5.18 + cpe:/a:oracle:mysql:5.5.19 + cpe:/a:oracle:mysql:5.5.12 + cpe:/a:mysql:mysql:5.1.22 + cpe:/a:oracle:mysql:5.5.13 + cpe:/a:mysql:mysql:5.1.21 + cpe:/a:oracle:mysql:5.5.14 + cpe:/a:mysql:mysql:5.1.20 + cpe:/a:oracle:mysql:5.5.15 + cpe:/a:mysql:mysql:5.1.6 + cpe:/a:oracle:mysql:5.5.10 + cpe:/a:mysql:mysql:5.1.7 + cpe:/a:oracle:mysql:5.5.11 + cpe:/a:mysql:mysql:5.1.23 + cpe:/a:mysql:mysql:5.1.8 + cpe:/a:oracle:mysql:5.1.70 + cpe:/a:mysql:mysql:5.1.5a + cpe:/a:oracle:mysql:5.5.27 + cpe:/a:mysql:mysql:5.1.46 + cpe:/a:oracle:mysql:5.1.71 + cpe:/a:mysql:mysql:5.1.47 + cpe:/a:mysql:mysql:5.1.48 + cpe:/a:mysql:mysql:5.1.17 + cpe:/a:mysql:mysql:5.1.16 + cpe:/a:mysql:mysql:5.1.19 + cpe:/a:mysql:mysql:5.1.18 + cpe:/a:oracle:mysql:5.5.29 + cpe:/a:oracle:mysql:5.5.28 + cpe:/a:oracle:mysql:5.5.25 + cpe:/a:oracle:mysql:5.5.26 + cpe:/a:oracle:mysql:5.5.23 + cpe:/a:oracle:mysql:5.6.8 + cpe:/a:mysql:mysql:5.1.11 + cpe:/a:oracle:mysql:5.5.24 + cpe:/a:mysql:mysql:5.1.10 + cpe:/a:oracle:mysql:5.5.21 + cpe:/a:oracle:mysql:5.5.22 + cpe:/a:mysql:mysql:5.1.12 + cpe:/a:oracle:mysql:5.5.20 + cpe:/a:mysql:mysql:5.1.32-bzr + cpe:/a:mysql:mysql:5.1.36 + cpe:/a:mysql:mysql:5.1.37 + cpe:/a:mysql:mysql:5.1.35 + cpe:/a:mysql:mysql:5.1.23a + cpe:/a:mysql:mysql:5.1.40 + cpe:/a:mysql:mysql:5.1.50 + cpe:/a:mysql:mysql:5.1.49 + cpe:/a:mysql:mysql:5.1.45 + cpe:/a:mysql:mysql:5.1.44 + cpe:/a:mysql:mysql:5.1.43 + cpe:/a:mysql:mysql:5.1.42 + cpe:/a:mysql:mysql:5.1.41 + cpe:/a:oracle:mysql:5.5.25:a + cpe:/a:mysql:mysql:5.1.39 + cpe:/a:mysql:mysql:5.1.38 + cpe:/a:mysql:mysql:5.1.34 + cpe:/a:mysql:mysql:5.1.31 + cpe:/a:mysql:mysql:5.1.30 + cpe:/a:mysql:mysql:5.1.33 + cpe:/a:mysql:mysql:5.1.32 + + CVE-2014-0402 + 2014-01-15T11:08:09.737-05:00 + 2014-03-05T23:50:26.627-05:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-01-15T23:06:43.427-05:00 + + + + XF + oracle-cpujan2014-cve20140402(90379) + + + BID + 64908 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + DEBIAN + DSA-2848 + + + DEBIAN + DSA-2845 + + + UBUNTU + USN-2086-1 + + + SECUNIA + 56580 + + + SECUNIA + 56541 + + + SECUNIA + 56491 + + + REDHAT + RHSA-2014:0189 + + + REDHAT + RHSA-2014:0186 + + + REDHAT + RHSA-2014:0173 + + + REDHAT + RHSA-2014:0164 + + + OSVDB + 102068 + + Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.71 and earlier, 5.5.33 and earlier, and 5.6.13 and earlier allows remote authenticated users to affect availability via unknown vectors related to Locking. + + + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.7.0:update_45 + cpe:/a:oracle:jdk:1.7.0:update_45 + cpe:/a:oracle:jre:1.6.0:update_65 + cpe:/a:oracle:jdk:1.6.0:update_65 + + CVE-2014-0403 + 2014-01-15T11:08:09.767-05:00 + 2014-04-01T02:28:12.077-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-15T23:35:52.483-05:00 + + + + XF + oracle-cpujan2014-cve20140403(90338) + + + SECTRACK + 1029608 + + + BID + 64920 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56535 + + + SECUNIA + 56485 + + + REDHAT + RHSA-2014:0135 + + + REDHAT + RHSA-2014:0134 + + + REDHAT + RHSA-2014:0030 + + + OSVDB + 102006 + + + HP + SSRT101455 + + + HP + HPSBUX02973 + + + HP + HPSBUX02972 + + + HP + SSRT101454 + + + SUSE + SUSE-SU-2014:0451 + + + SUSE + SUSE-SU-2014:0266 + + + SUSE + SUSE-SU-2014:0246 + + Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5898 and CVE-2014-0375. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:vm_virtualbox:4.2.14 + cpe:/a:oracle:vm_virtualbox:4.1.20 + cpe:/a:oracle:vm_virtualbox:4.0.12 + cpe:/a:oracle:vm_virtualbox:4.2.16 + cpe:/a:oracle:vm_virtualbox:4.1.22 + cpe:/a:oracle:vm_virtualbox:4.0.14 + cpe:/a:oracle:vm_virtualbox:4.1.8 + cpe:/a:oracle:vm_virtualbox:3.2.12 + cpe:/a:oracle:vm_virtualbox:4.1.28 + cpe:/a:oracle:vm_virtualbox:3.2.8 + cpe:/a:oracle:vm_virtualbox:3.2.16 + cpe:/a:oracle:vm_virtualbox:3.2.14 + cpe:/a:oracle:vm_virtualbox:4.3.2 + cpe:/a:oracle:vm_virtualbox:4.1.10 + cpe:/a:oracle:vm_virtualbox:4.0.20 + cpe:/a:oracle:vm_virtualbox:3.2.4 + cpe:/a:oracle:vm_virtualbox:4.1.18 + cpe:/a:oracle:vm_virtualbox:4.0.4 + cpe:/a:oracle:vm_virtualbox:3.2.6 + cpe:/a:oracle:vm_virtualbox:4.0.2 + cpe:/a:oracle:vm_virtualbox:4.1.4 + cpe:/a:oracle:vm_virtualbox:4.0.0 + cpe:/a:oracle:vm_virtualbox:4.1.6 + cpe:/a:oracle:vm_virtualbox:4.1.16 + cpe:/a:oracle:vm_virtualbox:4.1.14 + cpe:/a:oracle:vm_virtualbox:4.2.8 + cpe:/a:oracle:vm_virtualbox:4.1.12 + cpe:/a:oracle:vm_virtualbox:4.2.6 + cpe:/a:oracle:vm_virtualbox:4.1.2 + cpe:/a:oracle:vm_virtualbox:4.1.0 + cpe:/a:oracle:vm_virtualbox:3.2.2 + cpe:/a:oracle:vm_virtualbox:4.3.0 + cpe:/a:oracle:vm_virtualbox:4.0.6 + cpe:/a:oracle:vm_virtualbox:3.2.0 + cpe:/a:oracle:vm_virtualbox:4.0 + cpe:/a:oracle:vm_virtualbox:4.2.4 + cpe:/a:oracle:vm_virtualbox:4.2.2 + cpe:/a:oracle:vm_virtualbox:4.1.26 + cpe:/a:oracle:vm_virtualbox:3.2.10 + cpe:/a:oracle:vm_virtualbox:4.0.10 + cpe:/a:oracle:vm_virtualbox:4.2.12 + cpe:/a:oracle:vm_virtualbox:4.2.0 + cpe:/a:oracle:vm_virtualbox:4.1.24 + cpe:/a:oracle:vm_virtualbox:4.2.10 + cpe:/a:oracle:vm_virtualbox:3.2.18 + cpe:/a:oracle:vm_virtualbox:4.0.18 + cpe:/a:oracle:vm_virtualbox:4.0.16 + cpe:/a:oracle:vm_virtualbox:4.0.8 + cpe:/a:oracle:vm_virtualbox:4.2.18 + + CVE-2014-0404 + 2014-01-15T11:08:09.797-05:00 + 2014-03-26T00:56:16.157-04:00 + + + 2.4 + LOCAL + HIGH + SINGLE_INSTANCE + NONE + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-15T22:10:15.290-05:00 + + + + XF + oracle-cpujan2014-cve20140404(90372) + + + SECTRACK + 1029610 + + + BID + 64911 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + DEBIAN + DSA-2878 + + + SECUNIA + 56490 + + + OSVDB + 102061 + + Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect integrity and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0406. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:vm_virtualbox:4.2.14 + cpe:/a:oracle:vm_virtualbox:4.1.20 + cpe:/a:oracle:vm_virtualbox:4.0.12 + cpe:/a:oracle:vm_virtualbox:4.2.16 + cpe:/a:oracle:vm_virtualbox:4.1.22 + cpe:/a:oracle:vm_virtualbox:4.0.14 + cpe:/a:oracle:vm_virtualbox:4.1.8 + cpe:/a:oracle:vm_virtualbox:3.2.12 + cpe:/a:oracle:vm_virtualbox:4.1.28 + cpe:/a:oracle:vm_virtualbox:3.2.8 + cpe:/a:oracle:vm_virtualbox:3.2.16 + cpe:/a:oracle:vm_virtualbox:3.2.14 + cpe:/a:oracle:vm_virtualbox:4.3.2 + cpe:/a:oracle:vm_virtualbox:4.1.10 + cpe:/a:oracle:vm_virtualbox:4.0.20 + cpe:/a:oracle:vm_virtualbox:3.2.4 + cpe:/a:oracle:vm_virtualbox:4.1.18 + cpe:/a:oracle:vm_virtualbox:4.0.4 + cpe:/a:oracle:vm_virtualbox:3.2.6 + cpe:/a:oracle:vm_virtualbox:4.0.2 + cpe:/a:oracle:vm_virtualbox:4.1.4 + cpe:/a:oracle:vm_virtualbox:4.0.0 + cpe:/a:oracle:vm_virtualbox:4.1.6 + cpe:/a:oracle:vm_virtualbox:4.1.16 + cpe:/a:oracle:vm_virtualbox:4.1.14 + cpe:/a:oracle:vm_virtualbox:4.2.8 + cpe:/a:oracle:vm_virtualbox:4.1.12 + cpe:/a:oracle:vm_virtualbox:4.1.2 + cpe:/a:oracle:vm_virtualbox:4.2.6 + cpe:/a:oracle:vm_virtualbox:4.1.0 + cpe:/a:oracle:vm_virtualbox:3.2.2 + cpe:/a:oracle:vm_virtualbox:4.3.0 + cpe:/a:oracle:vm_virtualbox:4.0.6 + cpe:/a:oracle:vm_virtualbox:3.2.0 + cpe:/a:oracle:vm_virtualbox:4.0 + cpe:/a:oracle:vm_virtualbox:4.2.4 + cpe:/a:oracle:vm_virtualbox:4.1.26 + cpe:/a:oracle:vm_virtualbox:3.2.10 + cpe:/a:oracle:vm_virtualbox:4.2.2 + cpe:/a:oracle:vm_virtualbox:4.0.10 + cpe:/a:oracle:vm_virtualbox:4.2.12 + cpe:/a:oracle:vm_virtualbox:4.1.24 + cpe:/a:oracle:vm_virtualbox:4.2.0 + cpe:/a:oracle:vm_virtualbox:4.2.10 + cpe:/a:oracle:vm_virtualbox:4.0.18 + cpe:/a:oracle:vm_virtualbox:3.2.18 + cpe:/a:oracle:vm_virtualbox:4.0.8 + cpe:/a:oracle:vm_virtualbox:4.0.16 + cpe:/a:oracle:vm_virtualbox:4.2.18 + + CVE-2014-0405 + 2014-01-15T11:08:09.813-05:00 + 2014-02-06T23:51:43.943-05:00 + + + 3.5 + LOCAL + HIGH + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-15T23:38:43.393-05:00 + + + + XF + oracle-cpujan2014-cve20140405(90370) + + + SECTRACK + 1029610 + + + BID + 64900 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56490 + + + OSVDB + 102059 + + Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:vm_virtualbox:4.1.20 + cpe:/a:oracle:vm_virtualbox:4.0.12 + cpe:/a:oracle:vm_virtualbox:4.1.22 + cpe:/a:oracle:vm_virtualbox:4.0.14 + cpe:/a:oracle:vm_virtualbox:4.1.8 + cpe:/a:oracle:vm_virtualbox:3.2.12 + cpe:/a:oracle:vm_virtualbox:4.1.28 + cpe:/a:oracle:vm_virtualbox:3.2.16 + cpe:/a:oracle:vm_virtualbox:3.2.14 + cpe:/a:oracle:vm_virtualbox:4.3.2 + cpe:/a:oracle:vm_virtualbox:4.1.10 + cpe:/a:oracle:vm_virtualbox:4.0.20 + cpe:/a:oracle:vm_virtualbox:3.2.4 + cpe:/a:oracle:vm_virtualbox:4.1.18 + cpe:/a:oracle:vm_virtualbox:4.0.4 + cpe:/a:oracle:vm_virtualbox:3.2.6 + cpe:/a:oracle:vm_virtualbox:4.0.2 + cpe:/a:oracle:vm_virtualbox:4.0.0 + cpe:/a:oracle:vm_virtualbox:4.1.2 + cpe:/a:oracle:vm_virtualbox:4.1.0 + cpe:/a:oracle:vm_virtualbox:4.0 + cpe:/a:oracle:vm_virtualbox:4.2.4 + cpe:/a:oracle:vm_virtualbox:4.1.26 + cpe:/a:oracle:vm_virtualbox:4.0.10 + cpe:/a:oracle:vm_virtualbox:4.1.24 + cpe:/a:oracle:vm_virtualbox:4.0.18 + cpe:/a:oracle:vm_virtualbox:4.0.8 + cpe:/a:oracle:vm_virtualbox:4.0.16 + cpe:/a:oracle:vm_virtualbox:4.2.14 + cpe:/a:oracle:vm_virtualbox:4.2.16 + cpe:/a:oracle:vm_virtualbox:3.2.8 + cpe:/a:oracle:vm_virtualbox:4.1.4 + cpe:/a:oracle:vm_virtualbox:4.1.6 + cpe:/a:oracle:vm_virtualbox:4.1.16 + cpe:/a:oracle:vm_virtualbox:4.1.14 + cpe:/a:oracle:vm_virtualbox:4.2.8 + cpe:/a:oracle:vm_virtualbox:4.1.12 + cpe:/a:oracle:vm_virtualbox:4.2.6 + cpe:/a:oracle:vm_virtualbox:3.2.2 + cpe:/a:oracle:vm_virtualbox:4.3.0 + cpe:/a:oracle:vm_virtualbox:4.0.6 + cpe:/a:oracle:vm_virtualbox:3.2.0 + cpe:/a:oracle:vm_virtualbox:3.2.10 + cpe:/a:oracle:vm_virtualbox:4.2.2 + cpe:/a:oracle:vm_virtualbox:4.2.12 + cpe:/a:oracle:vm_virtualbox:4.2.0 + cpe:/a:oracle:vm_virtualbox:4.2.10 + cpe:/a:oracle:vm_virtualbox:3.2.18 + cpe:/a:oracle:vm_virtualbox:4.2.18 + + CVE-2014-0406 + 2014-01-15T11:08:09.843-05:00 + 2014-03-26T00:56:18.517-04:00 + + + 2.4 + LOCAL + HIGH + SINGLE_INSTANCE + NONE + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-15T23:42:01.087-05:00 + + + + XF + oracle-cpujan2014-cve20140406(90371) + + + SECTRACK + 1029610 + + + BID + 64905 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + DEBIAN + DSA-2878 + + + SECUNIA + 56490 + + + OSVDB + 102060 + + Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect integrity and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0404. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:vm_virtualbox:4.1.20 + cpe:/a:oracle:vm_virtualbox:4.0.12 + cpe:/a:oracle:vm_virtualbox:4.1.22 + cpe:/a:oracle:vm_virtualbox:4.0.14 + cpe:/a:oracle:vm_virtualbox:4.1.8 + cpe:/a:oracle:vm_virtualbox:3.2.12 + cpe:/a:oracle:vm_virtualbox:4.1.28 + cpe:/a:oracle:vm_virtualbox:3.2.16 + cpe:/a:oracle:vm_virtualbox:3.2.14 + cpe:/a:oracle:vm_virtualbox:4.3.2 + cpe:/a:oracle:vm_virtualbox:4.1.10 + cpe:/a:oracle:vm_virtualbox:4.0.20 + cpe:/a:oracle:vm_virtualbox:3.2.4 + cpe:/a:oracle:vm_virtualbox:4.1.18 + cpe:/a:oracle:vm_virtualbox:4.0.4 + cpe:/a:oracle:vm_virtualbox:3.2.6 + cpe:/a:oracle:vm_virtualbox:4.0.2 + cpe:/a:oracle:vm_virtualbox:4.0.0 + cpe:/a:oracle:vm_virtualbox:4.1.2 + cpe:/a:oracle:vm_virtualbox:4.1.0 + cpe:/a:oracle:vm_virtualbox:4.0 + cpe:/a:oracle:vm_virtualbox:4.2.4 + cpe:/a:oracle:vm_virtualbox:4.1.26 + cpe:/a:oracle:vm_virtualbox:4.0.10 + cpe:/a:oracle:vm_virtualbox:4.1.24 + cpe:/a:oracle:vm_virtualbox:4.0.18 + cpe:/a:oracle:vm_virtualbox:4.0.8 + cpe:/a:oracle:vm_virtualbox:4.0.16 + cpe:/a:oracle:vm_virtualbox:4.2.14 + cpe:/a:oracle:vm_virtualbox:4.2.16 + cpe:/a:oracle:vm_virtualbox:3.2.8 + cpe:/a:oracle:vm_virtualbox:4.1.4 + cpe:/a:oracle:vm_virtualbox:4.1.6 + cpe:/a:oracle:vm_virtualbox:4.1.16 + cpe:/a:oracle:vm_virtualbox:4.1.14 + cpe:/a:oracle:vm_virtualbox:4.2.8 + cpe:/a:oracle:vm_virtualbox:4.1.12 + cpe:/a:oracle:vm_virtualbox:4.2.6 + cpe:/a:oracle:vm_virtualbox:3.2.2 + cpe:/a:oracle:vm_virtualbox:4.3.0 + cpe:/a:oracle:vm_virtualbox:4.0.6 + cpe:/a:oracle:vm_virtualbox:3.2.0 + cpe:/a:oracle:vm_virtualbox:3.2.10 + cpe:/a:oracle:vm_virtualbox:4.2.2 + cpe:/a:oracle:vm_virtualbox:4.2.12 + cpe:/a:oracle:vm_virtualbox:4.2.0 + cpe:/a:oracle:vm_virtualbox:4.2.10 + cpe:/a:oracle:vm_virtualbox:3.2.18 + cpe:/a:oracle:vm_virtualbox:4.2.18 + + CVE-2014-0407 + 2014-01-15T11:08:09.877-05:00 + 2014-03-26T00:56:18.797-04:00 + + + 3.5 + LOCAL + HIGH + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-15T23:44:03.430-05:00 + + + + XF + oracle-cpujan2014-cve20140407(90369) + + + SECTRACK + 1029610 + + + BID + 64913 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + DEBIAN + DSA-2878 + + + SECUNIA + 56490 + + + OSVDB + 102058 + + Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core. + + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.7.0:update_45 + cpe:/a:oracle:jdk:1.7.0:update_45 + + CVE-2014-0408 + 2014-01-15T11:08:09.907-05:00 + 2014-03-05T23:50:27.127-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-01-15T23:47:23.170-05:00 + + + + UBUNTU + USN-2089-1 + + + SECTRACK + 1029608 + + + BID + 64910 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56485 + + + OSVDB + 101999 + + + SUSE + openSUSE-SU-2014:0180 + + + SUSE + openSUSE-SU-2014:0177 + + + SUSE + openSUSE-SU-2014:0174 + + Unspecified vulnerability in Oracle Java SE 7u45, when running on OS X, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. + + + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.7.0:update_45 + cpe:/a:oracle:jdk:1.7.0:update_45 + cpe:/a:oracle:jre:1.6.0:update_65 + cpe:/a:oracle:jdk:1.6.0:update_65 + + CVE-2014-0410 + 2014-01-15T11:08:09.953-05:00 + 2014-04-01T02:28:12.543-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-01-15T23:49:19.720-05:00 + + + + SECTRACK + 1029608 + + + BID + 64915 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56535 + + + SECUNIA + 56485 + + + REDHAT + RHSA-2014:0135 + + + REDHAT + RHSA-2014:0134 + + + REDHAT + RHSA-2014:0030 + + + OSVDB + 102024 + + + HP + SSRT101455 + + + HP + HPSBUX02973 + + + HP + HPSBUX02972 + + + HP + SSRT101454 + + + SUSE + SUSE-SU-2014:0451 + + + SUSE + SUSE-SU-2014:0266 + + + SUSE + SUSE-SU-2014:0246 + + Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5889, CVE-2013-5902, CVE-2014-0415, CVE-2014-0418, and CVE-2014-0424. + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.7.0:update_45 + cpe:/a:oracle:jdk:1.7.0:update_45 + cpe:/a:oracle:jrockit:r28.2.9 + cpe:/a:oracle:jrockit:r27.7.7 + cpe:/a:oracle:jre:1.6.0:update_65 + cpe:/a:oracle:jre:1.5.0:update_55 + cpe:/a:oracle:jdk:1.5.0:update_55 + cpe:/a:oracle:jdk:1.6.0:update_65 + + CVE-2014-0411 + 2014-01-15T11:08:10.017-05:00 + 2014-04-01T02:28:12.623-04:00 + + + 4.0 + NETWORK + HIGH + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-15T23:55:06.930-05:00 + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1053010 + + + XF + oracle-cpujan2014-cve20140411(90357) + + + UBUNTU + USN-2124-1 + + + UBUNTU + USN-2089-1 + + + SECTRACK + 1029608 + + + BID + 64918 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56535 + + + SECUNIA + 56487 + + + SECUNIA + 56486 + + + SECUNIA + 56485 + + + SECUNIA + 56432 + + + REDHAT + RHSA-2014:0136 + + + REDHAT + RHSA-2014:0135 + + + REDHAT + RHSA-2014:0134 + + + REDHAT + RHSA-2014:0097 + + + REDHAT + RHSA-2014:0030 + + + REDHAT + RHSA-2014:0027 + + + REDHAT + RHSA-2014:0026 + + + OSVDB + 102028 + + + HP + SSRT101455 + + + HP + HPSBUX02973 + + + HP + HPSBUX02972 + + + HP + SSRT101454 + + + SUSE + openSUSE-SU-2014:0180 + + + SUSE + openSUSE-SU-2014:0177 + + + SUSE + openSUSE-SU-2014:0174 + + + SUSE + SUSE-SU-2014:0451 + + + SUSE + SUSE-SU-2014:0266 + + + SUSE + SUSE-SU-2014:0246 + + + CONFIRM + http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/d533e96c7acc + + Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that this issue allows remote attackers to obtain sensitive information about encryption keys via a timing discrepancy during the TLS/SSL handshake. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mysql:mysql:5.5.0 + cpe:/a:oracle:mysql:5.1.52:sp1 + cpe:/a:mysql:mysql:5.5.1 + cpe:/a:mysql:mysql:5.5.7 + cpe:/a:mysql:mysql:5.5.8 + cpe:/a:mysql:mysql:5.5.5 + cpe:/a:mysql:mysql:5.5.6 + cpe:/a:mysql:mysql:5.1.49:sp1 + cpe:/a:mysql:mysql:5.1.46:sp1 + cpe:/a:mysql:mysql:5.5.9 + cpe:/a:mysql:mysql:5.5.3 + cpe:/a:mysql:mysql:5.5.4 + cpe:/a:mysql:mysql:5.5.2 + cpe:/a:oracle:mysql:5.6.10 + cpe:/a:mysql:mysql:5.1.40:sp1 + cpe:/a:mysql:mysql:5.1.43:sp1 + cpe:/a:oracle:mysql:5.6.12 + cpe:/a:oracle:mysql:5.6.11 + cpe:/a:oracle:mysql:5.6.14 + cpe:/a:oracle:mysql:5.6.13 + cpe:/a:mysql:mysql:5.1.37:sp1 + cpe:/a:oracle:mysql:5.1.62 + cpe:/a:oracle:mysql:5.1.61 + cpe:/a:mysql:mysql:5.1.34:sp1 + cpe:/a:oracle:mysql:5.1.60 + cpe:/a:oracle:mysql:5.1.66 + cpe:/a:oracle:mysql:5.1.65 + cpe:/a:oracle:mysql:5.1.64 + cpe:/a:oracle:mysql:5.1.63 + cpe:/a:oracle:mysql:5.1.69 + cpe:/a:mysql:mysql:5.1.23_bk + cpe:/a:oracle:mysql:5.1.68 + cpe:/a:mysql:mysql:5.1.31:sp1 + cpe:/a:oracle:mysql:5.5.31 + cpe:/a:oracle:mysql:5.5.33 + cpe:/a:mysql:mysql:5.1.5 + cpe:/a:oracle:mysql:5.5.32 + cpe:/a:mysql:mysql:5.1.3 + cpe:/a:oracle:mysql:5.5.34 + cpe:/a:mysql:mysql:5.1.4 + cpe:/a:mysql:mysql:5.1 + cpe:/a:mysql:mysql:5.1.1 + cpe:/a:mysql:mysql:5.1.2 + cpe:/a:mysql:mysql:5.1.23:a + cpe:/a:oracle:mysql:5.1.67 + cpe:/a:mysql:mysql:5.1.24 + cpe:/a:oracle:mysql:5.5.30 + cpe:/a:mysql:mysql:5.1.26 + cpe:/a:oracle:mysql:5.1.51 + cpe:/a:mysql:mysql:5.1.25 + cpe:/a:oracle:mysql:5.1.53 + cpe:/a:oracle:mysql:5.1.52 + cpe:/a:oracle:mysql:5.1.55 + cpe:/a:oracle:mysql:5.1.54 + cpe:/a:oracle:mysql:5.1.57 + cpe:/a:oracle:mysql:5.1.59 + cpe:/a:oracle:mysql:5.1.58 + cpe:/a:oracle:mysql:5.6.0 + cpe:/a:oracle:mysql:5.1.56 + cpe:/a:oracle:mysql:5.6.1 + cpe:/a:oracle:mysql:5.6.3 + cpe:/a:oracle:mysql:5.6.2 + cpe:/a:oracle:mysql:5.6.5 + cpe:/a:oracle:mysql:5.5.16 + cpe:/a:oracle:mysql:5.6.4 + cpe:/a:oracle:mysql:5.6.7 + cpe:/a:oracle:mysql:5.6.6 + cpe:/a:oracle:mysql:5.6.9 + cpe:/a:mysql:mysql:5.1.14 + cpe:/a:mysql:mysql:5.1.15 + cpe:/a:mysql:mysql:5.1.13 + cpe:/a:mysql:mysql:5.1.9 + cpe:/a:mysql:mysql:5.1.29 + cpe:/a:mysql:mysql:5.1.28 + cpe:/a:mysql:mysql:5.1.27 + cpe:/a:oracle:mysql:5.5.17 + cpe:/a:oracle:mysql:5.5.18 + cpe:/a:oracle:mysql:5.5.19 + cpe:/a:oracle:mysql:5.5.12 + cpe:/a:mysql:mysql:5.1.22 + cpe:/a:oracle:mysql:5.5.13 + cpe:/a:mysql:mysql:5.1.21 + cpe:/a:oracle:mysql:5.5.14 + cpe:/a:mysql:mysql:5.1.20 + cpe:/a:oracle:mysql:5.5.15 + cpe:/a:mysql:mysql:5.1.6 + cpe:/a:oracle:mysql:5.5.10 + cpe:/a:mysql:mysql:5.1.7 + cpe:/a:oracle:mysql:5.5.11 + cpe:/a:mysql:mysql:5.1.23 + cpe:/a:mysql:mysql:5.1.8 + cpe:/a:oracle:mysql:5.1.70 + cpe:/a:mysql:mysql:5.1.5a + cpe:/a:oracle:mysql:5.5.27 + cpe:/a:mysql:mysql:5.1.46 + cpe:/a:oracle:mysql:5.1.71 + cpe:/a:mysql:mysql:5.1.47 + cpe:/a:oracle:mysql:5.1.72 + cpe:/a:mysql:mysql:5.1.48 + cpe:/a:mysql:mysql:5.1.17 + cpe:/a:mysql:mysql:5.1.16 + cpe:/a:mysql:mysql:5.1.19 + cpe:/a:mysql:mysql:5.1.18 + cpe:/a:oracle:mysql:5.5.29 + cpe:/a:oracle:mysql:5.5.28 + cpe:/a:oracle:mysql:5.5.25 + cpe:/a:oracle:mysql:5.5.26 + cpe:/a:oracle:mysql:5.5.23 + cpe:/a:oracle:mysql:5.6.8 + cpe:/a:mysql:mysql:5.1.11 + cpe:/a:oracle:mysql:5.5.24 + cpe:/a:mysql:mysql:5.1.10 + cpe:/a:oracle:mysql:5.5.21 + cpe:/a:oracle:mysql:5.5.22 + cpe:/a:mysql:mysql:5.1.12 + cpe:/a:oracle:mysql:5.5.20 + cpe:/a:mysql:mysql:5.1.32-bzr + cpe:/a:mysql:mysql:5.1.36 + cpe:/a:mysql:mysql:5.1.37 + cpe:/a:mysql:mysql:5.1.35 + cpe:/a:mysql:mysql:5.1.23a + cpe:/a:mysql:mysql:5.1.40 + cpe:/a:mysql:mysql:5.1.50 + cpe:/a:mysql:mysql:5.1.49 + cpe:/a:mysql:mysql:5.1.45 + cpe:/a:mysql:mysql:5.1.44 + cpe:/a:mysql:mysql:5.1.43 + cpe:/a:mysql:mysql:5.1.42 + cpe:/a:mysql:mysql:5.1.41 + cpe:/a:oracle:mysql:5.5.25:a + cpe:/a:mysql:mysql:5.1.39 + cpe:/a:mysql:mysql:5.1.38 + cpe:/a:mysql:mysql:5.1.34 + cpe:/a:mysql:mysql:5.1.31 + cpe:/a:mysql:mysql:5.1.30 + cpe:/a:mysql:mysql:5.1.33 + cpe:/a:mysql:mysql:5.1.32 + + CVE-2014-0412 + 2014-01-15T11:08:10.033-05:00 + 2014-03-05T23:50:27.407-05:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-01-15T23:58:00.403-05:00 + + + + XF + oracle-cpujan2014-cve20140412(90378) + + + BID + 64880 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + DEBIAN + DSA-2848 + + + DEBIAN + DSA-2845 + + + UBUNTU + USN-2086-1 + + + SECUNIA + 56580 + + + SECUNIA + 56541 + + + SECUNIA + 56491 + + + REDHAT + RHSA-2014:0189 + + + REDHAT + RHSA-2014:0186 + + + REDHAT + RHSA-2014:0173 + + + REDHAT + RHSA-2014:0164 + + + OSVDB + 102067 + + Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB. + + + + + + + + + cpe:/a:oracle:fusion_middleware:10.1.3.5 + + CVE-2014-0413 + 2014-04-15T20:55:23.810-04:00 + 2014-04-16T11:45:14.457-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-16T11:45:14.407-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect integrity via vectors related to HTTP Request Handling, a different vulnerability than CVE-2014-0426. + + + + + + + + + cpe:/a:oracle:fusion_middleware:10.1.3.5 + + CVE-2014-0414 + 2014-04-15T20:55:23.840-04:00 + 2014-04-16T11:50:00.637-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-16T11:50:00.607-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect confidentiality via vectors related to HTTP Request Handling. + + + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.7.0:update_45 + cpe:/a:oracle:jdk:1.7.0:update_45 + cpe:/a:oracle:jre:1.6.0:update_65 + cpe:/a:oracle:jdk:1.6.0:update_65 + + CVE-2014-0415 + 2014-01-15T11:08:10.063-05:00 + 2014-04-01T02:28:12.793-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-01-15T23:59:22.250-05:00 + + + + SECTRACK + 1029608 + + + BID + 64899 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56535 + + + SECUNIA + 56485 + + + REDHAT + RHSA-2014:0135 + + + REDHAT + RHSA-2014:0134 + + + REDHAT + RHSA-2014:0030 + + + OSVDB + 102025 + + + HP + SSRT101455 + + + HP + HPSBUX02973 + + + HP + HPSBUX02972 + + + HP + SSRT101454 + + + SUSE + SUSE-SU-2014:0451 + + + SUSE + SUSE-SU-2014:0266 + + + SUSE + SUSE-SU-2014:0246 + + Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5889, CVE-2013-5902, CVE-2014-0410, CVE-2014-0418, and CVE-2014-0424. + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.7.0:update_45 + cpe:/a:oracle:jdk:1.7.0:update_45 + cpe:/a:oracle:jre:1.6.0:update_65 + cpe:/a:oracle:jre:1.5.0:update_55 + cpe:/a:oracle:jdk:1.5.0:update_55 + cpe:/a:oracle:jdk:1.6.0:update_65 + + CVE-2014-0416 + 2014-01-15T11:08:10.093-05:00 + 2014-04-01T02:28:12.887-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-16T00:01:40.347-05:00 + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1051912 + + + XF + oracle-cpujan2014-cve20140416(90349) + + + UBUNTU + USN-2124-1 + + + UBUNTU + USN-2089-1 + + + SECTRACK + 1029608 + + + BID + 64937 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56535 + + + SECUNIA + 56486 + + + SECUNIA + 56485 + + + SECUNIA + 56432 + + + REDHAT + RHSA-2014:0136 + + + REDHAT + RHSA-2014:0135 + + + REDHAT + RHSA-2014:0134 + + + REDHAT + RHSA-2014:0097 + + + REDHAT + RHSA-2014:0030 + + + REDHAT + RHSA-2014:0027 + + + REDHAT + RHSA-2014:0026 + + + OSVDB + 102017 + + + HP + SSRT101455 + + + HP + HPSBUX02973 + + + HP + HPSBUX02972 + + + HP + SSRT101454 + + + SUSE + openSUSE-SU-2014:0180 + + + SUSE + openSUSE-SU-2014:0177 + + + SUSE + openSUSE-SU-2014:0174 + + + SUSE + SUSE-SU-2014:0451 + + + SUSE + SUSE-SU-2014:0266 + + + SUSE + SUSE-SU-2014:0246 + + + MISC + http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/abe1cb2d27cb + + Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect integrity via vectors related to JAAS. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to how principals are set for the Subject class, which allows attackers to escape the sandbox using deserialization of a crafted Subject instance. + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.7.0:update_45 + cpe:/a:oracle:jdk:1.7.0:update_45 + cpe:/a:oracle:jre:1.6.0:update_65 + cpe:/a:oracle:jre:1.5.0:update_55 + cpe:/a:oracle:jdk:1.5.0:update_55 + cpe:/a:oracle:javafx:2.2.45 + cpe:/a:oracle:jdk:1.6.0:update_65 + + CVE-2014-0417 + 2014-01-15T11:08:10.127-05:00 + 2014-04-01T02:28:12.967-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-01-16T00:09:54.200-05:00 + + + + SECTRACK + 1029608 + + + BID + 64932 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56535 + + + SECUNIA + 56486 + + + SECUNIA + 56485 + + + SECUNIA + 56484 + + + REDHAT + RHSA-2014:0136 + + + REDHAT + RHSA-2014:0135 + + + REDHAT + RHSA-2014:0134 + + + REDHAT + RHSA-2014:0030 + + + OSVDB + 102001 + + + HP + SSRT101455 + + + HP + HPSBUX02973 + + + HP + HPSBUX02972 + + + HP + SSRT101454 + + + SUSE + SUSE-SU-2014:0451 + + + SUSE + SUSE-SU-2014:0266 + + + SUSE + SUSE-SU-2014:0246 + + Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JavaFX 2.2.45; and Java SE Embedded 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. + + + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.7.0:update_45 + cpe:/a:oracle:jdk:1.7.0:update_45 + cpe:/a:oracle:jre:1.6.0:update_65 + cpe:/a:oracle:jdk:1.6.0:update_65 + + CVE-2014-0418 + 2014-01-15T11:08:10.157-05:00 + 2014-03-16T00:44:18.253-04:00 + + + 5.1 + NETWORK + HIGH + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-16T00:13:11.533-05:00 + + + + XF + oracle-cpujan2014-cve20140418(90344) + + + SECTRACK + 1029608 + + + BID + 64917 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56535 + + + SECUNIA + 56485 + + + REDHAT + RHSA-2014:0030 + + + OSVDB + 102012 + + + HP + SSRT101455 + + + HP + HPSBUX02973 + + + HP + HPSBUX02972 + + + HP + SSRT101454 + + Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5889, CVE-2013-5902, CVE-2014-0410, CVE-2014-0415, and CVE-2014-0424. + + + + + + + + + + + + cpe:/a:oracle:virtualization_secure_global_desktop:5.0 + cpe:/a:oracle:virtualization_secure_global_desktop:4.63 + cpe:/a:oracle:virtualization_secure_global_desktop:5.10 + cpe:/a:oracle:virtualization_secure_global_desktop:4.71 + + CVE-2014-0419 + 2014-01-15T11:08:10.187-05:00 + 2014-02-06T23:51:44.910-05:00 + + + 5.1 + NETWORK + HIGH + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-16T15:10:41.143-05:00 + + + + XF + oracle-cpujan2014-cve20140419(90367) + + + SECTRACK + 1029610 + + + BID + 64902 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + OSVDB + 102110 + + Unspecified vulnerability in the Oracle Secure Global Desktop (SGD) component in Oracle Virtualization SGD before 4.63 with December 2013 PSU, 4.71, 5.0 with December 2013 PSU, and 5.10 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Administration Console and Workspace Web Applications. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:mysql:5.6.1 + cpe:/a:oracle:mysql:5.6.3 + cpe:/a:oracle:mysql:5.6.2 + cpe:/a:oracle:mysql:5.6.5 + cpe:/a:oracle:mysql:5.5.16 + cpe:/a:oracle:mysql:5.6.4 + cpe:/a:oracle:mysql:5.6.7 + cpe:/a:oracle:mysql:5.6.6 + cpe:/a:oracle:mysql:5.6.9 + cpe:/a:mysql:mysql:5.5.0 + cpe:/a:mysql:mysql:5.5.1 + cpe:/a:mysql:mysql:5.5.7 + cpe:/a:mysql:mysql:5.5.8 + cpe:/a:mysql:mysql:5.5.5 + cpe:/a:mysql:mysql:5.5.6 + cpe:/a:oracle:mysql:5.5.17 + cpe:/a:oracle:mysql:5.5.18 + cpe:/a:mysql:mysql:5.5.9 + cpe:/a:oracle:mysql:5.5.19 + cpe:/a:oracle:mysql:5.5.12 + cpe:/a:oracle:mysql:5.5.13 + cpe:/a:oracle:mysql:5.5.14 + cpe:/a:oracle:mysql:5.5.15 + cpe:/a:mysql:mysql:5.5.3 + cpe:/a:mysql:mysql:5.5.4 + cpe:/a:oracle:mysql:5.5.10 + cpe:/a:oracle:mysql:5.5.11 + cpe:/a:mysql:mysql:5.5.2 + cpe:/a:oracle:mysql:5.5.27 + cpe:/a:oracle:mysql:5.6.10 + cpe:/a:oracle:mysql:5.6.12 + cpe:/a:oracle:mysql:5.6.11 + cpe:/a:oracle:mysql:5.6.14 + cpe:/a:oracle:mysql:5.6.13 + cpe:/a:oracle:mysql:5.5.29 + cpe:/a:oracle:mysql:5.5.28 + cpe:/a:oracle:mysql:5.5.25 + cpe:/a:oracle:mysql:5.5.26 + cpe:/a:oracle:mysql:5.6.8 + cpe:/a:oracle:mysql:5.5.23 + cpe:/a:oracle:mysql:5.5.24 + cpe:/a:oracle:mysql:5.5.21 + cpe:/a:oracle:mysql:5.5.22 + cpe:/a:oracle:mysql:5.5.20 + cpe:/a:oracle:mysql:5.5.31 + cpe:/a:oracle:mysql:5.5.33 + cpe:/a:oracle:mysql:5.5.32 + cpe:/a:oracle:mysql:5.5.34 + cpe:/a:oracle:mysql:5.5.30 + cpe:/a:oracle:mysql:5.5.25:a + cpe:/a:oracle:mysql:5.6.0 + + CVE-2014-0420 + 2014-01-15T11:08:10.203-05:00 + 2014-03-05T23:50:27.957-05:00 + + + 2.8 + NETWORK + MEDIUM + MULTIPLE_INSTANCES + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-01-16T00:26:24.333-05:00 + + + + XF + oracle-cpujan2014-cve20140420(90388) + + + BID + 64888 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + DEBIAN + DSA-2848 + + + UBUNTU + USN-2086-1 + + + SECUNIA + 56580 + + + SECUNIA + 56491 + + + REDHAT + RHSA-2014:0189 + + + REDHAT + RHSA-2014:0186 + + + REDHAT + RHSA-2014:0173 + + + OSVDB + 102077 + + Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.34 and earlier, and 5.6.14 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Replication. + + + + + + + + + cpe:/o:sun:sunos:5.10:-:sparc + + CVE-2014-0421 + 2014-04-15T20:55:23.873-04:00 + 2014-04-16T12:05:48.247-04:00 + + + 4.6 + LOCAL + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-16T12:05:48.230-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Solaris 10, when running on the SPARC64-X Platform, allows local users to affect confidentiality, integrity, and availability via unknown vectors. + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.7.0:update_45 + cpe:/a:oracle:jdk:1.7.0:update_45 + cpe:/a:oracle:jre:1.6.0:update_65 + cpe:/a:oracle:jre:1.5.0:update_55 + cpe:/a:oracle:jdk:1.5.0:update_55 + cpe:/a:oracle:jdk:1.6.0:update_65 + + CVE-2014-0422 + 2014-01-15T11:08:10.237-05:00 + 2014-04-01T02:28:13.373-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-01-16T00:28:21.147-05:00 + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1051528 + + + UBUNTU + USN-2124-1 + + + UBUNTU + USN-2089-1 + + + SECTRACK + 1029608 + + + BID + 64921 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56535 + + + SECUNIA + 56486 + + + SECUNIA + 56485 + + + SECUNIA + 56432 + + + REDHAT + RHSA-2014:0136 + + + REDHAT + RHSA-2014:0135 + + + REDHAT + RHSA-2014:0134 + + + REDHAT + RHSA-2014:0097 + + + REDHAT + RHSA-2014:0030 + + + REDHAT + RHSA-2014:0027 + + + REDHAT + RHSA-2014:0026 + + + OSVDB + 101997 + + + HP + SSRT101455 + + + HP + HPSBUX02973 + + + HP + HPSBUX02972 + + + HP + SSRT101454 + + + SUSE + openSUSE-SU-2014:0180 + + + SUSE + openSUSE-SU-2014:0177 + + + SUSE + openSUSE-SU-2014:0174 + + + SUSE + SUSE-SU-2014:0451 + + + SUSE + SUSE-SU-2014:0266 + + + SUSE + SUSE-SU-2014:0246 + + Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JNDI. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to missing package access checks in the Naming / JNDI component, which allows attackers to escape the sandbox. + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.7.0:update_45 + cpe:/a:oracle:jdk:1.7.0:update_45 + cpe:/a:oracle:jrockit:r28.2.9 + cpe:/a:oracle:jrockit:r27.7.7 + cpe:/a:oracle:jre:1.6.0:update_65 + cpe:/a:oracle:jre:1.5.0:update_55 + cpe:/a:oracle:jdk:1.5.0:update_55 + cpe:/a:oracle:jdk:1.6.0:update_65 + + CVE-2014-0423 + 2014-01-15T11:08:10.267-05:00 + 2014-04-01T02:28:13.467-04:00 + + + 5.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + PARTIAL + http://nvd.nist.gov + 2014-01-16T10:11:55.190-05:00 + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1053066 + + + XF + oracle-cpujan2014-cve20140423(90340) + + + UBUNTU + USN-2124-1 + + + UBUNTU + USN-2089-1 + + + SECTRACK + 1029608 + + + BID + 64914 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56535 + + + SECUNIA + 56487 + + + SECUNIA + 56486 + + + SECUNIA + 56485 + + + SECUNIA + 56432 + + + REDHAT + RHSA-2014:0136 + + + REDHAT + RHSA-2014:0135 + + + REDHAT + RHSA-2014:0134 + + + REDHAT + RHSA-2014:0097 + + + REDHAT + RHSA-2014:0030 + + + REDHAT + RHSA-2014:0027 + + + REDHAT + RHSA-2014:0026 + + + HP + SSRT101455 + + + HP + HPSBUX02973 + + + HP + HPSBUX02972 + + + HP + SSRT101454 + + + SUSE + openSUSE-SU-2014:0180 + + + SUSE + openSUSE-SU-2014:0177 + + + SUSE + openSUSE-SU-2014:0174 + + + SUSE + SUSE-SU-2014:0451 + + + SUSE + SUSE-SU-2014:0266 + + + SUSE + SUSE-SU-2014:0246 + + + CONFIRM + http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/995b32f013f5 + + Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote authenticated users to affect confidentiality and availability via unknown vectors related to Beans. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability in DocumentHandler.java, related to Beans decoding. + + + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.7.0:update_45 + cpe:/a:oracle:jdk:1.7.0:update_45 + cpe:/a:oracle:jre:1.6.0:update_65 + cpe:/a:oracle:jdk:1.6.0:update_65 + + CVE-2014-0424 + 2014-01-15T11:08:10.297-05:00 + 2014-04-01T02:28:13.560-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-16T10:16:30.353-05:00 + + + + SECTRACK + 1029608 + + + BID + 64919 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56535 + + + SECUNIA + 56485 + + + REDHAT + RHSA-2014:0135 + + + REDHAT + RHSA-2014:0134 + + + REDHAT + RHSA-2014:0030 + + + OSVDB + 102004 + + + HP + SSRT101455 + + + HP + HPSBUX02973 + + + HP + HPSBUX02972 + + + HP + SSRT101454 + + + SUSE + SUSE-SU-2014:0451 + + + SUSE + SUSE-SU-2014:0266 + + + SUSE + SUSE-SU-2014:0246 + + Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5889, CVE-2013-5902, CVE-2014-0410, CVE-2014-0415, and CVE-2014-0418. + + + + + + + + + cpe:/a:oracle:peoplesoft_products:9.2 + + CVE-2014-0425 + 2014-01-15T11:08:10.330-05:00 + 2014-02-06T23:51:45.363-05:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-16T10:17:51.637-05:00 + + + + SECTRACK + 1029623 + + + BID + 64889 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56479 + + + OSVDB + 102044 + + Unspecified vulnerability in the PeopleSoft Enterprise SCM Services Procurement component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Security. + + + + + + + + + cpe:/a:oracle:fusion_middleware:10.1.3.5 + + CVE-2014-0426 + 2014-04-15T20:55:23.903-04:00 + 2014-04-16T12:13:36.887-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-16T12:13:36.840-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect integrity via vectors related to HTTP Request Handling, a different vulnerability than CVE-2014-0413. + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:mysql:5.6.1 + cpe:/a:oracle:mysql:5.6.3 + cpe:/a:oracle:mysql:5.6.2 + cpe:/a:oracle:mysql:5.6.5 + cpe:/a:oracle:mysql:5.6.4 + cpe:/a:oracle:mysql:5.6.7 + cpe:/a:oracle:mysql:5.6.6 + cpe:/a:oracle:mysql:5.6.9 + cpe:/a:oracle:mysql:5.6.10 + cpe:/a:oracle:mysql:5.6.12 + cpe:/a:oracle:mysql:5.6.0 + cpe:/a:oracle:mysql:5.6.11 + cpe:/a:oracle:mysql:5.6.13 + cpe:/a:oracle:mysql:5.6.8 + + CVE-2014-0427 + 2014-01-15T11:08:10.360-05:00 + 2014-02-06T23:51:45.443-05:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-01-16T10:19:16.340-05:00 + + + + XF + oracle-cpujan2014-cve20140427(90383) + + + BID + 64868 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56491 + + + OSVDB + 102072 + + Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.13 and earlier allows remote authenticated users to affect availability via vectors related to FTS. + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.7.0:update_45 + cpe:/a:oracle:jdk:1.7.0:update_45 + cpe:/a:oracle:jre:1.6.0:update_65 + cpe:/a:oracle:jre:1.5.0:update_55 + cpe:/a:oracle:jdk:1.5.0:update_55 + cpe:/a:oracle:jdk:1.6.0:update_65 + + CVE-2014-0428 + 2014-01-15T11:08:10.377-05:00 + 2014-04-01T02:28:13.793-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-01-16T10:23:45.847-05:00 + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1051519 + + + UBUNTU + USN-2124-1 + + + UBUNTU + USN-2089-1 + + + SECTRACK + 1029608 + + + BID + 64935 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56535 + + + SECUNIA + 56486 + + + SECUNIA + 56485 + + + SECUNIA + 56432 + + + REDHAT + RHSA-2014:0136 + + + REDHAT + RHSA-2014:0135 + + + REDHAT + RHSA-2014:0134 + + + REDHAT + RHSA-2014:0097 + + + REDHAT + RHSA-2014:0030 + + + REDHAT + RHSA-2014:0027 + + + REDHAT + RHSA-2014:0026 + + + OSVDB + 101996 + + + HP + SSRT101455 + + + HP + HPSBUX02973 + + + HP + HPSBUX02972 + + + HP + SSRT101454 + + + SUSE + openSUSE-SU-2014:0180 + + + SUSE + openSUSE-SU-2014:0177 + + + SUSE + openSUSE-SU-2014:0174 + + + SUSE + SUSE-SU-2014:0451 + + + SUSE + SUSE-SU-2014:0266 + + + SUSE + SUSE-SU-2014:0246 + + + MISC + http://hg.openjdk.java.net/jdk7u/jdk7u/corba/rev/0a879f00b698 + + Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to "insufficient security checks in IIOP streams," which allows attackers to escape the sandbox. + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jrockit:r27.8.1 + cpe:/a:oracle:jdk:1.8.0 + cpe:/a:oracle:jre:1.5.0:update_61 + cpe:/a:oracle:jdk:1.7.0:update_51 + cpe:/a:oracle:jre:1.6.0:update_71 + cpe:/a:oracle:jrockit:r28.3.1 + cpe:/a:oracle:jre:1.7.0:update_51 + cpe:/a:oracle:jdk:1.6.0:update_71 + cpe:/a:oracle:jdk:1.5.0:update_61 + + CVE-2014-0429 + 2014-04-15T20:55:23.920-04:00 + 2014-04-16T11:48:30.523-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-16T11:48:25.757-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:mysql:5.6.1 + cpe:/a:oracle:mysql:5.6.3 + cpe:/a:oracle:mysql:5.6.2 + cpe:/a:oracle:mysql:5.6.5 + cpe:/a:oracle:mysql:5.6.4 + cpe:/a:oracle:mysql:5.6.7 + cpe:/a:oracle:mysql:5.6.6 + cpe:/a:oracle:mysql:5.6.9 + cpe:/a:oracle:mysql:5.6.10 + cpe:/a:oracle:mysql:5.6.12 + cpe:/a:oracle:mysql:5.6.0 + cpe:/a:oracle:mysql:5.6.11 + cpe:/a:oracle:mysql:5.6.13 + cpe:/a:oracle:mysql:5.6.8 + + CVE-2014-0430 + 2014-01-15T11:08:10.407-05:00 + 2014-02-06T23:51:45.613-05:00 + + + 2.8 + NETWORK + MEDIUM + MULTIPLE_INSTANCES + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-01-16T10:25:23.317-05:00 + + + + XF + oracle-cpujan2014-cve20140430(90387) + + + BID + 64893 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56491 + + + OSVDB + 102076 + + Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.13 and earlier allows remote authenticated users to affect availability via unknown vectors related to Performance Schema. + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:mysql:5.6.1 + cpe:/a:oracle:mysql:5.6.3 + cpe:/a:oracle:mysql:5.6.2 + cpe:/a:oracle:mysql:5.6.5 + cpe:/a:oracle:mysql:5.6.4 + cpe:/a:oracle:mysql:5.6.7 + cpe:/a:oracle:mysql:5.6.6 + cpe:/a:oracle:mysql:5.6.9 + cpe:/a:oracle:mysql:5.6.10 + cpe:/a:oracle:mysql:5.6.12 + cpe:/a:oracle:mysql:5.6.0 + cpe:/a:oracle:mysql:5.6.11 + cpe:/a:oracle:mysql:5.6.14 + cpe:/a:oracle:mysql:5.6.13 + cpe:/a:oracle:mysql:5.6.8 + + CVE-2014-0431 + 2014-01-15T11:08:10.437-05:00 + 2014-02-06T23:51:45.707-05:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-01-16T10:26:51.883-05:00 + + + + XF + oracle-cpujan2014-cve20140431(90384) + + + BID + 64897 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56491 + + + OSVDB + 102073 + + Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB, a different vulnerability than CVE-2013-5881. + + + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jdk:1.8.0 + cpe:/a:oracle:jdk:1.7.0:update_51 + cpe:/a:oracle:jre:1.7.0:update_51 + + CVE-2014-0432 + 2014-04-15T20:55:23.967-04:00 + 2014-04-16T12:13:20.467-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-16T12:13:20.433-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-0455 and CVE-2014-2402. + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:mysql:5.6.1 + cpe:/a:oracle:mysql:5.6.3 + cpe:/a:oracle:mysql:5.6.2 + cpe:/a:oracle:mysql:5.6.5 + cpe:/a:oracle:mysql:5.6.4 + cpe:/a:oracle:mysql:5.6.7 + cpe:/a:oracle:mysql:5.6.6 + cpe:/a:oracle:mysql:5.6.9 + cpe:/a:oracle:mysql:5.6.10 + cpe:/a:oracle:mysql:5.6.12 + cpe:/a:oracle:mysql:5.6.0 + cpe:/a:oracle:mysql:5.6.11 + cpe:/a:oracle:mysql:5.6.13 + cpe:/a:oracle:mysql:5.6.8 + + CVE-2014-0433 + 2014-01-15T11:08:10.453-05:00 + 2014-02-06T23:51:45.787-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-01-16T10:29:32.433-05:00 + + + + XF + oracle-cpujan2014-cve20140433(90375) + + + BID + 64895 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56491 + + Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.13 and earlier allows remote attackers to affect availability via unknown vectors related to Thread Pooling. + + + + + + + + + + + cpe:/a:oracle:supply_chain_products_suite:6.1.1.0 + cpe:/a:oracle:supply_chain_products_suite:6.0.0 + cpe:/a:oracle:supply_chain_products_suite:6.1.0 + + CVE-2014-0434 + 2014-01-15T11:08:10.487-05:00 + 2014-02-06T23:51:45.863-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-16T10:33:24.360-05:00 + + + + SECTRACK + 1029620 + + + BID + 64851 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56472 + + + OSVDB + 102084 + + Unspecified vulnerability in the Oracle Agile Product Lifecycle Management for Process component in Oracle Supply Chain Products Suite 6.0, 6.1, and 6.1.1 allows remote attackers to affect integrity via unknown vectors related to Installation. + + + + + + + + + + + + + cpe:/a:oracle:supply_chain_products_suite:6.2.0 + cpe:/a:oracle:supply_chain_products_suite:6.3.1 + cpe:/a:oracle:supply_chain_products_suite:6.3.2 + cpe:/a:oracle:supply_chain_products_suite:6.1.0 + cpe:/a:oracle:supply_chain_products_suite:6.3.0 + + CVE-2014-0435 + 2014-01-15T11:08:10.517-05:00 + 2014-02-06T23:51:45.957-05:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-01-16T10:36:22.473-05:00 + + + + SECTRACK + 1029620 + + + BID + 64869 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + OSVDB + 102086 + + Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3, 6.3.1, and 6.3.2 allows remote authenticated users to affect availability via unknown vectors related to Data, Domain & Function Security. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mysql:mysql:5.5.0 + cpe:/a:oracle:mysql:5.1.52:sp1 + cpe:/a:mysql:mysql:5.5.1 + cpe:/a:mysql:mysql:5.5.7 + cpe:/a:mysql:mysql:5.5.8 + cpe:/a:mysql:mysql:5.5.5 + cpe:/a:mysql:mysql:5.1.49:sp1 + cpe:/a:mysql:mysql:5.5.6 + cpe:/a:mysql:mysql:5.1.46:sp1 + cpe:/a:mysql:mysql:5.5.9 + cpe:/a:mysql:mysql:5.5.3 + cpe:/a:mysql:mysql:5.5.4 + cpe:/a:mysql:mysql:5.5.2 + cpe:/a:oracle:mysql:5.6.10 + cpe:/a:mysql:mysql:5.1.40:sp1 + cpe:/a:oracle:mysql:5.6.12 + cpe:/a:mysql:mysql:5.1.43:sp1 + cpe:/a:oracle:mysql:5.6.11 + cpe:/a:oracle:mysql:5.6.14 + cpe:/a:oracle:mysql:5.6.13 + cpe:/a:mysql:mysql:5.1.37:sp1 + cpe:/a:oracle:mysql:5.1.62 + cpe:/a:oracle:mysql:5.1.61 + cpe:/a:mysql:mysql:5.1.34:sp1 + cpe:/a:oracle:mysql:5.1.60 + cpe:/a:oracle:mysql:5.1.66 + cpe:/a:oracle:mysql:5.1.65 + cpe:/a:oracle:mysql:5.1.64 + cpe:/a:oracle:mysql:5.1.63 + cpe:/a:oracle:mysql:5.1.69 + cpe:/a:mysql:mysql:5.1.23_bk + cpe:/a:oracle:mysql:5.1.68 + cpe:/a:mysql:mysql:5.1.31:sp1 + cpe:/a:oracle:mysql:5.5.31 + cpe:/a:oracle:mysql:5.5.33 + cpe:/a:mysql:mysql:5.1.5 + cpe:/a:oracle:mysql:5.5.32 + cpe:/a:mysql:mysql:5.1.3 + cpe:/a:oracle:mysql:5.5.34 + cpe:/a:mysql:mysql:5.1.4 + cpe:/a:mysql:mysql:5.1 + cpe:/a:mysql:mysql:5.1.1 + cpe:/a:mysql:mysql:5.1.2 + cpe:/a:mysql:mysql:5.1.23:a + cpe:/a:oracle:mysql:5.1.67 + cpe:/a:mysql:mysql:5.1.24 + cpe:/a:oracle:mysql:5.5.30 + cpe:/a:mysql:mysql:5.1.26 + cpe:/a:oracle:mysql:5.1.51 + cpe:/a:mysql:mysql:5.1.25 + cpe:/a:oracle:mysql:5.1.53 + cpe:/a:oracle:mysql:5.1.52 + cpe:/a:oracle:mysql:5.1.55 + cpe:/a:oracle:mysql:5.1.54 + cpe:/a:oracle:mysql:5.1.57 + cpe:/a:oracle:mysql:5.1.59 + cpe:/a:oracle:mysql:5.6.0 + cpe:/a:oracle:mysql:5.1.58 + cpe:/a:oracle:mysql:5.1.56 + cpe:/a:oracle:mysql:5.6.1 + cpe:/a:oracle:mysql:5.6.3 + cpe:/a:oracle:mysql:5.6.2 + cpe:/a:oracle:mysql:5.6.5 + cpe:/a:oracle:mysql:5.6.4 + cpe:/a:oracle:mysql:5.5.16 + cpe:/a:oracle:mysql:5.6.7 + cpe:/a:oracle:mysql:5.6.6 + cpe:/a:oracle:mysql:5.6.9 + cpe:/a:mysql:mysql:5.1.14 + cpe:/a:mysql:mysql:5.1.15 + cpe:/a:mysql:mysql:5.1.13 + cpe:/a:mysql:mysql:5.1.9 + cpe:/a:mysql:mysql:5.1.29 + cpe:/a:mysql:mysql:5.1.28 + cpe:/a:mysql:mysql:5.1.27 + cpe:/a:oracle:mysql:5.5.17 + cpe:/a:oracle:mysql:5.5.18 + cpe:/a:oracle:mysql:5.5.19 + cpe:/a:oracle:mysql:5.5.12 + cpe:/a:mysql:mysql:5.1.22 + cpe:/a:oracle:mysql:5.5.13 + cpe:/a:mysql:mysql:5.1.21 + cpe:/a:oracle:mysql:5.5.14 + cpe:/a:mysql:mysql:5.1.20 + cpe:/a:oracle:mysql:5.5.15 + cpe:/a:mysql:mysql:5.1.6 + cpe:/a:oracle:mysql:5.5.10 + cpe:/a:mysql:mysql:5.1.7 + cpe:/a:oracle:mysql:5.5.11 + cpe:/a:mysql:mysql:5.1.23 + cpe:/a:mysql:mysql:5.1.8 + cpe:/a:oracle:mysql:5.1.70 + cpe:/a:mysql:mysql:5.1.5a + cpe:/a:oracle:mysql:5.5.27 + cpe:/a:mysql:mysql:5.1.46 + cpe:/a:oracle:mysql:5.1.71 + cpe:/a:mysql:mysql:5.1.47 + cpe:/a:oracle:mysql:5.1.72 + cpe:/a:mysql:mysql:5.1.48 + cpe:/a:mysql:mysql:5.1.17 + cpe:/a:mysql:mysql:5.1.16 + cpe:/a:mysql:mysql:5.1.19 + cpe:/a:mysql:mysql:5.1.18 + cpe:/a:oracle:mysql:5.5.29 + cpe:/a:oracle:mysql:5.5.28 + cpe:/a:oracle:mysql:5.5.25 + cpe:/a:oracle:mysql:5.5.26 + cpe:/a:oracle:mysql:5.6.8 + cpe:/a:oracle:mysql:5.5.23 + cpe:/a:mysql:mysql:5.1.11 + cpe:/a:oracle:mysql:5.5.24 + cpe:/a:mysql:mysql:5.1.10 + cpe:/a:oracle:mysql:5.5.21 + cpe:/a:oracle:mysql:5.5.22 + cpe:/a:mysql:mysql:5.1.12 + cpe:/a:oracle:mysql:5.5.20 + cpe:/a:mysql:mysql:5.1.32-bzr + cpe:/a:mysql:mysql:5.1.36 + cpe:/a:mysql:mysql:5.1.37 + cpe:/a:mysql:mysql:5.1.35 + cpe:/a:mysql:mysql:5.1.23a + cpe:/a:mysql:mysql:5.1.40 + cpe:/a:mysql:mysql:5.1.50 + cpe:/a:mysql:mysql:5.1.49 + cpe:/a:mysql:mysql:5.1.45 + cpe:/a:mysql:mysql:5.1.44 + cpe:/a:mysql:mysql:5.1.43 + cpe:/a:mysql:mysql:5.1.42 + cpe:/a:mysql:mysql:5.1.41 + cpe:/a:oracle:mysql:5.5.25:a + cpe:/a:mysql:mysql:5.1.39 + cpe:/a:mysql:mysql:5.1.38 + cpe:/a:mysql:mysql:5.1.34 + cpe:/a:mysql:mysql:5.1.31 + cpe:/a:mysql:mysql:5.1.30 + cpe:/a:mysql:mysql:5.1.33 + cpe:/a:mysql:mysql:5.1.32 + + CVE-2014-0437 + 2014-01-15T11:08:10.547-05:00 + 2014-03-05T23:50:28.970-05:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-01-16T10:40:25.823-05:00 + + + + XF + oracle-cpujan2014-cve20140437(90385) + + + BID + 64849 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + DEBIAN + DSA-2848 + + + DEBIAN + DSA-2845 + + + UBUNTU + USN-2086-1 + + + SECUNIA + 56580 + + + SECUNIA + 56541 + + + SECUNIA + 56491 + + + REDHAT + RHSA-2014:0189 + + + REDHAT + RHSA-2014:0186 + + + REDHAT + RHSA-2014:0173 + + + REDHAT + RHSA-2014:0164 + + + OSVDB + 102074 + + Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. + + + + + + + + + + cpe:/a:oracle:peoplesoft_products:8.53 + cpe:/a:oracle:peoplesoft_products:8.52 + + CVE-2014-0438 + 2014-01-15T11:08:10.580-05:00 + 2014-02-06T23:51:46.130-05:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-16T10:43:00.390-05:00 + + + + SECTRACK + 1029623 + + + BID + 64887 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56478 + + + OSVDB + 102043 + + Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote authenticated users to affect confidentiality via unknown vectors related to Panel Processor. + + + + + + + + + + cpe:/a:oracle:peoplesoft_products:8.53 + cpe:/a:oracle:peoplesoft_products:8.52 + + CVE-2014-0439 + 2014-01-15T11:08:10.593-05:00 + 2014-02-06T23:51:46.207-05:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-16T10:46:06.177-05:00 + + + + SECTRACK + 1029623 + + + BID + 64884 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56478 + + + OSVDB + 102042 + + Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote authenticated users to affect integrity via unknown vectors related to Report Distribution. + + + + + + + + + + cpe:/a:oracle:peoplesoft_products:8.53 + cpe:/a:oracle:peoplesoft_products:8.52 + + CVE-2014-0440 + 2014-01-15T11:08:10.627-05:00 + 2014-02-06T23:51:46.287-05:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-01-16T10:50:57.103-05:00 + + + + SECTRACK + 1029623 + + + BID + 64881 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56478 + + + OSVDB + 102041 + + Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote authenticated users to affect availability via vectors related to PIA Core Technology. + + + + + + + + + + cpe:/a:oracle:peoplesoft_products:8.53 + cpe:/a:oracle:peoplesoft_products:8.52 + + CVE-2014-0441 + 2014-01-15T11:08:10.657-05:00 + 2014-02-06T23:51:46.363-05:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-01-16T11:14:19.230-05:00 + + + + SECTRACK + 1029623 + + + BID + 64839 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56478 + + + OSVDB + 102047 + + Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect availability via unknown vectors related to Integration Broker. + + + + + + + + + + + + cpe:/o:oracle:sunos:5.11.1 + cpe:/o:sun:sunos:5.11 + cpe:/o:sun:sunos:5.9 + cpe:/o:sun:sunos:5.10 + + CVE-2014-0442 + 2014-04-15T20:55:23.980-04:00 + 2014-04-16T12:02:12.850-04:00 + + + 4.6 + LOCAL + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-16T12:02:12.757-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Solaris 9, 10, and 11.1 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Print Filter Utility. + + + + + + + + + cpe:/a:oracle:peoplesoft_products:8.52 + + CVE-2014-0443 + 2014-01-15T11:08:10.687-05:00 + 2014-02-06T23:51:46.457-05:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-16T11:17:45.687-05:00 + + + + SECTRACK + 1029623 + + + BID + 64844 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56478 + + + OSVDB + 102032 + + Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 allows remote attackers to affect integrity via unknown vectors related to Security. + + + + + + + + + cpe:/a:oracle:supply_chain_products_suite:20.1.1 + + CVE-2014-0444 + 2014-01-15T11:08:10.720-05:00 + 2014-02-06T23:51:46.550-05:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-16T11:20:13.377-05:00 + + + + SECTRACK + 1029620 + + + BID + 64883 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56473 + + + OSVDB + 102089 + + Unspecified vulnerability in the Oracle AutoVue Electro-Mechanical Professional component in Oracle Supply Chain Products Suite 20.1.1 allows remote authenticated users to affect confidentiality via unknown vectors related to Web General, a different vulnerability than CVE-2013-5868 and CVE-2013-5871. + + + + + + + + + + cpe:/a:oracle:peoplesoft_products:8.53 + cpe:/a:oracle:peoplesoft_products:8.52 + + CVE-2014-0445 + 2014-01-15T11:08:10.737-05:00 + 2014-02-06T23:51:46.647-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-16T11:21:23.440-05:00 + + + + SECTRACK + 1029623 + + + BID + 64867 + + + BID + 64758 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + + SECUNIA + 56478 + + + OSVDB + 102038 + + Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect integrity via vectors related to PIA Core Technology, a different vulnerability than CVE-2014-0381. + + + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jdk:1.8.0 + cpe:/a:oracle:jre:1.5.0:update_61 + cpe:/a:oracle:jdk:1.7.0:update_51 + cpe:/a:oracle:jre:1.6.0:update_71 + cpe:/a:oracle:jre:1.7.0:update_51 + cpe:/a:oracle:jdk:1.6.0:update_71 + cpe:/a:oracle:jdk:1.5.0:update_61 + + CVE-2014-0446 + 2014-04-15T20:55:24.027-04:00 + 2014-04-16T12:22:03.403-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-16T12:22:03.343-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. + + + + + + + + + + cpe:/o:oracle:sunos:5.11.1 + cpe:/o:sun:sunos:5.10 + + CVE-2014-0447 + 2014-04-15T20:55:24.060-04:00 + 2014-04-16T12:03:56.307-04:00 + + + 4.9 + LOCAL + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-16T12:03:56.210-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Solaris 10 and 11.1 allows local users to affect availability via unknown vectors related to Kernel. + + + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jdk:1.8.0 + cpe:/a:oracle:jdk:1.7.0:update_51 + cpe:/a:oracle:jre:1.7.0:update_51 + + CVE-2014-0448 + 2014-04-15T20:55:24.090-04:00 + 2014-04-16T12:26:52.307-04:00 + + + 7.6 + NETWORK + HIGH + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-16T12:26:52.117-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 7u51 and 8 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jdk:1.8.0 + cpe:/a:oracle:jdk:1.7.0:update_51 + cpe:/a:oracle:jre:1.6.0:update_71 + cpe:/a:oracle:jre:1.7.0:update_51 + cpe:/a:oracle:jdk:1.6.0:update_71 + + CVE-2014-0449 + 2014-04-15T20:55:24.123-04:00 + 2014-04-16T12:32:01.737-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-16T12:32:01.080-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality via unknown vectors related to Deployment. + + + + + + + + + + cpe:/a:oracle:fusion_middleware:11.1.1.7.0 + cpe:/a:oracle:fusion_middleware:11.1.1.8.0 + + CVE-2014-0450 + 2014-04-15T20:55:24.153-04:00 + 2014-04-16T12:10:45.397-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-16T12:10:45.350-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Oracle WebCenter Portal component in Oracle Fusion Middleware 11.1.1.7 and 11.1.1.8 allows remote attackers to affect confidentiality via unknown vectors related to People Connection. + + + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jdk:1.8.0 + cpe:/a:oracle:jre:1.5.0:update_61 + cpe:/a:oracle:jdk:1.7.0:update_51 + cpe:/a:oracle:jre:1.6.0:update_71 + cpe:/a:oracle:jre:1.7.0:update_51 + cpe:/a:oracle:jdk:1.6.0:update_71 + cpe:/a:oracle:jdk:1.5.0:update_61 + + CVE-2014-0451 + 2014-04-15T21:55:09.650-04:00 + 2014-04-16T12:34:16.070-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-16T12:34:16.023-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT, a different vulnerability than CVE-2014-2412. + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jdk:1.8.0 + cpe:/a:oracle:jdk:1.7.0:update_51 + cpe:/a:oracle:jre:1.6.0:update_71 + cpe:/a:oracle:jre:1.7.0:update_51 + cpe:/a:oracle:jdk:1.6.0:update_71 + + CVE-2014-0452 + 2014-04-15T21:55:09.680-04:00 + 2014-04-16T12:36:24.543-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-16T12:36:24.510-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0458 and CVE-2014-2423. + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jrockit:r27.8.1 + cpe:/a:oracle:jdk:1.8.0 + cpe:/a:oracle:jre:1.5.0:update_61 + cpe:/a:oracle:jrockit:r28.3.1 + cpe:/a:oracle:jdk:1.7.0:update_51 + cpe:/a:oracle:jre:1.6.0:update_71 + cpe:/a:oracle:jre:1.7.0:update_51 + cpe:/a:oracle:jdk:1.6.0:update_71 + cpe:/a:oracle:jdk:1.5.0:update_61 + + CVE-2014-0453 + 2014-04-15T21:55:09.713-04:00 + 2014-04-16T12:28:06.963-04:00 + + + 4.0 + NETWORK + HIGH + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-16T12:28:06.900-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security. + + + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jdk:1.8.0 + cpe:/a:oracle:jdk:1.7.0:update_51 + cpe:/a:oracle:jre:1.7.0:update_51 + + CVE-2014-0454 + 2014-04-15T21:55:09.727-04:00 + 2014-04-16T12:40:02.097-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-16T12:40:02.067-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Security. + + + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jdk:1.8.0 + cpe:/a:oracle:jdk:1.7.0:update_51 + cpe:/a:oracle:jre:1.7.0:update_51 + + CVE-2014-0455 + 2014-04-15T21:55:09.760-04:00 + 2014-04-16T12:41:42.600-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-16T12:41:42.490-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-0432 and CVE-2014-2402. + + + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jdk:1.8.0 + cpe:/a:oracle:jdk:1.7.0:update_51 + cpe:/a:oracle:jre:1.7.0:update_51 + + CVE-2014-0456 + 2014-04-15T21:55:09.773-04:00 + 2014-04-16T12:44:35.077-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-16T12:44:35.027-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jrockit:r27.8.1 + cpe:/a:oracle:jdk:1.8.0 + cpe:/a:oracle:jre:1.5.0:update_61 + cpe:/a:oracle:jdk:1.7.0:update_51 + cpe:/a:oracle:jre:1.6.0:update_71 + cpe:/a:oracle:jrockit:r28.3.1 + cpe:/a:oracle:jre:1.7.0:update_51 + cpe:/a:oracle:jdk:1.6.0:update_71 + cpe:/a:oracle:jdk:1.5.0:update_61 + + CVE-2014-0457 + 2014-04-15T21:55:09.820-04:00 + 2014-04-16T12:29:16.450-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-16T12:29:16.373-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 5.0u61, SE 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jdk:1.8.0 + cpe:/a:oracle:jdk:1.7.0:update_51 + cpe:/a:oracle:jre:1.6.0:update_71 + cpe:/a:oracle:jre:1.7.0:update_51 + cpe:/a:oracle:jdk:1.6.0:update_71 + + CVE-2014-0458 + 2014-04-15T21:55:09.867-04:00 + 2014-04-16T12:43:55.247-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-16T12:43:55.120-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0452 and CVE-2014-2423. + + + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jdk:1.8.0 + cpe:/a:oracle:jdk:1.7.0:update_51 + cpe:/a:oracle:jre:1.7.0:update_51 + + CVE-2014-0459 + 2014-04-15T21:55:09.930-04:00 + 2014-04-16T12:46:18.967-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-16T12:46:18.937-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect availability via unknown vectors related to 2D. + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jrockit:r27.8.1 + cpe:/a:oracle:jdk:1.8.0 + cpe:/a:oracle:jre:1.5.0:update_61 + cpe:/a:oracle:jrockit:r28.3.1 + cpe:/a:oracle:jdk:1.7.0:update_51 + cpe:/a:oracle:jre:1.6.0:update_71 + cpe:/a:oracle:jre:1.7.0:update_51 + cpe:/a:oracle:jdk:1.6.0:update_71 + cpe:/a:oracle:jdk:1.5.0:update_61 + + CVE-2014-0460 + 2014-04-15T21:55:09.993-04:00 + 2014-04-16T12:30:21.547-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-16T12:30:21.093-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality and integrity via vectors related to JNDI. + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jdk:1.8.0 + cpe:/a:oracle:jdk:1.7.0:update_51 + cpe:/a:oracle:jre:1.6.0:update_71 + cpe:/a:oracle:jre:1.7.0:update_51 + cpe:/a:oracle:jdk:1.6.0:update_71 + + CVE-2014-0461 + 2014-04-15T21:55:10.057-04:00 + 2014-04-16T12:50:07.727-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-16T12:50:07.680-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jdk:1.8.0 + + CVE-2014-0463 + 2014-04-15T21:55:10.103-04:00 + 2014-04-16T12:53:07.873-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-16T12:53:07.810-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 8 allows remote attackers to affect confidentiality via unknown vectors related to Scripting, a different vulnerability than CVE-2014-0464. + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jdk:1.8.0 + + CVE-2014-0464 + 2014-04-15T21:55:10.167-04:00 + 2014-04-16T12:56:53.193-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-16T12:56:53.177-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 8 allows remote attackers to affect confidentiality via unknown vectors related to Scripting, a different vulnerability than CVE-2014-0463. + + + + + + + + + cpe:/a:oracle:fusion_middleware:8.0:update2_patch5 + + CVE-2014-0465 + 2014-04-15T21:55:10.227-04:00 + 2014-04-16T13:01:15.610-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-16T13:01:15.577-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Oracle OpenSSO component in Oracle Fusion Middleware 8.0 Update 2 Patch 5 allows remote authenticated users to affect integrity via unknown vectors related to Admin Console. + + + + + + + + + cpe:/a:gnu:a2ps:4.14 + + CVE-2014-0466 + 2014-04-03T12:15:39.863-04:00 + 2014-04-03T12:55:10.863-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-03T12:55:08.037-04:00 + + + + CONFIRM + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742902 + + + DEBIAN + DSA-2892 + + The fixps script in a2ps 4.14 does not use the -dSAFER option when executing gs, which allows context-dependent attackers to delete arbitrary files or execute arbitrary commands via a crafted PostScript file. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mutt:mutt:1.5.12 + cpe:/a:mutt:mutt:1.5.2 + cpe:/a:mutt:mutt:1.5.22 + cpe:/a:mutt:mutt:1.5.1 + cpe:/a:mutt:mutt:1.5.9 + cpe:/a:mutt:mutt:1.5.21 + cpe:/a:mutt:mutt:1.5.13 + cpe:/a:mutt:mutt:1.5.4 + cpe:/a:mutt:mutt:1.5.20 + cpe:/a:mutt:mutt:1.5.14 + cpe:/a:mutt:mutt:1.5.3 + cpe:/a:mutt:mutt:1.5.15 + cpe:/a:mutt:mutt:1.5.6 + cpe:/a:mutt:mutt:1.5.16 + cpe:/a:mutt:mutt:1.5.17 + cpe:/a:mutt:mutt:1.5.8 + cpe:/a:mutt:mutt:1.5.18 + cpe:/a:mutt:mutt:1.5.7 + cpe:/a:mutt:mutt:1.5.19 + cpe:/a:mutt:mutt:1.5.5 + cpe:/a:mutt:mutt:1.5.10 + cpe:/a:mutt:mutt:1.5 + cpe:/a:mutt:mutt:1.5.11 + + CVE-2014-0467 + 2014-03-14T11:55:05.637-04:00 + 2014-04-19T00:46:29.533-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-03-17T05:08:01.000-04:00 + + + + + UBUNTU + USN-2147-1 + + + CONFIRM + http://www.mutt.org/doc/devel/ChangeLog + + + DEBIAN + DSA-2874 + + + REDHAT + RHSA-2014:0304 + + + SUSE + openSUSE-SU-2014:0436 + + + SUSE + openSUSE-SU-2014:0434 + + + SUSE + SUSE-SU-2014:0471 + + Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of service (crash) via a crafted RFC2047 header line, related to address expansion. + + + + + + + + + cpe:/a:super_project:super:3.30.0 + + CVE-2014-0470 + 2014-04-30T10:22:06.110-04:00 + 2014-04-30T15:20:24.450-04:00 + + + 7.2 + LOCAL + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-30T15:20:24.403-04:00 + + + ALLOWS_ADMIN_ACCESS + + + MLIST + [oss-security] 20140428 super unchecked setuid (CVE-2014-0470) + + + DEBIAN + DSA-2917 + + super.c in Super 3.30.0 does not check the return value of the setuid function when the -F flag is set, which allows local users to gain privileges via unspecified vectors, aka an RLIMIT_NPROC attack. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:debian:dpkg:1.14.3 + cpe:/a:debian:dpkg:1.14.2 + cpe:/a:debian:dpkg:1.9.10 + cpe:/a:debian:dpkg:1.14.1 + cpe:/a:debian:dpkg:1.14.0 + cpe:/a:debian:dpkg:1.9.19 + cpe:/a:debian:dpkg:1.14.5 + cpe:/a:debian:dpkg:1.14.4 + cpe:/a:debian:dpkg:1.9.18 + cpe:/a:debian:dpkg:1.13.6 + cpe:/a:debian:dpkg:1.9.17 + cpe:/a:debian:dpkg:1.13.5 + cpe:/a:debian:dpkg:1.13.4 + cpe:/a:debian:dpkg:1.13.3 + cpe:/a:debian:dpkg:1.13.2 + cpe:/a:debian:dpkg:1.13.1 + cpe:/a:debian:dpkg:1.17.3 + cpe:/a:debian:dpkg:1.17.4 + cpe:/a:debian:dpkg:1.15.5.6 + cpe:/a:debian:dpkg:1.9.15 + cpe:/a:debian:dpkg:1.9.16 + cpe:/a:debian:dpkg:1.15.8.2 + cpe:/a:debian:dpkg:1.10.8 + cpe:/a:debian:dpkg:1.15.8.1 + cpe:/a:debian:dpkg:1.10.9 + cpe:/a:debian:dpkg:1.17.7 + cpe:/a:debian:dpkg:1.9.11 + cpe:/a:debian:dpkg:1.10.6 + cpe:/a:debian:dpkg:1.9.12 + cpe:/a:debian:dpkg:1.10.7 + cpe:/a:debian:dpkg:1.17.5 + cpe:/a:debian:dpkg:1.9.13 + cpe:/a:debian:dpkg:1.10.4 + cpe:/a:debian:dpkg:1.17.6 + cpe:/a:debian:dpkg:1.9.14 + cpe:/a:debian:dpkg:1.10.5 + cpe:/a:debian:dpkg:1.17.2 + cpe:/a:debian:dpkg:1.9.21 + cpe:/a:debian:dpkg:1.17.1 + cpe:/a:debian:dpkg:1.9.20 + cpe:/a:debian:dpkg:1.15.5.1 + cpe:/a:debian:dpkg:1.15.5.2 + cpe:/a:debian:dpkg:1.10.3 + cpe:/a:debian:dpkg:1.15.5.3 + cpe:/a:debian:dpkg:1.10.2 + cpe:/a:debian:dpkg:1.15.5.4 + cpe:/a:debian:dpkg:1.15.5.5 + cpe:/a:debian:dpkg:1.17.0 + cpe:/a:debian:dpkg:1.15.8.3 + cpe:/a:debian:dpkg:1.15.8.4 + cpe:/a:debian:dpkg:1.15.4.1 + cpe:/a:debian:dpkg:1.15.8.9 + cpe:/a:debian:dpkg:1.13.0 + cpe:/a:debian:dpkg:1.15.8.6 + cpe:/a:debian:dpkg:1.13.9 + cpe:/a:debian:dpkg:1.15.8.5 + cpe:/a:debian:dpkg:1.15.8.8 + cpe:/a:debian:dpkg:1.14.6 + cpe:/a:debian:dpkg:1.15.8.7 + cpe:/a:debian:dpkg:1.14.7 + cpe:/a:debian:dpkg:1.14.8 + cpe:/a:debian:dpkg:1.14.9 + cpe:/a:debian:dpkg:1.13.7 + cpe:/a:debian:dpkg:1.13.8 + cpe:/a:debian:dpkg:1.16.4.2 + cpe:/a:debian:dpkg:1.16.4.3 + cpe:/a:debian:dpkg:1.16.4.1 + cpe:/o:canonical:ubuntu_linux:10.04:-:lts + cpe:/a:debian:dpkg:1.14.21 + cpe:/a:debian:dpkg:1.14.20 + cpe:/a:debian:dpkg:1.14.23 + cpe:/a:debian:dpkg:1.14.22 + cpe:/a:debian:dpkg:1.13.11 + cpe:/a:debian:dpkg:1.14.16.1 + cpe:/a:debian:dpkg:1.13.10 + cpe:/a:debian:dpkg:1.14.16.2 + cpe:/o:canonical:ubuntu_linux:12.10 + cpe:/a:debian:dpkg:1.14.16.4 + cpe:/a:debian:dpkg:1.14.16.3 + cpe:/a:debian:dpkg:1.10 + cpe:/a:debian:dpkg:1.14.16.6 + cpe:/a:debian:dpkg:1.14.16.5 + cpe:/a:debian:dpkg:1.10.27 + cpe:/a:debian:dpkg:1.10.26 + cpe:/a:debian:dpkg:1.14.14 + cpe:/a:debian:dpkg:1.14.13 + cpe:/a:debian:dpkg:1.10.23 + cpe:/a:debian:dpkg:1.10.22 + cpe:/a:debian:dpkg:1.10.25 + cpe:/a:debian:dpkg:1.10.24 + cpe:/a:debian:dpkg:1.10.28 + cpe:/a:debian:dpkg:1.9.1 + cpe:/a:debian:dpkg:1.14.19 + cpe:/a:debian:dpkg:1.16.0.1 + cpe:/o:canonical:ubuntu_linux:12.04:-:lts + cpe:/a:debian:dpkg:1.10.20 + cpe:/a:debian:dpkg:1.10.21 + cpe:/a:debian:dpkg:1.14.15 + cpe:/a:debian:dpkg:1.14.16 + cpe:/a:debian:dpkg:1.14.17 + cpe:/a:debian:dpkg:1.14.18 + cpe:/a:debian:dpkg:1.14.25 + cpe:/a:debian:dpkg:1.14.24 + cpe:/a:debian:dpkg:1.10.16 + cpe:/a:debian:dpkg:1.10.15 + cpe:/a:debian:dpkg:1.16.1.2 + cpe:/a:debian:dpkg:1.10.14 + cpe:/a:debian:dpkg:1.16.1.1 + cpe:/a:debian:dpkg:1.10.13 + cpe:/a:debian:dpkg:1.10.12 + cpe:/a:debian:dpkg:1.10.11 + cpe:/a:debian:dpkg:1.16.0.3 + cpe:/a:debian:dpkg:1.16.0.2 + cpe:/a:debian:dpkg:1.13.13 + cpe:/a:debian:dpkg:1.13.12 + cpe:/a:debian:dpkg:1.13.11.1 + cpe:/a:debian:dpkg:1.13.18 + cpe:/a:debian:dpkg:1.10.17 + cpe:/a:debian:dpkg:1.13.19 + cpe:/a:debian:dpkg:1.10.18 + cpe:/a:debian:dpkg:1.14.11 + cpe:/a:debian:dpkg:1.14.12 + cpe:/a:debian:dpkg:1.13.14 + cpe:/a:debian:dpkg:1.13.15 + cpe:/a:debian:dpkg:1.14.10 + cpe:/a:debian:dpkg:1.13.16 + cpe:/a:debian:dpkg:1.13.17 + cpe:/a:debian:dpkg:1.14.28 + cpe:/a:debian:dpkg:1.14.29 + cpe:/a:debian:dpkg:1.10.19 + cpe:/a:debian:dpkg:1.14.26 + cpe:/a:debian:dpkg:1.14.27 + cpe:/a:debian:dpkg:1.16.3 + cpe:/a:debian:dpkg:1.16.2 + cpe:/a:debian:dpkg:1.9.2 + cpe:/a:debian:dpkg:1.15.6.1 + cpe:/a:debian:dpkg:1.9.3 + cpe:/a:debian:dpkg:1.16.1 + cpe:/a:debian:dpkg:1.16.0 + cpe:/a:debian:dpkg:1.16.11 + cpe:/a:debian:dpkg:1.15.7.2 + cpe:/a:debian:dpkg:1.15.0 + cpe:/a:debian:dpkg:1.16.12 + cpe:/a:debian:dpkg:1.15.2 + cpe:/a:debian:dpkg:1.16.10 + cpe:/a:debian:dpkg:1.15.1 + cpe:/a:debian:dpkg:1.15.4 + cpe:/a:debian:dpkg:1.13.24 + cpe:/a:debian:dpkg:1.15.3 + cpe:/a:debian:dpkg:1.13.23 + cpe:/a:debian:dpkg:1.15.7.1 + cpe:/a:debian:dpkg:1.13.25 + cpe:/o:canonical:ubuntu_linux:14.04::lts + cpe:/a:debian:dpkg:1.10.18.1 + cpe:/a:debian:dpkg:1.16.4 + cpe:/a:debian:dpkg:1.16.5 + cpe:/a:debian:dpkg:1.15.7 + cpe:/a:debian:dpkg:1.15.8 + cpe:/a:debian:dpkg:1.14.30 + cpe:/a:debian:dpkg:1.15.3.1 + cpe:/a:debian:dpkg:1.9.9 + cpe:/a:debian:dpkg:1.9.8 + cpe:/a:debian:dpkg:1.13.20 + cpe:/a:debian:dpkg:1.16.8 + cpe:/a:debian:dpkg:1.9.7 + cpe:/a:debian:dpkg:1.15.5 + cpe:/a:debian:dpkg:1.10.1 + cpe:/o:canonical:ubuntu_linux:13.10 + cpe:/a:debian:dpkg:1.13.21 + cpe:/a:debian:dpkg:1.16.9 + cpe:/a:debian:dpkg:1.15.6 + cpe:/a:debian:dpkg:1.13.22 + cpe:/a:debian:dpkg:1.16.6 + cpe:/a:debian:dpkg:1.16.7 + + CVE-2014-0471 + 2014-04-30T10:22:06.140-04:00 + 2014-05-01T12:33:41.257-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-05-01T12:33:40.477-04:00 + + + + + UBUNTU + USN-2183-1 + + + DEBIAN + DSA-2915 + + Directory traversal vulnerability in the unpacking functionality in dpkg before 1.15.9, 1.16.x before 1.16.13, and 1.17.x before 1.17.8 allows remote attackers to write arbitrary files via a crafted source package, related to "C-style filename quoting." + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:djangoproject:django:1.4.10 + cpe:/a:djangoproject:django:1.4.9 + cpe:/o:canonical:ubuntu_linux:10.04:-:lts + cpe:/a:djangoproject:django:1.4.7 + cpe:/a:djangoproject:django:1.4.8 + cpe:/a:djangoproject:django:1.7:alpha1 + cpe:/o:canonical:ubuntu_linux:12.04:-:lts + cpe:/a:djangoproject:django:1.5.1 + cpe:/a:djangoproject:django:1.7:alpha2 + cpe:/a:djangoproject:django:1.5.2 + cpe:/o:canonical:ubuntu_linux:14.04::lts + cpe:/a:djangoproject:django:1.5.3 + cpe:/a:djangoproject:django:1.5.4 + cpe:/a:djangoproject:django:1.5.5 + cpe:/a:djangoproject:django:1.4.6 + cpe:/a:djangoproject:django:1.4.5 + cpe:/a:djangoproject:django:1.4.4 + cpe:/a:djangoproject:django:1.4.3 + cpe:/a:djangoproject:django:1.4.2 + cpe:/a:djangoproject:django:1.4.1 + cpe:/a:djangoproject:django:1.7:beta1 + cpe:/a:djangoproject:django:1.4 + cpe:/o:canonical:ubuntu_linux:12.10 + cpe:/a:djangoproject:django:1.6 + cpe:/a:djangoproject:django:1.5 + cpe:/a:djangoproject:django:1.6.1 + cpe:/a:djangoproject:django:1.6.2 + cpe:/o:canonical:ubuntu_linux:13.10 + + CVE-2014-0472 + 2014-04-23T11:55:02.923-04:00 + 2014-04-24T10:26:26.947-04:00 + + + 5.1 + NETWORK + HIGH + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-24T10:26:26.757-04:00 + + + + + CONFIRM + https://www.djangoproject.com/weblog/2014/apr/21/security/ + + + UBUNTU + USN-2169-1 + + The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a "dotted Python path." + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:djangoproject:django:1.4.10 + cpe:/a:djangoproject:django:1.4.9 + cpe:/o:canonical:ubuntu_linux:10.04:-:lts + cpe:/a:djangoproject:django:1.4.7 + cpe:/a:djangoproject:django:1.7:alpha1 + cpe:/a:djangoproject:django:1.4.8 + cpe:/o:canonical:ubuntu_linux:12.04:-:lts + cpe:/a:djangoproject:django:1.5.1 + cpe:/a:djangoproject:django:1.7:alpha2 + cpe:/a:djangoproject:django:1.5.2 + cpe:/o:canonical:ubuntu_linux:14.04::lts + cpe:/a:djangoproject:django:1.5.3 + cpe:/a:djangoproject:django:1.5.4 + cpe:/a:djangoproject:django:1.5.5 + cpe:/a:djangoproject:django:1.4.6 + cpe:/a:djangoproject:django:1.4.5 + cpe:/a:djangoproject:django:1.4.4 + cpe:/a:djangoproject:django:1.4.3 + cpe:/a:djangoproject:django:1.4.2 + cpe:/a:djangoproject:django:1.4.1 + cpe:/a:djangoproject:django:1.7:beta1 + cpe:/a:djangoproject:django:1.4 + cpe:/o:canonical:ubuntu_linux:12.10 + cpe:/a:djangoproject:django:1.6 + cpe:/a:djangoproject:django:1.5 + cpe:/a:djangoproject:django:1.6.1 + cpe:/a:djangoproject:django:1.6.2 + cpe:/o:canonical:ubuntu_linux:13.10 + + CVE-2014-0473 + 2014-04-23T11:55:03.127-04:00 + 2014-04-24T10:40:37.877-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-24T10:40:37.440-04:00 + + + + + CONFIRM + https://www.djangoproject.com/weblog/2014/apr/21/security/ + + + UBUNTU + USN-2169-1 + + The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:djangoproject:django:1.4.10 + cpe:/a:djangoproject:django:1.4.9 + cpe:/o:canonical:ubuntu_linux:10.04:-:lts + cpe:/a:djangoproject:django:1.4.7 + cpe:/a:djangoproject:django:1.4.8 + cpe:/a:djangoproject:django:1.7:alpha1 + cpe:/o:canonical:ubuntu_linux:12.04:-:lts + cpe:/a:djangoproject:django:1.5.1 + cpe:/a:djangoproject:django:1.5.2 + cpe:/a:djangoproject:django:1.7:alpha2 + cpe:/a:djangoproject:django:1.5.3 + cpe:/o:canonical:ubuntu_linux:14.04::lts + cpe:/a:djangoproject:django:1.5.4 + cpe:/a:djangoproject:django:1.5.5 + cpe:/a:djangoproject:django:1.4.6 + cpe:/a:djangoproject:django:1.4.5 + cpe:/a:djangoproject:django:1.4.4 + cpe:/a:djangoproject:django:1.4.3 + cpe:/a:djangoproject:django:1.4.2 + cpe:/a:djangoproject:django:1.4.1 + cpe:/a:djangoproject:django:1.7:beta1 + cpe:/a:djangoproject:django:1.4 + cpe:/o:canonical:ubuntu_linux:12.10 + cpe:/a:djangoproject:django:1.6 + cpe:/a:djangoproject:django:1.5 + cpe:/a:djangoproject:django:1.6.1 + cpe:/a:djangoproject:django:1.6.2 + cpe:/o:canonical:ubuntu_linux:13.10 + + CVE-2014-0474 + 2014-04-23T11:55:03.237-04:00 + 2014-04-24T10:50:28.630-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-24T10:50:25.160-04:00 + + + + + CONFIRM + https://www.djangoproject.com/weblog/2014/apr/21/security/ + + + UBUNTU + USN-2169-1 + + The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, related to "MySQL typecasting." + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:adobe:adobe_air:3.6.0.6090 + cpe:/a:adobe:flash_player:11.2.202.243 + cpe:/a:adobe:flash_player:11.2.202.280 + cpe:/a:adobe:adobe_air:3.5.0.880 + cpe:/a:adobe:adobe_air:3.5.0.1060 + cpe:/a:adobe:flash_player:11.1.115.48 + cpe:/a:adobe:adobe_air:3.8.0.870 + cpe:/a:adobe:adobe_air:3.7.0.2090 + cpe:/a:adobe:flash_player:11.7.700.202 + cpe:/a:adobe:flash_player:11.2.202.273 + cpe:/a:adobe:flash_player:11.1 + cpe:/a:adobe:flash_player:11.4.402.265 + cpe:/a:adobe:flash_player:11.0 + cpe:/a:adobe:flash_player:11.2.202.275 + cpe:/a:adobe:flash_player:11.8.800.168 + cpe:/a:adobe:adobe_air_sdk:3.6.0.599 + cpe:/a:adobe:flash_player:11.2.202.270 + cpe:/a:adobe:adobe_air_sdk:3.3.0.3690 + cpe:/a:adobe:flash_player:11.2.202.228 + cpe:/a:adobe:adobe_air_sdk:3.7.0.1530 + cpe:/a:adobe:adobe_air:3.9.0.1030 + cpe:/a:adobe:flash_player:11.3.300.262 + cpe:/a:adobe:adobe_air:3.7.0.1530 + cpe:/a:adobe:adobe_air:3.7.0.1860 + cpe:/a:adobe:flash_player:11.3.300.265 + cpe:/a:adobe:flash_player:11.1.102.55 + cpe:/a:adobe:adobe_air:3.1.0.485 + cpe:/a:adobe:flash_player:11.2.202.223 + cpe:/a:adobe:adobe_air_sdk:3.8.0.910 + cpe:/a:adobe:adobe_air_sdk:3.7.0.2090 + cpe:/a:adobe:adobe_air_sdk:3.5.0.880 + cpe:/a:adobe:flash_player:11.2.202.297 + cpe:/a:adobe:adobe_air:3.9.0.1060 + cpe:/a:adobe:flash_player:11.8.800.94 + cpe:/a:adobe:adobe_air_sdk:3.4.0.2540 + cpe:/a:adobe:flash_player:11.2.202.291 + cpe:/a:adobe:flash_player:11.1.102.63 + cpe:/a:adobe:flash_player:11.1.102.62 + cpe:/a:adobe:adobe_air:3.4.0.2540 + cpe:/a:adobe:flash_player:11.9.900.170 + cpe:/a:adobe:adobe_air_sdk:3.1.0.488 + cpe:/a:adobe:flash_player:11.8.800.97 + cpe:/a:adobe:flash_player:11.5.502.110 + cpe:/a:adobe:adobe_air:3.1.0.488 + cpe:/a:adobe:adobe_air_sdk:3.2.0.2070 + cpe:/a:adobe:flash_player:11.1.111.8 + cpe:/a:adobe:adobe_air_sdk:3.3.0.3650 + cpe:/a:adobe:flash_player:11.2.202.285 + cpe:/a:adobe:flash_player:11.5.502.146 + cpe:/a:adobe:flash_player:11.3.300.271 + cpe:/a:adobe:flash_player:11.1.111.54 + cpe:/a:adobe:flash_player:11.3.300.273 + cpe:/a:adobe:flash_player:11.7.700.242 + cpe:/a:adobe:flash_player:11.9.900.117 + cpe:/a:adobe:flash_player:11.7.700.252 + cpe:/a:adobe:flash_player:11.1.115.54 + cpe:/a:adobe:flash_player:11.7.700.257 + cpe:/a:adobe:flash_player:11.5.502.149 + cpe:/a:adobe:flash_player:11.2.202.258 + cpe:/a:adobe:adobe_air_sdk:3.9.0.1210 + cpe:/a:adobe:adobe_air:3.3.0.3670 + cpe:/a:adobe:adobe_air:3.6.0.597 + cpe:/a:adobe:adobe_air_sdk:3.9.0.1030 + cpe:/a:adobe:flash_player:11.1.111.44 + cpe:/a:adobe:adobe_air_sdk:3.4.0.2710 + cpe:/a:adobe:flash_player:11.2.202.251 + cpe:/a:adobe:flash_player:11.1.115.58 + cpe:/a:adobe:flash_player:11.5.502.136 + cpe:/a:adobe:flash_player:11.5.502.135 + cpe:/a:adobe:adobe_air_sdk:3.5.0.1060 + cpe:/a:adobe:flash_player:11.7.700.232 + cpe:/a:adobe:flash_player:11.9.900.152 + cpe:/a:adobe:flash_player:11.0.1.152 + cpe:/a:adobe:flash_player:11.0.1.153 + cpe:/a:adobe:adobe_air:3.0.0.4080 + cpe:/a:adobe:flash_player:11.7.700.169 + cpe:/a:adobe:flash_player:11.1.111.50 + cpe:/a:adobe:flash_player:11.2.202.327 + cpe:/a:adobe:adobe_air:3.2.0.2070 + cpe:/a:adobe:flash_player:11.6.602.171 + cpe:/a:adobe:flash_player:11.2.202.310 + cpe:/a:adobe:flash_player:11.3.300.270 + cpe:/a:adobe:adobe_air_sdk:3.0.0.4080 + cpe:/a:adobe:adobe_air:3.0.0.408 + cpe:/a:adobe:adobe_air_sdk:3.7.0.1860 + cpe:/a:adobe:flash_player:11.2.202.261 + cpe:/a:adobe:flash_player:11.2.202.262 + cpe:/a:adobe:adobe_air:3.5.0.600 + cpe:/a:adobe:flash_player:11.1.102.59 + cpe:/a:adobe:adobe_air:3.8.0.910 + cpe:/a:adobe:adobe_air:3.1.0.4880 + cpe:/a:adobe:flash_player:11.3.300.268 + cpe:/a:adobe:adobe_air:3.9.0.1210 + cpe:/a:adobe:flash_player:11.2.202.235 + cpe:/a:adobe:flash_player:11.2.202.236 + cpe:/a:adobe:adobe_air_sdk:3.6.0.6090 + cpe:/a:adobe:adobe_air:3.9.0.1380 + cpe:/a:adobe:flash_player:11.4.402.287 + cpe:/a:adobe:flash_player:11.2.202.238 + cpe:/a:adobe:adobe_air_sdk:3.8.0.870 + cpe:/a:adobe:flash_player:11.6.602.180 + cpe:/a:adobe:flash_player:11.1.115.7 + cpe:/a:adobe:flash_player:11.7.700.224 + cpe:/a:adobe:adobe_air:3.5.0.890 + cpe:/a:adobe:flash_player:11.1.115.34 + cpe:/a:adobe:adobe_air:3.4.0.2710 + cpe:/a:adobe:adobe_air_sdk:3.5.0.890 + cpe:/a:adobe:flash_player:11.2.202.233 + cpe:/a:adobe:adobe_air_sdk:3.9.0.1380 + cpe:/a:adobe:adobe_air_sdk:3.5.0.600 + cpe:/a:adobe:flash_player:11.6.602.168 + cpe:/a:adobe:flash_player:11.6.602.167 + cpe:/a:adobe:flash_player:11.3.300.257 + cpe:/a:adobe:flash_player:11.2.202.332 + cpe:/a:adobe:flash_player:11.4.402.278 + cpe:/a:adobe:adobe_air:3.2.0.207 + + CVE-2014-0491 + 2014-01-15T11:13:03.993-05:00 + 2014-02-21T00:06:19.127-05:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-01-17T09:02:25.707-05:00 + + + + + CONFIRM + http://helpx.adobe.com/security/products/flash-player/apsb14-02.html + + + SECTRACK + 1029602 + + + SECUNIA + 56636 + + + SECUNIA + 56516 + + + REDHAT + RHSA-2014:0028 + + + SUSE + openSUSE-SU-2014:0128 + + Adobe Flash Player before 11.7.700.260 and 11.8.x and 11.9.x before 12.0.0.38 on Windows and Mac OS X and before 11.2.202.335 on Linux, Adobe AIR before 4.0.0.1390, Adobe AIR SDK before 4.0.0.1390, and Adobe AIR SDK & Compiler before 4.0.0.1390 allow attackers to bypass unspecified protection mechanisms via unknown vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:adobe:adobe_air:3.6.0.6090 + cpe:/a:adobe:flash_player:11.2.202.243 + cpe:/a:adobe:flash_player:11.2.202.280 + cpe:/a:adobe:adobe_air:3.5.0.880 + cpe:/a:adobe:adobe_air:3.5.0.1060 + cpe:/a:adobe:flash_player:11.1.115.48 + cpe:/a:adobe:adobe_air:3.8.0.870 + cpe:/a:adobe:adobe_air:3.7.0.2090 + cpe:/a:adobe:flash_player:11.7.700.202 + cpe:/a:adobe:flash_player:11.2.202.273 + cpe:/a:adobe:flash_player:11.1 + cpe:/a:adobe:flash_player:11.4.402.265 + cpe:/a:adobe:flash_player:11.0 + cpe:/a:adobe:flash_player:11.2.202.275 + cpe:/a:adobe:flash_player:11.8.800.168 + cpe:/a:adobe:adobe_air_sdk:3.6.0.599 + cpe:/a:adobe:flash_player:11.2.202.270 + cpe:/a:adobe:adobe_air_sdk:3.3.0.3690 + cpe:/a:adobe:flash_player:11.2.202.228 + cpe:/a:adobe:adobe_air_sdk:3.7.0.1530 + cpe:/a:adobe:adobe_air:3.9.0.1030 + cpe:/a:adobe:adobe_air:3.7.0.1530 + cpe:/a:adobe:flash_player:11.3.300.262 + cpe:/a:adobe:adobe_air:3.7.0.1860 + cpe:/a:adobe:flash_player:11.3.300.265 + cpe:/a:adobe:flash_player:11.1.102.55 + cpe:/a:adobe:adobe_air:3.1.0.485 + cpe:/a:adobe:flash_player:11.2.202.223 + cpe:/a:adobe:adobe_air_sdk:3.8.0.910 + cpe:/a:adobe:adobe_air_sdk:3.7.0.2090 + cpe:/a:adobe:adobe_air_sdk:3.5.0.880 + cpe:/a:adobe:flash_player:11.2.202.297 + cpe:/a:adobe:adobe_air:3.9.0.1060 + cpe:/a:adobe:flash_player:11.8.800.94 + cpe:/a:adobe:adobe_air_sdk:3.4.0.2540 + cpe:/a:adobe:flash_player:11.2.202.291 + cpe:/a:adobe:flash_player:11.1.102.63 + cpe:/a:adobe:flash_player:11.1.102.62 + cpe:/a:adobe:adobe_air:3.4.0.2540 + cpe:/a:adobe:flash_player:11.9.900.170 + cpe:/a:adobe:adobe_air_sdk:3.1.0.488 + cpe:/a:adobe:flash_player:11.8.800.97 + cpe:/a:adobe:flash_player:11.5.502.110 + cpe:/a:adobe:adobe_air:3.1.0.488 + cpe:/a:adobe:adobe_air_sdk:3.2.0.2070 + cpe:/a:adobe:flash_player:11.1.111.8 + cpe:/a:adobe:adobe_air_sdk:3.3.0.3650 + cpe:/a:adobe:flash_player:11.2.202.285 + cpe:/a:adobe:flash_player:11.5.502.146 + cpe:/a:adobe:flash_player:11.3.300.271 + cpe:/a:adobe:flash_player:11.1.111.54 + cpe:/a:adobe:flash_player:11.3.300.273 + cpe:/a:adobe:flash_player:11.7.700.242 + cpe:/a:adobe:flash_player:11.9.900.117 + cpe:/a:adobe:flash_player:11.7.700.252 + cpe:/a:adobe:flash_player:11.1.115.54 + cpe:/a:adobe:flash_player:11.7.700.257 + cpe:/a:adobe:flash_player:11.5.502.149 + cpe:/a:adobe:flash_player:11.2.202.258 + cpe:/a:adobe:adobe_air_sdk:3.9.0.1210 + cpe:/a:adobe:adobe_air:3.3.0.3670 + cpe:/a:adobe:adobe_air:3.6.0.597 + cpe:/a:adobe:adobe_air_sdk:3.9.0.1030 + cpe:/a:adobe:flash_player:11.1.111.44 + cpe:/a:adobe:adobe_air_sdk:3.4.0.2710 + cpe:/a:adobe:flash_player:11.2.202.251 + cpe:/a:adobe:flash_player:11.1.115.58 + cpe:/a:adobe:flash_player:11.5.502.136 + cpe:/a:adobe:flash_player:11.5.502.135 + cpe:/a:adobe:adobe_air_sdk:3.5.0.1060 + cpe:/a:adobe:flash_player:11.7.700.232 + cpe:/a:adobe:flash_player:11.9.900.152 + cpe:/a:adobe:flash_player:11.0.1.152 + cpe:/a:adobe:flash_player:11.0.1.153 + cpe:/a:adobe:adobe_air:3.0.0.4080 + cpe:/a:adobe:flash_player:11.7.700.169 + cpe:/a:adobe:flash_player:11.1.111.50 + cpe:/a:adobe:adobe_air:3.2.0.2070 + cpe:/a:adobe:flash_player:11.2.202.327 + cpe:/a:adobe:flash_player:11.6.602.171 + cpe:/a:adobe:flash_player:11.2.202.310 + cpe:/a:adobe:flash_player:11.3.300.270 + cpe:/a:adobe:adobe_air_sdk:3.0.0.4080 + cpe:/a:adobe:adobe_air:3.0.0.408 + cpe:/a:adobe:adobe_air_sdk:3.7.0.1860 + cpe:/a:adobe:flash_player:11.2.202.261 + cpe:/a:adobe:flash_player:11.2.202.262 + cpe:/a:adobe:adobe_air:3.5.0.600 + cpe:/a:adobe:flash_player:11.1.102.59 + cpe:/a:adobe:adobe_air:3.8.0.910 + cpe:/a:adobe:adobe_air:3.1.0.4880 + cpe:/a:adobe:flash_player:11.3.300.268 + cpe:/a:adobe:adobe_air:3.9.0.1210 + cpe:/a:adobe:flash_player:11.2.202.235 + cpe:/a:adobe:flash_player:11.2.202.236 + cpe:/a:adobe:adobe_air_sdk:3.6.0.6090 + cpe:/a:adobe:adobe_air:3.9.0.1380 + cpe:/a:adobe:flash_player:11.4.402.287 + cpe:/a:adobe:flash_player:11.2.202.238 + cpe:/a:adobe:adobe_air_sdk:3.8.0.870 + cpe:/a:adobe:flash_player:11.6.602.180 + cpe:/a:adobe:flash_player:11.1.115.7 + cpe:/a:adobe:flash_player:11.7.700.224 + cpe:/a:adobe:adobe_air:3.5.0.890 + cpe:/a:adobe:flash_player:11.1.115.34 + cpe:/a:adobe:adobe_air:3.4.0.2710 + cpe:/a:adobe:adobe_air_sdk:3.5.0.890 + cpe:/a:adobe:flash_player:11.2.202.233 + cpe:/a:adobe:adobe_air_sdk:3.9.0.1380 + cpe:/a:adobe:adobe_air_sdk:3.5.0.600 + cpe:/a:adobe:flash_player:11.6.602.168 + cpe:/a:adobe:flash_player:11.6.602.167 + cpe:/a:adobe:flash_player:11.3.300.257 + cpe:/a:adobe:flash_player:11.2.202.332 + cpe:/a:adobe:flash_player:11.4.402.278 + cpe:/a:adobe:adobe_air:3.2.0.207 + + CVE-2014-0492 + 2014-01-15T11:13:04.023-05:00 + 2014-02-21T00:06:19.203-05:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-01-17T09:07:23.057-05:00 + + + + + CONFIRM + http://helpx.adobe.com/security/products/flash-player/apsb14-02.html + + + SECTRACK + 1029602 + + + SECUNIA + 56636 + + + SECUNIA + 56516 + + + REDHAT + RHSA-2014:0028 + + + SUSE + openSUSE-SU-2014:0128 + + Adobe Flash Player before 11.7.700.260 and 11.8.x and 11.9.x before 12.0.0.38 on Windows and Mac OS X and before 11.2.202.335 on Linux, Adobe AIR before 4.0.0.1390, Adobe AIR SDK before 4.0.0.1390, and Adobe AIR SDK & Compiler before 4.0.0.1390 allow attackers to defeat the ASLR protection mechanism by leveraging an "address leak." + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:adobe:acrobat_reader:10.1.8 + cpe:/a:adobe:acrobat_reader:10.1.5 + cpe:/a:adobe:acrobat_reader:11.0.1 + cpe:/a:adobe:acrobat_reader:10.1.4 + cpe:/a:adobe:acrobat_reader:10.1.7 + cpe:/a:adobe:acrobat_reader:11.0.3 + cpe:/a:adobe:acrobat_reader:10.1.6 + cpe:/a:adobe:acrobat_reader:11.0.2 + cpe:/a:adobe:acrobat_reader:10.1.1 + cpe:/a:adobe:acrobat_reader:11.0.4 + cpe:/a:adobe:acrobat_reader:10.1 + cpe:/a:adobe:acrobat_reader:10.1.3 + cpe:/a:adobe:acrobat_reader:10.1.2 + cpe:/a:adobe:acrobat:10.1.5 + cpe:/a:adobe:acrobat:10.1.4 + cpe:/a:adobe:acrobat:11.0.3 + cpe:/a:adobe:acrobat:11.0.2 + cpe:/a:adobe:acrobat:10.1.8 + cpe:/a:adobe:acrobat:11.0.1 + cpe:/a:adobe:acrobat:10.1.7 + cpe:/a:adobe:acrobat:10.1.6 + cpe:/a:adobe:acrobat:10.1.1 + cpe:/a:adobe:acrobat:10.1.2 + cpe:/a:adobe:acrobat:11.0.5 + cpe:/a:adobe:acrobat:10.1.3 + cpe:/a:adobe:acrobat:11.0.4 + cpe:/a:adobe:acrobat_reader:11.0 + cpe:/a:adobe:acrobat:10.1 + cpe:/a:adobe:acrobat:11.0 + + CVE-2014-0493 + 2014-01-15T11:13:04.057-05:00 + 2014-02-06T23:51:47.503-05:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-01-17T09:27:21.693-05:00 + + + + + SECTRACK + 1029604 + + + CONFIRM + http://helpx.adobe.com/security/products/acrobat/apsb14-01.html + + Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0495. + + + + + + + + + cpe:/a:adobe:digital_editions:2.0.1 + + CVE-2014-0494 + 2014-01-23T14:55:03.970-05:00 + 2014-02-06T23:51:47.583-05:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-01-24T10:19:58.077-05:00 + + + + + XF + adobe-digital-cve20140494-code-exec(90648) + + + SECTRACK + 1029680 + + + BID + 65091 + + + SECUNIA + 56578 + + + OSVDB + 102364 + + + CONFIRM + http://helpx.adobe.com/security/products/Digital-Editions/apsb14-03.html + + Adobe Digital Editions 2.0.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:adobe:acrobat_reader:10.1.8 + cpe:/a:adobe:acrobat_reader:10.1.5 + cpe:/a:adobe:acrobat_reader:11.0.1 + cpe:/a:adobe:acrobat_reader:10.1.4 + cpe:/a:adobe:acrobat_reader:11.0.3 + cpe:/a:adobe:acrobat_reader:10.1.7 + cpe:/a:adobe:acrobat_reader:10.1.6 + cpe:/a:adobe:acrobat_reader:11.0.2 + cpe:/a:adobe:acrobat_reader:10.1.1 + cpe:/a:adobe:acrobat_reader:11.0.4 + cpe:/a:adobe:acrobat_reader:10.1.3 + cpe:/a:adobe:acrobat_reader:10.1 + cpe:/a:adobe:acrobat_reader:10.1.2 + cpe:/a:adobe:acrobat:10.1.5 + cpe:/a:adobe:acrobat:10.1.4 + cpe:/a:adobe:acrobat:11.0.3 + cpe:/a:adobe:acrobat:11.0.2 + cpe:/a:adobe:acrobat:10.1.8 + cpe:/a:adobe:acrobat:10.1.7 + cpe:/a:adobe:acrobat:11.0.1 + cpe:/a:adobe:acrobat:10.1.6 + cpe:/a:adobe:acrobat:10.1.1 + cpe:/a:adobe:acrobat:11.0.5 + cpe:/a:adobe:acrobat:10.1.2 + cpe:/a:adobe:acrobat:11.0.4 + cpe:/a:adobe:acrobat:10.1.3 + cpe:/a:adobe:acrobat_reader:11.0 + cpe:/a:adobe:acrobat:10.1 + cpe:/a:adobe:acrobat:11.0 + + CVE-2014-0495 + 2014-01-15T11:13:04.070-05:00 + 2014-02-06T23:51:47.677-05:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-01-17T09:29:08.820-05:00 + + + + + SECTRACK + 1029604 + + + CONFIRM + http://helpx.adobe.com/security/products/acrobat/apsb14-01.html + + Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0493. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:adobe:acrobat_reader:10.1.8 + cpe:/a:adobe:acrobat_reader:10.1.5 + cpe:/a:adobe:acrobat_reader:11.0.1 + cpe:/a:adobe:acrobat_reader:10.1.4 + cpe:/a:adobe:acrobat_reader:11.0.3 + cpe:/a:adobe:acrobat_reader:10.1.7 + cpe:/a:adobe:acrobat_reader:10.1.6 + cpe:/a:adobe:acrobat_reader:11.0.2 + cpe:/a:adobe:acrobat_reader:10.1.1 + cpe:/a:adobe:acrobat_reader:11.0.4 + cpe:/a:adobe:acrobat_reader:10.1.3 + cpe:/a:adobe:acrobat_reader:10.1 + cpe:/a:adobe:acrobat_reader:10.1.2 + cpe:/a:adobe:acrobat:10.1.5 + cpe:/a:adobe:acrobat:10.1.4 + cpe:/a:adobe:acrobat:11.0.3 + cpe:/a:adobe:acrobat:11.0.2 + cpe:/a:adobe:acrobat:10.1.8 + cpe:/a:adobe:acrobat:10.1.7 + cpe:/a:adobe:acrobat:11.0.1 + cpe:/a:adobe:acrobat:10.1.6 + cpe:/a:adobe:acrobat:10.1.1 + cpe:/a:adobe:acrobat:11.0.5 + cpe:/a:adobe:acrobat:10.1.2 + cpe:/a:adobe:acrobat:11.0.4 + cpe:/a:adobe:acrobat:10.1.3 + cpe:/a:adobe:acrobat_reader:11.0 + cpe:/a:adobe:acrobat:10.1 + cpe:/a:adobe:acrobat:11.0 + + CVE-2014-0496 + 2014-01-15T11:13:04.100-05:00 + 2014-02-06T23:51:47.753-05:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-01-17T09:36:23.813-05:00 + + + + + SECTRACK + 1029604 + + + CONFIRM + http://helpx.adobe.com/security/products/acrobat/apsb14-01.html + + Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:adobe:flash_player:11.2.202.243 + cpe:/a:adobe:flash_player:11.2.202.280 + cpe:/a:adobe:flash_player:11.1.111.8 + cpe:/a:adobe:flash_player:11.2.202.285 + cpe:/a:adobe:flash_player:11.5.502.146 + cpe:/a:adobe:flash_player:11.3.300.271 + cpe:/a:adobe:flash_player:11.1.111.54 + cpe:/a:adobe:flash_player:11.3.300.273 + cpe:/a:adobe:flash_player:11.1.115.48 + cpe:/a:adobe:flash_player:11.7.700.242 + cpe:/a:adobe:flash_player:11.9.900.117 + cpe:/a:adobe:flash_player:11.7.700.252 + cpe:/a:adobe:flash_player:11.7.700.202 + cpe:/a:adobe:flash_player:11.1 + cpe:/a:adobe:flash_player:11.2.202.273 + cpe:/a:adobe:flash_player:11.4.402.265 + cpe:/a:adobe:flash_player:11.0 + cpe:/a:adobe:flash_player:11.2.202.275 + cpe:/a:adobe:flash_player:11.8.800.168 + cpe:/a:adobe:flash_player:11.1.115.54 + cpe:/a:adobe:flash_player:11.7.700.257 + cpe:/a:adobe:flash_player:11.5.502.149 + cpe:/a:adobe:flash_player:11.2.202.258 + cpe:/a:adobe:flash_player:11.2.202.270 + cpe:/a:adobe:flash_player:12.0.0.43 + cpe:/a:adobe:flash_player:11.1.111.44 + cpe:/a:adobe:flash_player:11.2.202.251 + cpe:/a:adobe:flash_player:11.1.115.58 + cpe:/a:adobe:flash_player:11.5.502.136 + cpe:/a:adobe:flash_player:11.5.502.135 + cpe:/a:adobe:flash_player:11.2.202.228 + cpe:/a:adobe:flash_player:11.7.700.232 + cpe:/a:adobe:flash_player:11.9.900.152 + cpe:/a:adobe:flash_player:11.0.1.152 + cpe:/a:adobe:flash_player:11.7.700.260 + cpe:/a:adobe:flash_player:11.3.300.262 + cpe:/a:adobe:flash_player:11.0.1.153 + cpe:/a:adobe:flash_player:11.7.700.169 + cpe:/a:adobe:flash_player:11.1.111.50 + cpe:/a:adobe:flash_player:11.2.202.327 + cpe:/a:adobe:flash_player:11.6.602.171 + cpe:/a:adobe:flash_player:11.2.202.310 + cpe:/a:adobe:flash_player:11.3.300.265 + cpe:/a:adobe:flash_player:11.3.300.270 + cpe:/a:adobe:flash_player:11.1.102.55 + cpe:/a:adobe:flash_player:11.2.202.261 + cpe:/a:adobe:flash_player:11.2.202.262 + cpe:/a:adobe:flash_player:11.1.102.59 + cpe:/a:adobe:flash_player:11.2.202.223 + cpe:/a:adobe:flash_player:12.0.0.41 + cpe:/a:adobe:flash_player:11.2.202.335 + cpe:/a:adobe:flash_player:12.0.0.38 + cpe:/a:adobe:flash_player:11.3.300.268 + cpe:/a:adobe:flash_player:11.2.202.235 + cpe:/a:adobe:flash_player:11.2.202.236 + cpe:/a:adobe:flash_player:11.4.402.287 + cpe:/a:adobe:flash_player:11.2.202.238 + cpe:/a:adobe:flash_player:11.6.602.180 + cpe:/a:adobe:flash_player:11.2.202.297 + cpe:/a:adobe:flash_player:11.1.115.7 + cpe:/a:adobe:flash_player:11.7.700.224 + cpe:/a:adobe:flash_player:11.8.800.94 + cpe:/a:adobe:flash_player:11.1.115.34 + cpe:/a:adobe:flash_player:11.2.202.291 + cpe:/a:adobe:flash_player:11.1.102.63 + cpe:/a:adobe:flash_player:11.1.102.62 + cpe:/a:adobe:flash_player:11.2.202.233 + cpe:/a:adobe:flash_player:11.9.900.170 + cpe:/a:adobe:flash_player:11.6.602.168 + cpe:/a:adobe:flash_player:11.6.602.167 + cpe:/a:adobe:flash_player:11.8.800.97 + cpe:/a:adobe:flash_player:11.3.300.257 + cpe:/a:adobe:flash_player:11.2.202.332 + cpe:/a:adobe:flash_player:11.5.502.110 + cpe:/a:adobe:flash_player:11.4.402.278 + + CVE-2014-0497 + 2014-02-05T00:15:29.897-05:00 + 2014-02-21T00:06:19.593-05:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-05T12:11:58.243-05:00 + + + + + CONFIRM + http://helpx.adobe.com/security/products/flash-player/apsb14-04.html + + + REDHAT + RHSA-2014:0137 + + + SUSE + SUSE-SU-2014:0221 + + + SUSE + openSUSE-SU-2014:0203 + + + SUSE + openSUSE-SU-2014:0197 + + Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:adobe:adobe_air:3.6.0.6090 + cpe:/a:adobe:flash_player:11.2.202.243 + cpe:/a:adobe:flash_player:11.2.202.280 + cpe:/a:adobe:adobe_air:3.5.0.880 + cpe:/a:adobe:adobe_air:2.0.3.13070 + cpe:/a:adobe:adobe_air:3.5.0.1060 + cpe:/a:adobe:flash_player:11.1.115.48 + cpe:/a:adobe:adobe_air:3.8.0.870 + cpe:/a:adobe:adobe_air:3.7.0.2090 + cpe:/a:adobe:flash_player:11.7.700.202 + cpe:/a:adobe:flash_player:11.1 + cpe:/a:adobe:flash_player:11.2.202.273 + cpe:/a:adobe:flash_player:11.0 + cpe:/a:adobe:flash_player:11.4.402.265 + cpe:/a:adobe:flash_player:11.2.202.275 + cpe:/a:adobe:flash_player:11.8.800.168 + cpe:/a:adobe:adobe_air:2.0.2.12610 + cpe:/a:adobe:adobe_air_sdk:3.6.0.599 + cpe:/a:adobe:flash_player:11.2.202.270 + cpe:/a:adobe:adobe_air_sdk:3.3.0.3690 + cpe:/a:adobe:flash_player:12.0.0.43 + cpe:/a:adobe:flash_player:12.0.0.44 + cpe:/a:adobe:adobe_air:2.5.1.17730 + cpe:/a:adobe:flash_player:11.2.202.228 + cpe:/a:adobe:adobe_air_sdk:3.7.0.1530 + cpe:/a:adobe:adobe_air:2.5.0.16600 + cpe:/a:adobe:adobe_air:3.9.0.1030 + cpe:/a:adobe:adobe_air:3.7.0.1530 + cpe:/a:adobe:flash_player:11.3.300.262 + cpe:/a:adobe:adobe_air:3.7.0.1860 + cpe:/a:adobe:adobe_air:1.5.1 + cpe:/a:adobe:flash_player:11.3.300.265 + cpe:/a:adobe:flash_player:11.1.102.55 + cpe:/a:adobe:adobe_air:1.5.3 + cpe:/a:adobe:adobe_air:1.5.2 + cpe:/a:adobe:adobe_air:2.6.0.19120 + cpe:/a:adobe:adobe_air:2.7.0.19480 + cpe:/a:adobe:adobe_air:3.1.0.485 + cpe:/a:adobe:adobe_air_sdk:3.8.0.910 + cpe:/a:adobe:flash_player:11.2.202.223 + cpe:/a:adobe:adobe_air_sdk:3.7.0.2090 + cpe:/a:adobe:adobe_air_sdk:3.5.0.880 + cpe:/a:adobe:adobe_air:2.7.0.1948 + cpe:/a:adobe:adobe_air:1.5.3.9120 + cpe:/a:adobe:adobe_air:1.0.8.4990 + cpe:/a:adobe:flash_player:11.2.202.297 + cpe:/a:adobe:adobe_air:3.9.0.1060 + cpe:/a:adobe:flash_player:11.8.800.94 + cpe:/a:adobe:adobe_air_sdk:3.4.0.2540 + cpe:/a:adobe:flash_player:11.2.202.291 + cpe:/a:adobe:flash_player:11.1.102.63 + cpe:/a:adobe:flash_player:11.1.102.62 + cpe:/a:adobe:adobe_air:3.4.0.2540 + cpe:/a:adobe:flash_player:11.9.900.170 + cpe:/a:adobe:adobe_air_sdk:3.1.0.488 + cpe:/a:adobe:flash_player:11.8.800.97 + cpe:/a:adobe:adobe_air:1.5.1.8210 + cpe:/a:adobe:flash_player:11.5.502.110 + cpe:/a:adobe:adobe_air:3.1.0.488 + cpe:/a:adobe:adobe_air_sdk:3.2.0.2070 + cpe:/a:adobe:flash_player:11.1.111.8 + cpe:/a:adobe:adobe_air_sdk:3.3.0.3650 + cpe:/a:adobe:flash_player:11.2.202.285 + cpe:/a:adobe:flash_player:11.5.502.146 + cpe:/a:adobe:flash_player:11.3.300.271 + cpe:/a:adobe:flash_player:11.1.111.54 + cpe:/a:adobe:flash_player:11.3.300.273 + cpe:/a:adobe:adobe_air_sdk:3.8.0.1430 + cpe:/a:adobe:flash_player:11.9.900.117 + cpe:/a:adobe:flash_player:11.7.700.242 + cpe:/a:adobe:adobe_air_sdk:4.0.0.1390 + cpe:/a:adobe:flash_player:11.7.700.252 + cpe:/a:adobe:adobe_air:4.0.0.1390 + cpe:/a:adobe:flash_player:11.1.115.54 + cpe:/a:adobe:adobe_air:2.0.2 + cpe:/a:adobe:adobe_air:2.0.3 + cpe:/a:adobe:flash_player:11.7.700.257 + cpe:/a:adobe:adobe_air:2.0.4 + cpe:/a:adobe:adobe_air:2.6.0.19140 + cpe:/a:adobe:flash_player:11.5.502.149 + cpe:/a:adobe:adobe_air_sdk:3.9.0.1210 + cpe:/a:adobe:flash_player:11.2.202.258 + cpe:/a:adobe:adobe_air:3.3.0.3670 + cpe:/a:adobe:adobe_air_sdk:3.9.0.1030 + cpe:/a:adobe:adobe_air:3.6.0.597 + cpe:/a:adobe:adobe_air_sdk:3.4.0.2710 + cpe:/a:adobe:flash_player:11.1.111.44 + cpe:/a:adobe:flash_player:11.1.115.58 + cpe:/a:adobe:flash_player:11.2.202.251 + cpe:/a:adobe:flash_player:11.5.502.136 + cpe:/a:adobe:adobe_air_sdk:3.5.0.1060 + cpe:/a:adobe:flash_player:11.5.502.135 + cpe:/a:adobe:flash_player:11.7.700.232 + cpe:/a:adobe:flash_player:11.9.900.152 + cpe:/a:adobe:flash_player:11.7.700.261 + cpe:/a:adobe:flash_player:11.0.1.152 + cpe:/a:adobe:adobe_air:2.7.0.19530 + cpe:/a:adobe:flash_player:11.7.700.260 + cpe:/a:adobe:flash_player:11.0.1.153 + cpe:/a:adobe:adobe_air:3.0.0.4080 + cpe:/a:adobe:flash_player:11.1.111.50 + cpe:/a:adobe:flash_player:11.7.700.169 + cpe:/a:adobe:flash_player:11.2.202.327 + cpe:/a:adobe:adobe_air:3.2.0.2070 + cpe:/a:adobe:adobe_air:1.5.3.9130 + cpe:/a:adobe:flash_player:11.6.602.171 + cpe:/a:adobe:flash_player:11.2.202.310 + cpe:/a:adobe:adobe_air:1.5.0.7220 + cpe:/a:adobe:flash_player:11.3.300.270 + cpe:/a:adobe:adobe_air_sdk:3.0.0.4080 + cpe:/a:adobe:adobe_air_sdk:3.7.0.1860 + cpe:/a:adobe:adobe_air:3.0.0.408 + cpe:/a:adobe:flash_player:11.2.202.261 + cpe:/a:adobe:flash_player:11.2.202.262 + cpe:/a:adobe:flash_player:11.1.102.59 + cpe:/a:adobe:adobe_air:3.5.0.600 + cpe:/a:adobe:adobe_air:3.8.0.910 + cpe:/a:adobe:adobe_air:1.0.1 + cpe:/a:adobe:adobe_air:1.5 + cpe:/a:adobe:flash_player:12.0.0.41 + cpe:/a:adobe:adobe_air:1.0.4990 + cpe:/a:adobe:flash_player:11.2.202.335 + cpe:/a:adobe:flash_player:11.2.202.336 + cpe:/a:adobe:flash_player:12.0.0.38 + cpe:/a:adobe:adobe_air:3.1.0.4880 + cpe:/a:adobe:flash_player:11.3.300.268 + cpe:/a:adobe:adobe_air:3.9.0.1210 + cpe:/a:adobe:adobe_air:2.6 + cpe:/a:adobe:flash_player:11.2.202.235 + cpe:/a:adobe:adobe_air_sdk:3.6.0.6090 + cpe:/a:adobe:flash_player:11.2.202.236 + cpe:/a:adobe:adobe_air:2.7 + cpe:/a:adobe:adobe_air:3.9.0.1380 + cpe:/a:adobe:flash_player:11.4.402.287 + cpe:/a:adobe:adobe_air_sdk:3.8.0.870 + cpe:/a:adobe:flash_player:11.2.202.238 + cpe:/a:adobe:flash_player:11.6.602.180 + cpe:/a:adobe:flash_player:11.1.115.7 + cpe:/a:adobe:adobe_air:2.7.0.1953 + cpe:/a:adobe:flash_player:11.7.700.224 + cpe:/a:adobe:flash_player:11.7.700.225 + cpe:/a:adobe:adobe_air:1.1.0.5790 + cpe:/a:adobe:adobe_air:3.5.0.890 + cpe:/a:adobe:flash_player:11.1.115.34 + cpe:/a:adobe:adobe_air_sdk:3.5.0.890 + cpe:/a:adobe:adobe_air:3.4.0.2710 + cpe:/a:adobe:flash_player:11.2.202.233 + cpe:/a:adobe:adobe_air:2.7.1 + cpe:/a:adobe:adobe_air_sdk:3.9.0.1380 + cpe:/a:adobe:adobe_air_sdk:3.5.0.600 + cpe:/a:adobe:adobe_air:1.0 + cpe:/a:adobe:flash_player:11.6.602.168 + cpe:/a:adobe:flash_player:11.6.602.167 + cpe:/a:adobe:flash_player:11.3.300.257 + cpe:/a:adobe:adobe_air:1.1 + cpe:/a:adobe:flash_player:11.2.202.332 + cpe:/a:adobe:adobe_air:2.7.1.19610 + cpe:/a:adobe:flash_player:11.4.402.278 + cpe:/a:adobe:adobe_air:3.2.0.207 + + CVE-2014-0498 + 2014-02-21T00:06:54.517-05:00 + 2014-03-05T23:50:30.220-05:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-21T09:47:19.877-05:00 + + + + + CONFIRM + http://helpx.adobe.com/security/products/flash-player/apsb14-07.html + + + REDHAT + RHSA-2014:0196 + + + SUSE + SUSE-SU-2014:0290 + + + SUSE + openSUSE-SU-2014:0278 + + + SUSE + openSUSE-SU-2014:0277 + + Stack-based buffer overflow in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 allows attackers to execute arbitrary code via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:adobe:adobe_air:3.6.0.6090 + cpe:/a:adobe:flash_player:11.2.202.243 + cpe:/a:adobe:flash_player:11.2.202.280 + cpe:/a:adobe:adobe_air:3.5.0.880 + cpe:/a:adobe:adobe_air:2.0.3.13070 + cpe:/a:adobe:adobe_air:3.5.0.1060 + cpe:/a:adobe:flash_player:11.1.115.48 + cpe:/a:adobe:adobe_air:3.8.0.870 + cpe:/a:adobe:adobe_air:3.7.0.2090 + cpe:/a:adobe:flash_player:11.7.700.202 + cpe:/a:adobe:flash_player:11.2.202.273 + cpe:/a:adobe:flash_player:11.1 + cpe:/a:adobe:flash_player:11.4.402.265 + cpe:/a:adobe:flash_player:11.0 + cpe:/a:adobe:flash_player:11.2.202.275 + cpe:/a:adobe:flash_player:11.8.800.168 + cpe:/a:adobe:adobe_air:2.0.2.12610 + cpe:/a:adobe:adobe_air_sdk:3.6.0.599 + cpe:/a:adobe:flash_player:11.2.202.270 + cpe:/a:adobe:adobe_air_sdk:3.3.0.3690 + cpe:/a:adobe:flash_player:12.0.0.43 + cpe:/a:adobe:flash_player:12.0.0.44 + cpe:/a:adobe:adobe_air:2.5.1.17730 + cpe:/a:adobe:flash_player:11.2.202.228 + cpe:/a:adobe:adobe_air_sdk:3.7.0.1530 + cpe:/a:adobe:adobe_air:2.5.0.16600 + cpe:/a:adobe:adobe_air:3.9.0.1030 + cpe:/a:adobe:flash_player:11.3.300.262 + cpe:/a:adobe:adobe_air:3.7.0.1530 + cpe:/a:adobe:adobe_air:3.7.0.1860 + cpe:/a:adobe:adobe_air:1.5.1 + cpe:/a:adobe:flash_player:11.3.300.265 + cpe:/a:adobe:adobe_air:1.5.3 + cpe:/a:adobe:flash_player:11.1.102.55 + cpe:/a:adobe:adobe_air:1.5.2 + cpe:/a:adobe:adobe_air:2.6.0.19120 + cpe:/a:adobe:adobe_air:2.7.0.19480 + cpe:/a:adobe:adobe_air:3.1.0.485 + cpe:/a:adobe:adobe_air_sdk:3.8.0.910 + cpe:/a:adobe:flash_player:11.2.202.223 + cpe:/a:adobe:adobe_air_sdk:3.7.0.2090 + cpe:/a:adobe:adobe_air_sdk:3.5.0.880 + cpe:/a:adobe:adobe_air:2.7.0.1948 + cpe:/a:adobe:adobe_air:1.5.3.9120 + cpe:/a:adobe:adobe_air:1.0.8.4990 + cpe:/a:adobe:flash_player:11.2.202.297 + cpe:/a:adobe:adobe_air:3.9.0.1060 + cpe:/a:adobe:flash_player:11.8.800.94 + cpe:/a:adobe:adobe_air_sdk:3.4.0.2540 + cpe:/a:adobe:flash_player:11.2.202.291 + cpe:/a:adobe:flash_player:11.1.102.63 + cpe:/a:adobe:flash_player:11.1.102.62 + cpe:/a:adobe:adobe_air:3.4.0.2540 + cpe:/a:adobe:flash_player:11.9.900.170 + cpe:/a:adobe:adobe_air_sdk:3.1.0.488 + cpe:/a:adobe:flash_player:11.8.800.97 + cpe:/a:adobe:adobe_air:1.5.1.8210 + cpe:/a:adobe:flash_player:11.5.502.110 + cpe:/a:adobe:adobe_air:3.1.0.488 + cpe:/a:adobe:adobe_air_sdk:3.2.0.2070 + cpe:/a:adobe:flash_player:11.1.111.8 + cpe:/a:adobe:adobe_air_sdk:3.3.0.3650 + cpe:/a:adobe:flash_player:11.2.202.285 + cpe:/a:adobe:flash_player:11.5.502.146 + cpe:/a:adobe:flash_player:11.3.300.271 + cpe:/a:adobe:flash_player:11.1.111.54 + cpe:/a:adobe:flash_player:11.3.300.273 + cpe:/a:adobe:adobe_air_sdk:3.8.0.1430 + cpe:/a:adobe:flash_player:11.7.700.242 + cpe:/a:adobe:flash_player:11.9.900.117 + cpe:/a:adobe:adobe_air_sdk:4.0.0.1390 + cpe:/a:adobe:flash_player:11.7.700.252 + cpe:/a:adobe:adobe_air:4.0.0.1390 + cpe:/a:adobe:adobe_air:2.0.2 + cpe:/a:adobe:flash_player:11.1.115.54 + cpe:/a:adobe:flash_player:11.7.700.257 + cpe:/a:adobe:adobe_air:2.0.3 + cpe:/a:adobe:flash_player:11.5.502.149 + cpe:/a:adobe:adobe_air:2.0.4 + cpe:/a:adobe:adobe_air:2.6.0.19140 + cpe:/a:adobe:adobe_air_sdk:3.9.0.1210 + cpe:/a:adobe:flash_player:11.2.202.258 + cpe:/a:adobe:adobe_air:3.3.0.3670 + cpe:/a:adobe:adobe_air_sdk:3.9.0.1030 + cpe:/a:adobe:adobe_air:3.6.0.597 + cpe:/a:adobe:adobe_air_sdk:3.4.0.2710 + cpe:/a:adobe:flash_player:11.1.111.44 + cpe:/a:adobe:flash_player:11.2.202.251 + cpe:/a:adobe:flash_player:11.1.115.58 + cpe:/a:adobe:flash_player:11.5.502.136 + cpe:/a:adobe:adobe_air_sdk:3.5.0.1060 + cpe:/a:adobe:flash_player:11.5.502.135 + cpe:/a:adobe:flash_player:11.7.700.232 + cpe:/a:adobe:flash_player:11.9.900.152 + cpe:/a:adobe:flash_player:11.7.700.261 + cpe:/a:adobe:flash_player:11.7.700.260 + cpe:/a:adobe:flash_player:11.0.1.152 + cpe:/a:adobe:adobe_air:2.7.0.19530 + cpe:/a:adobe:flash_player:11.0.1.153 + cpe:/a:adobe:adobe_air:3.0.0.4080 + cpe:/a:adobe:flash_player:11.7.700.169 + cpe:/a:adobe:flash_player:11.1.111.50 + cpe:/a:adobe:adobe_air:3.2.0.2070 + cpe:/a:adobe:flash_player:11.2.202.327 + cpe:/a:adobe:flash_player:11.6.602.171 + cpe:/a:adobe:adobe_air:1.5.3.9130 + cpe:/a:adobe:adobe_air:1.5.0.7220 + cpe:/a:adobe:flash_player:11.2.202.310 + cpe:/a:adobe:flash_player:11.3.300.270 + cpe:/a:adobe:adobe_air_sdk:3.0.0.4080 + cpe:/a:adobe:adobe_air_sdk:3.7.0.1860 + cpe:/a:adobe:adobe_air:3.0.0.408 + cpe:/a:adobe:flash_player:11.2.202.261 + cpe:/a:adobe:flash_player:11.2.202.262 + cpe:/a:adobe:adobe_air:3.5.0.600 + cpe:/a:adobe:flash_player:11.1.102.59 + cpe:/a:adobe:adobe_air:3.8.0.910 + cpe:/a:adobe:adobe_air:1.0.1 + cpe:/a:adobe:flash_player:12.0.0.41 + cpe:/a:adobe:adobe_air:1.5 + cpe:/a:adobe:adobe_air:1.0.4990 + cpe:/a:adobe:flash_player:11.2.202.335 + cpe:/a:adobe:flash_player:11.2.202.336 + cpe:/a:adobe:flash_player:12.0.0.38 + cpe:/a:adobe:flash_player:11.3.300.268 + cpe:/a:adobe:adobe_air:3.1.0.4880 + cpe:/a:adobe:adobe_air:3.9.0.1210 + cpe:/a:adobe:adobe_air:2.6 + cpe:/a:adobe:flash_player:11.2.202.235 + cpe:/a:adobe:adobe_air_sdk:3.6.0.6090 + cpe:/a:adobe:adobe_air:2.7 + cpe:/a:adobe:adobe_air:3.9.0.1380 + cpe:/a:adobe:flash_player:11.2.202.236 + cpe:/a:adobe:flash_player:11.4.402.287 + cpe:/a:adobe:adobe_air_sdk:3.8.0.870 + cpe:/a:adobe:flash_player:11.2.202.238 + cpe:/a:adobe:flash_player:11.6.602.180 + cpe:/a:adobe:flash_player:11.1.115.7 + cpe:/a:adobe:flash_player:11.7.700.224 + cpe:/a:adobe:adobe_air:2.7.0.1953 + cpe:/a:adobe:flash_player:11.7.700.225 + cpe:/a:adobe:adobe_air:1.1.0.5790 + cpe:/a:adobe:adobe_air:3.5.0.890 + cpe:/a:adobe:flash_player:11.1.115.34 + cpe:/a:adobe:adobe_air_sdk:3.5.0.890 + cpe:/a:adobe:adobe_air:3.4.0.2710 + cpe:/a:adobe:adobe_air:2.7.1 + cpe:/a:adobe:flash_player:11.2.202.233 + cpe:/a:adobe:adobe_air_sdk:3.9.0.1380 + cpe:/a:adobe:adobe_air_sdk:3.5.0.600 + cpe:/a:adobe:flash_player:11.6.602.168 + cpe:/a:adobe:adobe_air:1.0 + cpe:/a:adobe:flash_player:11.6.602.167 + cpe:/a:adobe:flash_player:11.3.300.257 + cpe:/a:adobe:adobe_air:1.1 + cpe:/a:adobe:flash_player:11.2.202.332 + cpe:/a:adobe:flash_player:11.4.402.278 + cpe:/a:adobe:adobe_air:2.7.1.19610 + cpe:/a:adobe:adobe_air:3.2.0.207 + + CVE-2014-0499 + 2014-02-21T00:07:00.000-05:00 + 2014-03-05T23:50:30.313-05:00 + + + 7.8 + NETWORK + LOW + NONE + COMPLETE + NONE + NONE + http://nvd.nist.gov + 2014-02-21T10:14:09.750-05:00 + + + + + CONFIRM + http://helpx.adobe.com/security/products/flash-player/apsb14-07.html + + + REDHAT + RHSA-2014:0196 + + + SUSE + SUSE-SU-2014:0290 + + + SUSE + openSUSE-SU-2014:0278 + + + SUSE + openSUSE-SU-2014:0277 + + Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 do not prevent access to address information, which makes it easier for attackers to bypass the ASLR protection mechanism via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:adobe:shockwave_player:11.6.6.636 + cpe:/a:adobe:shockwave_player:11.5.10.620 + cpe:/a:adobe:shockwave_player:12.0.7.148 + cpe:/a:adobe:shockwave_player:11.6.5.635 + cpe:/a:adobe:shockwave_player:12.0.2.122 + cpe:/a:adobe:shockwave_player:11.5.0.596 + cpe:/a:adobe:shockwave_player:11.5.0.595 + cpe:/a:adobe:shockwave_player:11.0.3.471 + cpe:/a:adobe:shockwave_player:11.5.6.606 + cpe:/a:adobe:shockwave_player:11.5.9.615 + cpe:/a:adobe:shockwave_player:12.0.3.133 + cpe:/a:adobe:shockwave_player:11.5.1.601 + cpe:/a:adobe:shockwave_player:11.0.0.456 + cpe:/a:adobe:shockwave_player:11.6.4.634 + cpe:/a:adobe:shockwave_player:11.6.3.633 + cpe:/a:adobe:shockwave_player:11.6.8.638 + cpe:/a:adobe:shockwave_player:12.0.6.147 + cpe:/a:adobe:shockwave_player:11.5.2.602 + cpe:/a:adobe:shockwave_player:12.0.4.144 + cpe:/a:adobe:shockwave_player:11.6.1.629 + cpe:/a:adobe:shockwave_player:11.6.7.637 + cpe:/a:adobe:shockwave_player:11.6.0.626 + cpe:/a:adobe:shockwave_player:11.5.7.609 + cpe:/a:adobe:shockwave_player:12.0.0.112 + cpe:/a:adobe:shockwave_player:11.5.9.620 + cpe:/a:adobe:shockwave_player:11.5.8.612 + + CVE-2014-0500 + 2014-02-11T23:50:41.313-05:00 + 2014-02-13T12:25:11.727-05:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-12T11:15:21.057-05:00 + + + + + CONFIRM + http://helpx.adobe.com/security/products/shockwave/apsb14-06.html + + Adobe Shockwave Player before 12.0.9.149 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0501. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:adobe:shockwave_player:11.6.6.636 + cpe:/a:adobe:shockwave_player:11.5.10.620 + cpe:/a:adobe:shockwave_player:12.0.7.148 + cpe:/a:adobe:shockwave_player:11.6.5.635 + cpe:/a:adobe:shockwave_player:12.0.2.122 + cpe:/a:adobe:shockwave_player:11.5.0.596 + cpe:/a:adobe:shockwave_player:11.5.0.595 + cpe:/a:adobe:shockwave_player:11.0.3.471 + cpe:/a:adobe:shockwave_player:11.5.6.606 + cpe:/a:adobe:shockwave_player:11.5.9.615 + cpe:/a:adobe:shockwave_player:12.0.3.133 + cpe:/a:adobe:shockwave_player:11.5.1.601 + cpe:/a:adobe:shockwave_player:11.0.0.456 + cpe:/a:adobe:shockwave_player:11.6.4.634 + cpe:/a:adobe:shockwave_player:11.6.3.633 + cpe:/a:adobe:shockwave_player:11.6.8.638 + cpe:/a:adobe:shockwave_player:12.0.6.147 + cpe:/a:adobe:shockwave_player:11.5.2.602 + cpe:/a:adobe:shockwave_player:12.0.4.144 + cpe:/a:adobe:shockwave_player:11.6.1.629 + cpe:/a:adobe:shockwave_player:11.6.7.637 + cpe:/a:adobe:shockwave_player:11.6.0.626 + cpe:/a:adobe:shockwave_player:11.5.7.609 + cpe:/a:adobe:shockwave_player:12.0.0.112 + cpe:/a:adobe:shockwave_player:11.5.9.620 + cpe:/a:adobe:shockwave_player:11.5.8.612 + + CVE-2014-0501 + 2014-02-11T23:50:41.343-05:00 + 2014-02-13T12:24:49.680-05:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-12T11:16:47.060-05:00 + + + + + CONFIRM + http://helpx.adobe.com/security/products/shockwave/apsb14-06.html + + Adobe Shockwave Player before 12.0.9.149 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0500. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:adobe:adobe_air:3.6.0.6090 + cpe:/a:adobe:flash_player:11.2.202.243 + cpe:/a:adobe:flash_player:11.2.202.280 + cpe:/a:adobe:adobe_air:3.5.0.880 + cpe:/a:adobe:adobe_air:2.0.3.13070 + cpe:/a:adobe:adobe_air:3.5.0.1060 + cpe:/a:adobe:flash_player:11.1.115.48 + cpe:/a:adobe:adobe_air:3.8.0.870 + cpe:/a:adobe:adobe_air:3.7.0.2090 + cpe:/a:adobe:flash_player:11.7.700.202 + cpe:/a:adobe:flash_player:11.2.202.273 + cpe:/a:adobe:flash_player:11.1 + cpe:/a:adobe:flash_player:11.4.402.265 + cpe:/a:adobe:flash_player:11.0 + cpe:/a:adobe:flash_player:11.2.202.275 + cpe:/a:adobe:flash_player:11.8.800.168 + cpe:/a:adobe:adobe_air:2.0.2.12610 + cpe:/a:adobe:adobe_air_sdk:3.6.0.599 + cpe:/a:adobe:flash_player:11.2.202.270 + cpe:/a:adobe:adobe_air_sdk:3.3.0.3690 + cpe:/a:adobe:flash_player:12.0.0.43 + cpe:/a:adobe:flash_player:12.0.0.44 + cpe:/a:adobe:adobe_air:2.5.1.17730 + cpe:/a:adobe:flash_player:11.2.202.228 + cpe:/a:adobe:adobe_air_sdk:3.7.0.1530 + cpe:/a:adobe:adobe_air:3.9.0.1030 + cpe:/a:adobe:adobe_air:2.5.0.16600 + cpe:/a:adobe:adobe_air:3.7.0.1530 + cpe:/a:adobe:flash_player:11.3.300.262 + cpe:/a:adobe:adobe_air:3.7.0.1860 + cpe:/a:adobe:adobe_air:1.5.1 + cpe:/a:adobe:flash_player:11.3.300.265 + cpe:/a:adobe:adobe_air:1.5.3 + cpe:/a:adobe:flash_player:11.1.102.55 + cpe:/a:adobe:adobe_air:1.5.2 + cpe:/a:adobe:adobe_air:2.6.0.19120 + cpe:/a:adobe:adobe_air:2.7.0.19480 + cpe:/a:adobe:adobe_air:3.1.0.485 + cpe:/a:adobe:flash_player:11.2.202.223 + cpe:/a:adobe:adobe_air_sdk:3.8.0.910 + cpe:/a:adobe:adobe_air_sdk:3.7.0.2090 + cpe:/a:adobe:adobe_air_sdk:3.5.0.880 + cpe:/a:adobe:adobe_air:2.7.0.1948 + cpe:/a:adobe:adobe_air:1.5.3.9120 + cpe:/a:adobe:adobe_air:1.0.8.4990 + cpe:/a:adobe:flash_player:11.2.202.297 + cpe:/a:adobe:adobe_air:3.9.0.1060 + cpe:/a:adobe:flash_player:11.8.800.94 + cpe:/a:adobe:adobe_air_sdk:3.4.0.2540 + cpe:/a:adobe:flash_player:11.2.202.291 + cpe:/a:adobe:flash_player:11.1.102.63 + cpe:/a:adobe:flash_player:11.1.102.62 + cpe:/a:adobe:adobe_air:3.4.0.2540 + cpe:/a:adobe:flash_player:11.9.900.170 + cpe:/a:adobe:adobe_air_sdk:3.1.0.488 + cpe:/a:adobe:flash_player:11.8.800.97 + cpe:/a:adobe:adobe_air:1.5.1.8210 + cpe:/a:adobe:flash_player:11.5.502.110 + cpe:/a:adobe:adobe_air:3.1.0.488 + cpe:/a:adobe:adobe_air_sdk:3.2.0.2070 + cpe:/a:adobe:flash_player:11.1.111.8 + cpe:/a:adobe:adobe_air_sdk:3.3.0.3650 + cpe:/a:adobe:flash_player:11.2.202.285 + cpe:/a:adobe:flash_player:11.5.502.146 + cpe:/a:adobe:flash_player:11.3.300.271 + cpe:/a:adobe:flash_player:11.1.111.54 + cpe:/a:adobe:flash_player:11.3.300.273 + cpe:/a:adobe:adobe_air_sdk:3.8.0.1430 + cpe:/a:adobe:flash_player:11.9.900.117 + cpe:/a:adobe:flash_player:11.7.700.242 + cpe:/a:adobe:flash_player:11.7.700.252 + cpe:/a:adobe:adobe_air_sdk:4.0.0.1390 + cpe:/a:adobe:adobe_air:4.0.0.1390 + cpe:/a:adobe:adobe_air:2.0.2 + cpe:/a:adobe:flash_player:11.1.115.54 + cpe:/a:adobe:adobe_air:2.0.3 + cpe:/a:adobe:flash_player:11.7.700.257 + cpe:/a:adobe:adobe_air:2.6.0.19140 + cpe:/a:adobe:adobe_air:2.0.4 + cpe:/a:adobe:flash_player:11.5.502.149 + cpe:/a:adobe:flash_player:11.2.202.258 + cpe:/a:adobe:adobe_air_sdk:3.9.0.1210 + cpe:/a:adobe:adobe_air:3.3.0.3670 + cpe:/a:adobe:adobe_air:3.6.0.597 + cpe:/a:adobe:adobe_air_sdk:3.9.0.1030 + cpe:/a:adobe:flash_player:11.1.111.44 + cpe:/a:adobe:adobe_air_sdk:3.4.0.2710 + cpe:/a:adobe:flash_player:11.2.202.251 + cpe:/a:adobe:flash_player:11.1.115.58 + cpe:/a:adobe:flash_player:11.5.502.136 + cpe:/a:adobe:flash_player:11.5.502.135 + cpe:/a:adobe:adobe_air_sdk:3.5.0.1060 + cpe:/a:adobe:flash_player:11.7.700.232 + cpe:/a:adobe:flash_player:11.9.900.152 + cpe:/a:adobe:flash_player:11.7.700.261 + cpe:/a:adobe:adobe_air:2.7.0.19530 + cpe:/a:adobe:flash_player:11.7.700.260 + cpe:/a:adobe:flash_player:11.0.1.152 + cpe:/a:adobe:flash_player:11.0.1.153 + cpe:/a:adobe:adobe_air:3.0.0.4080 + cpe:/a:adobe:flash_player:11.7.700.169 + cpe:/a:adobe:flash_player:11.1.111.50 + cpe:/a:adobe:adobe_air:3.2.0.2070 + cpe:/a:adobe:flash_player:11.2.202.327 + cpe:/a:adobe:adobe_air:1.5.3.9130 + cpe:/a:adobe:flash_player:11.6.602.171 + cpe:/a:adobe:adobe_air:1.5.0.7220 + cpe:/a:adobe:flash_player:11.2.202.310 + cpe:/a:adobe:flash_player:11.3.300.270 + cpe:/a:adobe:adobe_air_sdk:3.0.0.4080 + cpe:/a:adobe:adobe_air:3.0.0.408 + cpe:/a:adobe:adobe_air_sdk:3.7.0.1860 + cpe:/a:adobe:flash_player:11.2.202.261 + cpe:/a:adobe:flash_player:11.2.202.262 + cpe:/a:adobe:adobe_air:3.5.0.600 + cpe:/a:adobe:flash_player:11.1.102.59 + cpe:/a:adobe:adobe_air:3.8.0.910 + cpe:/a:adobe:adobe_air:1.0.1 + cpe:/a:adobe:adobe_air:1.5 + cpe:/a:adobe:flash_player:12.0.0.41 + cpe:/a:adobe:adobe_air:1.0.4990 + cpe:/a:adobe:flash_player:11.2.202.335 + cpe:/a:adobe:flash_player:11.2.202.336 + cpe:/a:adobe:flash_player:12.0.0.38 + cpe:/a:adobe:adobe_air:3.1.0.4880 + cpe:/a:adobe:flash_player:11.3.300.268 + cpe:/a:adobe:adobe_air:3.9.0.1210 + cpe:/a:adobe:adobe_air:2.6 + cpe:/a:adobe:flash_player:11.2.202.235 + cpe:/a:adobe:adobe_air:3.9.0.1380 + cpe:/a:adobe:adobe_air:2.7 + cpe:/a:adobe:flash_player:11.2.202.236 + cpe:/a:adobe:adobe_air_sdk:3.6.0.6090 + cpe:/a:adobe:flash_player:11.4.402.287 + cpe:/a:adobe:flash_player:11.2.202.238 + cpe:/a:adobe:adobe_air_sdk:3.8.0.870 + cpe:/a:adobe:flash_player:11.6.602.180 + cpe:/a:adobe:flash_player:11.1.115.7 + cpe:/a:adobe:adobe_air:2.7.0.1953 + cpe:/a:adobe:flash_player:11.7.700.224 + cpe:/a:adobe:flash_player:11.7.700.225 + cpe:/a:adobe:adobe_air:1.1.0.5790 + cpe:/a:adobe:adobe_air:3.5.0.890 + cpe:/a:adobe:flash_player:11.1.115.34 + cpe:/a:adobe:adobe_air:3.4.0.2710 + cpe:/a:adobe:adobe_air_sdk:3.5.0.890 + cpe:/a:adobe:adobe_air:2.7.1 + cpe:/a:adobe:flash_player:11.2.202.233 + cpe:/a:adobe:adobe_air_sdk:3.9.0.1380 + cpe:/a:adobe:adobe_air_sdk:3.5.0.600 + cpe:/a:adobe:adobe_air:1.0 + cpe:/a:adobe:flash_player:11.6.602.168 + cpe:/a:adobe:flash_player:11.6.602.167 + cpe:/a:adobe:flash_player:11.3.300.257 + cpe:/a:adobe:adobe_air:1.1 + cpe:/a:adobe:flash_player:11.2.202.332 + cpe:/a:adobe:adobe_air:2.7.1.19610 + cpe:/a:adobe:flash_player:11.4.402.278 + cpe:/a:adobe:adobe_air:3.2.0.207 + + CVE-2014-0502 + 2014-02-21T00:07:00.017-05:00 + 2014-03-05T23:50:30.657-05:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-21T10:29:34.563-05:00 + + + + + CONFIRM + http://helpx.adobe.com/security/products/flash-player/apsb14-07.html + + + MISC + http://www.alienvault.com/open-threat-exchange/blog/analysis-of-an-attack-exploiting-the-adobe-zero-day-cve-2014-0502/ + + + REDHAT + RHSA-2014:0196 + + + SUSE + SUSE-SU-2014:0290 + + + SUSE + openSUSE-SU-2014:0278 + + + SUSE + openSUSE-SU-2014:0277 + + Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2014. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:adobe:flash_player:11.2.202.243 + cpe:/a:adobe:flash_player:11.1.111.8 + cpe:/a:adobe:flash_player:11.2.202.280 + cpe:/a:adobe:flash_player:11.2.202.285 + cpe:/a:adobe:flash_player:11.5.502.146 + cpe:/a:adobe:flash_player:11.3.300.271 + cpe:/a:adobe:flash_player:11.1.111.54 + cpe:/a:adobe:flash_player:11.3.300.273 + cpe:/a:adobe:flash_player:11.1.115.48 + cpe:/a:adobe:flash_player:11.7.700.242 + cpe:/a:adobe:flash_player:11.9.900.117 + cpe:/a:adobe:flash_player:11.7.700.252 + cpe:/a:adobe:flash_player:11.7.700.202 + cpe:/a:adobe:flash_player:11.1 + cpe:/a:adobe:flash_player:11.2.202.273 + cpe:/a:adobe:flash_player:11.0 + cpe:/a:adobe:flash_player:11.4.402.265 + cpe:/a:adobe:flash_player:11.2.202.275 + cpe:/a:adobe:flash_player:11.1.115.54 + cpe:/a:adobe:flash_player:11.8.800.168 + cpe:/a:adobe:flash_player:11.7.700.257 + cpe:/a:adobe:flash_player:11.2.202.341 + cpe:/a:adobe:flash_player:11.5.502.149 + cpe:/a:adobe:flash_player:11.2.202.258 + cpe:/a:adobe:flash_player:11.2.202.270 + cpe:/a:adobe:flash_player:12.0.0.43 + cpe:/a:adobe:flash_player:12.0.0.44 + cpe:/a:adobe:flash_player:11.1.111.44 + cpe:/a:adobe:flash_player:11.1.115.58 + cpe:/a:adobe:flash_player:11.2.202.251 + cpe:/a:adobe:flash_player:11.5.502.136 + cpe:/a:adobe:flash_player:11.2.202.228 + cpe:/a:adobe:flash_player:11.5.502.135 + cpe:/a:adobe:flash_player:11.7.700.232 + cpe:/a:adobe:flash_player:11.9.900.152 + cpe:/a:adobe:flash_player:11.7.700.261 + cpe:/a:adobe:flash_player:11.0.1.152 + cpe:/a:adobe:flash_player:11.7.700.260 + cpe:/a:adobe:flash_player:11.0.1.153 + cpe:/a:adobe:flash_player:11.3.300.262 + cpe:/a:adobe:flash_player:11.1.111.50 + cpe:/a:adobe:flash_player:11.7.700.169 + cpe:/a:adobe:flash_player:11.2.202.327 + cpe:/a:adobe:flash_player:11.6.602.171 + cpe:/a:adobe:flash_player:11.7.700.269 + cpe:/a:adobe:flash_player:11.2.202.310 + cpe:/a:adobe:flash_player:11.3.300.270 + cpe:/a:adobe:flash_player:11.3.300.265 + cpe:/a:adobe:flash_player:11.1.102.55 + cpe:/a:adobe:flash_player:11.2.202.261 + cpe:/a:adobe:flash_player:11.2.202.262 + cpe:/a:adobe:flash_player:11.1.102.59 + cpe:/a:adobe:flash_player:11.2.202.223 + cpe:/a:adobe:flash_player:12.0.0.41 + cpe:/a:adobe:flash_player:11.2.202.335 + cpe:/a:adobe:flash_player:11.2.202.336 + cpe:/a:adobe:flash_player:12.0.0.38 + cpe:/a:adobe:flash_player:11.3.300.268 + cpe:/a:adobe:flash_player:11.2.202.235 + cpe:/a:adobe:flash_player:11.2.202.236 + cpe:/a:adobe:flash_player:11.4.402.287 + cpe:/a:adobe:flash_player:11.2.202.238 + cpe:/a:adobe:flash_player:11.2.202.297 + cpe:/a:adobe:flash_player:11.6.602.180 + cpe:/a:adobe:flash_player:12.0.0.70 + cpe:/a:adobe:flash_player:11.1.115.7 + cpe:/a:adobe:flash_player:11.7.700.224 + cpe:/a:adobe:flash_player:11.8.800.94 + cpe:/a:adobe:flash_player:11.1.115.34 + cpe:/a:adobe:flash_player:11.2.202.291 + cpe:/a:adobe:flash_player:11.1.102.63 + cpe:/a:adobe:flash_player:11.1.102.62 + cpe:/a:adobe:flash_player:11.9.900.170 + cpe:/a:adobe:flash_player:11.2.202.233 + cpe:/a:adobe:flash_player:11.6.602.168 + cpe:/a:adobe:flash_player:11.8.800.97 + cpe:/a:adobe:flash_player:11.6.602.167 + cpe:/a:adobe:flash_player:11.3.300.257 + cpe:/a:adobe:flash_player:11.2.202.332 + cpe:/a:adobe:flash_player:11.5.502.110 + cpe:/a:adobe:flash_player:11.4.402.278 + + CVE-2014-0503 + 2014-03-12T01:15:20.163-04:00 + 2014-03-26T00:56:25.017-04:00 + + + 6.4 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-12T14:26:16.680-04:00 + + + + + REDHAT + RHSA-2014:0289 + + + SUSE + SUSE-SU-2014:0387 + + + SUSE + openSUSE-SU-2014:0379 + + + CONFIRM + http://helpx.adobe.com/security/products/flash-player/apsb14-08.html + + Adobe Flash Player before 11.7.700.272 and 11.8.x through 12.0.x before 12.0.0.77 on Windows and OS X, and before 11.2.202.346 on Linux, allows remote attackers to bypass the Same Origin Policy via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:adobe:flash_player:11.2.202.243 + cpe:/a:adobe:flash_player:11.1.111.8 + cpe:/a:adobe:flash_player:11.2.202.280 + cpe:/a:adobe:flash_player:11.2.202.285 + cpe:/a:adobe:flash_player:11.5.502.146 + cpe:/a:adobe:flash_player:11.3.300.271 + cpe:/a:adobe:flash_player:11.1.111.54 + cpe:/a:adobe:flash_player:11.3.300.273 + cpe:/a:adobe:flash_player:11.1.115.48 + cpe:/a:adobe:flash_player:11.7.700.242 + cpe:/a:adobe:flash_player:11.9.900.117 + cpe:/a:adobe:flash_player:11.7.700.252 + cpe:/a:adobe:flash_player:11.7.700.202 + cpe:/a:adobe:flash_player:11.1 + cpe:/a:adobe:flash_player:11.2.202.273 + cpe:/a:adobe:flash_player:11.0 + cpe:/a:adobe:flash_player:11.4.402.265 + cpe:/a:adobe:flash_player:11.2.202.275 + cpe:/a:adobe:flash_player:11.1.115.54 + cpe:/a:adobe:flash_player:11.8.800.168 + cpe:/a:adobe:flash_player:11.7.700.257 + cpe:/a:adobe:flash_player:11.2.202.341 + cpe:/a:adobe:flash_player:11.5.502.149 + cpe:/a:adobe:flash_player:11.2.202.258 + cpe:/a:adobe:flash_player:11.2.202.270 + cpe:/a:adobe:flash_player:12.0.0.43 + cpe:/a:adobe:flash_player:12.0.0.44 + cpe:/a:adobe:flash_player:11.1.111.44 + cpe:/a:adobe:flash_player:11.1.115.58 + cpe:/a:adobe:flash_player:11.2.202.251 + cpe:/a:adobe:flash_player:11.5.502.136 + cpe:/a:adobe:flash_player:11.2.202.228 + cpe:/a:adobe:flash_player:11.5.502.135 + cpe:/a:adobe:flash_player:11.7.700.232 + cpe:/a:adobe:flash_player:11.9.900.152 + cpe:/a:adobe:flash_player:11.7.700.261 + cpe:/a:adobe:flash_player:11.0.1.152 + cpe:/a:adobe:flash_player:11.7.700.260 + cpe:/a:adobe:flash_player:11.0.1.153 + cpe:/a:adobe:flash_player:11.3.300.262 + cpe:/a:adobe:flash_player:11.1.111.50 + cpe:/a:adobe:flash_player:11.7.700.169 + cpe:/a:adobe:flash_player:11.2.202.327 + cpe:/a:adobe:flash_player:11.6.602.171 + cpe:/a:adobe:flash_player:11.7.700.269 + cpe:/a:adobe:flash_player:11.2.202.310 + cpe:/a:adobe:flash_player:11.3.300.270 + cpe:/a:adobe:flash_player:11.3.300.265 + cpe:/a:adobe:flash_player:11.1.102.55 + cpe:/a:adobe:flash_player:11.2.202.261 + cpe:/a:adobe:flash_player:11.2.202.262 + cpe:/a:adobe:flash_player:11.1.102.59 + cpe:/a:adobe:flash_player:11.2.202.223 + cpe:/a:adobe:flash_player:12.0.0.41 + cpe:/a:adobe:flash_player:11.2.202.335 + cpe:/a:adobe:flash_player:11.2.202.336 + cpe:/a:adobe:flash_player:12.0.0.38 + cpe:/a:adobe:flash_player:11.3.300.268 + cpe:/a:adobe:flash_player:11.2.202.235 + cpe:/a:adobe:flash_player:11.2.202.236 + cpe:/a:adobe:flash_player:11.4.402.287 + cpe:/a:adobe:flash_player:11.2.202.238 + cpe:/a:adobe:flash_player:11.2.202.297 + cpe:/a:adobe:flash_player:11.6.602.180 + cpe:/a:adobe:flash_player:12.0.0.70 + cpe:/a:adobe:flash_player:11.1.115.7 + cpe:/a:adobe:flash_player:11.7.700.224 + cpe:/a:adobe:flash_player:11.8.800.94 + cpe:/a:adobe:flash_player:11.1.115.34 + cpe:/a:adobe:flash_player:11.2.202.291 + cpe:/a:adobe:flash_player:11.1.102.63 + cpe:/a:adobe:flash_player:11.1.102.62 + cpe:/a:adobe:flash_player:11.9.900.170 + cpe:/a:adobe:flash_player:11.2.202.233 + cpe:/a:adobe:flash_player:11.6.602.168 + cpe:/a:adobe:flash_player:11.8.800.97 + cpe:/a:adobe:flash_player:11.6.602.167 + cpe:/a:adobe:flash_player:11.3.300.257 + cpe:/a:adobe:flash_player:11.2.202.332 + cpe:/a:adobe:flash_player:11.5.502.110 + cpe:/a:adobe:flash_player:11.4.402.278 + + CVE-2014-0504 + 2014-03-12T01:15:20.177-04:00 + 2014-03-26T00:56:25.110-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-03-12T14:23:01.817-04:00 + + + + + REDHAT + RHSA-2014:0289 + + + SUSE + SUSE-SU-2014:0387 + + + SUSE + openSUSE-SU-2014:0379 + + + CONFIRM + http://helpx.adobe.com/security/products/flash-player/apsb14-08.html + + Adobe Flash Player before 11.7.700.272 and 11.8.x through 12.0.x before 12.0.0.77 on Windows and OS X, and before 11.2.202.346 on Linux, allows attackers to read the clipboard via unspecified vectors. + + + + + + + + + + + + + + + cpe:/a:adobe:shockwave_player:12.0.6.147 + cpe:/a:adobe:shockwave_player:12.0.7.148 + cpe:/a:adobe:shockwave_player:12.0.9.149 + cpe:/a:adobe:shockwave_player:12.0.3.133 + cpe:/a:adobe:shockwave_player:12.0.2.122 + cpe:/a:adobe:shockwave_player:12.0.4.144 + cpe:/a:adobe:shockwave_player:12.0.0.112 + + CVE-2014-0505 + 2014-03-14T06:55:05.600-04:00 + 2014-03-14T13:07:42.850-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-14T13:07:42.807-04:00 + + + + + CONFIRM + http://helpx.adobe.com/security/products/shockwave/apsb14-10.html + + Adobe Shockwave Player before 12.1.0.150 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. + + + + + + + + + + + + + + cpe:/a:adobe:flash_player:12.0.0.77 + + CVE-2014-0506 + 2014-03-27T06:55:04.357-04:00 + 2014-04-19T00:46:32.797-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-27T10:23:38.027-04:00 + + + + + MISC + http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/ + + + MISC + http://twitter.com/thezdi/statuses/443886338077495296 + + + CONFIRM + http://helpx.adobe.com/security/products/flash-player/apsb14-09.html + + Use-after-free vulnerability in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK & Compiler before 13.0.0.83 allows remote attackers to execute arbitrary code, and possibly bypass an Internet Explorer sandbox protection mechanism, via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:adobe:adobe_air:3.6.0.6090 + cpe:/a:adobe:flash_player:11.2.202.243 + cpe:/a:adobe:flash_player:11.2.202.280 + cpe:/a:adobe:adobe_air:3.5.0.880 + cpe:/a:adobe:adobe_air:2.0.3.13070 + cpe:/a:adobe:adobe_air:3.5.0.1060 + cpe:/a:adobe:flash_player:11.1.115.48 + cpe:/a:adobe:adobe_air:3.8.0.870 + cpe:/a:adobe:adobe_air:3.7.0.2090 + cpe:/a:adobe:flash_player:11.7.700.202 + cpe:/a:adobe:flash_player:11.2.202.273 + cpe:/a:adobe:flash_player:11.1 + cpe:/a:adobe:flash_player:11.4.402.265 + cpe:/a:adobe:flash_player:11.0 + cpe:/a:adobe:flash_player:11.2.202.275 + cpe:/a:adobe:flash_player:11.8.800.168 + cpe:/a:adobe:adobe_air:2.0.2.12610 + cpe:/a:adobe:adobe_air_sdk:3.6.0.599 + cpe:/a:adobe:flash_player:11.2.202.270 + cpe:/a:adobe:adobe_air_sdk:4.0.0.1628 + cpe:/a:adobe:adobe_air_sdk:3.3.0.3690 + cpe:/a:adobe:flash_player:12.0.0.43 + cpe:/a:adobe:adobe_air:2.5.1.17730 + cpe:/a:adobe:flash_player:11.2.202.228 + cpe:/a:adobe:adobe_air_sdk:3.7.0.1530 + cpe:/a:adobe:adobe_air:3.9.0.1030 + cpe:/a:adobe:adobe_air:2.5.0.16600 + cpe:/a:adobe:adobe_air:3.7.0.1530 + cpe:/a:adobe:flash_player:11.3.300.262 + cpe:/a:adobe:adobe_air:3.7.0.1860 + cpe:/a:adobe:adobe_air:1.5.1 + cpe:/a:adobe:flash_player:11.3.300.265 + cpe:/a:adobe:flash_player:11.1.102.55 + cpe:/a:adobe:adobe_air:1.5.3 + cpe:/a:adobe:adobe_air:1.5.2 + cpe:/a:adobe:adobe_air:2.6.0.19120 + cpe:/a:adobe:adobe_air:2.7.0.19480 + cpe:/a:adobe:adobe_air:3.1.0.485 + cpe:/a:adobe:adobe_air_sdk:3.8.0.910 + cpe:/a:adobe:flash_player:11.2.202.223 + cpe:/a:adobe:adobe_air_sdk:3.7.0.2090 + cpe:/a:adobe:adobe_air_sdk:3.5.0.880 + cpe:/a:adobe:adobe_air:2.7.0.1948 + cpe:/a:adobe:adobe_air:1.5.3.9120 + cpe:/a:adobe:adobe_air:1.0.8.4990 + cpe:/a:adobe:flash_player:11.2.202.297 + cpe:/a:adobe:adobe_air:3.9.0.1060 + cpe:/a:adobe:flash_player:11.8.800.94 + cpe:/a:adobe:adobe_air_sdk:3.4.0.2540 + cpe:/a:adobe:flash_player:11.2.202.291 + cpe:/a:adobe:flash_player:11.1.102.63 + cpe:/a:adobe:flash_player:11.1.102.62 + cpe:/a:adobe:adobe_air:3.4.0.2540 + cpe:/a:adobe:flash_player:11.9.900.170 + cpe:/a:adobe:adobe_air_sdk:3.1.0.488 + cpe:/a:adobe:flash_player:11.8.800.97 + cpe:/a:adobe:adobe_air:1.5.1.8210 + cpe:/a:adobe:flash_player:11.5.502.110 + cpe:/a:adobe:adobe_air:3.1.0.488 + cpe:/a:adobe:adobe_air_sdk:3.2.0.2070 + cpe:/a:adobe:flash_player:11.1.111.8 + cpe:/a:adobe:adobe_air_sdk:3.3.0.3650 + cpe:/a:adobe:flash_player:11.2.202.285 + cpe:/a:adobe:flash_player:11.5.502.146 + cpe:/a:adobe:flash_player:11.3.300.271 + cpe:/a:adobe:flash_player:11.1.111.54 + cpe:/a:adobe:flash_player:11.3.300.273 + cpe:/a:adobe:adobe_air_sdk:3.8.0.1430 + cpe:/a:adobe:flash_player:11.7.700.242 + cpe:/a:adobe:flash_player:11.9.900.117 + cpe:/a:adobe:adobe_air_sdk:4.0.0.1390 + cpe:/a:adobe:flash_player:11.7.700.252 + cpe:/a:adobe:adobe_air:4.0.0.1390 + cpe:/a:adobe:flash_player:11.1.115.54 + cpe:/a:adobe:adobe_air:2.0.2 + cpe:/a:adobe:flash_player:11.7.700.257 + cpe:/a:adobe:adobe_air:2.0.3 + cpe:/a:adobe:flash_player:11.2.202.341 + cpe:/a:adobe:flash_player:11.5.502.149 + cpe:/a:adobe:adobe_air:2.0.4 + cpe:/a:adobe:adobe_air:2.6.0.19140 + cpe:/a:adobe:adobe_air_sdk:3.9.0.1210 + cpe:/a:adobe:flash_player:11.2.202.258 + cpe:/a:adobe:adobe_air:3.3.0.3670 + cpe:/a:adobe:adobe_air_sdk:3.9.0.1030 + cpe:/a:adobe:adobe_air:3.6.0.597 + cpe:/a:adobe:adobe_air_sdk:3.4.0.2710 + cpe:/a:adobe:flash_player:11.1.111.44 + cpe:/a:adobe:flash_player:11.2.202.251 + cpe:/a:adobe:flash_player:11.1.115.58 + cpe:/a:adobe:flash_player:11.5.502.136 + cpe:/a:adobe:adobe_air_sdk:3.5.0.1060 + cpe:/a:adobe:flash_player:11.5.502.135 + cpe:/a:adobe:flash_player:11.7.700.232 + cpe:/a:adobe:flash_player:11.9.900.152 + cpe:/a:adobe:adobe_air:2.7.0.19530 + cpe:/a:adobe:flash_player:11.7.700.260 + cpe:/a:adobe:flash_player:11.0.1.152 + cpe:/a:adobe:flash_player:11.0.1.153 + cpe:/a:adobe:adobe_air:3.0.0.4080 + cpe:/a:adobe:flash_player:11.7.700.169 + cpe:/a:adobe:flash_player:11.1.111.50 + cpe:/a:adobe:flash_player:11.2.202.327 + cpe:/a:adobe:adobe_air:3.2.0.2070 + cpe:/a:adobe:flash_player:11.6.602.171 + cpe:/a:adobe:adobe_air:1.5.3.9130 + cpe:/a:adobe:flash_player:11.2.202.310 + cpe:/a:adobe:adobe_air:1.5.0.7220 + cpe:/a:adobe:flash_player:11.3.300.270 + cpe:/a:adobe:adobe_air_sdk:3.0.0.4080 + cpe:/a:adobe:adobe_air_sdk:3.7.0.1860 + cpe:/a:adobe:adobe_air:3.0.0.408 + cpe:/a:adobe:flash_player:11.2.202.261 + cpe:/a:adobe:flash_player:11.2.202.262 + cpe:/a:adobe:adobe_air:3.5.0.600 + cpe:/a:adobe:flash_player:11.1.102.59 + cpe:/a:adobe:adobe_air:3.8.0.910 + cpe:/a:adobe:adobe_air:1.0.1 + cpe:/a:adobe:flash_player:12.0.0.41 + cpe:/a:adobe:adobe_air:1.5 + cpe:/a:adobe:adobe_air:1.0.4990 + cpe:/a:adobe:flash_player:11.2.202.335 + cpe:/a:adobe:flash_player:11.2.202.336 + cpe:/a:adobe:flash_player:12.0.0.38 + cpe:/a:adobe:adobe_air:3.1.0.4880 + cpe:/a:adobe:flash_player:11.3.300.268 + cpe:/a:adobe:adobe_air:3.9.0.1210 + cpe:/a:adobe:flash_player:11.2.202.235 + cpe:/a:adobe:adobe_air:2.6 + cpe:/a:adobe:adobe_air_sdk:3.6.0.6090 + cpe:/a:adobe:adobe_air:3.9.0.1380 + cpe:/a:adobe:flash_player:11.2.202.236 + cpe:/a:adobe:adobe_air:2.7 + cpe:/a:adobe:flash_player:11.4.402.287 + cpe:/a:adobe:adobe_air_sdk:3.8.0.870 + cpe:/a:adobe:flash_player:11.2.202.238 + cpe:/a:adobe:flash_player:11.6.602.180 + cpe:/a:adobe:flash_player:11.1.115.7 + cpe:/a:adobe:adobe_air:2.7.0.1953 + cpe:/a:adobe:flash_player:11.7.700.224 + cpe:/a:adobe:adobe_air:1.1.0.5790 + cpe:/a:adobe:adobe_air:3.5.0.890 + cpe:/a:adobe:flash_player:11.1.115.34 + cpe:/a:adobe:adobe_air_sdk:3.5.0.890 + cpe:/a:adobe:adobe_air:3.4.0.2710 + cpe:/a:adobe:adobe_air:2.7.1 + cpe:/a:adobe:flash_player:11.2.202.233 + cpe:/a:adobe:adobe_air_sdk:3.9.0.1380 + cpe:/a:adobe:flash_player:11.2.202.346 + cpe:/a:adobe:adobe_air_sdk:3.5.0.600 + cpe:/a:adobe:flash_player:11.6.602.168 + cpe:/a:adobe:adobe_air:1.0 + cpe:/a:adobe:flash_player:11.6.602.167 + cpe:/a:adobe:flash_player:11.3.300.257 + cpe:/a:adobe:adobe_air:1.1 + cpe:/a:adobe:flash_player:11.2.202.332 + cpe:/a:adobe:adobe_air:2.7.1.19610 + cpe:/a:adobe:flash_player:11.4.402.278 + cpe:/a:adobe:adobe_air:3.2.0.207 + + CVE-2014-0507 + 2014-04-08T19:55:06.353-04:00 + 2014-04-09T20:17:23.330-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-09T20:17:22.187-04:00 + + + + + CONFIRM + http://helpx.adobe.com/security/products/flash-player/apsb14-09.html + + Buffer overflow in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK & Compiler before 13.0.0.83 allows attackers to execute arbitrary code via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:adobe:adobe_air:3.6.0.6090 + cpe:/a:adobe:flash_player:11.2.202.243 + cpe:/a:adobe:flash_player:11.2.202.280 + cpe:/a:adobe:adobe_air:3.5.0.880 + cpe:/a:adobe:adobe_air:2.0.3.13070 + cpe:/a:adobe:adobe_air:3.5.0.1060 + cpe:/a:adobe:flash_player:11.1.115.48 + cpe:/a:adobe:adobe_air:3.8.0.870 + cpe:/a:adobe:adobe_air:3.7.0.2090 + cpe:/a:adobe:flash_player:11.7.700.202 + cpe:/a:adobe:flash_player:11.1 + cpe:/a:adobe:flash_player:11.2.202.273 + cpe:/a:adobe:flash_player:11.0 + cpe:/a:adobe:flash_player:11.4.402.265 + cpe:/a:adobe:flash_player:11.2.202.275 + cpe:/a:adobe:flash_player:11.8.800.168 + cpe:/a:adobe:adobe_air:2.0.2.12610 + cpe:/a:adobe:adobe_air_sdk:3.6.0.599 + cpe:/a:adobe:flash_player:11.2.202.270 + cpe:/a:adobe:adobe_air_sdk:4.0.0.1628 + cpe:/a:adobe:adobe_air_sdk:3.3.0.3690 + cpe:/a:adobe:flash_player:12.0.0.43 + cpe:/a:adobe:adobe_air:2.5.1.17730 + cpe:/a:adobe:flash_player:11.2.202.228 + cpe:/a:adobe:adobe_air_sdk:3.7.0.1530 + cpe:/a:adobe:adobe_air:3.9.0.1030 + cpe:/a:adobe:adobe_air:2.5.0.16600 + cpe:/a:adobe:adobe_air:3.7.0.1530 + cpe:/a:adobe:flash_player:11.3.300.262 + cpe:/a:adobe:adobe_air:3.7.0.1860 + cpe:/a:adobe:adobe_air:1.5.1 + cpe:/a:adobe:flash_player:11.3.300.265 + cpe:/a:adobe:adobe_air:1.5.3 + cpe:/a:adobe:flash_player:11.1.102.55 + cpe:/a:adobe:adobe_air:1.5.2 + cpe:/a:adobe:adobe_air:2.6.0.19120 + cpe:/a:adobe:adobe_air:2.7.0.19480 + cpe:/a:adobe:adobe_air:3.1.0.485 + cpe:/a:adobe:adobe_air_sdk:3.8.0.910 + cpe:/a:adobe:flash_player:11.2.202.223 + cpe:/a:adobe:adobe_air_sdk:3.7.0.2090 + cpe:/a:adobe:adobe_air_sdk:3.5.0.880 + cpe:/a:adobe:adobe_air:2.7.0.1948 + cpe:/a:adobe:adobe_air:1.5.3.9120 + cpe:/a:adobe:adobe_air:1.0.8.4990 + cpe:/a:adobe:flash_player:11.2.202.297 + cpe:/a:adobe:adobe_air:3.9.0.1060 + cpe:/a:adobe:flash_player:11.8.800.94 + cpe:/a:adobe:adobe_air_sdk:3.4.0.2540 + cpe:/a:adobe:flash_player:11.2.202.291 + cpe:/a:adobe:flash_player:11.1.102.63 + cpe:/a:adobe:flash_player:11.1.102.62 + cpe:/a:adobe:adobe_air:3.4.0.2540 + cpe:/a:adobe:flash_player:11.9.900.170 + cpe:/a:adobe:adobe_air_sdk:3.1.0.488 + cpe:/a:adobe:flash_player:11.8.800.97 + cpe:/a:adobe:adobe_air:1.5.1.8210 + cpe:/a:adobe:flash_player:11.5.502.110 + cpe:/a:adobe:adobe_air:3.1.0.488 + cpe:/a:adobe:adobe_air_sdk:3.2.0.2070 + cpe:/a:adobe:flash_player:11.1.111.8 + cpe:/a:adobe:adobe_air_sdk:3.3.0.3650 + cpe:/a:adobe:flash_player:11.2.202.285 + cpe:/a:adobe:flash_player:11.5.502.146 + cpe:/a:adobe:flash_player:11.3.300.271 + cpe:/a:adobe:flash_player:11.1.111.54 + cpe:/a:adobe:flash_player:11.3.300.273 + cpe:/a:adobe:adobe_air_sdk:3.8.0.1430 + cpe:/a:adobe:flash_player:11.9.900.117 + cpe:/a:adobe:flash_player:11.7.700.242 + cpe:/a:adobe:adobe_air_sdk:4.0.0.1390 + cpe:/a:adobe:flash_player:11.7.700.252 + cpe:/a:adobe:adobe_air:4.0.0.1390 + cpe:/a:adobe:adobe_air:2.0.2 + cpe:/a:adobe:flash_player:11.1.115.54 + cpe:/a:adobe:adobe_air:2.0.3 + cpe:/a:adobe:flash_player:11.7.700.257 + cpe:/a:adobe:adobe_air:2.6.0.19140 + cpe:/a:adobe:adobe_air:2.0.4 + cpe:/a:adobe:flash_player:11.2.202.341 + cpe:/a:adobe:flash_player:11.5.502.149 + cpe:/a:adobe:adobe_air_sdk:3.9.0.1210 + cpe:/a:adobe:flash_player:11.2.202.258 + cpe:/a:adobe:adobe_air:3.3.0.3670 + cpe:/a:adobe:adobe_air:3.6.0.597 + cpe:/a:adobe:adobe_air_sdk:3.9.0.1030 + cpe:/a:adobe:flash_player:11.1.111.44 + cpe:/a:adobe:adobe_air_sdk:3.4.0.2710 + cpe:/a:adobe:flash_player:11.1.115.58 + cpe:/a:adobe:flash_player:11.2.202.251 + cpe:/a:adobe:flash_player:11.5.502.136 + cpe:/a:adobe:adobe_air_sdk:3.5.0.1060 + cpe:/a:adobe:flash_player:11.5.502.135 + cpe:/a:adobe:flash_player:11.7.700.232 + cpe:/a:adobe:flash_player:11.9.900.152 + cpe:/a:adobe:adobe_air:2.7.0.19530 + cpe:/a:adobe:flash_player:11.0.1.152 + cpe:/a:adobe:flash_player:11.7.700.260 + cpe:/a:adobe:flash_player:11.0.1.153 + cpe:/a:adobe:adobe_air:3.0.0.4080 + cpe:/a:adobe:flash_player:11.1.111.50 + cpe:/a:adobe:flash_player:11.7.700.169 + cpe:/a:adobe:adobe_air:3.2.0.2070 + cpe:/a:adobe:flash_player:11.2.202.327 + cpe:/a:adobe:adobe_air:1.5.3.9130 + cpe:/a:adobe:flash_player:11.6.602.171 + cpe:/a:adobe:adobe_air:1.5.0.7220 + cpe:/a:adobe:flash_player:11.2.202.310 + cpe:/a:adobe:flash_player:11.3.300.270 + cpe:/a:adobe:adobe_air_sdk:3.0.0.4080 + cpe:/a:adobe:adobe_air:3.0.0.408 + cpe:/a:adobe:adobe_air_sdk:3.7.0.1860 + cpe:/a:adobe:flash_player:11.2.202.261 + cpe:/a:adobe:flash_player:11.2.202.262 + cpe:/a:adobe:adobe_air:3.5.0.600 + cpe:/a:adobe:flash_player:11.1.102.59 + cpe:/a:adobe:adobe_air:3.8.0.910 + cpe:/a:adobe:adobe_air:1.0.1 + cpe:/a:adobe:adobe_air:1.5 + cpe:/a:adobe:flash_player:12.0.0.41 + cpe:/a:adobe:adobe_air:1.0.4990 + cpe:/a:adobe:flash_player:11.2.202.335 + cpe:/a:adobe:flash_player:11.2.202.336 + cpe:/a:adobe:flash_player:12.0.0.38 + cpe:/a:adobe:adobe_air:3.1.0.4880 + cpe:/a:adobe:flash_player:11.3.300.268 + cpe:/a:adobe:adobe_air:3.9.0.1210 + cpe:/a:adobe:adobe_air:2.6 + cpe:/a:adobe:flash_player:11.2.202.235 + cpe:/a:adobe:adobe_air:3.9.0.1380 + cpe:/a:adobe:adobe_air:2.7 + cpe:/a:adobe:flash_player:11.2.202.236 + cpe:/a:adobe:adobe_air_sdk:3.6.0.6090 + cpe:/a:adobe:flash_player:11.4.402.287 + cpe:/a:adobe:flash_player:11.2.202.238 + cpe:/a:adobe:adobe_air_sdk:3.8.0.870 + cpe:/a:adobe:flash_player:11.6.602.180 + cpe:/a:adobe:flash_player:11.1.115.7 + cpe:/a:adobe:adobe_air:2.7.0.1953 + cpe:/a:adobe:flash_player:11.7.700.224 + cpe:/a:adobe:adobe_air:1.1.0.5790 + cpe:/a:adobe:adobe_air:3.5.0.890 + cpe:/a:adobe:flash_player:11.1.115.34 + cpe:/a:adobe:adobe_air:3.4.0.2710 + cpe:/a:adobe:adobe_air_sdk:3.5.0.890 + cpe:/a:adobe:adobe_air:2.7.1 + cpe:/a:adobe:flash_player:11.2.202.233 + cpe:/a:adobe:adobe_air_sdk:3.9.0.1380 + cpe:/a:adobe:flash_player:11.2.202.346 + cpe:/a:adobe:adobe_air_sdk:3.5.0.600 + cpe:/a:adobe:adobe_air:1.0 + cpe:/a:adobe:flash_player:11.6.602.168 + cpe:/a:adobe:flash_player:11.6.602.167 + cpe:/a:adobe:flash_player:11.3.300.257 + cpe:/a:adobe:adobe_air:1.1 + cpe:/a:adobe:flash_player:11.2.202.332 + cpe:/a:adobe:adobe_air:2.7.1.19610 + cpe:/a:adobe:flash_player:11.4.402.278 + cpe:/a:adobe:adobe_air:3.2.0.207 + + CVE-2014-0508 + 2014-04-08T19:55:06.370-04:00 + 2014-04-09T20:20:48.977-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-09T20:20:36.570-04:00 + + + + + CONFIRM + http://helpx.adobe.com/security/products/flash-player/apsb14-09.html + + Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK & Compiler before 13.0.0.83 allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:adobe:adobe_air:3.6.0.6090 + cpe:/a:adobe:flash_player:11.2.202.243 + cpe:/a:adobe:flash_player:11.2.202.280 + cpe:/a:adobe:adobe_air:3.5.0.880 + cpe:/a:adobe:adobe_air:2.0.3.13070 + cpe:/a:adobe:adobe_air:3.5.0.1060 + cpe:/a:adobe:flash_player:11.1.115.48 + cpe:/a:adobe:adobe_air:3.8.0.870 + cpe:/a:adobe:adobe_air:3.7.0.2090 + cpe:/a:adobe:flash_player:11.7.700.202 + cpe:/a:adobe:flash_player:11.2.202.273 + cpe:/a:adobe:flash_player:11.1 + cpe:/a:adobe:flash_player:11.4.402.265 + cpe:/a:adobe:flash_player:11.0 + cpe:/a:adobe:flash_player:11.2.202.275 + cpe:/a:adobe:flash_player:11.8.800.168 + cpe:/a:adobe:adobe_air:2.0.2.12610 + cpe:/a:adobe:adobe_air_sdk:3.6.0.599 + cpe:/a:adobe:flash_player:11.2.202.270 + cpe:/a:adobe:adobe_air_sdk:4.0.0.1628 + cpe:/a:adobe:flash_player:12.0.0.43 + cpe:/a:adobe:adobe_air_sdk:3.3.0.3690 + cpe:/a:adobe:adobe_air:2.5.1.17730 + cpe:/a:adobe:flash_player:11.2.202.228 + cpe:/a:adobe:adobe_air_sdk:3.7.0.1530 + cpe:/a:adobe:adobe_air:2.5.0.16600 + cpe:/a:adobe:adobe_air:3.9.0.1030 + cpe:/a:adobe:flash_player:11.3.300.262 + cpe:/a:adobe:adobe_air:3.7.0.1530 + cpe:/a:adobe:adobe_air:3.7.0.1860 + cpe:/a:adobe:adobe_air:1.5.1 + cpe:/a:adobe:flash_player:11.3.300.265 + cpe:/a:adobe:adobe_air:1.5.3 + cpe:/a:adobe:flash_player:11.1.102.55 + cpe:/a:adobe:adobe_air:1.5.2 + cpe:/a:adobe:adobe_air:2.6.0.19120 + cpe:/a:adobe:adobe_air:2.7.0.19480 + cpe:/a:adobe:adobe_air:3.1.0.485 + cpe:/a:adobe:adobe_air_sdk:3.8.0.910 + cpe:/a:adobe:flash_player:11.2.202.223 + cpe:/a:adobe:adobe_air_sdk:3.7.0.2090 + cpe:/a:adobe:adobe_air_sdk:3.5.0.880 + cpe:/a:adobe:adobe_air:2.7.0.1948 + cpe:/a:adobe:adobe_air:1.5.3.9120 + cpe:/a:adobe:adobe_air:1.0.8.4990 + cpe:/a:adobe:flash_player:11.2.202.297 + cpe:/a:adobe:adobe_air:3.9.0.1060 + cpe:/a:adobe:flash_player:11.8.800.94 + cpe:/a:adobe:adobe_air_sdk:3.4.0.2540 + cpe:/a:adobe:flash_player:11.2.202.291 + cpe:/a:adobe:flash_player:11.1.102.63 + cpe:/a:adobe:flash_player:11.1.102.62 + cpe:/a:adobe:adobe_air:3.4.0.2540 + cpe:/a:adobe:flash_player:11.9.900.170 + cpe:/a:adobe:adobe_air_sdk:3.1.0.488 + cpe:/a:adobe:flash_player:11.8.800.97 + cpe:/a:adobe:adobe_air:1.5.1.8210 + cpe:/a:adobe:flash_player:11.5.502.110 + cpe:/a:adobe:adobe_air:3.1.0.488 + cpe:/a:adobe:adobe_air_sdk:3.2.0.2070 + cpe:/a:adobe:flash_player:11.1.111.8 + cpe:/a:adobe:adobe_air_sdk:3.3.0.3650 + cpe:/a:adobe:flash_player:11.2.202.285 + cpe:/a:adobe:flash_player:11.5.502.146 + cpe:/a:adobe:flash_player:11.3.300.271 + cpe:/a:adobe:flash_player:11.1.111.54 + cpe:/a:adobe:flash_player:11.3.300.273 + cpe:/a:adobe:adobe_air_sdk:3.8.0.1430 + cpe:/a:adobe:flash_player:11.7.700.242 + cpe:/a:adobe:flash_player:11.9.900.117 + cpe:/a:adobe:flash_player:11.7.700.252 + cpe:/a:adobe:adobe_air_sdk:4.0.0.1390 + cpe:/a:adobe:adobe_air:4.0.0.1390 + cpe:/a:adobe:adobe_air:2.0.2 + cpe:/a:adobe:flash_player:11.1.115.54 + cpe:/a:adobe:flash_player:11.7.700.257 + cpe:/a:adobe:adobe_air:2.0.3 + cpe:/a:adobe:flash_player:11.5.502.149 + cpe:/a:adobe:adobe_air:2.0.4 + cpe:/a:adobe:adobe_air:2.6.0.19140 + cpe:/a:adobe:flash_player:11.2.202.341 + cpe:/a:adobe:adobe_air_sdk:3.9.0.1210 + cpe:/a:adobe:flash_player:11.2.202.258 + cpe:/a:adobe:adobe_air:3.3.0.3670 + cpe:/a:adobe:adobe_air_sdk:3.9.0.1030 + cpe:/a:adobe:adobe_air:3.6.0.597 + cpe:/a:adobe:adobe_air_sdk:3.4.0.2710 + cpe:/a:adobe:flash_player:11.1.111.44 + cpe:/a:adobe:flash_player:11.2.202.251 + cpe:/a:adobe:flash_player:11.1.115.58 + cpe:/a:adobe:flash_player:11.5.502.136 + cpe:/a:adobe:flash_player:11.5.502.135 + cpe:/a:adobe:adobe_air_sdk:3.5.0.1060 + cpe:/a:adobe:flash_player:11.7.700.232 + cpe:/a:adobe:flash_player:11.9.900.152 + cpe:/a:adobe:flash_player:11.7.700.260 + cpe:/a:adobe:flash_player:11.0.1.152 + cpe:/a:adobe:adobe_air:2.7.0.19530 + cpe:/a:adobe:flash_player:11.0.1.153 + cpe:/a:adobe:adobe_air:3.0.0.4080 + cpe:/a:adobe:flash_player:11.7.700.169 + cpe:/a:adobe:flash_player:11.1.111.50 + cpe:/a:adobe:adobe_air:3.2.0.2070 + cpe:/a:adobe:flash_player:11.2.202.327 + cpe:/a:adobe:flash_player:11.6.602.171 + cpe:/a:adobe:adobe_air:1.5.3.9130 + cpe:/a:adobe:adobe_air:1.5.0.7220 + cpe:/a:adobe:flash_player:11.2.202.310 + cpe:/a:adobe:flash_player:11.3.300.270 + cpe:/a:adobe:adobe_air_sdk:3.0.0.4080 + cpe:/a:adobe:adobe_air_sdk:3.7.0.1860 + cpe:/a:adobe:adobe_air:3.0.0.408 + cpe:/a:adobe:flash_player:11.2.202.261 + cpe:/a:adobe:flash_player:11.2.202.262 + cpe:/a:adobe:adobe_air:3.5.0.600 + cpe:/a:adobe:flash_player:11.1.102.59 + cpe:/a:adobe:adobe_air:3.8.0.910 + cpe:/a:adobe:adobe_air:1.0.1 + cpe:/a:adobe:flash_player:12.0.0.41 + cpe:/a:adobe:adobe_air:1.5 + cpe:/a:adobe:adobe_air:1.0.4990 + cpe:/a:adobe:flash_player:11.2.202.335 + cpe:/a:adobe:flash_player:11.2.202.336 + cpe:/a:adobe:flash_player:12.0.0.38 + cpe:/a:adobe:flash_player:11.3.300.268 + cpe:/a:adobe:adobe_air:3.1.0.4880 + cpe:/a:adobe:adobe_air:3.9.0.1210 + cpe:/a:adobe:adobe_air:2.6 + cpe:/a:adobe:flash_player:11.2.202.235 + cpe:/a:adobe:adobe_air_sdk:3.6.0.6090 + cpe:/a:adobe:adobe_air:2.7 + cpe:/a:adobe:adobe_air:3.9.0.1380 + cpe:/a:adobe:flash_player:11.2.202.236 + cpe:/a:adobe:flash_player:11.4.402.287 + cpe:/a:adobe:adobe_air_sdk:3.8.0.870 + cpe:/a:adobe:flash_player:11.2.202.238 + cpe:/a:adobe:flash_player:11.6.602.180 + cpe:/a:adobe:flash_player:11.1.115.7 + cpe:/a:adobe:flash_player:11.7.700.224 + cpe:/a:adobe:adobe_air:2.7.0.1953 + cpe:/a:adobe:adobe_air:1.1.0.5790 + cpe:/a:adobe:adobe_air:3.5.0.890 + cpe:/a:adobe:flash_player:11.1.115.34 + cpe:/a:adobe:adobe_air_sdk:3.5.0.890 + cpe:/a:adobe:adobe_air:3.4.0.2710 + cpe:/a:adobe:adobe_air:2.7.1 + cpe:/a:adobe:flash_player:11.2.202.233 + cpe:/a:adobe:adobe_air_sdk:3.9.0.1380 + cpe:/a:adobe:flash_player:11.2.202.346 + cpe:/a:adobe:adobe_air_sdk:3.5.0.600 + cpe:/a:adobe:flash_player:11.6.602.168 + cpe:/a:adobe:adobe_air:1.0 + cpe:/a:adobe:flash_player:11.6.602.167 + cpe:/a:adobe:flash_player:11.3.300.257 + cpe:/a:adobe:adobe_air:1.1 + cpe:/a:adobe:flash_player:11.2.202.332 + cpe:/a:adobe:flash_player:11.4.402.278 + cpe:/a:adobe:adobe_air:2.7.1.19610 + cpe:/a:adobe:adobe_air:3.2.0.207 + + CVE-2014-0509 + 2014-04-08T19:55:06.400-04:00 + 2014-04-09T20:22:06.277-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-09T20:22:05.167-04:00 + + + + + CONFIRM + http://helpx.adobe.com/security/products/flash-player/apsb14-09.html + + Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK & Compiler before 13.0.0.83 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + cpe:/a:adobe:flash_player:12.0.0.77 + + CVE-2014-0510 + 2014-03-27T06:55:04.387-04:00 + 2014-04-01T02:28:16.420-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-27T10:35:11.520-04:00 + + + + + BID + 66241 + + + MISC + http://www.pwn2own.com/2014/03/pwn2own-results-thursday-day-two/ + + + MISC + http://twitter.com/thezdi/statuses/444262022444621824 + + Heap-based buffer overflow in Adobe Flash Player 12.0.0.77 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors, as demonstrated by Zeguang Zhao and Liang Chen during a Pwn2Own competition at CanSecWest 2014. + + + + + + + + + cpe:/a:adobe:acrobat_reader:11.0.6 + + CVE-2014-0511 + 2014-03-27T06:55:04.417-04:00 + 2014-03-27T10:56:30.530-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-27T10:56:30.483-04:00 + + + + + MISC + http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/ + + + MISC + http://twitter.com/thezdi/statuses/443827076580122624 + + Heap-based buffer overflow in Adobe Reader 11.0.06 allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014. + + + + + + + + + cpe:/a:adobe:acrobat_reader:11.0.6 + + CVE-2014-0512 + 2014-03-27T06:55:04.450-04:00 + 2014-03-27T11:04:03.953-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-27T11:04:03.907-04:00 + + + + + MISC + http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/ + + + MISC + http://twitter.com/thezdi/statuses/443827076580122624 + + Adobe Reader 11.0.06 allows attackers to bypass a PDF sandbox protection mechanism via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014. + + + + + + + + + + cpe:/a:adobe:adobe_reader:11.1.0::~~~android~~ + cpe:/a:adobe:adobe_reader:11.1.3::~~~android~~ + + CVE-2014-0514 + 2014-04-15T19:13:14.743-04:00 + 2014-04-24T01:03:54.260-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-16T09:53:16.463-04:00 + + + + + CONFIRM + http://helpx.adobe.com/security/products/reader-mobile/apsb14-12.html + + + BID + 66798 + + + BUGTRAQ + 20140413 Adobe Reader for Android exposes insecure Javascript interfaces + + + MISC + http://www.securify.nl/advisory/SFY20140401/adobe_reader_for_android_exposes_insecure_javascript_interfaces.html + + + FULLDISC + 20140413 Adobe Reader for Android exposes insecure Javascript interfaces + + The Adobe Reader Mobile application before 11.2 for Android does not properly restrict use of JavaScript, which allows remote attackers to execute arbitrary code via a crafted PDF document, a related issue to CVE-2012-6636. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:adobe:flash_player:11.2.202.261 + cpe:/a:adobe:flash_player:11.2.202.243 + cpe:/a:adobe:flash_player:11.2.202.280 + cpe:/a:adobe:flash_player:11.2.202.262 + cpe:/a:adobe:flash_player:11.2.202.285 + cpe:/a:adobe:flash_player:11.2.202.223 + cpe:/a:adobe:flash_player:11.7.700.275 + cpe:/a:adobe:flash_player:11.2.202.335 + cpe:/a:adobe:flash_player:11.2.202.336 + cpe:/a:adobe:flash_player:11.7.700.242 + cpe:/a:adobe:flash_player:11.7.700.202 + cpe:/a:adobe:flash_player:11.2.202.273 + cpe:/a:adobe:flash_player:11.7.700.272 + cpe:/a:adobe:flash_player:11.2.202.275 + cpe:/a:adobe:flash_player:11.2.202.235 + cpe:/a:adobe:flash_player:13.0.0.182 + cpe:/a:adobe:flash_player:11.2.202.236 + cpe:/a:adobe:flash_player:11.8.800.168 + cpe:/a:adobe:flash_player:11.7.700.257 + cpe:/a:adobe:flash_player:11.2.202.238 + cpe:/a:adobe:flash_player:11.2.202.341 + cpe:/a:adobe:flash_player:11.2.202.297 + cpe:/a:adobe:flash_player:11.2.202.258 + cpe:/a:adobe:flash_player:11.7.700.224 + cpe:/a:adobe:flash_player:11.7.700.225 + cpe:/a:adobe:flash_player:11.2.202.270 + cpe:/a:adobe:flash_player:11.8.800.94 + cpe:/a:adobe:flash_player:11.2.202.291 + cpe:/a:adobe:flash_player:11.2.202.251 + cpe:/a:adobe:flash_player:11.2.202.228 + cpe:/a:adobe:flash_player:11.7.700.232 + cpe:/a:adobe:flash_player:11.2.202.233 + cpe:/a:adobe:flash_player:11.2.202.346 + cpe:/a:adobe:flash_player:11.7.700.261 + cpe:/a:adobe:flash_player:11.7.700.260 + cpe:/a:adobe:flash_player:11.7.700.169 + cpe:/a:adobe:flash_player:11.8.800.97 + cpe:/a:adobe:flash_player:11.2.202.332 + cpe:/a:adobe:flash_player:11.7.700.269 + cpe:/a:adobe:flash_player:13.0.0.201 + cpe:/a:adobe:flash_player:11.2.202.350 + cpe:/a:adobe:flash_player:11.2.202.310 + + CVE-2014-0515 + 2014-04-29T06:37:03.733-04:00 + 2014-04-29T10:46:06.390-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-29T10:46:05.390-04:00 + + + + + CONFIRM + http://helpx.adobe.com/security/products/flash-player/apsb14-13.html + + Buffer overflow in Adobe Flash Player before 11.7.700.279 and 11.8.x through 13.0.x before 13.0.0.206 on Windows and OS X, and before 11.2.202.356 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in April 2014. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:isc:bind:9.6.2-p1 + cpe:/a:isc:bind:9.6.2-p2 + cpe:/a:isc:bind:9.8.1:b2 + cpe:/a:isc:bind:9.8.1:b3 + cpe:/a:isc:bind:9.6-esv-r4-p1 + cpe:/a:isc:bind:9.9.4 + cpe:/a:isc:bind:9.6.2-p3 + cpe:/a:isc:bind:9.6.1b1 + cpe:/a:isc:bind:9.6-esv-r6:rc2 + cpe:/a:isc:bind:9.6-esv-r6:rc1 + cpe:/a:isc:bind:9.6.0a1 + cpe:/a:isc:bind:9.7.0:beta + cpe:/a:isc:bind:9.8.5:b2 + cpe:/a:isc:bind:9.7.6:p2 + cpe:/a:isc:bind:9.8.0:a1 + cpe:/a:isc:bind:9.6.1:p1 + cpe:/a:isc:bind:9.6.0:p1 + cpe:/a:isc:bind:9.6.1:p3 + cpe:/a:isc:bind:9.7.3 + cpe:/a:isc:bind:9.7.2 + cpe:/a:isc:bind:9.6.1:p2 + cpe:/a:isc:bind:9.7.1 + cpe:/a:isc:bind:9.7.4:p1 + cpe:/a:isc:bind:9.7.0 + cpe:/a:isc:bind:9.7.6:p1 + cpe:/a:isc:bind:9.7.7 + cpe:/a:isc:bind:9.7.5 + cpe:/a:isc:bind:9.7.6 + cpe:/a:isc:bind:9.6-esv-r5b1 + cpe:/a:isc:bind:9.7.4 + cpe:/a:isc:bind:9.6.0b1 + cpe:/a:isc:bind:9.7.0a2 + cpe:/a:isc:bind:9.6-esv-r7:p2 + cpe:/a:isc:bind:9.7.0a3 + cpe:/a:isc:bind:9.7.0a1 + cpe:/a:isc:bind:9.6-esv-r7:p1 + cpe:/a:isc:bind:9.6-esv-r5:p1 + cpe:/a:isc:bind:9.8.1:p1 + cpe:/a:isc:bind:9.6-esv-r9 + cpe:/a:isc:bind:9.7.0:rc2 + cpe:/a:isc:bind:9.8.0:p1 + cpe:/a:isc:bind:9.7.0:rc1 + cpe:/a:isc:bind:9.7.1:rc1 + cpe:/a:isc:bind:9.7.2:rc1 + cpe:/a:isc:bind:9.7.3:rc1 + cpe:/a:isc:bind:9.8.0:p2 + cpe:/a:isc:bind:9.6-esv-r1 + cpe:/a:isc:bind:9.7.2:p2 + cpe:/a:isc:bind:9.7.4b1 + cpe:/a:isc:bind:9.7.1:p2 + cpe:/a:isc:bind:9.7.2:p3 + cpe:/a:isc:bind:9.6-esv-r3 + cpe:/a:isc:bind:9.6-esv-r9:p1 + cpe:/a:isc:bind:9.7.0:p2 + cpe:/a:isc:bind:9.7.3:p1 + cpe:/a:isc:bind:9.6-esv-r2 + cpe:/a:isc:bind:9.7.2:p1 + cpe:/a:isc:bind:9.7.1:p1 + cpe:/a:isc:bind:9.7.0:p1 + cpe:/a:isc:bind:9.7.5:rc1 + cpe:/a:isc:bind:9.7.4:rc1 + cpe:/a:isc:bind:9.7.5:rc2 + cpe:/a:isc:bind:9.7.3:b1 + cpe:/a:isc:bind:9.8.0:b1 + cpe:/a:isc:bind:9.8.1:b1 + cpe:/a:isc:bind:9.8.2:b1 + cpe:/a:isc:bind:9.7.5:b1 + cpe:/a:isc:bind:9.7.4:b1 + cpe:/a:isc:bind:9.8.5:b1 + cpe:/a:isc:bind:9.8.6:b1 + cpe:/a:isc:bind:9.9.4:p1 + cpe:/a:isc:bind:9.6.3b1 + cpe:/a:isc:bind:9.8.5 + cpe:/a:isc:bind:9.8.4 + cpe:/a:isc:bind:9.8.3 + cpe:/a:isc:bind:9.6.3 + cpe:/a:isc:bind:9.6.2 + cpe:/a:isc:bind:9.6.1 + cpe:/a:isc:bind:9.6.2b1 + cpe:/a:isc:bind:9.8.6 + cpe:/a:isc:bind:9.6.0 + cpe:/a:isc:bind:9.8.0 + cpe:/a:isc:bind:9.8.1 + cpe:/a:isc:bind:9.6-esv + cpe:/a:isc:bind:9.9.4:rc1 + cpe:/a:isc:bind:9.9.4:rc2 + cpe:/a:isc:bind:9.6-esv-r6:b1 + cpe:/a:isc:bind:9.8.0:p4 + cpe:/a:isc:bind:9.7.1b1 + cpe:/a:isc:bind:9.8.5:p2 + cpe:/a:isc:bind:9.8.3:p2 + cpe:/a:isc:bind:9.8.6:p1 + cpe:/a:isc:bind:9.8.5:p1 + cpe:/a:isc:bind:9.6-esv-r5 + cpe:/a:isc:bind:9.6-esv-r4 + cpe:/a:isc:bind:9.8.3:p1 + cpe:/a:isc:bind:9.6-esv-r7 + cpe:/a:isc:bind:9.6-esv-r6 + cpe:/a:isc:bind:9.7.0b1 + cpe:/a:isc:bind:9.7.0b2 + cpe:/a:isc:bind:9.7.0b3 + cpe:/a:isc:bind:9.8.5:rc1 + cpe:/a:isc:bind:9.8.6:rc2 + cpe:/a:isc:bind:9.8.6:rc1 + cpe:/a:isc:bind:9.8.5:rc2 + cpe:/a:isc:bind:9.8.2:rc1 + cpe:/a:isc:bind:9.8.1:rc1 + cpe:/a:isc:bind:9.8.2:rc2 + cpe:/a:isc:bind:9.8.0:rc1 + cpe:/a:isc:bind:9.6.3:rc1 + cpe:/a:isc:bind:9.6.0:rc2 + cpe:/a:isc:bind:9.6.0:rc1 + cpe:/a:isc:bind:9.6.1:rc1 + cpe:/a:isc:bind:9.6.2:rc1 + + CVE-2014-0591 + 2014-01-13T23:29:56.953-05:00 + 2014-02-21T00:06:20.017-05:00 + + + 2.6 + NETWORK + HIGH + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-01-14T13:15:57.453-05:00 + + + + + CONFIRM + https://kb.isc.org/article/AA-01085 + + + CONFIRM + https://kb.isc.org/article/AA-01078 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1051717 + + + UBUNTU + USN-2081-1 + + + SLACKWARE + SSA:2014-028-01 + + + SECTRACK + 1029589 + + + BID + 64801 + + + MANDRIVA + MDVSA-2014:002 + + + FREEBSD + FreeBSD-SA-14:04 + + + SECUNIA + 56574 + + + SECUNIA + 56522 + + + SECUNIA + 56493 + + + SECUNIA + 56442 + + + SECUNIA + 56427 + + + SECUNIA + 56425 + + + REDHAT + RHSA-2014:0043 + + + OSVDB + 101973 + + + HP + SSRT101420 + + + HP + HPSBUX02961 + + + SUSE + openSUSE-SU-2014:0202 + + + SUSE + openSUSE-SU-2014:0199 + + + FEDORA + FEDORA-2014-0811 + + + FEDORA + FEDORA-2014-0858 + + The query_findclosestnsec3 function in query.c in named in ISC BIND 9.6, 9.7, and 9.8 before 9.8.6-P2 and 9.9 before 9.9.4-P2, and 9.6-ESV before 9.6-ESV-R10-P2, allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via a crafted DNS query to an authoritative nameserver that uses the NSEC3 signing feature. + + + + + + + + + + + + + + cpe:/a:crowbar:barclamp:1.7 + cpe:/a:novell:suse_cloud:3.0 + + CVE-2014-0592 + 2014-04-04T10:55:19.717-04:00 + 2014-04-04T12:20:45.747-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-04T12:20:39.887-04:00 + + + + + SUSE + SUSE-SU-2014:0452 + + + CONFIRM + https://github.com/crowbar/barclamp-network/pull/269 + + + CONFIRM + https://bugzilla.novell.com/show_bug.cgi?id=864183 + + + BID + 66519 + + + SECUNIA + 57509 + + Barclamp (aka barclamp-network) 1.7 for the Crowbar Framework, as used in SUSE Cloud 3, does not enable netfilter on bridges when creating new instances, which allows remote attackers to bypass security group restrictions via unspecified vectors, related to floating IPs. + + + + + + + + + + + + + + + + + + + + + + + + cpe:/h:juniper:srx220:- + cpe:/h:juniper:srx100:- + cpe:/o:juniper:junos:12.1x44 + cpe:/o:juniper:junos:12.1x46 + cpe:/h:juniper:srx240:- + cpe:/o:juniper:junos:11.4 + cpe:/o:juniper:junos:12.1x45 + cpe:/o:juniper:junos:12.1 + cpe:/h:juniper:srx650:- + cpe:/h:juniper:srx110:- + cpe:/h:juniper:srx210:- + cpe:/h:juniper:srx550:- + + CVE-2014-0612 + 2014-04-14T11:09:06.273-04:00 + 2014-04-19T00:46:35.330-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-15T09:23:32.577-04:00 + + + + BID + 66759 + + + SECTRACK + 1030057 + + + SECUNIA + 57845 + + + CONFIRM + http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10620 + + Unspecified vulnerability in Juniper Junos before 11.4R10-S1, before 11.4R11, 12.1X44 before 12.1X44-D26, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, and 12.1X46 before 12.1X46-D10, when Dynamic IPsec VPN is configured, allows remote attackers to cause a denial of service (new Dynamic VPN connection failures and CPU and disk consumption) via unknown vectors. + + + + + + + + + + + + + + + + + + + cpe:/o:juniper:junos:12.3 + cpe:/o:juniper:junos:12.1r + cpe:/o:juniper:junos:12.2 + cpe:/o:juniper:junos:12.1x44 + cpe:/o:juniper:junos:12.1x46 + cpe:/o:juniper:junos:11.4 + cpe:/o:juniper:junos:12.1x45 + cpe:/o:juniper:junos:10.4 + cpe:/o:juniper:junos:13.2 + cpe:/o:juniper:junos:13.1 + cpe:/o:juniper:junos:13.3 + + CVE-2014-0613 + 2014-01-15T11:08:04.157-05:00 + 2014-01-15T13:11:02.323-05:00 + + + 7.1 + NETWORK + MEDIUM + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-01-15T13:10:59.573-05:00 + + + + SECTRACK + 1029586 + + + OSVDB + 101861 + + + CONFIRM + http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10607 + + The XNM command processor in Juniper Junos 10.4 before 10.4R16, 11.4 before 11.4R10, 12.1R before 12.1R8-S2, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, 12.1X46 before 12.1X46-D10, 12.2 before 12.2R7, 12.3 before 12.3R5, 13.1 before 13.1R3-S1, 13.2 before 13.2R2-S2, and 13.3 before 13.3R1, when xnm-ssl or xnm-clear-text is enabled, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors. + + + + + + + + + + cpe:/o:juniper:junos:13.2 + cpe:/o:juniper:junos:13.3 + + CVE-2014-0614 + 2014-04-14T11:09:06.303-04:00 + 2014-04-15T09:30:14.717-04:00 + + + 7.1 + NETWORK + MEDIUM + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-15T09:30:14.687-04:00 + + + + BID + 66762 + + + SECTRACK + 1030062 + + + SECUNIA + 57819 + + + CONFIRM + http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10618 + + Juniper Junos 13.2 before 13.2R3 and 13.3 before 13.3R1, when PIM is enabled, allows remote attackers to cause a denial of service (kernel panic and crash) via a large number of crafted IGMP packets. + + + + + + + + + + + + + + + + + + + cpe:/o:juniper:junos:12.3 + cpe:/o:juniper:junos:12.1r + cpe:/o:juniper:junos:12.2 + cpe:/o:juniper:junos:12.1x44 + cpe:/o:juniper:junos:12.1x46 + cpe:/o:juniper:junos:11.4 + cpe:/o:juniper:junos:12.1x45 + cpe:/o:juniper:junos:10.4 + cpe:/o:juniper:junos:13.2 + cpe:/o:juniper:junos:13.1 + cpe:/o:juniper:junos:13.3 + + CVE-2014-0615 + 2014-01-15T11:08:04.313-05:00 + 2014-01-24T14:22:37.923-05:00 + + + 7.2 + LOCAL + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-01-15T08:17:06.000-05:00 + + + + + SECTRACK + 1029585 + + + BID + 64762 + + + OSVDB + 101862 + + + CONFIRM + http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10608 + + Juniper Junos 10.4 before 10.4R16, 11.4 before 11.4R10, 12.1R before 12.1R8-S2, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, 12.1X46 before 12.1X46-D10, 12.2 before 12.2R7, 12.3 before 12.3R5, 13.1 before 13.1R3-S1, 13.2 before 13.2R2, and 13.3 before 13.3R1 allows local users to gain privileges via vectors related to "certain combinations of Junos OS CLI commands and arguments." + + + + + + + + + + + + + + + + + + + cpe:/o:juniper:junos:12.3 + cpe:/o:juniper:junos:12.1r + cpe:/o:juniper:junos:12.2 + cpe:/o:juniper:junos:12.1x44 + cpe:/o:juniper:junos:12.1x46 + cpe:/o:juniper:junos:11.4 + cpe:/o:juniper:junos:12.1x45 + cpe:/o:juniper:junos:10.4 + cpe:/o:juniper:junos:13.2 + cpe:/o:juniper:junos:13.1 + cpe:/o:juniper:junos:13.3 + + CVE-2014-0616 + 2014-01-15T11:08:04.343-05:00 + 2014-01-24T14:21:16.560-05:00 + + + 7.1 + NETWORK + MEDIUM + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-01-24T14:21:13.873-05:00 + + + + + SECTRACK + 1029582 + + + BID + 64766 + + + OSVDB + 101868 + + + CONFIRM + http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10609 + + Juniper Junos 10.4 before 10.4R16, 11.4 before 11.4R10, 12.1R before 12.1R8-S2, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, 12.1X46 before 12.1X46-D10, 12.2 before 12.2R7, 12.3 before 12.3R4-S2, 13.1 before 13.1R3-S1, 13.2 before 13.2R2, and 13.3 before 13.3R1 allows remote attackers to cause a denial of service (rdp crash) via a large BGP UPDATE message which immediately triggers a withdraw message to be sent, as demonstrated by a long AS_PATH and a large number of BGP Communities. + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:juniper:junos:12.1r + cpe:/h:juniper:srx220:- + cpe:/o:juniper:junos:10.4s + cpe:/o:juniper:junos:10.4r + cpe:/h:juniper:srx1400:- + cpe:/h:juniper:srx3600:- + cpe:/h:juniper:srx5800:- + cpe:/h:juniper:srx210:- + cpe:/h:juniper:srx100:- + cpe:/o:juniper:junos:11.4 + cpe:/h:juniper:srx240:- + cpe:/h:juniper:srx650:- + cpe:/h:juniper:srx5600:- + cpe:/h:juniper:srx110:- + cpe:/h:juniper:srx3400:- + cpe:/h:juniper:srx550:- + + CVE-2014-0617 + 2014-01-15T11:08:04.377-05:00 + 2014-01-15T13:27:15.923-05:00 + + + 7.1 + NETWORK + MEDIUM + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-01-15T13:27:13.423-05:00 + + + + SECTRACK + 1029583 + + + BID + 64764 + + + OSVDB + 101863 + + + CONFIRM + http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10610 + + Juniper Junos 10.4S before 10.4S15, 10.4R before 10.4R16, 11.4 before 11.4R9, and 12.1R before 12.1R7 on SRX Series service gateways allows remote attackers to cause a denial of service (flowd crash) via a crafted IP packet. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:juniper:junos:12.1r + cpe:/h:juniper:srx220:- + cpe:/h:juniper:srx1400:- + cpe:/h:juniper:srx3600:- + cpe:/h:juniper:srx5800:- + cpe:/h:juniper:srx210:- + cpe:/o:juniper:junos:12.1x44 + cpe:/h:juniper:srx100:- + cpe:/o:juniper:junos:12.1x45 + cpe:/o:juniper:junos:11.4 + cpe:/h:juniper:srx240:- + cpe:/h:juniper:srx650:- + cpe:/o:juniper:junos:10.4 + cpe:/h:juniper:srx5600:- + cpe:/h:juniper:srx110:- + cpe:/h:juniper:srx3400:- + cpe:/h:juniper:srx550:- + + CVE-2014-0618 + 2014-01-10T23:44:42.617-05:00 + 2014-01-17T00:20:32.577-05:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-01-13T10:53:28.973-05:00 + + + + CONFIRM + https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10611 + + + XF + juniper-junos-srx-cve20140618-dos(90238) + + + SECTRACK + 1029584 + + + BID + 64769 + + + OSVDB + 101864 + + Juniper Junos before 10.4 before 10.4R16, 11.4 before 11.4R8, 12.1R before 12.1R7, 12.1X44 before 12.1X44-D20, and 12.1X45 before 12.1X45-D10 on SRX Series service gateways, when used as a UAC enforcer and captive portal is enabled, allows remote attackers to cause a denial of service (flowd crash) via a crafted HTTP message. + + + + + + + + + cpe:/h:technicolor:tc7200:std6.01.12 + + CVE-2014-0620 + 2014-01-08T10:30:02.683-05:00 + 2014-02-25T12:49:25.067-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-09T09:17:09.000-05:00 + + + + + EXPLOIT-DB + 30668 + + Multiple cross-site scripting (XSS) vulnerabilities in Technicolor (formerly Thomson) TC7200 STD6.01.12 allow remote attackers to inject arbitrary web script or HTML via the (1) ADDNewDomain parameter to parental/website-filters.asp or (2) VmTracerouteHost parameter to goform/status/diagnostics-route. + + + + + + + + + cpe:/h:technicolor:tc7200:std6.01.12 + + CVE-2014-0621 + 2014-01-08T10:30:02.730-05:00 + 2014-02-24T21:07:22.937-05:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-09T09:18:22.000-05:00 + + + + + EXPLOIT-DB + 30667 + + Multiple cross-site request forgery (CSRF) vulnerabilities in Technicolor (formerly Thomson) TC7200 STD6.01.12 allow remote attackers to hijack the authentication of administrators for requests that (1) perform a factory reset via a request to goform/system/factory, (2) disable advanced options via a request to goform/advanced/options, (3) remove ip-filters via the IpFilterAddressDelete1 parameter to goform/advanced/ip-filters, or (4) remove firewall settings via the cbFirewall parameter to goform/advanced/firewall. + + + + + + + + + + + + + cpe:/a:emc:documentum_foundation_services:6.6 + cpe:/a:emc:documentum_foundation_services:6.7 + cpe:/a:emc:documentum_foundation_services:7.1 + cpe:/a:emc:documentum_foundation_services:7.0 + cpe:/a:emc:documentum_foundation_services:6.5 + + CVE-2014-0622 + 2014-02-06T17:55:03.357-05:00 + 2014-02-07T12:35:32.203-05:00 + + + 9.0 + NETWORK + LOW + SINGLE_INSTANCE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-07T12:35:32.110-05:00 + + + + + BUGTRAQ + 20140205 ESA-2014-005: EMC Documentum Foundation Services (DFS) Content Access Vulnerability + + The web service in EMC Documentum Foundation Services (DFS) 6.5 through 6.7 before 6.7 SP1 P22, 6.7 SP2 before P08, 7.0 before P12, and 7.1 before P01 does not properly implement content uploading, which allows remote authenticated users to bypass intended content access restrictions via unspecified vectors. + + + + + + + + + + cpe:/a:rsa:authentication_manager:7.1:- + cpe:/a:rsa:authentication_manager:7.1:sp4 + + CVE-2014-0623 + 2014-03-27T06:55:04.480-04:00 + 2014-03-27T11:37:47.770-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-27T11:37:43.443-04:00 + + + + + BUGTRAQ + 20140326 ESA-2014-015: RSA Authentication Manager Cross Frame Scripting Vulnerability + + Cross-site scripting (XSS) vulnerability in the Self-Service Console in EMC RSA Authentication Manager 7.1 before SP4 P32 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "cross frame scripting" issue. + + + + + + + + + + + cpe:/a:emc:rsa_data_loss_prevention:9.6 + cpe:/a:emc:rsa_data_loss_prevention:9.0 + cpe:/a:emc:rsa_data_loss_prevention:9.5 + + CVE-2014-0624 + 2014-03-06T06:55:05.177-05:00 + 2014-03-07T14:17:23.473-05:00 + + + 2.7 + ADJACENT_NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-03-06T12:41:47.500-05:00 + + + + BUGTRAQ + 20140228 ESA-2014-003: RSA Data Loss Prevention Improper Session Management Vulnerability + + EMC RSA Data Loss Prevention (DLP) 9.x before 9.6-SP2 does not properly manage sessions, which allows remote authenticated users to gain privileges and bypass intended content-reading restrictions via unspecified vectors. + + + + + + + + + + + + + + cpe:/a:emc:rsa_bsafe_ssl-j:5.1.1 + cpe:/a:emc:rsa_bsafe_ssl-j:6.0 + cpe:/a:emc:rsa_bsafe_ssl-j:5.1.0 + cpe:/a:emc:rsa_bsafe_ssl-j:6.0.1 + cpe:/a:emc:rsa_bsafe_ssl-j:5.1.2 + cpe:/a:emc:rsa_bsafe_ssl-j:5.0 + + CVE-2014-0625 + 2014-02-17T19:55:05.143-05:00 + 2014-02-18T14:43:45.623-05:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-02-18T14:43:45.577-05:00 + + + + + BUGTRAQ + 20140214 ESA-2014-009: RSA BSAFE SSL-J Multiple Vulnerabilities + + The SSLSocket implementation in the (1) JSAFE and (2) JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to cause a denial of service (memory consumption) by triggering application-data processing during the TLS handshake, a time at which the data is internally buffered. + + + + + + + + + + + + + + cpe:/a:emc:rsa_bsafe_ssl-j:5.1.1 + cpe:/a:emc:rsa_bsafe_ssl-j:6.0 + cpe:/a:emc:rsa_bsafe_ssl-j:5.1.0 + cpe:/a:emc:rsa_bsafe_ssl-j:6.0.1 + cpe:/a:emc:rsa_bsafe_ssl-j:5.1.2 + cpe:/a:emc:rsa_bsafe_ssl-j:5.0 + + CVE-2014-0626 + 2014-02-17T19:55:05.173-05:00 + 2014-02-18T14:45:23.737-05:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-02-18T14:45:23.657-05:00 + + + + + BUGTRAQ + 20140214 ESA-2014-009: RSA BSAFE SSL-J Multiple Vulnerabilities + + The (1) JSAFE and (2) JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 make it easier for remote attackers to bypass intended cryptographic protection mechanisms by triggering application-data processing during the TLS handshake, a time at which the data is both unencrypted and unauthenticated. + + + + + + + + + + + + + + cpe:/a:emc:rsa_bsafe_ssl-j:5.1.1 + cpe:/a:emc:rsa_bsafe_ssl-j:6.0 + cpe:/a:emc:rsa_bsafe_ssl-j:5.1.0 + cpe:/a:emc:rsa_bsafe_ssl-j:6.0.1 + cpe:/a:emc:rsa_bsafe_ssl-j:5.1.2 + cpe:/a:emc:rsa_bsafe_ssl-j:5.0 + + CVE-2014-0627 + 2014-02-17T19:55:05.207-05:00 + 2014-02-18T14:46:21.660-05:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-18T14:46:21.597-05:00 + + + + + BUGTRAQ + 20140214 ESA-2014-009: RSA BSAFE SSL-J Multiple Vulnerabilities + + The SSLEngine API implementation in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to trigger the selection of a weak cipher suite by using the wrap method during a certain incomplete-handshake state. + + + + + + + + + + + + + cpe:/a:emc:rsa_bsafe:4.0.0::~~micro_edition_suite~~~ + cpe:/a:emc:rsa_bsafe:4.0.1::~~micro_edition_suite~~~ + cpe:/a:emc:rsa_bsafe:4.0.2::~~micro_edition_suite~~~ + cpe:/a:emc:rsa_bsafe:4.0.3::~~micro_edition_suite~~~ + cpe:/a:emc:rsa_bsafe:4.0.4::~~micro_edition_suite~~~ + + CVE-2014-0628 + 2014-03-25T09:25:38.210-04:00 + 2014-03-25T11:13:51.850-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-03-25T11:13:48.447-04:00 + + + + + BUGTRAQ + 20140324 ESA-2014-011: RSA BSAFE Micro Edition Suite Server Crash Vulnerability + + The server in EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.5 does not properly process certificate chains, which allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors. + + + + + + + + + + cpe:/a:emc:documentum_taskspace:6.7:sp2 + cpe:/a:emc:documentum_taskspace:6.7:sp1 + + CVE-2014-0629 + 2014-03-06T06:55:05.193-05:00 + 2014-03-07T14:16:34.033-05:00 + + + 8.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-06T07:45:19.000-05:00 + + + + + BUGTRAQ + 20140305 ESA-2014-012: EMC Documentum TaskSpace Multiple Vulnerabilities + + EMC Documentum TaskSpace (TSP) 6.7SP1 before P25 and 6.7SP2 before P11 does not properly handle the interaction between the dm_world group and the dm_superusers_dynamic group, which allows remote authenticated users to obtain sensitive information and gain privileges in opportunistic circumstances by leveraging an incorrect group-addition implementation. + + + + + + + + + + cpe:/a:emc:documentum_taskspace:6.7:sp2 + cpe:/a:emc:documentum_taskspace:6.7:sp1 + + CVE-2014-0630 + 2014-03-06T06:55:05.223-05:00 + 2014-03-07T14:14:46.673-05:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-03-06T12:46:37.337-05:00 + + + + + BUGTRAQ + 20140305 ESA-2014-012: EMC Documentum TaskSpace Multiple Vulnerabilities + + EMC Documentum TaskSpace (TSP) 6.7SP1 before P25 and 6.7SP2 before P11 allows remote authenticated users to read arbitrary files via a modified imaging-service URL. + + + + + + + + + + + + + cpe:/a:emc:vplex_geosynchrony:5.2 + cpe:/a:emc:vplex_geosynchrony:5.1 + cpe:/a:emc:vplex_geosynchrony:5.0 + cpe:/a:emc:vplex_geosynchrony:5.2.1 + cpe:/a:emc:vplex_geosynchrony:4.0 + + CVE-2014-0632 + 2014-04-01T02:28:17.997-04:00 + 2014-04-01T10:10:48.903-04:00 + + + 9.0 + NETWORK + LOW + SINGLE_INSTANCE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-01T10:10:48.840-04:00 + + + + + BUGTRAQ + 20140326 ESA-2014-016: EMC VPLEX Multiple Vulnerabilities + + Directory traversal vulnerability in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 allows remote authenticated users to execute arbitrary code via unspecified vectors. + + + + + + + + + + + + + cpe:/a:emc:vplex_geosynchrony:5.2 + cpe:/a:emc:vplex_geosynchrony:5.1 + cpe:/a:emc:vplex_geosynchrony:5.0 + cpe:/a:emc:vplex_geosynchrony:5.2.1 + cpe:/a:emc:vplex_geosynchrony:4.0 + + CVE-2014-0633 + 2014-04-01T02:28:18.030-04:00 + 2014-04-01T10:13:09.453-04:00 + + + 7.7 + ADJACENT_NETWORK + LOW + SINGLE_INSTANCE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-01T10:13:05.737-04:00 + + + + + BUGTRAQ + 20140326 ESA-2014-016: EMC VPLEX Multiple Vulnerabilities + + The GUI in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 does not properly validate session-timeout values, which might make it easier for remote attackers to execute arbitrary code by leveraging an unattended workstation. + + + + + + + + + + + + + cpe:/a:emc:vplex_geosynchrony:5.2 + cpe:/a:emc:vplex_geosynchrony:5.1 + cpe:/a:emc:vplex_geosynchrony:5.0 + cpe:/a:emc:vplex_geosynchrony:5.2.1 + cpe:/a:emc:vplex_geosynchrony:4.0 + + CVE-2014-0634 + 2014-04-01T02:28:18.060-04:00 + 2014-04-01T10:14:43.753-04:00 + + + 6.0 + NETWORK + MEDIUM + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-01T10:14:43.707-04:00 + + + + + BUGTRAQ + 20140326 ESA-2014-016: EMC VPLEX Multiple Vulnerabilities + + EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 does not include the HTTPOnly flag in a Set-Cookie header for an unspecified cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie. + + + + + + + + + + + + + cpe:/a:emc:vplex_geosynchrony:5.2 + cpe:/a:emc:vplex_geosynchrony:5.1 + cpe:/a:emc:vplex_geosynchrony:5.0 + cpe:/a:emc:vplex_geosynchrony:5.2.1 + cpe:/a:emc:vplex_geosynchrony:4.0 + + CVE-2014-0635 + 2014-04-01T02:28:18.077-04:00 + 2014-04-01T10:16:06.773-04:00 + + + 7.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + COMPLETE + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-01T10:15:53.477-04:00 + + + + + BUGTRAQ + 20140326 ESA-2014-016: EMC VPLEX Multiple Vulnerabilities + + Session fixation vulnerability in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 allows remote attackers to hijack web sessions via unspecified vectors. + + + + + + + + + + + + + + + + + + + cpe:/a:emc:rsa_bsafe:4.0.0::~~micro_edition_suite~~~ + cpe:/a:emc:rsa_bsafe:4.0.1::~~micro_edition_suite~~~ + cpe:/a:emc:rsa_bsafe:3.2.0::~~micro_edition_suite~~~ + cpe:/a:emc:rsa_bsafe:4.0.2::~~micro_edition_suite~~~ + cpe:/a:emc:rsa_bsafe:3.2.1::~~micro_edition_suite~~~ + cpe:/a:emc:rsa_bsafe:4.0.3::~~micro_edition_suite~~~ + cpe:/a:emc:rsa_bsafe:3.2.2::~~micro_edition_suite~~~ + cpe:/a:emc:rsa_bsafe:4.0.4::~~micro_edition_suite~~~ + cpe:/a:emc:rsa_bsafe:3.2.3::~~micro_edition_suite~~~ + cpe:/a:emc:rsa_bsafe:3.2.5::~~micro_edition_suite~~~ + cpe:/a:emc:rsa_bsafe:3.2.4::~~micro_edition_suite~~~ + + CVE-2014-0636 + 2014-04-11T15:55:04.307-04:00 + 2014-04-14T12:43:06.777-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-14T12:43:06.667-04:00 + + + + + BUGTRAQ + 20140411 ESA-2014-019: RSA BSAFE Micro Edition Suite Certificate Chain Processing Vulnerability + + EMC RSA BSAFE Micro Edition Suite (MES) 3.2.x before 3.2.6 and 4.0.x before 4.0.5 does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate chain. + + + + + + + + + + + + + + + + + + cpe:/a:emc:rsa_adaptive_authentication_on-premise:6.0.2.1:sp1_patch3 + cpe:/a:emc:rsa_adaptive_authentication_on-premise:6.0.2.1:sp3 + cpe:/a:emc:rsa_adaptive_authentication_on-premise:7.1 + cpe:/a:emc:rsa_adaptive_authentication_on-premise:7.0 + cpe:/a:emc:rsa_adaptive_authentication_on-premise:6.0.2.1:sp2 + cpe:/a:emc:rsa_adaptive_authentication_on-premise:6.0.2.1:sp3_p3 + cpe:/a:emc:rsa_adaptive_authentication_on-premise:6.0.2.1:sp1_patch2 + cpe:/a:emc:rsa_adaptive_authentication_on-premise:6.0.2.1:sp2_patch1 + cpe:/a:emc:rsa_adaptive_authentication_on-premise:6.0.2.1 + cpe:/a:emc:rsa_adaptive_authentication_on-premise:6.0 + + CVE-2014-0637 + 2014-04-04T11:09:05.337-04:00 + 2014-04-04T12:34:39.997-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-04T12:34:39.917-04:00 + + + + + BUGTRAQ + 20140401 ESA-2014-020: RSA Adaptive Authentication (On-Premise) Multiple Vulnerabilities + + Cross-site scripting (XSS) vulnerability in the back-office case-management application in RSA Adaptive Authentication (On-Premise) 6.x and 7.x before 7.1 SP0 P2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + + + + + + + + + cpe:/a:emc:rsa_adaptive_authentication_on-premise:6.0.2.1:sp1_patch3 + cpe:/a:emc:rsa_adaptive_authentication_on-premise:6.0.2.1:sp3 + cpe:/a:emc:rsa_adaptive_authentication_on-premise:7.1 + cpe:/a:emc:rsa_adaptive_authentication_on-premise:7.0 + cpe:/a:emc:rsa_adaptive_authentication_on-premise:6.0.2.1:sp2 + cpe:/a:emc:rsa_adaptive_authentication_on-premise:6.0.2.1:sp3_p3 + cpe:/a:emc:rsa_adaptive_authentication_on-premise:6.0.2.1:sp1_patch2 + cpe:/a:emc:rsa_adaptive_authentication_on-premise:6.0.2.1:sp2_patch1 + cpe:/a:emc:rsa_adaptive_authentication_on-premise:6.0.2.1 + cpe:/a:emc:rsa_adaptive_authentication_on-premise:6.0 + + CVE-2014-0638 + 2014-04-04T11:09:38.057-04:00 + 2014-04-04T12:37:35.080-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-04T12:37:34.423-04:00 + + + + + BUGTRAQ + 20140401 ESA-2014-020: RSA Adaptive Authentication (On-Premise) Multiple Vulnerabilities + + Cross-site scripting (XSS) vulnerability in RSA Adaptive Authentication (On-Premise) 6.x and 7.x before 7.1 SP0 P2 allows remote attackers to inject arbitrary web script or HTML via vectors involving FRAME elements, related to a "cross-frame scripting" issue. + + + + + + + + + + + + + + + + + + + cpe:/a:emc:documentum_content_server:6.7:- + cpe:/a:emc:documentum_content_server:6.7:sp1 + cpe:/a:emc:documentum_content_server:6.5:sp3 + cpe:/a:emc:documentum_content_server:6.7:sp2 + cpe:/a:emc:documentum_content_server:6.0 + cpe:/a:emc:documentum_content_server:6.5:sp1 + cpe:/a:emc:documentum_content_server:6.5:sp2 + cpe:/a:emc:documentum_content_server:7.0 + cpe:/a:emc:documentum_content_server:6.5 + cpe:/a:emc:documentum_content_server:7.1 + cpe:/a:emc:documentum_content_server:6.6 + + CVE-2014-0642 + 2014-04-15T19:13:16.790-04:00 + 2014-04-16T10:03:42.857-04:00 + + + 5.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-16T10:03:42.797-04:00 + + + + + MISC + http://twitter.com/artika4biz/statuses/455358950116823040 + + + BUGTRAQ + 20140411 ESA-2014-026: EMC Documentum Content Server Information Disclosure Vulnerability + + EMC Documentum Content Server before 6.7 SP1 P26, 6.7 SP2 before P13, 7.0 before P13, and 7.1 before P02 allows remote authenticated users to bypass intended access restrictions and read metadata from certain folders via unspecified vectors. + + + + + + + + + + + + + + + cpe:/h:emc:cloud_tiering_appliance:- + cpe:/a:emc:cloud_tiering_appliance_software:10.0:sp1 + cpe:/a:emc:cloud_tiering_appliance_software:10.0:- + + CVE-2014-0644 + 2014-04-16T21:55:05.657-04:00 + 2014-04-17T11:06:50.127-04:00 + + + 7.8 + NETWORK + LOW + NONE + COMPLETE + NONE + NONE + http://nvd.nist.gov + 2014-04-17T11:06:50.063-04:00 + + + + + MISC + https://gist.github.com/brandonprry/9895721 + + + FULLDISC + 20140331 EMC CTA v10.0 unauthenticated XXE with root perms + + + BUGTRAQ + 20140416 ESA-2014-028: EMC Cloud Tiering Appliance XML External Entity (XXE) and Information Disclosure Vulnerabilities + + EMC Cloud Tiering Appliance (CTA) 10 through SP1 allows remote attackers to read arbitrary files via an api/login request containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, as demonstrated by reading the /etc/shadow file. + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/h:emc:cloud_tiering_appliance:- + cpe:/a:emc:file_management_appliance_software:7.0 + cpe:/a:emc:cloud_tiering_appliance_software:10.0:sp1 + cpe:/a:emc:cloud_tiering_appliance_software:10.0:- + cpe:/h:emc:file_management_appliance:- + cpe:/a:emc:cloud_tiering_appliance_software:9.0 + + CVE-2014-0645 + 2014-04-16T21:55:05.690-04:00 + 2014-04-17T11:10:45.367-04:00 + + + 4.7 + LOCAL + MEDIUM + NONE + COMPLETE + NONE + NONE + http://nvd.nist.gov + 2014-04-17T11:10:45.273-04:00 + + + + + MISC + https://gist.github.com/brandonprry/9895721 + + + FULLDISC + 20140331 EMC CTA v10.0 unauthenticated XXE with root perms + + + BUGTRAQ + 20140416 ESA-2014-028: EMC Cloud Tiering Appliance XML External Entity (XXE) and Information Disclosure Vulnerabilities + + EMC Cloud Tiering Appliance (CTA) 9.x through 10 SP1 and File Management Appliance (FMA) 7.x store DES password hashes for the root, super, and admin accounts, which makes it easier for context-dependent attackers to obtain sensitive information via a brute-force attack. + + + + + + + + + + + + cpe:/a:emc:rsa_access_manager:6.2:- + cpe:/a:emc:rsa_access_manager:6.2:sp1 + cpe:/a:emc:rsa_access_manager:6.1:sp4 + cpe:/a:emc:rsa_access_manager:6.1:sp3 + + CVE-2014-0646 + 2014-05-01T13:29:56.697-04:00 + 2014-05-02T09:49:06.440-04:00 + + + 6.9 + LOCAL + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-05-02T09:49:06.363-04:00 + + + + + BUGTRAQ + 20140430 ESA-2014-029: RSA Access Manager Sensitive Information Disclosure Vulnerability + + The runtime WS component in the server in EMC RSA Access Manager 6.1.3 before 6.1.3.39, 6.1.4 before 6.1.4.22, 6.2.0 before 6.2.0.11, and 6.2.1 before 6.2.1.03, when INFO logging is enabled, allows local users to discover cleartext passwords by reading log files. + + + + + + + + + + + + + + cpe:/a:starbucks:starbucks:2.6.1 + + CVE-2014-0647 + 2014-01-27T19:55:03.957-05:00 + 2014-02-24T17:03:17.877-05:00 + + + 2.1 + LOCAL + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-28T11:54:07.187-05:00 + + + + + MISC + https://itunes.apple.com/us/app/starbucks/id331177714?mt=8 + + + XF + starbucks-cve20140647-info-disclosure(90412) + + + MISC + http://www.zdnet.com/the-starbucks-bug-not-as-awful-as-reported-7000025269/ + + + MISC + http://www.zdnet.com/starbucks-fixes-ios-app-bugs-7000025323/ + + + BID + 64942 + + + BUGTRAQ + 20140114 [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application + + + OSVDB + 102514 + + + FULLDISC + 20140113 [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application + + + FULLDISC + 20140117 Re: [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application + + The Starbucks 2.6.1 application for iOS stores sensitive information in plaintext in the Crashlytics log file (/Library/Caches/com.crashlytics.data/com.starbucks.mystarbucks/session.clslog), which allows attackers to discover usernames, passwords, and e-mail addresses via an application that reads session.clslog. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:secure_access_control_system:5.2.0.26.1 + cpe:/a:cisco:secure_access_control_system:5.2.0.26.2 + cpe:/a:cisco:secure_access_control_system:5.1.0.44.1 + cpe:/a:cisco:secure_access_control_system:5.1 + cpe:/a:cisco:secure_access_control_system:5.4.0.46.5 + cpe:/a:cisco:secure_access_control_system:5.2 + cpe:/a:cisco:secure_access_control_system:5.4.0.46.6 + cpe:/a:cisco:secure_access_control_system:5.1.0.44.5 + cpe:/a:cisco:secure_access_control_system:5.1.0.44.4 + cpe:/a:cisco:secure_access_control_system:5.3.0.40.8 + cpe:/a:cisco:secure_access_control_system:5.4.0.46.1 + cpe:/a:cisco:secure_access_control_system:5.3.0.40.9 + cpe:/a:cisco:secure_access_control_system:5.4.0.46.2 + cpe:/a:cisco:secure_access_control_system:5.2.0.26 + cpe:/a:cisco:secure_access_control_system:5.1.0.44 + cpe:/a:cisco:secure_access_control_system:5.3.0.40.1 + cpe:/a:cisco:secure_access_control_system:5.1.0.44.2 + cpe:/a:cisco:secure_access_control_system:5.1.0.44.3 + cpe:/a:cisco:secure_access_control_system:5.3.0.40.7 + cpe:/a:cisco:secure_access_control_system:5.4.0.46.4 + cpe:/a:cisco:secure_access_control_system:5.4.0.46.3 + cpe:/a:cisco:secure_access_control_system:5.3.0.40.6 + cpe:/a:cisco:secure_access_control_system:5.3.0.40.3 + cpe:/a:cisco:secure_access_control_system:5.3.0.40.2 + cpe:/a:cisco:secure_access_control_system:5.3.0.40.5 + cpe:/a:cisco:secure_access_control_system:5.3.0.40.4 + + CVE-2014-0648 + 2014-01-16T14:55:04.637-05:00 + 2014-01-23T23:38:00.120-05:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-01-17T11:20:03.047-05:00 + + + + + XF + cisco-acs-cve20140648-unauth-access(90431) + + + SECTRACK + 1029634 + + + BID + 64962 + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32379 + + + CISCO + 20140115 Multiple Vulnerabilities in Cisco Secure Access Control System + + + SECUNIA + 56213 + + + OSVDB + 102117 + + The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authentication and authorization requirements, which allows remote attackers to obtain administrative access via a request to this interface, aka Bug ID CSCud75187. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:secure_access_control_system:5.2.0.26.1 + cpe:/a:cisco:secure_access_control_system:5.2.0.26.2 + cpe:/a:cisco:secure_access_control_system:5.1.0.44.1 + cpe:/a:cisco:secure_access_control_system:5.1 + cpe:/a:cisco:secure_access_control_system:5.4.0.46.5 + cpe:/a:cisco:secure_access_control_system:5.2 + cpe:/a:cisco:secure_access_control_system:5.4.0.46.6 + cpe:/a:cisco:secure_access_control_system:5.1.0.44.5 + cpe:/a:cisco:secure_access_control_system:5.1.0.44.4 + cpe:/a:cisco:secure_access_control_system:5.3.0.40.8 + cpe:/a:cisco:secure_access_control_system:5.4.0.46.1 + cpe:/a:cisco:secure_access_control_system:5.3.0.40.9 + cpe:/a:cisco:secure_access_control_system:5.4.0.46.2 + cpe:/a:cisco:secure_access_control_system:5.2.0.26 + cpe:/a:cisco:secure_access_control_system:5.1.0.44 + cpe:/a:cisco:secure_access_control_system:5.3.0.40.1 + cpe:/a:cisco:secure_access_control_system:5.1.0.44.2 + cpe:/a:cisco:secure_access_control_system:5.1.0.44.3 + cpe:/a:cisco:secure_access_control_system:5.3.0.40.7 + cpe:/a:cisco:secure_access_control_system:5.4.0.46.4 + cpe:/a:cisco:secure_access_control_system:5.4.0.46.3 + cpe:/a:cisco:secure_access_control_system:5.3.0.40.6 + cpe:/a:cisco:secure_access_control_system:5.3.0.40.3 + cpe:/a:cisco:secure_access_control_system:5.3.0.40.2 + cpe:/a:cisco:secure_access_control_system:5.3.0.40.5 + cpe:/a:cisco:secure_access_control_system:5.3.0.40.4 + + CVE-2014-0649 + 2014-01-16T14:55:04.670-05:00 + 2014-01-23T23:38:00.200-05:00 + + + 9.0 + NETWORK + LOW + SINGLE_INSTANCE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-01-17T11:26:22.603-05:00 + + + + + XF + cisco-acs-cve20140649-priv-esc(90430) + + + SECTRACK + 1029634 + + + BID + 64958 + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32378 + + + CISCO + 20140115 Multiple Vulnerabilities in Cisco Secure Access Control System + + + SECUNIA + 56213 + + + OSVDB + 102116 + + The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authorization requirements, which allows remote authenticated users to obtain superadmin access via a request to this interface, aka Bug ID CSCud75180. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:secure_access_control_system:5.2.0.26.1 + cpe:/a:cisco:secure_access_control_system:5.2.0.26.2 + cpe:/a:cisco:secure_access_control_system:5.1.0.44.1 + cpe:/a:cisco:secure_access_control_system:5.1 + cpe:/a:cisco:secure_access_control_system:5.2 + cpe:/a:cisco:secure_access_control_system:5.1.0.44.5 + cpe:/a:cisco:secure_access_control_system:5.1.0.44.4 + cpe:/a:cisco:secure_access_control_system:5.4.0.46.1 + cpe:/a:cisco:secure_access_control_system:5.3.0.40.8 + cpe:/a:cisco:secure_access_control_system:5.4.0.46.2 + cpe:/a:cisco:secure_access_control_system:5.3.0.40.9 + cpe:/a:cisco:secure_access_control_system:5.2.0.26 + cpe:/a:cisco:secure_access_control_system:5.1.0.44 + cpe:/a:cisco:secure_access_control_system:5.3.0.40.1 + cpe:/a:cisco:secure_access_control_system:5.1.0.44.2 + cpe:/a:cisco:secure_access_control_system:5.1.0.44.3 + cpe:/a:cisco:secure_access_control_system:5.3.0.40.7 + cpe:/a:cisco:secure_access_control_system:5.3.0.40.6 + cpe:/a:cisco:secure_access_control_system:5.3.0.40.3 + cpe:/a:cisco:secure_access_control_system:5.3.0.40.2 + cpe:/a:cisco:secure_access_control_system:5.3.0.40.5 + cpe:/a:cisco:secure_access_control_system:5.3.0.40.4 + + CVE-2014-0650 + 2014-01-16T14:55:04.700-05:00 + 2014-01-31T01:08:15.533-05:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-01-17T11:28:46.247-05:00 + + + + + XF + cisco-acs-cve20140650-command-exec(90432) + + + SECTRACK + 1029634 + + + BID + 64964 + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32380 + + + CISCO + 20140115 Multiple Vulnerabilities in Cisco Secure Access Control System + + + SECUNIA + 56213 + + + OSVDB + 102115 + + The web interface in Cisco Secure Access Control System (ACS) 5.x before 5.4 Patch 3 allows remote attackers to execute arbitrary operating-system commands via a request to this interface, aka Bug ID CSCue65962. + + + + + + + + + cpe:/a:cisco:context_directory_agent:- + + CVE-2014-0651 + 2014-01-08T16:55:06.223-05:00 + 2014-01-17T00:20:32.983-05:00 + + + 4.9 + NETWORK + MEDIUM + SINGLE_INSTANCE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-09T13:14:43.650-05:00 + + + + + XF + cisco-cda-cve20140651-priv-esc(90166) + + + SECTRACK + 1029573 + + + BID + 64706 + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32364 + + + CISCO + 20140107 Cisco Context Directory Agent Privilege Escalation Vulnerability + + + SECUNIA + 56365 + + + OSVDB + 101809 + + The administrative interface in Cisco Context Directory Agent (CDA) does not properly enforce authorization requirements, which allows remote authenticated users to obtain administrative access by hijacking a session, aka Bug ID CSCuj45347. + + + + + + + + + cpe:/a:cisco:context_directory_agent:- + + CVE-2014-0652 + 2014-01-08T16:55:06.240-05:00 + 2014-01-17T00:20:33.093-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-09T13:15:21.870-05:00 + + + + + XF + cisco-cda-cve20140652-xss(90167) + + + SECTRACK + 1029572 + + + BID + 64703 + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32365 + + + CISCO + 20140107 Cisco Context Directory Agent Mappings Page Cross-Site Scripting Vulnerability + + + SECUNIA + 56365 + + + OSVDB + 101803 + + Cross-site scripting (XSS) vulnerability in the Mappings page in Cisco Context Directory Agent (CDA) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuj45358. + + + + + + + + + cpe:/h:cisco:adaptive_security_appliance + + CVE-2014-0653 + 2014-01-08T16:55:06.270-05:00 + 2014-01-17T00:20:33.200-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-09T14:32:30.300-05:00 + + + + + XF + cisco-asa-cve20140653-sec-bypass(90165) + + + SECTRACK + 1029570 + + + BID + 64708 + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32363 + + + CISCO + 20140107 Cisco Adaptive Security Appliance Identity Firewall NetBIOS Logout Probe Auth State Change Vulnerability + + + SECUNIA + 56366 + + + OSVDB + 101834 + + The Identity Firewall (IDFW) functionality in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to trigger authentication-state modifications via a crafted NetBIOS logout probe response, aka Bug ID CSCuj45340. + + + + + + + + + cpe:/a:cisco:context_directory_agent:- + + CVE-2014-0654 + 2014-01-08T16:55:06.303-05:00 + 2014-01-17T00:20:33.297-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-09T13:17:47.750-05:00 + + + + + XF + cisco-cda-cve20140654-sec-bypass(90168) + + + SECTRACK + 1029574 + + + BID + 64709 + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32366 + + + CISCO + 20140107 Cisco Context Directory Agent Replayed RADIUS Accounting Message Vulnerability + + + SECUNIA + 56365 + + + OSVDB + 101802 + + Cisco Context Directory Agent (CDA) allows remote attackers to modify the cache via a replay attack involving crafted RADIUS accounting messages, aka Bug ID CSCuj45383. + + + + + + + + + cpe:/h:cisco:adaptive_security_appliance + + CVE-2014-0655 + 2014-01-08T16:55:06.333-05:00 + 2014-01-17T00:20:33.387-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-09T14:33:31.800-05:00 + + + + + XF + cisco-asa-cve20140655-sec-bypass(90164) + + + SECTRACK + 1029575 + + + BID + 64700 + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32362 + + + CISCO + 20140107 Cisco Adaptive Security Appliance RADIUS Change of Authorization Message Replay Vulnerability + + + SECUNIA + 56366 + + + OSVDB + 101838 + + The Identity Firewall (IDFW) functionality in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to change the user-cache contents via a replay attack involving crafted RADIUS Change of Authorization (CoA) messages, aka Bug ID CSCuj45332. + + + + + + + + + cpe:/a:cisco:context_directory_agent:- + + CVE-2014-0656 + 2014-01-08T16:55:06.380-05:00 + 2014-01-17T00:20:33.483-05:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-09T13:16:36.607-05:00 + + + + + XF + cisco-cda-cve20140656-sec-bypass(90169) + + + SECTRACK + 1029569 + + + BID + 64701 + + + CISCO + 20140107 Cisco Context Directory Agent Hidden Input Vulnerability + + + OSVDB + 101801 + + Cisco Context Directory Agent (CDA) allows remote authenticated users to trigger the omission of certain user-interface data via crafted field values, aka Bug ID CSCuj45353. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:unified_communications_manager:8.6%282a%29su2 + cpe:/a:cisco:unified_communications_manager:6.1%285%29 + cpe:/a:cisco:unified_communications_manager:8.6%282a%29su3 + cpe:/a:cisco:unified_communications_manager:6.1%283b%29su1 + cpe:/a:cisco:unified_communications_manager:8.6%283%29 + cpe:/a:cisco:unified_communications_manager:5.1%282%29 + cpe:/a:cisco:unified_communications_manager:8.6%282a%29su1 + cpe:/a:cisco:unified_communications_manager:6.1%283a%29 + cpe:/a:cisco:unified_communications_manager:6.0%281b%29 + cpe:/a:cisco:unified_communications_manager:6.0%281a%29 + cpe:/a:cisco:unified_communications_manager:7.1%285%29su1a + cpe:/a:cisco:unified_communications_manager:8.0%282%29 + cpe:/a:cisco:unified_communications_manager:8.0 + cpe:/a:cisco:unified_communications_manager:7.1%283b%29su1 + cpe:/a:cisco:unified_communications_manager:8.0%281%29 + cpe:/a:cisco:unified_communications_manager:7.1%283b%29su2 + cpe:/a:cisco:unified_communications_manager:6.1%284a%29 + cpe:/a:cisco:unified_communications_manager:6.1%284%29 + cpe:/a:cisco:unified_communications_manager:8.5%281%29su2 + cpe:/a:cisco:unified_communications_manager:8.5%281%29su1 + cpe:/a:cisco:unified_communications_manager:8.6%282%29 + cpe:/a:cisco:unified_communications_manager:6.1%281a%29 + cpe:/a:cisco:unified_communications_manager:3.3%285%29sr1 + cpe:/a:cisco:unified_communications_manager:6.1%284%29su1 + cpe:/a:cisco:unified_communications_manager:8.5 + cpe:/a:cisco:unified_communications_manager:8.6 + cpe:/a:cisco:unified_communications_manager:7.1%285%29 + cpe:/a:cisco:unified_communications_manager:8.5%281%29su5 + cpe:/a:cisco:unified_communications_manager:8.6%281%29 + cpe:/a:cisco:unified_communications_manager:8.5%281%29su3 + cpe:/a:cisco:unified_communications_manager:8.5%281%29su4 + cpe:/a:cisco:unified_communications_manager:6.0%281%29 + cpe:/a:cisco:unified_communications_manager:7.1%285b%29su1a + cpe:/a:cisco:unified_communications_manager:5.1%281%29 + cpe:/a:cisco:unified_communications_manager:9.1%281%29 + cpe:/a:cisco:unified_communications_manager:7.0%282a%29su2 + cpe:/a:cisco:unified_communications_manager:7.1%282b%29su1 + cpe:/a:cisco:unified_communications_manager:7.0%282a%29su1 + cpe:/a:cisco:unified_communications_manager:4.3%281%29 + cpe:/a:cisco:unified_communications_manager:6.1%283%29 + cpe:/a:cisco:unified_communications_manager:8.6%281a%29 + cpe:/a:cisco:unified_communications_manager:4.2.1 + cpe:/a:cisco:unified_communications_manager:7.1%282a%29su1 + cpe:/a:cisco:unified_communications_manager:4.2.3 + cpe:/a:cisco:unified_communications_manager:5.1 + cpe:/a:cisco:unified_communications_manager:4.2.2 + cpe:/a:cisco:unified_communications_manager:6.1%282%29su1 + cpe:/a:cisco:unified_communications_manager:5.1%283d%29 + cpe:/a:cisco:unified_communications_manager:7.0%281%29su1 + cpe:/a:cisco:unified_communications_manager:4.2 + cpe:/a:cisco:unified_communications_manager:4.2.3sr2b + cpe:/a:cisco:unified_communications_manager:4.3 + cpe:/a:cisco:unified_communications_manager:9.0%281%29 + cpe:/a:cisco:unified_communications_manager:6.1%285%29su1 + cpe:/a:cisco:unified_communications_manager:6.1%285%29su2 + cpe:/a:cisco:unified_communications_manager:5.0 + cpe:/a:cisco:unified_communications_manager:4.1%283%29 + cpe:/a:cisco:unified_communications_manager:6.1%285%29su3 + cpe:/a:cisco:unified_communications_manager:8.6%284%29 + cpe:/a:cisco:unified_communications_manager:5.1%283e%29 + cpe:/a:cisco:unified_communications_manager:8.0%282c%29su1 + cpe:/a:cisco:unified_communications_manager:7.1%282b%29 + cpe:/a:cisco:unified_communications_manager:6.1%282%29 + cpe:/a:cisco:unified_communications_manager:6.1%282%29su1a + cpe:/a:cisco:unified_communications_manager:5.1.2 + cpe:/a:cisco:unified_communications_manager:8.0%283a%29su2 + cpe:/a:cisco:unified_communications_manager:8.0%283a%29su1 + cpe:/a:cisco:unified_communications_manager:7.0%282a%29 + cpe:/a:cisco:unified_communications_manager:8.0%283a%29su3 + cpe:/a:cisco:unified_communications_manager:5.1%283a%29 + cpe:/a:cisco:unified_communications_manager:3.3%285%29sr2a + cpe:/a:cisco:unified_communications_manager:4.2.3sr2 + cpe:/a:cisco:unified_communications_manager:8.0%282b%29 + cpe:/a:cisco:unified_communications_manager:5.1%281c%29 + cpe:/a:cisco:unified_communications_manager:3.3%285%29 + cpe:/a:cisco:unified_communications_manager:7.1%282a%29 + cpe:/a:cisco:unified_communications_manager:6.1%281%29 + cpe:/a:cisco:unified_communications_manager:5.1%282a%29 + cpe:/a:cisco:unified_communications_manager:7.1%285b%29su6 + cpe:/a:cisco:unified_communications_manager:5.1%282b%29 + cpe:/a:cisco:unified_communications_manager:5.1%281b%29 + cpe:/a:cisco:unified_communications_manager:7.1%283a%29 + cpe:/a:cisco:unified_communications_manager:7.1%285a%29 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr4 + cpe:/a:cisco:unified_communications_manager:8.0%282c%29 + cpe:/a:cisco:unified_communications_manager:7.1%285b%29su3 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr1 + cpe:/a:cisco:unified_communications_manager:7.1%285b%29su2 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr2 + cpe:/a:cisco:unified_communications_manager:7.1%285b%29su5 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr3 + cpe:/a:cisco:unified_communications_manager:7.1%283a%29su1a + cpe:/a:cisco:unified_communications_manager:7.1%285b%29su4 + cpe:/a:cisco:unified_communications_manager:6.0 + cpe:/a:cisco:unified_communications_manager:7.1%285b%29su1 + cpe:/a:cisco:unified_communications_manager:6.1%284a%29su2 + cpe:/a:cisco:unified_communications_manager:7.0%281%29su1a + cpe:/a:cisco:unified_communications_manager:6.1%281b%29 + cpe:/a:cisco:unified_communications_manager:5.1%283c%29 + cpe:/a:cisco:unified_communications_manager:8.0%283a%29 + cpe:/a:cisco:unified_communications_manager:7.1%283b%29 + cpe:/a:cisco:unified_communications_manager:7.1%285b%29 + cpe:/a:cisco:unified_communications_manager:7.0%282%29 + cpe:/a:cisco:unified_communications_manager:8.5%281%29 + cpe:/a:cisco:unified_communications_manager:8.0%283%29 + cpe:/a:cisco:unified_communications_manager:7.1%283a%29su1 + cpe:/a:cisco:unified_communications_manager:5.1%283%29 + cpe:/a:cisco:unified_communications_manager:8.6%282a%29 + cpe:/a:cisco:unified_communications_manager:6.1%283b%29 + cpe:/a:cisco:unified_communications_manager:8.0%282a%29 + cpe:/a:cisco:unified_communications_manager:7.1%283%29 + cpe:/a:cisco:unified_communications_manager:4.2.3sr1 + cpe:/a:cisco:unified_communications_manager:7.1%285%29su1 + + CVE-2014-0657 + 2014-01-08T16:55:06.410-05:00 + 2014-01-17T00:20:33.577-05:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-09T14:44:49.190-05:00 + + + + + XF + cisco-ucm-cve20140657-sec-bypass(90120) + + + SECTRACK + 1029571 + + + BID + 64690 + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32341 + + + CISCO + 20140107 Cisco Unified Communications Manager Role Bypass Vulnerability + + + SECUNIA + 56368 + + + OSVDB + 101800 + + The administration portal in Cisco Unified Communications Manager (Unified CM) 9.1(1) and earlier does not properly handle role restrictions, which allows remote authenticated users to bypass role-based access control via multiple visits to a forbidden portal URL, aka Bug ID CSCuj83540. + + + + + + + + + + + + + + + cpe:/h:cisco:unified_ip_phone_9951 + cpe:/h:cisco:unified_ip_phone_9971 + cpe:/o:cisco:unified_ip_phones_9900_series_firmware:- + + CVE-2014-0658 + 2014-01-10T11:47:06.037-05:00 + 2014-01-17T00:20:33.670-05:00 + + + 5.4 + NETWORK + HIGH + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-01-10T13:05:09.983-05:00 + + + + + XF + cisco-unified-cve20140658-dos(90236) + + + SECTRACK + 1029596 + + + BID + 64770 + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32402 + + + CISCO + 20140110 Cisco 9900 Series IP Phone Crafted Header Unregister Vulnerability + + + SECUNIA + 56384 + + + OSVDB + 101913 + + Cisco 9900 Unified IP phones allow remote attackers to cause a denial of service (unregistration) via a crafted SIP header, aka Bug ID CSCul24898. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:cisco:rvs4000_firmware:1.3.3.5 + cpe:/o:cisco:wap4410n_firmware:2.0.2.1 + cpe:/o:cisco:wap4410n_firmware:2.0.6.1 + cpe:/o:cisco:rvs4000_firmware:1.3.2.0 + cpe:/o:cisco:wrvs4400n_firmware:1.1.13 + cpe:/o:cisco:wrvs4400n_firmware:2.0.1.3 + cpe:/o:cisco:rvs4000_firmware:2.0.3.2 + cpe:/o:cisco:wap4410n_firmware:2.0.4.2 + cpe:/h:cisco:wrvs4400n:- + cpe:/h:cisco:rvs4000:- + cpe:/o:cisco:wrvs4400n_firmware:1.1.03 + cpe:/o:cisco:wap4410n_firmware:2.0.3.3 + cpe:/o:cisco:rvs4000_firmware:2.0.2.7 + cpe:/h:cisco:wap4410n:- + cpe:/o:cisco:wrvs4400n_firmware:2.0.2.1 + cpe:/o:cisco:rvs4000_firmware:2.0.0.3 + + CVE-2014-0659 + 2014-01-12T13:34:55.957-05:00 + 2014-01-17T00:20:33.763-05:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-01-13T13:36:09.533-05:00 + + + + + MISC + https://github.com/elvanderb/TCP-32764 + + + XF + cisco-small-cve20140659-priv-esc(90233) + + + SECTRACK + 1029580 + + + SECTRACK + 1029579 + + + BID + 64776 + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32381 + + + CISCO + 20140110 Undocumented Test Interface in Cisco Small Business Devices + + + SECUNIA + 56292 + + The Cisco WAP4410N access point with firmware through 2.0.6.1, WRVS4400N router with firmware 1.x through 1.1.13 and 2.x through 2.0.2.1, and RVS4000 router with firmware through 2.0.3.2 allow remote attackers to read credential and configuration data, and execute arbitrary commands, via requests to the test interface on TCP port 32764, aka Bug IDs CSCum37566, CSCum43693, CSCum43700, and CSCum43685. + + + + + + + + + + + + cpe:/a:cisco:telepresence_isdn_gateway_software:2.1%281.43%29 + cpe:/a:cisco:telepresence_isdn_gateway_software:2.1%281.56%29 + cpe:/a:cisco:telepresence_isdn_gateway_software:2.1%281.49%29 + cpe:/a:cisco:telepresence_isdn_gateway_software:2.1%281.79%29 + + CVE-2014-0660 + 2014-01-22T16:55:02.823-05:00 + 2014-01-31T01:08:16.437-05:00 + + + 7.1 + NETWORK + MEDIUM + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-01-23T12:26:09.173-05:00 + + + + + XF + cisco-isdn-cve20140660-dos(90622) + + + SECTRACK + 1029657 + + + BID + 65072 + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32460 + + + CISCO + 20140122 Cisco TelePresence ISDN Gateway D-Channel Denial of Service Vulnerability + + + SECUNIA + 56591 + + + OSVDB + 102361 + + Cisco TelePresence ISDN Gateway with software before 2.2(1.92) allows remote attackers to cause a denial of service (D-channel call outage) via a crafted Q.931 STATUS message, aka Bug ID CSCui50360. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/h:cisco:telepresence_system_500-37:- + cpe:/a:cisco:telepresence_system_software:6.0.1%2850%29 + cpe:/a:cisco:telepresence_system_software:1.10.1%2843%29 + cpe:/a:cisco:telepresence_system_software:1.7.5%2842%29 + cpe:/a:cisco:telepresence_system_software:1.10.1 + cpe:/a:cisco:telepresence_system_software:1.9.1%2868%29 + cpe:/a:cisco:telepresence_system_software:6.0.3%2833%29 + cpe:/a:cisco:telepresence_system_software:1.9.2%2819%29 + cpe:/a:cisco:telepresence_system_software:1.10.0 + cpe:/h:cisco:telepresence_system_tx1300_47 + cpe:/a:cisco:telepresence_system_software:1.9.6.1%283%29 + cpe:/a:cisco:telepresence_system_software:1.9.3%2844%29 + cpe:/a:cisco:telepresence_system_software:1.8.0%2855%29 + cpe:/h:cisco:telepresence_system_3200 + cpe:/a:cisco:telepresence_system_software:1.9.6%282%29 + cpe:/a:cisco:telepresence_system_software:1.8.3%284%29 + cpe:/a:cisco:telepresence_system_software:1.9.4%2819%29 + cpe:/h:cisco:telepresence_system_tx9000 + cpe:/h:cisco:telepresence_system_3010 + cpe:/h:cisco:telepresence_system_tx9200 + cpe:/a:cisco:telepresence_system_software:6.1.0%2890%29 + cpe:/h:cisco:telepresence_system_1000:- + cpe:/a:cisco:telepresence_system_software:1.7.6%284%29 + cpe:/a:cisco:telepresence_system_software:1.10.0%28259%29 + cpe:/a:cisco:telepresence_system_software:1.9.5%287%29 + cpe:/a:cisco:telepresence_system_software:6.0.2%2828%29 + cpe:/h:cisco:telepresence_system_tx1310_65 + cpe:/a:cisco:telepresence_system_software:1.8.1%2834%29 + cpe:/h:cisco:telepresence_system_3000 + cpe:/h:cisco:telepresence_system_500-32:- + cpe:/a:cisco:telepresence_system_software:1.9.0%2846%29 + cpe:/a:cisco:telepresence_system_software:1.8.4%2813%29 + cpe:/a:cisco:telepresence_system_software:1.8.2%2811%29 + cpe:/h:cisco:telepresence_system_3210 + cpe:/a:cisco:telepresence_system_software:1.8.5%284%29 + cpe:/h:cisco:telepresence_system_1100:- + cpe:/h:cisco:telepresence_system_1300-65:- + cpe:/a:cisco:telepresence_system_software:1.5.10%283648%29 + cpe:/a:cisco:telepresence_system_software:6.0.0.1%284%29 + + CVE-2014-0661 + 2014-01-22T16:55:03.560-05:00 + 2014-01-31T01:08:16.673-05:00 + + + 8.3 + ADJACENT_NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-01-23T12:48:10.377-05:00 + + + + + XF + cisco-telepresence-cve20140661-command-exec(90624) + + + SECTRACK + 1029656 + + + BID + 65071 + + + CISCO + 20140122 Cisco TelePresence System Software Command Execution Vulnerability + + + SECUNIA + 56533 + + + OSVDB + 102362 + + The System Status Collection Daemon (SSCD) in Cisco TelePresence System 500-37, 1000, 1300-65, and 3xxx before 1.10.2(42), and 500-32, 1300-47, TX1310 65, and TX9xxx before 6.0.4(11), allows remote attackers to execute arbitrary commands or cause a denial of service (stack memory corruption) via a crafted XML-RPC message, aka Bug ID CSCui32796. + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_video_communication_servers_software:x6.1 + cpe:/a:cisco:telepresence_video_communication_servers_software:x7.2.1 + cpe:/a:cisco:telepresence_video_communication_servers_software:x6 + cpe:/a:cisco:telepresence_video_communication_servers_software:x7.1 + cpe:/a:cisco:telepresence_video_communication_servers_software:x7.2.2 + cpe:/a:cisco:telepresence_video_communication_servers_software:x7.0 + cpe:/a:cisco:telepresence_video_communication_servers_software:x7.2 + cpe:/a:cisco:telepresence_video_communication_servers_software:x7.0.1 + cpe:/a:cisco:telepresence_video_communication_servers_software:x7.0.2 + cpe:/a:cisco:telepresence_video_communication_servers_software:x7.0.3 + + CVE-2014-0662 + 2014-01-22T16:55:03.573-05:00 + 2014-01-31T01:08:16.923-05:00 + + + 7.1 + NETWORK + MEDIUM + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-01-23T12:34:49.577-05:00 + + + + + XF + cisco-vcs-cve20140662-dos(90621) + + + SECTRACK + 1029655 + + + BID + 65076 + + + CONFIRM + http://tools.cisco.com/security/center/viewAMBAlert.x?alertId=32409 + + + CISCO + 20140122 Cisco TelePresence Video Communication Server SIP Denial of Service Vulnerability + + + SECUNIA + 56592 + + + OSVDB + 102363 + + The SIP module in Cisco TelePresence Video Communication Server (VCS) before 8.1 allows remote attackers to cause a denial of service (process failure) via a crafted SDP message, aka Bug ID CSCue97632. + + + + + + + + + cpe:/a:cisco:secure_access_control_system:- + + CVE-2014-0663 + 2014-01-10T11:47:06.067-05:00 + 2014-01-17T00:20:33.873-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-10T13:08:20.660-05:00 + + + + + XF + cisco-acs-cve20140663-xss(90232) + + + SECTRACK + 1029595 + + + BID + 64773 + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32403 + + + CISCO + 20140110 Cisco Secure Access Control System Cross-Site Scripting Vulnerability + + + SECUNIA + 56382 + + + OSVDB + 101914 + + Cross-site scripting (XSS) vulnerability in the web framework in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCum03625. + + + + + + + + + cpe:/a:cisco:unity_connection:- + + CVE-2014-0664 + 2014-01-10T11:47:06.083-05:00 + 2014-04-04T23:59:36.323-04:00 + + + 6.8 + NETWORK + LOW + SINGLE_INSTANCE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-01-10T12:58:00.977-05:00 + + + + + XF + cisco-unity-cve20140664-dos(90234) + + + SECTRACK + 1029593 + + + BID + 64772 + + + CISCO + 20140110 Cisco Unity Connection Internet Message Access Protocol Denial of Service Vulnerability + + + SECUNIA + 56370 + + + OSVDB + 101915 + + The server in Cisco Unity Connection allows remote authenticated users to cause a denial of service (CPU consumption) via unspecified IMAP commands, aka Bug ID CSCul49976. + + + + + + + + + cpe:/a:cisco:identity_services_engine_software:- + + CVE-2014-0665 + 2014-01-15T11:11:08.457-05:00 + 2014-01-23T23:38:01.463-05:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-15T15:57:11.723-05:00 + + + + + XF + cisco-ise-cve2040665-unsuth-access(90463) + + + SECTRACK + 1029624 + + + BID + 64939 + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32448 + + + CISCO + 20140115 Cisco ISE Unprivileged Support Bundle Download Vulnerability + + + SECUNIA + 56439 + + + OSVDB + 102118 + + The RBAC implementation in Cisco Identity Services Engine (ISE) Software does not properly verify privileges for support-bundle downloads, which allows remote authenticated users to obtain sensitive information via a download action, as demonstrated by obtaining read access to the user database, aka Bug ID CSCul83904. + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:jabber:9.1%28.3%29:-:~-~-~windows~~ + cpe:/a:cisco:jabber:9.1%28.2%29:-:~-~-~windows~~ + cpe:/a:cisco:jabber:9.2%28.0%29:-:~-~-~windows~~ + cpe:/a:cisco:jabber:9.1%28.0%29:-:~-~-~windows~~ + cpe:/a:cisco:jabber:9.1%28.1%29:-:~-~-~windows~~ + cpe:/a:cisco:jabber:9.0%28.3%29:-:~-~-~windows~~ + cpe:/a:cisco:jabber:9.2%28.1%29:-:~-~-~windows~~ + cpe:/a:cisco:jabber:9.1%28.5%29:-:~-~-~windows~~ + cpe:/a:cisco:jabber:9.0%28.2%29:-:~-~-~windows~~ + cpe:/a:cisco:jabber:9.0%28.1%29:-:~-~-~windows~~ + cpe:/a:cisco:jabber:9.0%28.4%29:-:~-~-~windows~~ + cpe:/a:cisco:jabber:9.0%28.5%29:-:~-~-~windows~~ + cpe:/a:cisco:jabber:9.0%28.0%29:-:~-~-~windows~~ + cpe:/a:cisco:jabber:9.1%28.4%29:-:~-~-~windows~~ + cpe:/a:cisco:jabber:9.0:-:~-~-~windows~~ + cpe:/a:cisco:jabber:9.1:-:~-~-~windows~~ + cpe:/a:cisco:jabber:9.2:-:~-~-~windows~~ + + CVE-2014-0666 + 2014-01-16T14:55:04.730-05:00 + 2014-01-23T23:38:01.557-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-17T11:18:16.483-05:00 + + + + + XF + cisco-jabber-cve20140666-code-exec(90435) + + + SECTRACK + 1029635 + + + BID + 64965 + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32451 + + + CISCO + 20140115 Cisco Jabber for Windows Remote Code Execution Vulnerability + + + SECUNIA + 56331 + + + OSVDB + 102122 + + Directory traversal vulnerability in the Send Screen Capture implementation in Cisco Jabber 9.2(.1) and earlier on Windows allows remote attackers to upload arbitrary types of files, and consequently execute arbitrary code, via modified packets, aka Bug ID CSCug48056. + + + + + + + + + cpe:/a:cisco:secure_access_control_system:- + + CVE-2014-0667 + 2014-01-16T14:55:04.763-05:00 + 2014-01-23T23:38:01.637-05:00 + + + 6.3 + NETWORK + MEDIUM + SINGLE_INSTANCE + COMPLETE + NONE + NONE + http://nvd.nist.gov + 2014-01-17T11:21:20.410-05:00 + + + + + XF + cisco-acs-cve20140667-info-disc(90497) + + + SECTRACK + 1029641 + + + BID + 64983 + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32468 + + + CISCO + 20140116 Cisco Secure ACS RMI Arbitrary File Read Vulnerability + + + OSVDB + 102168 + + The RMI interface in Cisco Secure Access Control System (ACS) does not properly enforce authorization requirements, which allows remote authenticated users to read arbitrary files via a request to this interface, aka Bug ID CSCud75169. + + + + + + + + + cpe:/a:cisco:secure_access_control_system:- + + CVE-2014-0668 + 2014-01-19T23:58:49.807-05:00 + 2014-01-31T01:08:17.783-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-21T12:07:57.267-05:00 + + + + + XF + cisco-acs-cve20140668-xss(90561) + + + SECTRACK + 1029654 + + + BID + 65016 + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32489 + + + CISCO + 20140117 Cisco Secure ACS Portal Cross-Site Scripting Vulnerability + + + SECUNIA + 56543 + + + OSVDB + 102256 + + Cross-site scripting (XSS) vulnerability in the portal in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCue65949. + + + + + + + + + cpe:/a:cisco:asr_5000_series_software:- + + CVE-2014-0669 + 2014-01-22T00:22:20.720-05:00 + 2014-01-31T01:08:17.953-05:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-22T15:59:24.233-05:00 + + + + + XF + cisco-ggsn-cve20140669-sec-bypass(90614) + + + SECTRACK + 1029666 + + + BID + 65052 + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32513 + + + CISCO + 20140121 Cisco ASR 5000 Series Gateway GPRS Support Node Traffic Bypass Vulnerability + + + SECUNIA + 56546 + + + OSVDB + 102318 + + The Wireless Session Protocol (WSP) feature in the Gateway GPRS Support Node (GGSN) component on Cisco ASR 5000 series devices allows remote attackers to bypass intended Top-Up payment restrictions via unspecified WSP packets, aka Bug ID CSCuh28371. + + + + + + + + + cpe:/a:cisco:mediasense:- + + CVE-2014-0670 + 2014-01-22T00:22:20.737-05:00 + 2014-01-31T01:08:18.220-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-22T12:04:42.507-05:00 + + + + + XF + cisco-mediasense-cve20140670-xss(90615) + + + SECTRACK + 1029667 + + + BID + 65053 + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32514 + + + CISCO + 20140121 Cisco MediaSense Search and Play Cross-Site Scripting Vulnerability + + + SECUNIA + 56563 + + + OSVDB + 102319 + + Cross-site scripting (XSS) vulnerability in the Search and Play interface in Cisco MediaSense allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCum16686. + + + + + + + + + cpe:/a:cisco:mediasense:- + + CVE-2014-0671 + 2014-01-22T00:22:20.767-05:00 + 2014-01-31T01:08:18.487-05:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-22T12:03:32.037-05:00 + + + + + XF + cisco-mediasense-cve20140671-open-redirect(90617) + + + SECTRACK + 1029669 + + + BID + 65055 + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32517 + + + CISCO + 20140121 Cisco MediaSense Open Redirection Vulnerability + + + SECUNIA + 56544 + + + OSVDB + 102341 + + Open redirect vulnerability in Cisco MediaSense allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter, aka Bug ID CSCum16749. + + + + + + + + + cpe:/a:cisco:mediasense:- + + CVE-2014-0672 + 2014-01-22T00:22:20.783-05:00 + 2014-04-04T23:59:36.947-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-22T11:50:59.487-05:00 + + + + + XF + cisco-mediasense-cve20140672-info-disc(90616) + + + SECTRACK + 1029668 + + + BID + 65054 + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32516 + + + CISCO + 20140121 Cisco MediaSense Search and Play Authorization Vulnerability + + + SECUNIA + 56600 + + + OSVDB + 102342 + + The Search and Play interface in Cisco MediaSense does not properly enforce authorization requirements, which allows remote authenticated users to download arbitrary recordings via a request to this interface. + + + + + + + + + + cpe:/h:cisco:video_surveillance_indoor_fixed_dome_ip_hd_camera:5010 + cpe:/h:cisco:video_surveillance_indoor_fixed_dome_ip_hd_camera:5011 + + CVE-2014-0673 + 2014-01-25T17:55:03.300-05:00 + 2014-04-22T13:23:51.623-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-27T05:18:59.000-05:00 + + + + + XF + cisco-video-cve20140673-xss(90733) + + + SECTRACK + 1029689 + + + BID + 65145 + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32568 + + + CISCO + 20140124 Cisco Video Surveillance 5000 Series HD IP Dome Camera Multiple Cross-Site Scripting Vulnerabilities + + + SECUNIA + 56552 + + + OSVDB + 102557 + + Multiple cross-site scripting (XSS) vulnerabilities in the web interface on Cisco Video Surveillance 5000 HD IP Dome cameras allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug IDs CSCud10943 and CSCud10950. + + + + + + + + + cpe:/a:cisco:video_surveillance_operations_manager:- + + CVE-2014-0674 + 2014-01-23T23:38:09.667-05:00 + 2014-01-31T01:08:19.080-05:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-24T11:40:37.560-05:00 + + + + + XF + cisco-vsom-cve20140674-unauth-access(90651) + + + SECTRACK + 1029692 + + + BID + 65111 + + + CISCO + 20140123 Cisco Video Surveillance Operations Manager MySQL Database Insufficient Authentication Controls + + + SECUNIA + 56619 + + + OSVDB + 102409 + + Cisco Video Surveillance Operations Manager (VSOM) does not require authentication for MySQL database connections, which allows remote attackers to obtain sensitive information, modify data, or cause a denial of service by leveraging network connectivity from a client system with a crafted host name, aka Bug ID CSCud10992. + + + + + + + + + cpe:/h:cisco:telepresence_video_communication_server:- + + CVE-2014-0675 + 2014-01-22T23:41:16.097-05:00 + 2014-01-30T00:17:30.627-05:00 + + + 6.4 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-23T12:31:22.587-05:00 + + + + + XF + cisco-telepresence-cve20140675-mitm(90650) + + + SECTRACK + 1029682 + + + BID + 65101 + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32540 + + + CISCO + 20140122 Cisco TelePresence Video Communication Server Expressway Default SSL Certificate Vulnerability + + + SECUNIA + 56621 + + + OSVDB + 102377 + + The Expressway component in Cisco TelePresence Video Communication Server (VCS) uses the same default X.509 certificate across different customers' installations, which makes it easier for remote attackers to conduct man-in-the-middle attacks against SSL sessions by leveraging the certificate's trust relationship, aka Bug ID CSCue07471. + + + + + + + + + cpe:/o:cisco:nx-os:- + + CVE-2014-0676 + 2014-01-22T16:55:03.607-05:00 + 2014-01-31T01:08:19.437-05:00 + + + 6.8 + LOCAL + LOW + SINGLE_INSTANCE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-01-23T12:37:28.860-05:00 + + + + + XF + cisco-nxos-cve20140676-priv-esc(90627) + + + SECTRACK + 1029690 + + + BID + 65083 + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32531 + + + CISCO + 20140122 Cisco NX-OS Software TACACS+ Command Authorization Vulnerability + + + SECUNIA + 56597 + + + OSVDB + 102366 + + Cisco NX-OS allows local users to bypass intended TACACS+ command restrictions via a series of multiple commands, aka Bug ID CSCum47367. + + + + + + + + + cpe:/o:cisco:nx-os:- + + CVE-2014-0677 + 2014-01-22T16:55:03.637-05:00 + 2014-01-31T01:08:19.627-05:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-01-23T12:38:54.863-05:00 + + + + + XF + cisco-nxos-cve20140677-dos(90623) + + + SECTRACK + 1029691 + + + BID + 65074 + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32532 + + + CISCO + 20140122 Cisco NX-OS Software Label Distribution Protocol Message Vulnerability + + + SECUNIA + 56611 + + + OSVDB + 102368 + + The Label Distribution Protocol (LDP) functionality in Cisco NX-OS allows remote attackers to cause a denial of service (temporary LDP session outage) via LDP discovery traffic containing malformed Hello messages, aka Bug ID CSCul88851. + + + + + + + + + cpe:/a:cisco:secure_access_control_system:- + + CVE-2014-0678 + 2014-01-25T17:55:03.567-05:00 + 2014-02-06T23:51:51.160-05:00 + + + 5.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-27T10:16:23.980-05:00 + + + + + XF + cisco-acs-cve20140678-unauth-access(90732) + + + SECTRACK + 1029688 + + + BID + 65144 + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32567 + + + CISCO + 20140124 Cisco Secure ACS Portal Session Management Vulnerability + + + SECUNIA + 56540 + + + OSVDB + 102558 + + The portal interface in Cisco Secure Access Control System (ACS) does not properly manage sessions, which allows remote authenticated users to hijack sessions and gain privileges via unspecified vectors, aka Bug ID CSCue65951. + + + + + + + + + + + + + + cpe:/a:cisco:prime_infrastructure:1.4.0 + cpe:/a:cisco:prime_infrastructure:1.4.1 + cpe:/a:cisco:prime_infrastructure:1.3.0 + cpe:/a:cisco:prime_infrastructure:1.2.1 + cpe:/a:cisco:prime_infrastructure:1.2.0 + cpe:/a:cisco:prime_infrastructure:2.0.0 + + CVE-2014-0679 + 2014-02-27T15:55:05.130-05:00 + 2014-02-28T10:56:55.753-05:00 + + + 9.0 + NETWORK + LOW + SINGLE_INSTANCE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-28T10:56:55.613-05:00 + + + + + CISCO + 20140226 Cisco Prime Infrastructure Command Execution Vulnerability + + Cisco Prime Infrastructure 1.2 and 1.3 before 1.3.0.20-2, 1.4 before 1.4.0.45-2, and 2.0 before 2.0.0.0.294-2 allows remote authenticated users to execute arbitrary commands with root privileges via an unspecified URL, aka Bug ID CSCum71308. + + + + + + + + + cpe:/h:cisco:identity_services_engine:- + + CVE-2014-0680 + 2014-01-29T13:34:05.310-05:00 + 2014-02-06T23:51:51.240-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-29T14:23:47.250-05:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32617 + + + CISCO + 20140128 Cisco Identity Services Engine HTTP Control Interface for NAC Web Agent Cross-Site Scripting Vulnerability + + + SECUNIA + 56672 + + + OSVDB + 102588 + + Cross-site scripting (XSS) vulnerability in the HTTP control interface in the NAC Web Agent component in Cisco Identity Services Engine (ISE) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCui15038. + + + + + + + + + cpe:/a:cisco:identity_services_engine_software:1.2 + + CVE-2014-0681 + 2014-01-29T13:34:05.340-05:00 + 2014-02-06T23:51:51.333-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-29T14:25:16.267-05:00 + + + + + BID + 65183 + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32609 + + + CISCO + 20140128 Cisco Identity Services Engine Reports Output Cross-Site Scripting Vulnerability + + + SECUNIA + 56714 + + + OSVDB + 102589 + + Cross-site scripting (XSS) vulnerability in Cisco Identity Services Engine (ISE) 1.2 patch 2 and earlier allows remote attackers to inject arbitrary web script or HTML via a report containing a crafted URL that is not properly handled during generation of report-output pages, aka Bug ID CSCui15064. + + + + + + + + + cpe:/a:cisco:webex_meetings_server:- + + CVE-2014-0682 + 2014-01-29T13:34:05.373-05:00 + 2014-02-06T23:51:51.410-05:00 + + + 4.9 + NETWORK + MEDIUM + SINGLE_INSTANCE + PARTIAL + NONE + PARTIAL + http://nvd.nist.gov + 2014-01-29T14:27:16.583-05:00 + + + + + BID + 65198 + + + CISCO + 20140128 Cisco WebEx Meetings Server Unauthorized Meeting Actions Vulnerability + + + OSVDB + 102590 + + Cisco WebEx Meetings Server allows remote authenticated users to bypass authorization checks and (1) join arbitrary meetings, or (2) terminate a meeting without having a host role, via a crafted URL, aka Bug ID CSCuj42346. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:cisco:rv215w_firmware:1.1.0.5 + cpe:/h:cisco:rv215w:- + cpe:/h:cisco:rv110w:- + cpe:/h:cisco:cvr100w:- + cpe:/o:cisco:cvr100w_firmware:1.0.1.19 + cpe:/o:cisco:rv110w_firmware:1.2.0.9 + + CVE-2014-0683 + 2014-03-06T06:55:05.287-05:00 + 2014-03-07T14:14:22.000-05:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-06T13:00:04.700-05:00 + + + + + CISCO + 20140305 Cisco Small Business Router Password Disclosure Vulnerability + + The web management interface on the Cisco RV110W firewall with firmware 1.2.0.9 and earlier, RV215W router with firmware 1.1.0.5 and earlier, and CVR100W router with firmware 1.0.1.19 and earlier does not prevent replaying of modified authentication requests, which allows remote attackers to obtain administrative access by leveraging the ability to intercept requests, aka Bug IDs CSCul94527, CSCum86264, and CSCum86275. + + + + + + + + + + + cpe:/a:cisco:unified_communications_manager:9.1%282.10000.28%29 + cpe:/a:cisco:unified_communications_manager:9.1%282%29 + cpe:/a:cisco:unified_communications_manager:9.1%281%29 + + CVE-2014-0686 + 2014-02-04T00:39:08.480-05:00 + 2014-02-24T20:33:06.417-05:00 + + + 6.0 + LOCAL + HIGH + SINGLE_INSTANCE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-03T17:11:26.000-05:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32683 + + + CISCO + 20140131 Cisco Unified Communications Manager Operating System-Level Privilege Escalation Vulnerability + + Cisco Unified Communications Manager (aka Unified CM) 9.1 (2.10000.28) and earlier allows local users to gain privileges by leveraging incorrect file permissions, aka Bug IDs CSCul24917 and CSCul24908. + + + + + + + + + + + + + + + + cpe:/a:cisco:cloud_portal:9.1:sp1 + cpe:/a:cisco:cloud_portal:9.1:sp2 + cpe:/a:cisco:cloud_portal:9.1:sp3 + cpe:/a:cisco:cloud_portal:9.4 + cpe:/a:cisco:cloud_portal:9.3 + cpe:/a:cisco:cloud_portal:9.4.1 + cpe:/a:cisco:cloud_portal:9.3.1 + cpe:/a:cisco:cloud_portal:9.3.2 + + CVE-2014-0694 + 2014-03-14T06:55:05.723-04:00 + 2014-03-14T13:56:47.767-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-03-14T13:56:47.690-04:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=33336 + + + CISCO + 20140312 Cisco Intelligent Automation for Cloud Cryptographic Implementation Issues + + Intelligent Automation for Cloud (IAC) in Cisco Cloud Portal 9.4.1 and earlier includes a cryptographic key in binary files, which makes it easier for remote attackers to obtain cleartext data from an arbitrary IAC installation by leveraging knowledge of this key, aka Bug IDs CSCui34764, CSCui34772, CSCui34776, CSCui34798, CSCui34800, CSCui34805, CSCui34809, CSCui34810, CSCui34813, CSCui34814, and CSCui34818. + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:cisco:wireless_lan_controller_software:7.3.101.0 + cpe:/o:cisco:wireless_lan_controller_software:7.4.100.60 + cpe:/o:cisco:wireless_lan_controller_software:7.2.110.0 + cpe:/o:cisco:wireless_lan_controller_software:7.0.235.0 + cpe:/o:cisco:wireless_lan_controller_software:7.2 + cpe:/o:cisco:wireless_lan_controller_software:7.3 + cpe:/o:cisco:wireless_lan_controller_software:7.4.100.0 + cpe:/o:cisco:wireless_lan_controller_software:7.2.103.0 + cpe:/o:cisco:wireless_lan_controller_software:7.0.220.0 + cpe:/o:cisco:wireless_lan_controller_software:7.0 + + CVE-2014-0701 + 2014-03-06T06:55:05.317-05:00 + 2014-03-07T14:50:55.837-05:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-03-06T03:12:44.000-05:00 + + + + + CISCO + 20140305 Multiple Vulnerabilities in Cisco Wireless LAN Controllers + + Cisco Wireless LAN Controller (WLC) devices 7.0 before 7.0.250.0, 7.2, 7.3, and 7.4 before 7.4.110.0 do not properly deallocate memory, which allows remote attackers to cause a denial of service (reboot) by sending WebAuth login requests at a high rate, aka Bug ID CSCuf52361. + + + + + + + + + + + + + + + cpe:/o:cisco:wireless_lan_controller_software:7.4.100.60 + cpe:/h:cisco:wireless_lan_controller + cpe:/o:cisco:wireless_lan_controller_software:7.4.100.0 + + CVE-2014-0703 + 2014-03-06T06:55:05.333-05:00 + 2014-03-07T14:12:52.263-05:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-06T13:19:14.680-05:00 + + + + + CISCO + 20140305 Multiple Vulnerabilities in Cisco Wireless LAN Controllers + + Cisco Wireless LAN Controller (WLC) devices 7.4 before 7.4.110.0 distribute Aironet IOS software with a race condition in the status of the administrative HTTP server, which allows remote attackers to bypass intended access restrictions by connecting to an Aironet access point on which this server had been disabled ineffectively, aka Bug ID CSCuf66202. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:cisco:wireless_lan_controller_software:4.2.174.0 + cpe:/o:cisco:wireless_lan_controller_software:7.0.98.0 + cpe:/o:cisco:wireless_lan_controller_software:5.1.151.0 + cpe:/o:cisco:wireless_lan_controller_software:5.0.148.2 + cpe:/o:cisco:wireless_lan_controller_software:4.1.171.0 + cpe:/o:cisco:wireless_lan_controller_software:5.0.148.0 + cpe:/o:cisco:wireless_lan_controller_software:7.3.101.0 + cpe:/o:cisco:wireless_lan_controller_software:6.0.182.0 + cpe:/o:cisco:wireless_lan_controller_software:4.2.173.0 + cpe:/o:cisco:wireless_lan_controller_software:4.2.176.0 + cpe:/o:cisco:wireless_lan_controller_software:4.0.155.5 + cpe:/o:cisco:wireless_lan_controller_software:5.1.152.0 + cpe:/o:cisco:wireless_lan_controller_software:4.2.61.0 + cpe:/o:cisco:wireless_lan_controller_software:4.0.179.8 + cpe:/o:cisco:wireless_lan_controller_software:4.1.181.0 + cpe:/o:cisco:wireless_lan_controller_software:4.1.185.0 + cpe:/o:cisco:wireless_lan_controller_software:5.2.157.0 + cpe:/o:cisco:wireless_lan_controller_software:4.0.108 + cpe:/o:cisco:wireless_lan_controller_software:6.0.199.0 + cpe:/o:cisco:wireless_lan_controller_software:4.2.99.0 + cpe:/o:cisco:wireless_lan_controller_software:4.2m + cpe:/o:cisco:wireless_lan_controller_software:4.0.155.0 + cpe:/o:cisco:wireless_lan_controller_software:4.2.182.0 + cpe:/o:cisco:wireless_lan_controller_software:4.0.219.0 + cpe:/o:cisco:wireless_lan_controller_software:7.2 + cpe:/o:cisco:wireless_lan_controller_software:6.0 + cpe:/o:cisco:wireless_lan_controller_software:7.3 + cpe:/o:cisco:wireless_lan_controller_software:6.0.188.0 + cpe:/o:cisco:wireless_lan_controller_software:4.0.179.11 + cpe:/o:cisco:wireless_lan_controller_software:7.0 + cpe:/o:cisco:wireless_lan_controller_software:7.1 + cpe:/o:cisco:wireless_lan_controller_software:7.2.110.0 + cpe:/h:cisco:wireless_lan_controller + cpe:/o:cisco:wireless_lan_controller_software:7.1.91.0 + cpe:/o:cisco:wireless_lan_controller_software:4.0.217.0 + cpe:/o:cisco:wireless_lan_controller_software:4.2 + cpe:/o:cisco:wireless_lan_controller_software:5.0 + cpe:/o:cisco:wireless_lan_controller_software:4.2.130.0 + cpe:/o:cisco:wireless_lan_controller_software:4.0.196 + cpe:/o:cisco:wireless_lan_controller_software:4.1m + cpe:/o:cisco:wireless_lan_controller_software:7.0.235.0 + cpe:/o:cisco:wireless_lan_controller_software:4.0 + cpe:/o:cisco:wireless_lan_controller_software:6.0.199.4 + cpe:/o:cisco:wireless_lan_controller_software:7.0.220.0 + cpe:/o:cisco:wireless_lan_controller_software:4.2.112.0 + cpe:/o:cisco:wireless_lan_controller_software:4.1 + cpe:/o:cisco:wireless_lan_controller_software:4.0.206.0 + cpe:/o:cisco:wireless_lan_controller_software:5.1 + cpe:/o:cisco:wireless_lan_controller_software:5.2 + cpe:/o:cisco:wireless_lan_controller_software:4.2.117.0 + cpe:/o:cisco:wireless_lan_controller_software:7.2.103.0 + cpe:/o:cisco:wireless_lan_controller_software:5.1.160.0 + cpe:/o:cisco:wireless_lan_controller_software:5.2.169.0 + cpe:/o:cisco:wireless_lan_controller_software:6.0.196.0 + + CVE-2014-0704 + 2014-03-06T06:55:05.367-05:00 + 2014-03-07T14:12:10.827-05:00 + + + 7.1 + NETWORK + MEDIUM + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-03-06T13:23:11.203-05:00 + + + + + CISCO + 20140305 Multiple Vulnerabilities in Cisco Wireless LAN Controllers + + The IGMP implementation on Cisco Wireless LAN Controller (WLC) devices 4.x, 5.x, 6.x, 7.0 before 7.0.250.0, 7.1, 7.2, and 7.3, when IGMPv3 Snooping is enabled, allows remote attackers to cause a denial of service (memory over-read and device restart) via a crafted field in an IGMPv3 message, aka Bug ID CSCuh33240. + + + + + + + + + + + + + + + + + + + + + cpe:/o:cisco:wireless_lan_controller_software:7.3.101.0 + cpe:/o:cisco:wireless_lan_controller_software:7.4.100.60 + cpe:/o:cisco:wireless_lan_controller_software:7.2.110.0 + cpe:/h:cisco:wireless_lan_controller + cpe:/o:cisco:wireless_lan_controller_software:7.2 + cpe:/o:cisco:wireless_lan_controller_software:7.4.100.0 + cpe:/o:cisco:wireless_lan_controller_software:7.3 + cpe:/o:cisco:wireless_lan_controller_software:7.2.103.0 + cpe:/o:cisco:wireless_lan_controller_software:7.5 + + CVE-2014-0705 + 2014-03-06T06:55:05.380-05:00 + 2014-03-07T14:08:17.977-05:00 + + + 7.1 + NETWORK + MEDIUM + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-03-06T13:37:58.303-05:00 + + + + + CISCO + 20140305 Multiple Vulnerabilities in Cisco Wireless LAN Controllers + + The multicast listener discovery (MLD) service on Cisco Wireless LAN Controller (WLC) devices 7.2, 7.3, 7.4 before 7.4.121.0, and 7.5, when MLDv2 Snooping is enabled, allows remote attackers to cause a denial of service (device restart) via a malformed IPv6 MLDv2 packet, aka Bug ID CSCuh74233. + + + + + + + + + + + + + + + + + + + + cpe:/o:cisco:wireless_lan_controller_software:7.3.101.0 + cpe:/o:cisco:wireless_lan_controller_software:7.4.100.60 + cpe:/o:cisco:wireless_lan_controller_software:7.2.110.0 + cpe:/h:cisco:wireless_lan_controller + cpe:/o:cisco:wireless_lan_controller_software:7.2 + cpe:/o:cisco:wireless_lan_controller_software:7.4.100.0 + cpe:/o:cisco:wireless_lan_controller_software:7.3 + cpe:/o:cisco:wireless_lan_controller_software:7.2.103.0 + + CVE-2014-0706 + 2014-03-06T06:55:05.413-05:00 + 2014-03-07T14:03:15.967-05:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-03-06T13:45:49.500-05:00 + + + + + CISCO + 20140305 Multiple Vulnerabilities in Cisco Wireless LAN Controllers + + Cisco Wireless LAN Controller (WLC) devices 7.2 before 7.2.115.2, 7.3, and 7.4 before 7.4.110.0 allow remote attackers to cause a denial of service (device restart) via a crafted 802.11 Ethernet frame, aka Bug ID CSCue87929. + + + + + + + + + + + + + + + + + + + + cpe:/o:cisco:wireless_lan_controller_software:7.3.101.0 + cpe:/o:cisco:wireless_lan_controller_software:7.4.100.60 + cpe:/o:cisco:wireless_lan_controller_software:7.2.110.0 + cpe:/h:cisco:wireless_lan_controller + cpe:/o:cisco:wireless_lan_controller_software:7.2 + cpe:/o:cisco:wireless_lan_controller_software:7.4.100.0 + cpe:/o:cisco:wireless_lan_controller_software:7.3 + cpe:/o:cisco:wireless_lan_controller_software:7.2.103.0 + + CVE-2014-0707 + 2014-03-06T06:55:05.427-05:00 + 2014-03-07T14:02:48.077-05:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-03-06T13:53:34.027-05:00 + + + + + CISCO + 20140305 Multiple Vulnerabilities in Cisco Wireless LAN Controllers + + Cisco Wireless LAN Controller (WLC) devices 7.2, 7.3, and 7.4 before 7.4.110.0 allow remote attackers to cause a denial of service (device restart) via a crafted 802.11 Ethernet frame, aka Bug ID CSCuf80681. + + + + + + + + + cpe:/a:cisco:webex_meeting_center + + CVE-2014-0708 + 2014-03-20T21:04:02.903-04:00 + 2014-03-24T18:48:13.077-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-03-21T10:00:19.893-04:00 + + + + + CISCO + 20140318 Cisco WebEx Business Suite HTTP GET Parameters Include Sensitive Information + + WebEx Meeting Center in Cisco WebEx Business Suite does not properly compose URLs for HTTP GET requests, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) a browser's history, aka Bug ID CSCul98272. + + + + + + + + + + + cpe:/a:cisco:ucs_director:4.0.0.1 + cpe:/a:cisco:ucs_director:4.0.0.0 + cpe:/a:cisco:ucs_director:4.0.0.2 + + CVE-2014-0709 + 2014-02-22T16:55:09.500-05:00 + 2014-03-05T23:50:34.657-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-24T10:24:04.240-05:00 + + + + + CISCO + 20140219 Cisco UCS Director Default Credentials Vulnerability + + Cisco UCS Director (formerly Cloupia) before 4.0.0.3 has a hardcoded password for the root account, which makes it easier for remote attackers to obtain administrative access via an SSH session to the CLI interface, aka Bug ID CSCui73930. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:firewall_services_module_software:3.2%2823%29 + cpe:/a:cisco:firewall_services_module_software:3.1%282%29 + cpe:/a:cisco:firewall_services_module_software:3.1%2813%29 + cpe:/a:cisco:firewall_services_module_software:4.0%281%29 + cpe:/a:cisco:firewall_services_module_software:3.2%288%29 + cpe:/a:cisco:firewall_services_module_software:4.1%2814%29 + cpe:/a:cisco:firewall_services_module_software:3.1%287%29 + cpe:/a:cisco:firewall_services_module_software:4.0%2810%29 + cpe:/a:cisco:firewall_services_module_software:4.1%2810%29 + cpe:/a:cisco:firewall_services_module_software:4.0%2812%29 + cpe:/a:cisco:firewall_services_module_software:3.2%2824%29 + cpe:/a:cisco:firewall_services_module_software:4.0%285%29 + cpe:/a:cisco:firewall_services_module_software:3.2%2810%29 + cpe:/a:cisco:firewall_services_module_software:3.1%2817%29 + cpe:/a:cisco:firewall_services_module_software:3.2%2819%29 + cpe:/a:cisco:firewall_services_module_software:3.2%2815%29 + cpe:/a:cisco:firewall_services_module_software:4.1%284%29 + cpe:/a:cisco:firewall_services_module_software:4.0%2815%29 + cpe:/a:cisco:firewall_services_module_software:4.1%289%29 + cpe:/a:cisco:firewall_services_module_software:3.2%2826%29 + cpe:/a:cisco:firewall_services_module_software:3.2%284%29 + cpe:/a:cisco:firewall_services_module_software:3.1%286%29 + cpe:/a:cisco:firewall_services_module_software:3.2%285%29 + cpe:/a:cisco:firewall_services_module_software:3.1%285%29 + cpe:/a:cisco:firewall_services_module_software:3.2%281%29 + cpe:/a:cisco:firewall_services_module_software:4.1%2813%29 + cpe:/a:cisco:firewall_services_module_software:4.1%285%29 + cpe:/a:cisco:firewall_services_module_software:3.2%2813%29 + cpe:/a:cisco:firewall_services_module_software:4.0%286%29 + cpe:/a:cisco:firewall_services_module_software:3.1%288%29 + cpe:/a:cisco:firewall_services_module_software:3.1%2814%29 + cpe:/a:cisco:firewall_services_module_software:3.2%2820%29 + cpe:/a:cisco:firewall_services_module_software:4.0%282%29 + cpe:/a:cisco:firewall_services_module_software:3.2%289%29 + cpe:/a:cisco:firewall_services_module_software:3.1%2810%29 + cpe:/a:cisco:firewall_services_module_software:4.1%281%29 + cpe:/a:cisco:firewall_services_module_software:3.1%2811%29 + cpe:/a:cisco:firewall_services_module_software:3.1%2818%29 + cpe:/a:cisco:firewall_services_module_software:3.2 + cpe:/a:cisco:firewall_services_module_software:4.1%288%29 + cpe:/a:cisco:firewall_services_module_software:3.1 + cpe:/a:cisco:firewall_services_module_software:3.2%2816%29 + cpe:/a:cisco:firewall_services_module_software:3.2%2825%29 + cpe:/a:cisco:firewall_services_module_software:4.1%286%29 + cpe:/a:cisco:firewall_services_module_software:3.1%289%29 + cpe:/a:cisco:firewall_services_module_software:3.2%2821%29 + cpe:/a:cisco:firewall_services_module_software:4.1%282%29 + cpe:/a:cisco:firewall_services_module_software:3.1%2820%29 + cpe:/a:cisco:firewall_services_module_software:4.0%287%29 + cpe:/a:cisco:firewall_services_module_software:3.2%286%29 + cpe:/a:cisco:firewall_services_module_software:3.1%2815%29 + cpe:/a:cisco:firewall_services_module_software:3.1%2819%29 + cpe:/a:cisco:firewall_services_module_software:4.0%283%29 + cpe:/a:cisco:firewall_services_module_software:4.0%2813%29 + cpe:/a:cisco:firewall_services_module_software:3.1%2821%29 + cpe:/a:cisco:firewall_services_module_software:3.2%2817%29 + cpe:/a:cisco:firewall_services_module_software:4.0 + cpe:/a:cisco:firewall_services_module_software:4.1 + cpe:/a:cisco:firewall_services_module_software:3.2%282%29 + cpe:/a:cisco:firewall_services_module_software:3.1%2812%29 + cpe:/a:cisco:firewall_services_module_software:3.1%284%29 + cpe:/a:cisco:firewall_services_module_software:4.1%2811%29 + cpe:/a:cisco:firewall_services_module_software:4.1%287%29 + cpe:/a:cisco:firewall_services_module_software:4.0%284%29 + cpe:/a:cisco:firewall_services_module_software:3.2%2812%29 + cpe:/a:cisco:firewall_services_module_software:4.0%288%29 + cpe:/a:cisco:firewall_services_module_software:3.2%2822%29 + cpe:/a:cisco:firewall_services_module_software:4.0%2811%29 + cpe:/a:cisco:firewall_services_module_software:3.2%283%29 + cpe:/a:cisco:firewall_services_module_software:3.1%2816%29 + cpe:/a:cisco:firewall_services_module_software:3.2%287%29 + cpe:/a:cisco:firewall_services_module_software:3.1%283%29 + cpe:/a:cisco:firewall_services_module_software:3.2%2818%29 + cpe:/a:cisco:firewall_services_module_software:3.2%2811%29 + cpe:/a:cisco:firewall_services_module_software:4.1%2812%29 + cpe:/a:cisco:firewall_services_module_software:4.1%283%29 + cpe:/a:cisco:firewall_services_module_software:4.0%2814%29 + cpe:/a:cisco:firewall_services_module_software:3.2%2827%29 + cpe:/a:cisco:firewall_services_module_software:3.2%2814%29 + + CVE-2014-0710 + 2014-02-22T16:55:09.530-05:00 + 2014-02-24T11:55:46.107-05:00 + + + 7.1 + NETWORK + MEDIUM + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-02-24T11:55:45.467-05:00 + + + + + CISCO + 20140219 Cisco Firewall Services Module Cut-Through Proxy Denial of Service Vulnerability + + Race condition in the cut-through proxy feature in Cisco Firewall Services Module (FWSM) Software 3.x before 3.2(28) and 4.x before 4.1(15) allows remote attackers to cause a denial of service (device reload) via certain matching traffic, aka Bug ID CSCuj16824. + + + + + + + + + + + + + + + + cpe:/a:cisco:ips_sensor_software:7.1%282%29e4 + cpe:/a:cisco:ips_sensor_software:7.1%286%29e4 + cpe:/a:cisco:ips_sensor_software:7.2%281%29e4 + cpe:/a:cisco:ips_sensor_software:7.1%288%29e4 + cpe:/a:cisco:ips_sensor_software:7.1%284%29e4 + cpe:/a:cisco:ips_sensor_software:7.1%283%29e4 + cpe:/a:cisco:ips_sensor_software:7.1%281%29e4 + cpe:/a:cisco:ips_sensor_software:7.1%287%29e4 + + CVE-2014-0718 + 2014-02-22T16:55:09.547-05:00 + 2014-03-05T23:50:34.830-05:00 + + + 7.1 + NETWORK + MEDIUM + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-02-24T12:08:09.157-05:00 + + + + + CISCO + 20140219 Multiple Vulnerabilities in Cisco IPS Software + + The produce-verbose-alert feature in Cisco IPS Software 7.1 before 7.1(8)E4 and 7.2 before 7.2(2)E4 allows remote attackers to cause a denial of service (Analysis Engine process outage) via fragmented packets, aka Bug ID CSCui91266. + + + + + + + + + + + + + + + + cpe:/a:cisco:ips_sensor_software:7.1%282%29e4 + cpe:/a:cisco:ips_sensor_software:7.1%286%29e4 + cpe:/a:cisco:ips_sensor_software:7.2%281%29e4 + cpe:/a:cisco:ips_sensor_software:7.1%288%29e4 + cpe:/a:cisco:ips_sensor_software:7.1%284%29e4 + cpe:/a:cisco:ips_sensor_software:7.1%283%29e4 + cpe:/a:cisco:ips_sensor_software:7.1%281%29e4 + cpe:/a:cisco:ips_sensor_software:7.1%287%29e4 + + CVE-2014-0719 + 2014-02-22T16:55:09.577-05:00 + 2014-03-05T23:50:34.907-05:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-02-24T12:35:44.527-05:00 + + + + + CISCO + 20140219 Multiple Vulnerabilities in Cisco IPS Software + + The control-plane access-list implementation in Cisco IPS Software before 7.1(8p2)E4 and 7.2 before 7.2(2)E4 allows remote attackers to cause a denial of service (MainApp process outage) via crafted packets to TCP port 7000, aka Bug ID CSCui67394. + + + + + + + + + + + + + + + + cpe:/a:cisco:ips_sensor_software:7.1%282%29e4 + cpe:/a:cisco:ips_sensor_software:7.1%286%29e4 + cpe:/a:cisco:ips_sensor_software:7.2%281%29e4 + cpe:/a:cisco:ips_sensor_software:7.1%288%29e4 + cpe:/a:cisco:ips_sensor_software:7.1%284%29e4 + cpe:/a:cisco:ips_sensor_software:7.1%283%29e4 + cpe:/a:cisco:ips_sensor_software:7.1%281%29e4 + cpe:/a:cisco:ips_sensor_software:7.1%287%29e4 + + CVE-2014-0720 + 2014-02-22T16:55:09.593-05:00 + 2014-03-05T23:50:34.987-05:00 + + + 7.1 + NETWORK + MEDIUM + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-02-24T12:39:40.567-05:00 + + + + + CISCO + 20140219 Multiple Vulnerabilities in Cisco IPS Software + + Cisco IPS Software 7.1 before 7.1(8)E4 and 7.2 before 7.2(2)E4 allows remote attackers to cause a denial of service (Analysis Engine process outage) via a flood of jumbo frames, aka Bug ID CSCuh94944. + + + + + + + + + cpe:/h:cisco:unified_sip_phone_3905:- + + CVE-2014-0721 + 2014-02-22T16:55:09.627-05:00 + 2014-03-05T23:50:35.080-05:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-24T12:41:30.927-05:00 + + + + + CISCO + 20140219 Unauthorized Access Vulnerability in Cisco Unified SIP Phone 3905 + + The Cisco Unified SIP Phone 3905 with firmware before 9.4(1) allows remote attackers to obtain root access via a session on the test interface on TCP port 7870, aka Bug ID CSCuh75574. + + + + + + + + + cpe:/a:cisco:unified_communications_manager + + CVE-2014-0722 + 2014-02-13T00:24:51.450-05:00 + 2014-02-13T09:08:56.980-05:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-02-13T09:08:56.933-05:00 + + + + + CISCO + 20140211 Cisco Unified Communications Manager Unauthenticated log4jinit Access Vulnerability + + The log4jinit web application in Cisco Unified Communications Manager (UCM) does not properly validate authentication, which allows remote attackers to cause a denial of service (performance degradation) via unspecified use of this application, aka Bug ID CSCum05347. + + + + + + + + + cpe:/a:cisco:unified_communications_manager + + CVE-2014-0723 + 2014-02-13T00:24:51.497-05:00 + 2014-02-13T09:09:56.623-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-13T09:09:47.373-05:00 + + + + + CISCO + 20140211 Cisco Unified Communications Manager IPMA Cross-Site Scripting Vulnerability + + Cross-site scripting (XSS) vulnerability in the IP Manager Assistant (IPMA) interface in Cisco Unified Communications Manager (UCM) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCum05343. + + + + + + + + + + cpe:/a:cisco:unified_communications_manager:10.0 + cpe:/a:cisco:unified_communications_manager:10.0%281%29 + + CVE-2014-0724 + 2014-02-13T00:24:51.527-05:00 + 2014-02-13T12:13:31.060-05:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-02-13T12:13:27.670-05:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32825 + + + CISCO + 20140211 Cisco Unified Communications Manager Arbitrary File Read Vulnerability + + The bulk administration interface in Cisco Unified Communications Manager (UCM) 10.0(1) and earlier allows remote attackers to bypass authentication and read arbitrary files by using an unspecified prompt, aka Bug ID CSCum05340. + + + + + + + + + cpe:/a:cisco:unified_communications_manager + + CVE-2014-0725 + 2014-02-13T00:24:51.557-05:00 + 2014-02-13T09:11:25.343-05:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-02-13T09:11:25.313-05:00 + + + + + CISCO + 20140212 Cisco Unified Communications Manager WAR File Availability Vulnerability + + Cisco Unified Communications Manager (UCM) does not require authentication for reading WAR files, which allows remote attackers to obtain sensitive information via unspecified access to a "file storage location," aka Bug ID CSCum05337. + + + + + + + + + + cpe:/a:cisco:unified_communications_manager:10.0 + cpe:/a:cisco:unified_communications_manager:10.0%281%29 + + CVE-2014-0726 + 2014-02-13T00:24:51.573-05:00 + 2014-02-13T12:16:13.597-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-13T12:16:13.473-05:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32843 + + + CISCO + 20140212 Cisco Unified Communications Manager IPMA Blind SQL Injection Vulnerability + + SQL injection vulnerability in the IP Manager Assistant (IPMA) interface in Cisco Unified Communications Manager (UCM) 10.0(1) and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05326. + + + + + + + + + cpe:/a:cisco:unified_communications_manager + + CVE-2014-0727 + 2014-02-13T00:24:51.607-05:00 + 2014-02-13T09:13:20.003-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-13T09:13:19.677-05:00 + + + + + CISCO + 20140212 Cisco Unified Communications Manager CMIVR Blind SQL Injection Vulnerability + + SQL injection vulnerability in the CallManager Interactive Voice Response (CMIVR) interface in Cisco Unified Communications Manager (UCM) allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05318. + + + + + + + + + + cpe:/a:cisco:unified_communications_manager:10.0 + cpe:/a:cisco:unified_communications_manager:10.0%281%29 + + CVE-2014-0728 + 2014-02-13T00:24:51.637-05:00 + 2014-02-13T12:16:50.037-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-13T12:16:49.990-05:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32834 + + + CISCO + 20140211 Cisco Unified Communications Manager Java Interface SQL Injection Vulnerability + + SQL injection vulnerability in the Java database interface in Cisco Unified Communications Manager (UCM) 10.0(1) and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05313. + + + + + + + + + cpe:/a:cisco:unified_communications_manager + + CVE-2014-0729 + 2014-02-13T00:24:51.667-05:00 + 2014-02-13T09:14:39.197-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-13T09:14:39.163-05:00 + + + + + CISCO + 20140211 Cisco Unified Communications Manager Enterprise Mobility Application Blind SQL Injection Vulnerability + + SQL injection vulnerability in the Enterprise Mobility Application (EMApp) interface in Cisco Unified Communications Manager (UCM) allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05302. + + + + + + + + + + cpe:/a:cisco:unified_computing_system_central_software:1.1 + cpe:/a:cisco:unified_computing_system_central_software:1.0 + + CVE-2014-0730 + 2014-02-22T16:55:09.640-05:00 + 2014-02-24T12:53:40.070-05:00 + + + 6.8 + LOCAL + LOW + SINGLE_INSTANCE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-24T12:53:39.913-05:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32910 + + + CISCO + 20140218 Cisco Unified Computing System Central Software Privilege Escalation Vulnerability + + Cisco Unified Computing System (UCS) Central Software 1.1 and earlier allows local users to gain privileges via a CLI copy command in a local-mgmt context, aka Bug ID CSCul53128. + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:unified_communications_manager:4.2.3sr2b + cpe:/a:cisco:unified_communications_manager:4.2 + cpe:/a:cisco:unified_communications_manager:4.3 + cpe:/a:cisco:unified_communications_manager:10.0 + cpe:/a:cisco:unified_communications_manager:3.3%285%29sr1 + cpe:/a:cisco:unified_communications_manager:4.1%283%29 + cpe:/a:cisco:unified_communications_manager:3.3%285%29sr2a + cpe:/a:cisco:unified_communications_manager:4.2.3sr2 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr4 + cpe:/a:cisco:unified_communications_manager:4.2.1 + cpe:/a:cisco:unified_communications_manager:4.2.3sr1 + cpe:/a:cisco:unified_communications_manager:4.2.3 + cpe:/a:cisco:unified_communications_manager:4.2.2 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr1 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr2 + cpe:/a:cisco:unified_communications_manager:3.3%285%29 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr3 + cpe:/a:cisco:unified_communications_manager:10.0%281%29 + + CVE-2014-0731 + 2014-02-22T16:55:09.670-05:00 + 2014-03-05T23:50:35.877-05:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-02-24T13:08:09.763-05:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32915 + + + CISCO + 20140218 Cisco Unified Communications Manager Java Class File Availability Vulnerability + + The administration interface in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to bypass authentication and read Java class files via a direct request, aka Bug ID CSCum46497. + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:unified_communications_manager:4.2.3sr2b + cpe:/a:cisco:unified_communications_manager:4.2 + cpe:/a:cisco:unified_communications_manager:4.3 + cpe:/a:cisco:unified_communications_manager:10.0 + cpe:/a:cisco:unified_communications_manager:3.3%285%29sr1 + cpe:/a:cisco:unified_communications_manager:4.1%283%29 + cpe:/a:cisco:unified_communications_manager:3.3%285%29sr2a + cpe:/a:cisco:unified_communications_manager:4.2.3sr2 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr4 + cpe:/a:cisco:unified_communications_manager:4.2.1 + cpe:/a:cisco:unified_communications_manager:4.2.3sr1 + cpe:/a:cisco:unified_communications_manager:4.2.3 + cpe:/a:cisco:unified_communications_manager:4.2.2 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr1 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr2 + cpe:/a:cisco:unified_communications_manager:3.3%285%29 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr3 + cpe:/a:cisco:unified_communications_manager:10.0%281%29 + + CVE-2014-0732 + 2014-02-20T00:18:04.140-05:00 + 2014-02-20T19:26:40.500-05:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-02-20T05:50:11.000-05:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32913 + + + CISCO + 20140218 Cisco Unified Communications Manager Real Time Monitoring Tool Information Disclosure Vulnerability + + The Real Time Monitoring Tool (RTMT) web application in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier does not properly enforce authentication requirements, which allows remote attackers to read application files via a direct request to a URL, aka Bug ID CSCum46495. + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:unified_communications_manager:4.2.3sr2b + cpe:/a:cisco:unified_communications_manager:4.2 + cpe:/a:cisco:unified_communications_manager:4.3 + cpe:/a:cisco:unified_communications_manager:10.0 + cpe:/a:cisco:unified_communications_manager:3.3%285%29sr1 + cpe:/a:cisco:unified_communications_manager:4.1%283%29 + cpe:/a:cisco:unified_communications_manager:3.3%285%29sr2a + cpe:/a:cisco:unified_communications_manager:4.2.3sr2 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr4 + cpe:/a:cisco:unified_communications_manager:4.2.1 + cpe:/a:cisco:unified_communications_manager:4.2.3sr1 + cpe:/a:cisco:unified_communications_manager:4.2.3 + cpe:/a:cisco:unified_communications_manager:4.2.2 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr1 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr2 + cpe:/a:cisco:unified_communications_manager:3.3%285%29 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr3 + cpe:/a:cisco:unified_communications_manager:10.0%281%29 + + CVE-2014-0733 + 2014-02-20T10:27:09.437-05:00 + 2014-02-20T18:52:25.500-05:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-02-20T13:51:25.780-05:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32914 + + + CISCO + 20140218 Cisco Unified Communications Manager Enterprise License Manager Information Disclosure Vulnerability + + The Enterprise License Manager (ELM) component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier does not properly enforce authentication requirements, which allows remote attackers to read ELM files via a direct request to a URL, aka Bug ID CSCum46494. + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:unified_communications_manager:4.2.3sr2b + cpe:/a:cisco:unified_communications_manager:4.2 + cpe:/a:cisco:unified_communications_manager:4.3 + cpe:/a:cisco:unified_communications_manager:10.0 + cpe:/a:cisco:unified_communications_manager:3.3%285%29sr1 + cpe:/a:cisco:unified_communications_manager:4.1%283%29 + cpe:/a:cisco:unified_communications_manager:3.3%285%29sr2a + cpe:/a:cisco:unified_communications_manager:4.2.3sr2 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr4 + cpe:/a:cisco:unified_communications_manager:4.2.1 + cpe:/a:cisco:unified_communications_manager:4.2.3sr1 + cpe:/a:cisco:unified_communications_manager:4.2.3 + cpe:/a:cisco:unified_communications_manager:4.2.2 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr1 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr2 + cpe:/a:cisco:unified_communications_manager:3.3%285%29 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr3 + cpe:/a:cisco:unified_communications_manager:10.0%281%29 + + CVE-2014-0734 + 2014-02-20T00:18:04.203-05:00 + 2014-02-20T19:25:07.140-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-20T05:52:49.000-05:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32916 + + + CISCO + 20140218 Cisco Unified Communications Manager CAPF Unauthenticated Blind SQL Injection Vulnerability + + SQL injection vulnerability in the Certificate Authority Proxy Function (CAPF) implementation in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum46483. + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:unified_communications_manager:4.2.3sr2b + cpe:/a:cisco:unified_communications_manager:4.2 + cpe:/a:cisco:unified_communications_manager:4.3 + cpe:/a:cisco:unified_communications_manager:10.0 + cpe:/a:cisco:unified_communications_manager:3.3%285%29sr1 + cpe:/a:cisco:unified_communications_manager:4.1%283%29 + cpe:/a:cisco:unified_communications_manager:3.3%285%29sr2a + cpe:/a:cisco:unified_communications_manager:4.2.3sr2 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr4 + cpe:/a:cisco:unified_communications_manager:4.2.1 + cpe:/a:cisco:unified_communications_manager:4.2.3sr1 + cpe:/a:cisco:unified_communications_manager:4.2.3 + cpe:/a:cisco:unified_communications_manager:4.2.2 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr1 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr2 + cpe:/a:cisco:unified_communications_manager:3.3%285%29 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr3 + cpe:/a:cisco:unified_communications_manager:10.0%281%29 + + CVE-2014-0735 + 2014-02-20T00:18:04.233-05:00 + 2014-02-20T19:22:06.967-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-20T10:54:07.110-05:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32912 + + + CISCO + 20140218 Cisco Unified Communications Manager IPMA Reflected Cross-Site Scripting Vulnerability + + Cross-site scripting (XSS) vulnerability in the IP Manager Assistant (IPMA) interface in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCum46470. + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:unified_communications_manager:4.2.3sr2b + cpe:/a:cisco:unified_communications_manager:4.2 + cpe:/a:cisco:unified_communications_manager:4.3 + cpe:/a:cisco:unified_communications_manager:10.0 + cpe:/a:cisco:unified_communications_manager:3.3%285%29sr1 + cpe:/a:cisco:unified_communications_manager:4.1%283%29 + cpe:/a:cisco:unified_communications_manager:3.3%285%29sr2a + cpe:/a:cisco:unified_communications_manager:4.2.3sr2 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr4 + cpe:/a:cisco:unified_communications_manager:4.2.1 + cpe:/a:cisco:unified_communications_manager:4.2.3sr1 + cpe:/a:cisco:unified_communications_manager:4.2.3 + cpe:/a:cisco:unified_communications_manager:4.2.2 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr1 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr2 + cpe:/a:cisco:unified_communications_manager:3.3%285%29 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr3 + cpe:/a:cisco:unified_communications_manager:10.0%281%29 + + CVE-2014-0736 + 2014-02-20T00:18:04.267-05:00 + 2014-02-20T19:13:56.517-05:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-20T11:07:18.670-05:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32911 + + + CISCO + 20140218 Cisco Unified Communications Manager CAR Page CSRF Vulnerability + + Cross-site request forgery (CSRF) vulnerability in the Call Detail Records Analysis and Reporting (CAR) page in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make CAR modifications, aka Bug ID CSCum46468. + + + + + + + + + cpe:/h:cisco:unified_ip_phone_7960g + + CVE-2014-0737 + 2014-02-22T16:55:09.703-05:00 + 2014-03-05T23:50:36.423-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-24T12:59:28.923-05:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32957 + + + CISCO + 20140220 Cisco Third-Generation IP Phone CTL Trust Chain Enforcement Vulnerability + + The Cisco Unified IP Phone 7960G 9.2(1) and earlier allows remote attackers to bypass authentication and change trust relationships by injecting a Certificate Trust List (CTL) file, aka Bug ID CSCuj66795. + + + + + + + + + cpe:/a:cisco:adaptive_security_appliance_software:- + + CVE-2014-0738 + 2014-02-22T16:55:09.717-05:00 + 2014-03-05T23:50:36.503-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-24T13:01:32.017-05:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32956 + + + CISCO + 20140220 Cisco Adaptive Security Appliance Phone Proxy CTL Authentication Vulnerability + + The Phone Proxy component in Cisco Adaptive Security Appliance (ASA) Software 9.1(.3) and earlier allows remote attackers to bypass authentication and change trust relationships by injecting a Certificate Trust List (CTL) file, aka Bug ID CSCuj66770. + + + + + + + + + cpe:/a:cisco:adaptive_security_appliance_software:- + + CVE-2014-0739 + 2014-02-22T16:55:09.750-05:00 + 2014-03-05T23:50:36.580-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-24T13:03:40.177-05:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=32955 + + + CISCO + 20140220 Cisco Adaptive Security Appliance Phone Proxy sec_db Race Condition Vulnerability + + Race condition in the Phone Proxy component in Cisco Adaptive Security Appliance (ASA) Software 9.1(.3) and earlier allows remote attackers to bypass sec_db authentication and provide certain pass-through services to untrusted devices via a crafted configuration-file TFTP request, aka Bug ID CSCuj66766. + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:unified_communications_manager:4.2.3sr2b + cpe:/a:cisco:unified_communications_manager:4.2 + cpe:/a:cisco:unified_communications_manager:4.3 + cpe:/a:cisco:unified_communications_manager:10.0 + cpe:/a:cisco:unified_communications_manager:3.3%285%29sr1 + cpe:/a:cisco:unified_communications_manager:4.1%283%29 + cpe:/a:cisco:unified_communications_manager:3.3%285%29sr2a + cpe:/a:cisco:unified_communications_manager:4.2.3sr2 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr4 + cpe:/a:cisco:unified_communications_manager:4.2.1 + cpe:/a:cisco:unified_communications_manager:4.2.3sr1 + cpe:/a:cisco:unified_communications_manager:4.2.3 + cpe:/a:cisco:unified_communications_manager:4.2.2 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr1 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr2 + cpe:/a:cisco:unified_communications_manager:3.3%285%29 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr3 + cpe:/a:cisco:unified_communications_manager:10.0%281%29 + + CVE-2014-0740 + 2014-02-26T20:55:03.290-05:00 + 2014-03-10T15:15:17.973-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-27T06:19:07.000-05:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=33049 + + + CISCO + 20140225 Cisco Unified Communications Manager OS Administration CSRF Vulnerability + + Cross-site request forgery (CSRF) vulnerability in the Call Detail Records Analysis and Reporting (CAR) interface in the OS Administration component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to hijack the authentication of administrators for requests that make administrative changes, aka Bug ID CSCun00701. + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:unified_communications_manager:4.2.3sr2b + cpe:/a:cisco:unified_communications_manager:4.2 + cpe:/a:cisco:unified_communications_manager:4.3 + cpe:/a:cisco:unified_communications_manager:10.0 + cpe:/a:cisco:unified_communications_manager:3.3%285%29sr1 + cpe:/a:cisco:unified_communications_manager:4.1%283%29 + cpe:/a:cisco:unified_communications_manager:3.3%285%29sr2a + cpe:/a:cisco:unified_communications_manager:4.2.3sr2 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr4 + cpe:/a:cisco:unified_communications_manager:4.2.1 + cpe:/a:cisco:unified_communications_manager:4.2.3sr1 + cpe:/a:cisco:unified_communications_manager:4.2.3 + cpe:/a:cisco:unified_communications_manager:4.2.2 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr1 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr2 + cpe:/a:cisco:unified_communications_manager:3.3%285%29 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr3 + cpe:/a:cisco:unified_communications_manager:10.0%281%29 + + CVE-2014-0741 + 2014-02-26T20:55:03.320-05:00 + 2014-03-10T15:14:22.027-04:00 + + + 6.2 + LOCAL + LOW + SINGLE_INSTANCE + COMPLETE + COMPLETE + NONE + http://nvd.nist.gov + 2014-02-27T11:20:33.913-05:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=33046 + + + CISCO + 20140225 Cisco Unified Communications Manager CAPF Certificate Import Arbitrary File Read/Write Vulnerability + + The certificate-import feature in the Certificate Authority Proxy Function (CAPF) CLI implementation in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows local users to read or modify arbitrary files via a crafted command, aka Bug ID CSCum95461. + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:unified_communications_manager:4.2.3sr2b + cpe:/a:cisco:unified_communications_manager:4.2 + cpe:/a:cisco:unified_communications_manager:4.3 + cpe:/a:cisco:unified_communications_manager:10.0 + cpe:/a:cisco:unified_communications_manager:3.3%285%29sr1 + cpe:/a:cisco:unified_communications_manager:4.1%283%29 + cpe:/a:cisco:unified_communications_manager:3.3%285%29sr2a + cpe:/a:cisco:unified_communications_manager:4.2.3sr2 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr4 + cpe:/a:cisco:unified_communications_manager:4.2.1 + cpe:/a:cisco:unified_communications_manager:4.2.3sr1 + cpe:/a:cisco:unified_communications_manager:4.2.3 + cpe:/a:cisco:unified_communications_manager:4.2.2 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr1 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr2 + cpe:/a:cisco:unified_communications_manager:3.3%285%29 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr3 + cpe:/a:cisco:unified_communications_manager:10.0%281%29 + + CVE-2014-0742 + 2014-02-26T20:55:03.350-05:00 + 2014-03-07T15:44:43.350-05:00 + + + 6.2 + LOCAL + LOW + SINGLE_INSTANCE + COMPLETE + COMPLETE + NONE + http://nvd.nist.gov + 2014-02-27T11:21:23.037-05:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=33045 + + + CISCO + 20140225 Cisco Unified Communications Manager CAPF CSR Arbitrary File Read/Write Vulnerability + + The Certificate Authority Proxy Function (CAPF) CLI implementation in the CSR management feature in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows local users to read or modify arbitrary files via unspecified vectors, aka Bug ID CSCum95464. + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:unified_communications_manager:4.2.3sr2b + cpe:/a:cisco:unified_communications_manager:4.2 + cpe:/a:cisco:unified_communications_manager:4.3 + cpe:/a:cisco:unified_communications_manager:10.0 + cpe:/a:cisco:unified_communications_manager:3.3%285%29sr1 + cpe:/a:cisco:unified_communications_manager:4.1%283%29 + cpe:/a:cisco:unified_communications_manager:3.3%285%29sr2a + cpe:/a:cisco:unified_communications_manager:4.2.3sr2 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr4 + cpe:/a:cisco:unified_communications_manager:4.2.1 + cpe:/a:cisco:unified_communications_manager:4.2.3sr1 + cpe:/a:cisco:unified_communications_manager:4.2.3 + cpe:/a:cisco:unified_communications_manager:4.2.2 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr1 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr2 + cpe:/a:cisco:unified_communications_manager:3.3%285%29 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr3 + cpe:/a:cisco:unified_communications_manager:10.0%281%29 + + CVE-2014-0743 + 2014-02-26T20:55:03.367-05:00 + 2014-03-10T15:12:02.823-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-27T11:23:49.917-05:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=33044 + + + CISCO + 20140225 Cisco Unified Communications Manager CAPF Unauthenticated Device Information Update Vulnerability + + The Certificate Authority Proxy Function (CAPF) component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to bypass authentication and modify registered-device information via crafted data, aka Bug ID CSCum95468. + + + + + + + + + cpe:/a:cisco:unified_contact_center_express_editor_software:- + + CVE-2014-0745 + 2014-02-26T20:55:03.397-05:00 + 2014-03-10T17:49:21.407-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-27T06:25:31.000-05:00 + + + + + CISCO + 20140225 Cisco Unified Contact Center Express Serviceability Page CSRF Vulnerability + + Cross-site request forgery (CSRF) vulnerability in the Unified Serviceability subsystem in Cisco Unified Contact Center Express (Unified CCX) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCum95502. + + + + + + + + + cpe:/a:cisco:unified_contact_center_express_editor_software:- + + CVE-2014-0746 + 2014-02-26T20:55:03.430-05:00 + 2014-03-10T17:49:02.983-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-02-27T06:49:09.000-05:00 + + + + + CISCO + 20140225 Cisco Unified Contact Center Express DRS Sensitive Information Disclosure Vulnerability + + The disaster recovery system (DRS) in Cisco Unified Contact Center Express (Unified CCX) allows remote authenticated users to obtain sensitive information by reading extraneous fields in an HTML document, aka Bug ID CSCum95536. + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:unified_communications_manager:4.2.3sr2b + cpe:/a:cisco:unified_communications_manager:4.2 + cpe:/a:cisco:unified_communications_manager:4.3 + cpe:/a:cisco:unified_communications_manager:10.0 + cpe:/a:cisco:unified_communications_manager:3.3%285%29sr1 + cpe:/a:cisco:unified_communications_manager:4.1%283%29 + cpe:/a:cisco:unified_communications_manager:3.3%285%29sr2a + cpe:/a:cisco:unified_communications_manager:4.2.3sr2 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr4 + cpe:/a:cisco:unified_communications_manager:4.2.1 + cpe:/a:cisco:unified_communications_manager:4.2.3sr1 + cpe:/a:cisco:unified_communications_manager:4.2.3 + cpe:/a:cisco:unified_communications_manager:4.2.2 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr1 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr2 + cpe:/a:cisco:unified_communications_manager:3.3%285%29 + cpe:/a:cisco:unified_communications_manager:4.1%283%29sr3 + cpe:/a:cisco:unified_communications_manager:10.0%281%29 + + CVE-2014-0747 + 2014-02-26T20:55:03.447-05:00 + 2014-03-10T15:12:50.057-04:00 + + + 6.8 + LOCAL + LOW + SINGLE_INSTANCE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-27T11:22:41.820-05:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=33048 + + + CISCO + 20140225 Cisco Unified Communications Manager CAPF CLI Command Injection Vulnerability + + The Certificate Authority Proxy Function (CAPF) CLI implementation in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows local users to inject commands via unspecified CAPF programs, aka Bug ID CSCum95493. + + + + + + + + + + + + + + + cpe:/a:ge:intelligent_platforms_proficy_hmi%2fscada_cimplicity:8.2 + cpe:/a:ge:intelligent_platforms_proficy_hmi%2fscada_cimplicity:8.1 + cpe:/a:ge:intelligent_platforms_proficy_hmi%2fscada_cimplicity:8.0 + cpe:/a:ge:intelligent_platforms_proficy_process_systems_with_cimplicity:- + cpe:/a:ge:intelligent_platforms_proficy_hmi%2fscada_cimplicity:4.01 + cpe:/a:ge:intelligent_platforms_proficy_hmi%252fscada_cimplicity:8.2:sim24 + cpe:/a:ge:intelligent_platforms_proficy_hmi%2fscada_cimplicity:7.5 + + CVE-2014-0750 + 2014-01-25T17:55:04.550-05:00 + 2014-02-21T00:06:26.797-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-27T10:23:10.100-05:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-023-01 + + + BID + 65124 + + + CONFIRM + http://support.ge-ip.com/support/index?page=kbchannel&id=KB15939 + + Directory traversal vulnerability in gefebt.exe in the WebView CimWeb components in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY through 8.2 SIM 24, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary code via a crafted HTTP request, aka ZDI-CAN-1622. + + + + + + + + + + + + + + + cpe:/a:ge:intelligent_platforms_proficy_hmi%2fscada_cimplicity:8.2 + cpe:/a:ge:intelligent_platforms_proficy_hmi%2fscada_cimplicity:8.1 + cpe:/a:ge:intelligent_platforms_proficy_hmi%2fscada_cimplicity:8.0 + cpe:/a:ge:intelligent_platforms_proficy_process_systems_with_cimplicity:- + cpe:/a:ge:intelligent_platforms_proficy_hmi%2fscada_cimplicity:4.01 + cpe:/a:ge:intelligent_platforms_proficy_hmi%252fscada_cimplicity:8.2:sim24 + cpe:/a:ge:intelligent_platforms_proficy_hmi%2fscada_cimplicity:7.5 + + CVE-2014-0751 + 2014-01-25T17:55:04.583-05:00 + 2014-02-21T00:06:26.877-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-27T10:27:15.557-05:00 + + + + + BID + 65117 + + + CONFIRM + http://support.ge-ip.com/support/index?page=kbchannel&id=KB15940 + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-023-01 + + Directory traversal vulnerability in CimWebServer.exe (aka the WebView component) in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY before 8.2 SIM 24, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary code via a crafted message to TCP port 10212, aka ZDI-CAN-1623. + + + + + + + + + + + + + + + + + + cpe:/a:ecava:integraxor:4.1 + cpe:/a:ecava:integraxor:3.71.4200 + cpe:/a:ecava:integraxor:3.6.4000.0 + cpe:/a:ecava:integraxor:3.5.3900.5 + cpe:/a:ecava:integraxor:3.60.4061 + cpe:/a:ecava:integraxor:4.1.4360 + cpe:/a:ecava:integraxor:3.71 + cpe:/a:ecava:integraxor:3.72 + cpe:/a:ecava:integraxor:4.00 + cpe:/a:ecava:integraxor:3.5.3900.10 + + CVE-2014-0752 + 2014-01-09T13:07:26.597-05:00 + 2014-01-10T09:56:26.270-05:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-10T09:56:26.160-05:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-008-01 + + + CONFIRM + http://www.integraxor.com/blog/category/security/vulnerability-note/ + + The SCADA server in Ecava IntegraXor before 4.1.4369 allows remote attackers to read arbitrary project backup files via a crafted URL. + + + + + + + + + + + + + + + + + + + + cpe:/a:ecava:integraxor:4.1 + cpe:/a:ecava:integraxor:4.1.4369 + cpe:/a:ecava:integraxor:3.71.4200 + cpe:/a:ecava:integraxor:3.6.4000.0 + cpe:/a:ecava:integraxor:3.60.4061 + cpe:/a:ecava:integraxor:3.5.3900.5 + cpe:/a:ecava:integraxor:4.1.4360 + cpe:/a:ecava:integraxor:3.71 + cpe:/a:ecava:integraxor:3.72 + cpe:/a:ecava:integraxor:4.00 + cpe:/a:ecava:integraxor:3.5.3900.10 + cpe:/a:ecava:integraxor:4.1.4380 + + CVE-2014-0753 + 2014-01-20T20:55:03.620-05:00 + 2014-01-22T11:45:57.620-05:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-01-22T11:45:57.543-05:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-016-01 + + + CONFIRM + http://www.integraxor.com/blog/buffer-overflow-vulnerability-note/ + + Stack-based buffer overflow in the SCADA server in Ecava IntegraXor before 4.1.4390 allows remote attackers to cause a denial of service (system crash) by triggering access to DLL code located in the IntegraXor directory. + + + + + + + + + + + + + + + + + cpe:/a:rockwellautomation:rslogix_5000_design_and_configuration_software:7.0 + cpe:/a:rockwellautomation:rslogix_5000_design_and_configuration_software:21.0 + cpe:/a:rockwellautomation:rslogix_5000_design_and_configuration_software:18.0 + cpe:/a:rockwellautomation:rslogix_5000_design_and_configuration_software:20.01 + + CVE-2014-0755 + 2014-02-05T00:15:29.930-05:00 + 2014-02-21T00:06:27.110-05:00 + + + 6.9 + LOCAL + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-05T12:37:20.797-05:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-021-01 + + + XF + rslogix-cve20140755-info-disc(90981) + + + BID + 65337 + + + OSVDB + 102858 + + Rockwell Automation RSLogix 5000 7 through 20.01, and 21.0, does not properly implement password protection for .ACD files (aka project files), which allows local users to obtain sensitive information or modify data via unspecified vectors. + + + + + + + + + cpe:/a:3s-software:codesys_runtime_toolkit:2.4.7.43 + + CVE-2014-0757 + 2014-01-31T01:15:53.073-05:00 + 2014-02-21T00:06:27.203-05:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-01-31T13:54:09.890-05:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-030-01 + + + SECUNIA + 56713 + + Smart Software Solutions (3S) CoDeSys Runtime Toolkit before 2.4.7.44 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors. + + + + + + + + + + + + cpe:/a:iconics:genesis32:8.0 + cpe:/a:iconics:genesis32:8.05 + cpe:/a:iconics:genesis32:8.04 + cpe:/a:iconics:genesis32:8.02 + + CVE-2014-0758 + 2014-02-23T23:48:10.193-05:00 + 2014-02-24T14:45:33.177-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-24T14:45:31.190-05:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-051-01 + + An ActiveX control in GenLaunch.htm in ICONICS GENESIS32 8.0, 8.02, 8.04, and 8.05 allows remote attackers to execute arbitrary programs via a crafted HTML document. + + + + + + + + + + cpe:/a:schneider-electric:floating_license_manager:1.4.0 + cpe:/a:schneider-electric:floating_license_manager:1.0.0 + + CVE-2014-0759 + 2014-02-28T01:18:54.260-05:00 + 2014-02-28T12:16:12.043-05:00 + + + 6.9 + LOCAL + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-28T12:16:11.967-05:00 + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-058-01 + + + CONFIRM + http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-015-01 + + Unquoted Windows search path vulnerability in Schneider Electric Floating License Manager 1.0.0 through 1.4.0 allows local users to gain privileges via a Trojan horse application with a name composed of an initial substring of a path that contains a space character. + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:softmotion3d:softmotion:- + cpe:/h:festo:cecx-x-c1_modular_master_controller:- + cpe:/a:3s-software:codesys_runtime_system:- + cpe:/h:festo:cecx-x-m1_modular_controller:- + + CVE-2014-0760 + 2014-04-25T01:12:07.693-04:00 + 2014-04-25T09:56:18.937-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-25T09:56:18.873-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01 + + The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion provide an undocumented access method involving the FTP protocol, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors. + + + + + + + + + + + + cpe:/a:advantech:advantech_webaccess:7.1 + cpe:/a:advantech:advantech_webaccess:7.0 + cpe:/a:advantech:advantech_webaccess:6.0 + cpe:/a:advantech:advantech_webaccess:5.0 + + CVE-2014-0763 + 2014-04-12T00:37:31.440-04:00 + 2014-04-14T13:27:16.287-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-14T13:27:16.227-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03 + + Multiple SQL injection vulnerabilities in DBVisitor.dll in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary SQL commands via SOAP requests to unspecified functions. + + + + + + + + + + + + cpe:/a:advantech:advantech_webaccess:7.1 + cpe:/a:advantech:advantech_webaccess:7.0 + cpe:/a:advantech:advantech_webaccess:6.0 + cpe:/a:advantech:advantech_webaccess:5.0 + + CVE-2014-0764 + 2014-04-12T00:37:31.470-04:00 + 2014-04-14T13:28:25.463-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-14T13:28:25.417-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03 + + Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long NodeName parameter. + + + + + + + + + + + + cpe:/a:advantech:advantech_webaccess:7.1 + cpe:/a:advantech:advantech_webaccess:7.0 + cpe:/a:advantech:advantech_webaccess:6.0 + cpe:/a:advantech:advantech_webaccess:5.0 + + CVE-2014-0765 + 2014-04-12T00:37:31.503-04:00 + 2014-04-14T13:29:25.650-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-14T13:29:25.603-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03 + + Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long GotoCmd argument. + + + + + + + + + + + + cpe:/a:advantech:advantech_webaccess:7.1 + cpe:/a:advantech:advantech_webaccess:7.0 + cpe:/a:advantech:advantech_webaccess:6.0 + cpe:/a:advantech:advantech_webaccess:5.0 + + CVE-2014-0766 + 2014-04-12T00:37:31.533-04:00 + 2014-04-14T13:35:51.447-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-14T13:35:51.400-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03 + + Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long NodeName2 argument. + + + + + + + + + + + + cpe:/a:advantech:advantech_webaccess:7.1 + cpe:/a:advantech:advantech_webaccess:7.0 + cpe:/a:advantech:advantech_webaccess:6.0 + cpe:/a:advantech:advantech_webaccess:5.0 + + CVE-2014-0767 + 2014-04-12T00:37:31.567-04:00 + 2014-04-14T13:37:09.870-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-14T13:36:52.900-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03 + + Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long AccessCode argument. + + + + + + + + + + + + cpe:/a:advantech:advantech_webaccess:7.1 + cpe:/a:advantech:advantech_webaccess:7.0 + cpe:/a:advantech:advantech_webaccess:6.0 + cpe:/a:advantech:advantech_webaccess:5.0 + + CVE-2014-0768 + 2014-04-12T00:37:31.597-04:00 + 2014-04-14T13:38:18.043-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-14T13:38:17.857-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03 + + Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long AccessCode2 argument. + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:softmotion3d:softmotion:- + cpe:/h:festo:cecx-x-c1_modular_master_controller:- + cpe:/a:3s-software:codesys_runtime_system:- + cpe:/h:festo:cecx-x-m1_modular_controller:- + + CVE-2014-0769 + 2014-04-25T01:12:07.753-04:00 + 2014-04-25T09:58:09.157-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-25T09:58:09.110-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01 + + The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion do not require authentication for connections to certain TCP ports, which allows remote attackers to (1) modify the configuration via a request to the debug service on port 4000 or (2) delete log entries via a request to the log service on port 4001. + + + + + + + + + + + + cpe:/a:advantech:advantech_webaccess:7.1 + cpe:/a:advantech:advantech_webaccess:7.0 + cpe:/a:advantech:advantech_webaccess:6.0 + cpe:/a:advantech:advantech_webaccess:5.0 + + CVE-2014-0770 + 2014-04-12T00:37:31.627-04:00 + 2014-04-14T13:40:36.627-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-14T13:40:36.563-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03 + + Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long UserName parameter. + + + + + + + + + + + + cpe:/a:advantech:advantech_webaccess:7.1 + cpe:/a:advantech:advantech_webaccess:7.0 + cpe:/a:advantech:advantech_webaccess:6.0 + cpe:/a:advantech:advantech_webaccess:5.0 + + CVE-2014-0771 + 2014-04-12T00:37:31.643-04:00 + 2014-04-14T13:42:25.053-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-14T13:42:15.443-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03 + + The OpenUrlToBuffer method in the BWOCXRUN.BwocxrunCtrl.1 ActiveX control in bwocxrun.ocx in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a file: URL. + + + + + + + + + + + + cpe:/a:advantech:advantech_webaccess:7.1 + cpe:/a:advantech:advantech_webaccess:7.0 + cpe:/a:advantech:advantech_webaccess:6.0 + cpe:/a:advantech:advantech_webaccess:5.0 + + CVE-2014-0772 + 2014-04-12T00:37:31.673-04:00 + 2014-04-14T13:44:26.243-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-14T13:44:26.180-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03 + + The OpenUrlToBufferTimeout method in the BWOCXRUN.BwocxrunCtrl.1 ActiveX control in bwocxrun.ocx in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a file: URL. + + + + + + + + + + + + cpe:/a:advantech:advantech_webaccess:7.1 + cpe:/a:advantech:advantech_webaccess:7.0 + cpe:/a:advantech:advantech_webaccess:6.0 + cpe:/a:advantech:advantech_webaccess:5.0 + + CVE-2014-0773 + 2014-04-12T00:37:31.707-04:00 + 2014-04-14T13:56:26.973-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-14T13:56:23.520-04:00 + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03 + + The CreateProcess method in the BWOCXRUN.BwocxrunCtrl.1 ActiveX control in bwocxrun.ocx in Advantech WebAccess before 7.2 allows remote attackers to execute (1) setup.exe, (2) bwvbprt.exe, and (3) bwvbprtl.exe programs from arbitrary pathnames via a crafted argument, as demonstrated by a UNC share pathname. + + + + + + + + + + + + + + cpe:/a:schneider-electric:opc_factory_server:3.35 + cpe:/a:schneider-electric:ofs_test_client_tlxcdluofs33:3.35 + cpe:/a:schneider-electric:ofs_test_client_tlxcdsuofs33:3.35 + cpe:/a:schneider-electric:ofs_test_client_tlxcdltofs33:3.35 + cpe:/a:schneider-electric:ofs_test_client_tlxcdlfofs33:3.35 + cpe:/a:schneider-electric:ofs_test_client_tlxcdstofs33:3.35 + + CVE-2014-0774 + 2014-02-28T01:18:54.277-05:00 + 2014-02-28T12:59:27.513-05:00 + + + 6.9 + LOCAL + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-28T12:59:27.450-05:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-058-02 + + + CONFIRM + http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-031-01 + + Stack-based buffer overflow in the C++ sample client in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 - 3.35, TLXCDSTOFS33 - 3.35, TLXCDLUOFS33 - 3.35, TLXCDLTOFS33 - 3.35, and TLXCDLFOFS33 - 3.35 allows local users to gain privileges via vectors involving a malformed configuration file. + + + + + + + + + + cpe:/a:ioserver:ioserver_opc_server:- + cpe:/a:ioserver:opc_drivers:1.0.20 + + CVE-2014-0777 + 2014-04-11T12:55:03.457-04:00 + 2014-04-14T12:19:34.417-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-14T12:19:30.477-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-100-01 + + The Modbus slave/outstation driver in the OPC Drivers 1.0.20 and earlier in IOServer OPC Server allows remote attackers to cause a denial of service (out-of-bounds read and daemon crash) via a crafted packet. + + + + + + + + + cpe:/a:progea:movicon:11.4 + + CVE-2014-0778 + 2014-04-19T15:55:07.200-04:00 + 2014-04-21T14:50:53.030-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-21T14:50:52.983-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-105-01 + + The TCPUploader module in Progea Movicon 11.4 before 11.4.1150 allows remote attackers to obtain potentially sensitive version information via network traffic to TCP port 10651. + + + + + + + + + + + + + + + + + cpe:/a:schneider-electric:scada_expert_clearscada:2013:r2 + cpe:/a:schneider-electric:clearscada:2010:r3 + cpe:/a:schneider-electric:scada_expert_clearscada:2013:r1.1a + cpe:/a:schneider-electric:clearscada:2010:r2 + cpe:/a:schneider-electric:scada_expert_clearscada:2013:r1.2 + cpe:/a:schneider-electric:scada_expert_clearscada:2013:r1.1 + cpe:/a:schneider-electric:clearscada:2010:r2.1 + cpe:/a:schneider-electric:clearscada:2010:r3.1 + cpe:/a:schneider-electric:scada_expert_clearscada:2013:r1 + + CVE-2014-0779 + 2014-03-14T06:55:05.803-04:00 + 2014-03-14T13:37:49.707-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-14T13:37:49.613-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-072-01 + + + CONFIRM + http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-024-01 + + The PLC driver in ServerMain.exe in the Kepware KepServerEX 4 component in Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R2 build 71.4165, 2010 R2.1 build 71.4325, 2010 R3 build 72.4560, 2010 R3.1 build 72.4644, 2013 R1 build 73.4729, 2013 R1.1 build 73.4832, 2013 R1.1a build 73.4903, 2013 R1.2 build 73.4955, and 2013 R2 build 74.5094 allows remote attackers to cause a denial of service (application crash) via a crafted OPF file (aka project file). + + + + + + + + + + + cpe:/a:indusoft:web_studio:7.1:- + cpe:/a:indusoft:web_studio:7.1:sp2 + cpe:/a:indusoft:web_studio:7.1:sp1 + + CVE-2014-0780 + 2014-04-25T01:12:07.787-04:00 + 2014-04-25T11:48:51.573-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-25T11:48:51.433-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-107-02 + + Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests. + + + + + + + + + + + + + + + + + + + + cpe:/a:yokogawa:centum_cs_3000:r3.02 + cpe:/a:yokogawa:centum_cs_3000:r3.03 + cpe:/a:yokogawa:centum_cs_3000:r3.01 + cpe:/a:yokogawa:centum_cs_3000:r3.04 + cpe:/a:yokogawa:centum_cs_3000:r3.05 + cpe:/a:yokogawa:centum_cs_3000:r3.06 + cpe:/a:yokogawa:centum_cs_3000:r3.07 + cpe:/a:yokogawa:centum_cs_3000:r3.08 + cpe:/a:yokogawa:centum_cs_3000:r3.08.70 + cpe:/a:yokogawa:centum_cs_3000:r3.09 + cpe:/a:yokogawa:centum_cs_3000:r3.08.50 + cpe:/a:yokogawa:centum_cs_3000:r3.09.50 + + CVE-2014-0781 + 2014-03-14T06:55:05.817-04:00 + 2014-03-14T11:51:04.050-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-14T11:51:03.973-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-070-01 + + Heap-based buffer overflow in BKCLogSvr.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary code via crafted UDP packets. + + + + + + + + + + + + + + + + + + + + cpe:/a:yokogawa:centum_cs_3000:r3.02 + cpe:/a:yokogawa:centum_cs_3000:r3.03 + cpe:/a:yokogawa:centum_cs_3000:r3.01 + cpe:/a:yokogawa:centum_cs_3000:r3.04 + cpe:/a:yokogawa:centum_cs_3000:r3.05 + cpe:/a:yokogawa:centum_cs_3000:r3.06 + cpe:/a:yokogawa:centum_cs_3000:r3.07 + cpe:/a:yokogawa:centum_cs_3000:r3.08 + cpe:/a:yokogawa:centum_cs_3000:r3.08.70 + cpe:/a:yokogawa:centum_cs_3000:r3.09 + cpe:/a:yokogawa:centum_cs_3000:r3.08.50 + cpe:/a:yokogawa:centum_cs_3000:r3.09.50 + + CVE-2014-0783 + 2014-03-14T06:55:05.850-04:00 + 2014-03-14T11:52:26.427-04:00 + + + 9.0 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + COMPLETE + http://nvd.nist.gov + 2014-03-14T11:52:26.367-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-070-01 + + Stack-based buffer overflow in BKHOdeq.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary code via a crafted TCP packet. + + + + + + + + + + + + + + + + + + + + cpe:/a:yokogawa:centum_cs_3000:r3.02 + cpe:/a:yokogawa:centum_cs_3000:r3.03 + cpe:/a:yokogawa:centum_cs_3000:r3.01 + cpe:/a:yokogawa:centum_cs_3000:r3.04 + cpe:/a:yokogawa:centum_cs_3000:r3.05 + cpe:/a:yokogawa:centum_cs_3000:r3.06 + cpe:/a:yokogawa:centum_cs_3000:r3.07 + cpe:/a:yokogawa:centum_cs_3000:r3.08 + cpe:/a:yokogawa:centum_cs_3000:r3.08.70 + cpe:/a:yokogawa:centum_cs_3000:r3.09 + cpe:/a:yokogawa:centum_cs_3000:r3.08.50 + cpe:/a:yokogawa:centum_cs_3000:r3.09.50 + + CVE-2014-0784 + 2014-03-14T06:55:05.863-04:00 + 2014-03-14T11:54:45.087-04:00 + + + 8.3 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + COMPLETE + http://nvd.nist.gov + 2014-03-14T11:54:44.930-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-070-01 + + Stack-based buffer overflow in BKBCopyD.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary code via a crafted TCP packet. + + + + + + + + + + + + + + cpe:/a:ecava:integraxor:4.1 + cpe:/a:ecava:integraxor:4.1.4369 + cpe:/a:ecava:integraxor:4.1.4390 + cpe:/a:ecava:integraxor:4.1.4360 + cpe:/a:ecava:integraxor:4.1.4340 + cpe:/a:ecava:integraxor:4.1.4380 + + CVE-2014-0786 + 2014-04-30T21:56:10.490-04:00 + 2014-05-01T12:18:09.443-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-05-01T12:18:09.240-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-091-01 + + + CONFIRM + http://www.integraxor.com/blog/category/security/vulnerability-note/ + + Ecava IntegraXor before 4.1.4393 allows remote attackers to read cleartext credentials for administrative accounts via SELECT statements that leverage the guest role. + + + + + + + + + + cpe:/a:wellintech:kingscada:3.1.2 + cpe:/a:wellintech:kingscada:3.1 + + CVE-2014-0787 + 2014-04-12T00:37:31.737-04:00 + 2014-04-14T13:59:36.133-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-14T13:59:36.057-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-098-02 + + Stack-based buffer overflow in WellinTech KingSCADA before 3.1.2.13 allows remote attackers to execute arbitrary code via a crafted packet. + + + + + + + + + + + + + cpe:/h:schneider-electric:opc_factory_server_tlxcdsuofs:3.35 + cpe:/h:schneider-electric:opc_factory_server_tlxcdstofs:3.35 + cpe:/h:schneider-electric:opc_factory_server_tlxcdltofs:3.35 + cpe:/h:schneider-electric:opc_factory_server_tlxcdlfofs:3.35 + cpe:/h:schneider-electric:opc_factory_server_tlxcdluofs:3.35 + + CVE-2014-0789 + 2014-04-04T11:09:45.917-04:00 + 2014-04-04T13:52:48.090-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-04T13:52:43.417-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-093-01 + + + CONFIRM + http://www.schneider-electric.com/corporate/en/support/cybersecurity/viewer-news.page?c_filepath=/templatedata/Content/News/data/en/local/cybersecurity/general_information/2014/03/20140325_vulnerability_disclosure_opc_factory_server.xml + + Multiple buffer overflows in the OPC Automation 2.0 Server Object ActiveX control in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 3.5 and earlier, TLXCDSTOFS33 3.5 and earlier, TLXCDLUOFS33 3.5 and earlier, TLXCDLTOFS33 3.5 and earlier, and TLXCDLFOFS33 3.5 and earlier allow remote attackers to cause a denial of service via long arguments to unspecified functions. + + + + + + + + + + + cpe:/a:freerdp_project:freerdp:1.0.0 + cpe:/a:freerdp_project:freerdp:1.0.1 + cpe:/a:freerdp_project:freerdp:1.0.2 + + CVE-2014-0791 + 2014-01-03T13:54:13.257-05:00 + 2014-01-06T21:38:52.107-05:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-06T21:38:52.027-05:00 + + + + + MISC + https://github.com/sidhpurwala-huzaifa/FreeRDP/commit/e2745807c4c3e0a590c0f69a9b655dc74ebaa03e + + + MISC + https://github.com/FreeRDP/FreeRDP/pull/1649 + + + MISC + https://bugzilla.redhat.com/show_bug.cgi?id=998941 + + + MLIST + [oss-security] 20140103 Re: CVE for freerdp int overflow? + + + MLIST + [oss-security] 20140102 CVE for freerdp int overflow? + + Integer overflow in the license_read_scope_list function in libfreerdp/core/license.c in FreeRDP through 1.0.2 allows remote RDP servers to cause a denial of service (application crash) or possibly have unspecified other impact via a large ScopeCount value in a Scope List in a Server License Request packet. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:sonatype:nexus:2.0.2 + cpe:/a:sonatype:nexus:2.0.5 + cpe:/a:sonatype:nexus:2.0.6 + cpe:/a:sonatype:nexus:2.0.3 + cpe:/a:sonatype:nexus:2.0.4 + cpe:/a:sonatype:nexus:2.0 + cpe:/a:sonatype:nexus:2.3.1 + cpe:/a:sonatype:nexus:2.1.1 + cpe:/a:sonatype:nexus:2.0.4:1 + cpe:/a:sonatype:nexus:1.0 + cpe:/a:sonatype:nexus:2.0.1 + cpe:/a:sonatype:nexus:2.7.0 + cpe:/a:sonatype:nexus:2.6.0 + cpe:/a:sonatype:nexus:2.5.1 + cpe:/a:sonatype:nexus:2.5.0 + cpe:/a:sonatype:nexus:2.6.4 + cpe:/a:sonatype:nexus:2.7.0:06 + cpe:/a:sonatype:nexus:2.1 + cpe:/a:sonatype:nexus:2.7.0:05 + cpe:/a:sonatype:nexus:2.2 + cpe:/a:sonatype:nexus:2.7.0:04 + cpe:/a:sonatype:nexus:2.6.2 + cpe:/a:sonatype:nexus:2.4.0 + cpe:/a:sonatype:nexus:2.6.1 + cpe:/a:sonatype:nexus:2.6.3 + + CVE-2014-0792 + 2014-01-17T15:55:04.000-05:00 + 2014-01-21T09:14:59.440-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-21T09:14:47.817-05:00 + + + + + CONFIRM + https://support.sonatype.com/entries/37828023-Nexus-Security-Vulnerability + + + CONFIRM + http://www.sonatype.org/advisories/archive/2014-01-13-Nexus + + + CONFIRM + https://sonatype.zendesk.com/entries/37551958-Configuring-Xstream-Whitelist + + Sonatype Nexus 1.x and 2.x before 2.7.1 allows remote attackers to create arbitrary objects and execute arbitrary code via unspecified vectors related to unmarshalling of unintended Object types. + + + + + + + + + + + + + + + + cpe:/a:stackideas:komento:1.7.2 + cpe:/a:stackideas:komento:1.7.1 + cpe:/a:stackideas:komento:1.7.0 + + CVE-2014-0793 + 2014-01-30T13:55:03.503-05:00 + 2014-02-21T13:15:05.407-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-30T20:50:28.000-05:00 + + + + + MISC + https://www.htbridge.com/advisory/HTB23194 + + + BUGTRAQ + 20140123 Cross-Site Scripting (XSS) in Komento Joomla Extension + + + EXPLOIT-DB + 31174 + + + CONFIRM + http://stackideas.com/downloads/changelog/komento + + Multiple cross-site scripting (XSS) vulnerabilities in the StackIdeas Komento (com_komento) component before 1.7.3 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) website or (2) latitude parameter in a comment to the default URI. + + + + + + + + + + + + + + cpe:/a:joomla:com_jvcomment:3.0.2 + + CVE-2014-0794 + 2014-01-26T15:55:06.657-05:00 + 2014-02-24T17:04:57.927-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-27T03:30:46.000-05:00 + + + + + MISC + https://www.htbridge.com/advisory/HTB23195 + + + XF + joomla-jvcomment-unspecified-sql-injection(90532) + + + BID + 64661 + + + BUGTRAQ + 20140123 SQL Injection in JV Comment Joomla Extension + + + OSVDB + 101960 + + + EXPLOIT-DB + 31175 + + + CONFIRM + http://extensions.joomla.org/extensions/contacts-and-feedback/articles-comments/23394 + + Cross-site scripting (XSS) vulnerability in JV Comment (com_jvcomment) 3.0.2 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the id parameter in a comment.like action. + + + + + + + + + + + + + + + + cpe:/a:aokitaka:zip_with_pass_pro:6.3.0:-:~-~-~android~~ + cpe:/a:aokitaka:zip_with_pass_pro:6.3.5:-:~-~-~android~~ + cpe:/a:aokitaka:zip_with_pass_pro:6.3.4:-:~-~-~android~~ + cpe:/a:aokitaka:zip_with_pass_pro:6.3.7:-:~-~-~android~~ + cpe:/a:aokitaka:zip_with_pass_pro:6.2.2:-:~-~-~android~~ + cpe:/a:aokitaka:zip_with_pass_pro:6.2.1:-:~-~-~android~~ + cpe:/a:aokitaka:zip_with_pass_pro:6.3.8:-:~-~-~android~~ + cpe:/a:aokitaka:zip_with_pass:4.5.7:-:~-~-~android~~ + + CVE-2014-0802 + 2014-01-12T13:34:56.000-05:00 + 2014-01-13T14:07:31.053-05:00 + + + 5.8 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-13T14:07:27.397-05:00 + + + + + JVNDB + JVNDB-2014-000001 + + + JVN + JVN#88313872 + + Directory traversal vulnerability in the aokitaka ZIP with Pass application 4.5.7 and earlier, and ZIP with Pass Pro application 6.3.8 and earlier, for Android allows attackers to overwrite or create arbitrary files via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:yuichiro_okuyama:tetra_filer_free:1.5.1:-:~-~-~android~~ + cpe:/a:yuichiro_okuyama:tetra_filer:1.5.1:-:~-~-~android~~ + cpe:/a:yuichiro_okuyama:tetra_filer:2.3.1:-:~-~-~android~~ + cpe:/a:yuichiro_okuyama:tetra_filer_free:2.3.1:-:~-~-~android~~ + + CVE-2014-0803 + 2014-01-12T13:34:56.033-05:00 + 2014-01-13T14:47:08.617-05:00 + + + 5.8 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-13T14:47:08.507-05:00 + + + + + CONFIRM + https://play.google.com/store/apps/details?id=jp.main.brits.android.filer.free + + + CONFIRM + https://play.google.com/store/apps/details?id=jp.main.brits.android.filer.app + + + JVNDB + JVNDB-2014-000002 + + + JVN + JVN#51285738 + + Directory traversal vulnerability in the tetra filer application 2.3.1 and earlier for Android 4.0.3, tetra filer free application 2.3.1 and earlier for Android 4.0.3, tetra filer application 1.5.1 and earlier for Android before 4.0.3, and tetra filer free application 1.5.1 and earlier for Android before 4.0.3 allows attackers to overwrite or create arbitrary files via unspecified vectors. + + + + + + + + + + cpe:/a:cgene:security_file_manager:1.0.6:-:~-~trial~android~~ + cpe:/a:cgene:security_file_manager:1.0.6:-:~-~pro~android~~ + + CVE-2014-0804 + 2014-01-12T13:34:56.063-05:00 + 2014-01-13T15:05:50.797-05:00 + + + 5.8 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-13T15:05:50.733-05:00 + + + + + CONFIRM + https://play.google.com/store/apps/details?id=com.cgene.android.secret.filelock.pro + + + CONFIRM + https://play.google.com/store/apps/details?id=com.cgene.android.secret.filelock.free + + + JVNDB + JVNDB-2014-000003 + + + JVN + JVN#44392991 + + Directory traversal vulnerability in the CGENE Security File Manager Pro application 1.0.6 and earlier, and Security File Manager Trial application 1.0.6 and earlier, for Android allows attackers to overwrite or create arbitrary files via unspecified vectors. + + + + + + + + + + + cpe:/a:skyarts:neofiler:2.4.2:-:~-~lite~android~~ + cpe:/a:skyarts:neofiler:5.4.3:-:~-~free~android~~ + cpe:/a:skyarts:neofiler:5.4.3:-:~-~-~android~~ + + CVE-2014-0805 + 2014-01-12T13:34:56.547-05:00 + 2014-01-13T23:49:19.543-05:00 + + + 5.8 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-13T23:49:19.417-05:00 + + + + + CONFIRM + https://play.google.com/store/apps/details?id=com.skyarts.android.neofilerlite + + + CONFIRM + https://play.google.com/store/apps/details?id=com.skyarts.android.neofilerfree + + + CONFIRM + https://play.google.com/store/apps/details?id=com.skyarts.android.neofiler + + + CONFIRM + http://www.skyarts.com/products/android/neofiler/index.html + + + JVNDB + JVNDB-2014-000004 + + + JVN + JVN#85716574 + + Directory traversal vulnerability in the NeoFiler application 5.4.3 and earlier, NeoFiler Free application 5.4.3 and earlier, and NeoFiler Lite application 2.4.2 and earlier for Android allows attackers to overwrite or create arbitrary files via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:fenrir-inc:sleipnir_mobile:1.3.0:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:1.5.1 + cpe:/a:fenrir-inc:sleipnir_mobile:1.5.0 + cpe:/a:fenrir-inc:sleipnir_mobile:2.0.4:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:2.12.1:- + cpe:/a:fenrir-inc:sleipnir_mobile:2.0.3:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:1.1.0 + cpe:/a:fenrir-inc:sleipnir_mobile:2.0.2:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:1.0.0:rc:black + cpe:/a:fenrir-inc:sleipnir_mobile:2.10.0 + cpe:/a:fenrir-inc:sleipnir_mobile:2.7.0 + cpe:/a:fenrir-inc:sleipnir_mobile:2.12.1:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:2.6.0 + cpe:/a:fenrir-inc:sleipnir_mobile:2.0.0:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:2.0.1:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:2.2.3 + cpe:/a:fenrir-inc:sleipnir_mobile:2.1.0:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:2.9.1:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:2.3.0 + cpe:/a:fenrir-inc:sleipnir_mobile:2.5.0 + cpe:/a:fenrir-inc:sleipnir_mobile:2.2.0 + cpe:/a:fenrir-inc:sleipnir_mobile:2.5.1 + cpe:/a:fenrir-inc:sleipnir_mobile:1.6.0 + cpe:/a:fenrir-inc:sleipnir_mobile:2.2.2 + cpe:/a:fenrir-inc:sleipnir_mobile:2.2.1 + cpe:/a:fenrir-inc:sleipnir_mobile:2.4.1 + cpe:/a:fenrir-inc:sleipnir_mobile:1.7.0 + cpe:/a:fenrir-inc:sleipnir_mobile:2.5.1:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:2.5.0:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:1.4.0 + cpe:/a:fenrir-inc:sleipnir_mobile:1.7.1 + cpe:/a:fenrir-inc:sleipnir_mobile:1.0.0:rc + cpe:/a:fenrir-inc:sleipnir_mobile:2.4.0 + cpe:/a:fenrir-inc:sleipnir_mobile:2.11:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:2.8.0 + cpe:/a:fenrir-inc:sleipnir_mobile:2.12:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:2.10.0:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:2.10:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:2.4.1:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:1.2.0:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:2.4.0:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:1.0.0:alpha:black + cpe:/a:fenrir-inc:sleipnir_mobile:2.2.1:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:2.2.0:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:2.2.3:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:2.2.2:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:1.0.0:alpha + cpe:/a:fenrir-inc:sleipnir_mobile:1.1.0:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:2.3.0:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:1.2.0 + cpe:/a:fenrir-inc:sleipnir_mobile:2.0.0 + cpe:/a:fenrir-inc:sleipnir_mobile:1.7.1:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:1.7.0:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:1.6.0:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:2.9.1 + cpe:/a:fenrir-inc:sleipnir_mobile:2.0.2 + cpe:/a:fenrir-inc:sleipnir_mobile:2.0.3 + cpe:/a:fenrir-inc:sleipnir_mobile:2.0.4 + cpe:/a:fenrir-inc:sleipnir_mobile:1.3.0 + cpe:/a:fenrir-inc:sleipnir_mobile:1.4.0:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:2.9.0:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:1.5.1:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:1.5.0:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:2.0.1 + cpe:/a:fenrir-inc:sleipnir_mobile:2.8.0:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:1.0.0:beta_update1 + cpe:/a:fenrir-inc:sleipnir_mobile:2.1.0 + cpe:/a:fenrir-inc:sleipnir_mobile:2.6.0:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:2.10:- + cpe:/a:fenrir-inc:sleipnir_mobile:2.11:- + cpe:/a:fenrir-inc:sleipnir_mobile:2.7.0:-:black + cpe:/a:fenrir-inc:sleipnir_mobile:2.12:- + cpe:/a:fenrir-inc:sleipnir_mobile:1.0.0:beta_update1:black + + CVE-2014-0806 + 2014-01-22T16:55:03.653-05:00 + 2014-01-23T12:56:48.870-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-23T12:56:47.840-05:00 + + + + + JVNDB + JVNDB-2014-000007 + + + JVN + JVN#81637882 + + The Sleipnir Mobile application 2.12.1 and earlier and Sleipnir Mobile Black Edition application 2.12.1 and earlier for Android provide Geolocation API data without verifying user consent, which allows remote attackers to obtain sensitive location information via a web site that makes API calls. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:lockon:ec-cube:2.11.0:beta2 + cpe:/a:lockon:ec-cube:2.12.0 + cpe:/a:lockon:ec-cube:2.4.0:rc1 + cpe:/a:lockon:ec-cube:2.11.5 + cpe:/a:lockon:ec-cube:2.11.4 + cpe:/a:lockon:ec-cube:2.11.3 + cpe:/a:lockon:ec-cube:2.12.1 + cpe:/a:lockon:ec-cube:2.11.2 + cpe:/a:lockon:ec-cube:2.4.3 + cpe:/a:lockon:ec-cube:2.12.2 + cpe:/a:lockon:ec-cube:2.4.4 + cpe:/a:lockon:ec-cube:2.4.2 + cpe:/a:lockon:ec-cube:2.4.1 + cpe:/a:lockon:ec-cube:2.4.0 + cpe:/a:lockon:ec-cube:2.11.1 + cpe:/a:lockon:ec-cube:2.11.0:beta + cpe:/a:lockon:ec-cube:2.11.0 + + CVE-2014-0807 + 2014-01-22T16:55:03.683-05:00 + 2014-01-23T13:10:13.500-05:00 + + + 6.4 + NETWORK + LOW + NONE + NONE + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-23T13:10:12.843-05:00 + + + + CONFIRM + http://www.ec-cube.net/info/weakness/weakness.php?id=56 + + + JVNDB + JVNDB-2014-000005 + + + JVN + JVN#17849447 + + data/class/pages/shopping/LC_Page_Shopping_Deliv.php in LOCKON EC-CUBE 2.4.4 and earlier, and 2.11.0 through 2.12.2, allows remote attackers to modify data via unspecified vectors. + + + + + + + + + + + + + + + + + + + cpe:/a:lockon:ec-cube:2.11.0:beta2 + cpe:/a:lockon:ec-cube:2.12.0 + cpe:/a:lockon:ec-cube:2.11.1 + cpe:/a:lockon:ec-cube:2.11.5 + cpe:/a:lockon:ec-cube:2.11.4 + cpe:/a:lockon:ec-cube:2.11.0:beta + cpe:/a:lockon:ec-cube:2.12.1 + cpe:/a:lockon:ec-cube:2.11.3 + cpe:/a:lockon:ec-cube:2.11.0 + cpe:/a:lockon:ec-cube:2.12.2 + cpe:/a:lockon:ec-cube:2.11.2 + + CVE-2014-0808 + 2014-01-22T16:55:03.717-05:00 + 2014-01-23T13:03:07.020-05:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-23T13:03:06.943-05:00 + + + + CONFIRM + http://www.ec-cube.net/info/weakness/weakness.php?id=57 + + + JVNDB + JVNDB-2014-000006 + + + JVN + JVN#51770585 + + The lfCheckError function in data/class/pages/shopping/LC_Page_Shopping_Multiple.php in LOCKON EC-CUBE 2.11.0 through 2.12.2 allows remote attackers to obtain sensitive shipping information via unspecified vectors. + + + + + + + + + + cpe:/a:gapless_player:simzip:1.1 + cpe:/a:gapless_player:simzip:1.2 + + CVE-2014-0809 + 2014-01-24T10:08:00.827-05:00 + 2014-02-21T00:06:28.813-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-24T18:05:15.553-05:00 + + + + + CONFIRM + https://play.google.com/store/apps/details?id=com.acidzazz.simzip + + + XF + simple-zip-cve20140809-dir-traversal(90980) + + + JVNDB + JVNDB-2014-000008 + + + JVN + JVN#49384502 + + Directory traversal vulnerability in the Gapless Player SimZip (aka Simple Zip Viewer) application before 1.2.1 for Android allows remote attackers to overwrite or create arbitrary files via a crafted filename. + + + + + + + + + + + + + cpe:/a:justsystems:sanshiro:2010 + cpe:/a:justsystems:sanshiro:viewer + cpe:/a:justsystems:sanshiro:2007 + cpe:/a:justsystems:sanshiro:2008 + cpe:/a:justsystems:sanshiro:2009 + + CVE-2014-0810 + 2014-01-29T00:37:02.857-05:00 + 2014-01-29T13:39:45.720-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-29T13:39:45.610-05:00 + + + + CONFIRM + http://www.justsystems.com/jp/info/js14001.html + + + JVNDB + JVNDB-2014-000011 + + + JVN + JVN#28011378 + + Unspecified vulnerability in JustSystems Sanshiro 2007 before update 3, 2008 before update 5, 2009 before update 6, and 2010 before update 6, and Sanshiro Viewer before 2.0.2.0, allows remote attackers to execute arbitrary code via a crafted document. + + + + + + + + + cpe:/a:blackboard:vista%2fce:8.0:sp6 + + CVE-2014-0811 + 2014-02-22T16:55:09.780-05:00 + 2014-02-24T13:32:13.250-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-24T13:32:13.217-05:00 + + + + + JVNDB + JVNDB-2014-000012 + + + JVN + JVN#24730765 + + Cross-site scripting (XSS) vulnerability in Blackboard Vista/CE 8.0 SP6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + + + + + cpe:/a:kent-web:joyful_note:2.8 + + CVE-2014-0812 + 2014-02-01T10:55:04.557-05:00 + 2014-02-03T11:46:21.317-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-03T11:45:50.377-05:00 + + + + + CONFIRM + http://www.kent-web.com/bbs/joyful.html + + + JVNDB + JVNDB-2014-000013 + + + JVN + JVN#30718178 + + Cross-site scripting (XSS) vulnerability in KENT-WEB Joyful Note 2.8 and earlier, when Internet Explorer 7 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:phpmyfaq:phpmyfaq:2.5.5 + cpe:/a:phpmyfaq:phpmyfaq:1.3.9 + cpe:/a:phpmyfaq:phpmyfaq:2.5.6 + cpe:/a:phpmyfaq:phpmyfaq:1.3.8 + cpe:/a:phpmyfaq:phpmyfaq:2.5.7 + cpe:/a:phpmyfaq:phpmyfaq:1.0 + cpe:/a:phpmyfaq:phpmyfaq:1.4 + cpe:/a:phpmyfaq:phpmyfaq:1.4.0 + cpe:/a:phpmyfaq:phpmyfaq:1.4.1 + cpe:/a:phpmyfaq:phpmyfaq:1.2.0 + cpe:/a:phpmyfaq:phpmyfaq:1.4.0a + cpe:/a:phpmyfaq:phpmyfaq:1.2.5 + cpe:/a:phpmyfaq:phpmyfaq:1.2.4 + cpe:/a:phpmyfaq:phpmyfaq:1.5.8 + cpe:/a:phpmyfaq:phpmyfaq:2.7.3 + cpe:/a:phpmyfaq:phpmyfaq:1.5.7 + cpe:/a:phpmyfaq:phpmyfaq:2.7.4 + cpe:/a:phpmyfaq:phpmyfaq:1.4:alpha1 + cpe:/a:phpmyfaq:phpmyfaq:1.5.6 + cpe:/a:phpmyfaq:phpmyfaq:2.7.5 + cpe:/a:phpmyfaq:phpmyfaq:1.4:alpha2 + cpe:/a:phpmyfaq:phpmyfaq:2.7.6 + cpe:/a:phpmyfaq:phpmyfaq:2.7.7 + cpe:/a:phpmyfaq:phpmyfaq:2.7.8 + cpe:/a:phpmyfaq:phpmyfaq:2.7.9 + cpe:/a:phpmyfaq:phpmyfaq:1.5.9 + cpe:/a:phpmyfaq:phpmyfaq:1.5:alpha2 + cpe:/a:phpmyfaq:phpmyfaq:1.5:alpha1 + cpe:/a:phpmyfaq:phpmyfaq:1.4.11 + cpe:/a:phpmyfaq:phpmyfaq:1.4.10 + cpe:/a:phpmyfaq:phpmyfaq:2.0.4 + cpe:/a:phpmyfaq:phpmyfaq:2.0.3 + cpe:/a:phpmyfaq:phpmyfaq:2.0.2 + cpe:/a:phpmyfaq:phpmyfaq:1.3.9:pl1 + cpe:/a:phpmyfaq:phpmyfaq:1.3.12 + cpe:/a:phpmyfaq:phpmyfaq:1.3.13 + cpe:/a:phpmyfaq:phpmyfaq:1.5.0 + cpe:/a:phpmyfaq:phpmyfaq:1.3.11 + cpe:/a:phpmyfaq:phpmyfaq:1.6.5 + cpe:/a:phpmyfaq:phpmyfaq:1.6.7 + cpe:/a:phpmyfaq:phpmyfaq:1.6.6 + cpe:/a:phpmyfaq:phpmyfaq:1.6.9 + cpe:/a:phpmyfaq:phpmyfaq:1.6.8 + cpe:/a:phpmyfaq:phpmyfaq:2.0.1 + cpe:/a:phpmyfaq:phpmyfaq:2.0.0 + cpe:/a:phpmyfaq:phpmyfaq:2.0.9 + cpe:/a:phpmyfaq:phpmyfaq:2.0.17 + cpe:/a:phpmyfaq:phpmyfaq:2.0.6 + cpe:/a:phpmyfaq:phpmyfaq:1.6.10 + cpe:/a:phpmyfaq:phpmyfaq:2.0.5 + cpe:/a:phpmyfaq:phpmyfaq:2.0.8 + cpe:/a:phpmyfaq:phpmyfaq:1.6.12 + cpe:/a:phpmyfaq:phpmyfaq:2.0.7 + cpe:/a:phpmyfaq:phpmyfaq:1.6.11 + cpe:/a:phpmyfaq:phpmyfaq:2.6.7 + cpe:/a:phpmyfaq:phpmyfaq:2.8.3 + cpe:/a:phpmyfaq:phpmyfaq:2.6.8 + cpe:/a:phpmyfaq:phpmyfaq:2.8.4 + cpe:/a:phpmyfaq:phpmyfaq:2.6.9 + cpe:/a:phpmyfaq:phpmyfaq:2.8.2 + cpe:/a:phpmyfaq:phpmyfaq:1.1.4a + cpe:/a:phpmyfaq:phpmyfaq:1.3.0 + cpe:/a:phpmyfaq:phpmyfaq:1.3.1 + cpe:/a:phpmyfaq:phpmyfaq:1.0.1 + cpe:/a:phpmyfaq:phpmyfaq:1.3.2 + cpe:/a:phpmyfaq:phpmyfaq:1.4.9 + cpe:/a:phpmyfaq:phpmyfaq:2.6.4 + cpe:/a:phpmyfaq:phpmyfaq:1.4.8 + cpe:/a:phpmyfaq:phpmyfaq:2.6.5 + cpe:/a:phpmyfaq:phpmyfaq:2.8.5 + cpe:/a:phpmyfaq:phpmyfaq:1.4.7 + cpe:/a:phpmyfaq:phpmyfaq:2.6.6 + cpe:/a:phpmyfaq:phpmyfaq:1.1.2 + cpe:/a:phpmyfaq:phpmyfaq:1.3.10 + cpe:/a:phpmyfaq:phpmyfaq:1.1.4 + cpe:/a:phpmyfaq:phpmyfaq:1.1.3 + cpe:/a:phpmyfaq:phpmyfaq:1.3.14 + cpe:/a:phpmyfaq:phpmyfaq:1.1.0 + cpe:/a:phpmyfaq:phpmyfaq:1.1.1 + cpe:/a:phpmyfaq:phpmyfaq:2.0.14 + cpe:/a:phpmyfaq:phpmyfaq:1.5:rc2 + cpe:/a:phpmyfaq:phpmyfaq:2.0.15 + cpe:/a:phpmyfaq:phpmyfaq:2.0.12 + cpe:/a:phpmyfaq:phpmyfaq:1.1.5 + cpe:/a:phpmyfaq:phpmyfaq:1.5:rc4 + cpe:/a:phpmyfaq:phpmyfaq:2.0.13 + cpe:/a:phpmyfaq:phpmyfaq:1.5:rc1 + cpe:/a:phpmyfaq:phpmyfaq:2.0.16 + cpe:/a:phpmyfaq:phpmyfaq:1.5:rc5 + cpe:/a:phpmyfaq:phpmyfaq:2.5.0 + cpe:/a:phpmyfaq:phpmyfaq:1.3.6 + cpe:/a:phpmyfaq:phpmyfaq:1.6.4 + cpe:/a:phpmyfaq:phpmyfaq:2.5.1 + cpe:/a:phpmyfaq:phpmyfaq:1.3.5 + cpe:/a:phpmyfaq:phpmyfaq:2.5.2 + cpe:/a:phpmyfaq:phpmyfaq:1.3.4 + cpe:/a:phpmyfaq:phpmyfaq:2.5.3 + cpe:/a:phpmyfaq:phpmyfaq:1.3.3 + cpe:/a:phpmyfaq:phpmyfaq:2.6.18 + cpe:/a:phpmyfaq:phpmyfaq:2.5.4 + cpe:/a:phpmyfaq:phpmyfaq:1.5:rc3 + cpe:/a:phpmyfaq:phpmyfaq:1.6.0 + cpe:/a:phpmyfaq:phpmyfaq:1.6.1 + cpe:/a:phpmyfaq:phpmyfaq:1.6.2 + cpe:/a:phpmyfaq:phpmyfaq:1.3.7 + cpe:/a:phpmyfaq:phpmyfaq:1.6.3 + cpe:/a:phpmyfaq:phpmyfaq:2.6.14 + cpe:/a:phpmyfaq:phpmyfaq:1.2.3 + cpe:/a:phpmyfaq:phpmyfaq:1.2.2 + cpe:/a:phpmyfaq:phpmyfaq:1.2.1 + cpe:/a:phpmyfaq:phpmyfaq:2.7.2 + cpe:/a:phpmyfaq:phpmyfaq:2.7.0 + cpe:/a:phpmyfaq:phpmyfaq:2.6.10 + cpe:/a:phpmyfaq:phpmyfaq:2.6.11 + cpe:/a:phpmyfaq:phpmyfaq:2.7.1 + cpe:/a:phpmyfaq:phpmyfaq:2.6.12 + cpe:/a:phpmyfaq:phpmyfaq:2.6.13 + cpe:/a:phpmyfaq:phpmyfaq:1.0.1a + cpe:/a:phpmyfaq:phpmyfaq:2.6.17 + cpe:/a:phpmyfaq:phpmyfaq:2.6.16 + cpe:/a:phpmyfaq:phpmyfaq:2.6.15 + cpe:/a:phpmyfaq:phpmyfaq:1.5:beta2 + cpe:/a:phpmyfaq:phpmyfaq:2.8.0 + cpe:/a:phpmyfaq:phpmyfaq:1.5:beta3 + cpe:/a:phpmyfaq:phpmyfaq:1.5:beta1 + cpe:/a:phpmyfaq:phpmyfaq:2.0.11 + cpe:/a:phpmyfaq:phpmyfaq:1.2.5b + cpe:/a:phpmyfaq:phpmyfaq:2.0.10 + cpe:/a:phpmyfaq:phpmyfaq:1.2.5a + cpe:/a:phpmyfaq:phpmyfaq:2.8.1 + cpe:/a:phpmyfaq:phpmyfaq:1.5 + cpe:/a:phpmyfaq:phpmyfaq:1.5.2 + cpe:/a:phpmyfaq:phpmyfaq:2.6.3 + cpe:/a:phpmyfaq:phpmyfaq:1.5.1 + cpe:/a:phpmyfaq:phpmyfaq:1.4.6 + cpe:/a:phpmyfaq:phpmyfaq:1.5.4 + cpe:/a:phpmyfaq:phpmyfaq:1.5.3 + cpe:/a:phpmyfaq:phpmyfaq:2.6.0 + cpe:/a:phpmyfaq:phpmyfaq:1.4.4 + cpe:/a:phpmyfaq:phpmyfaq:1.4.5 + cpe:/a:phpmyfaq:phpmyfaq:1.5.5 + cpe:/a:phpmyfaq:phpmyfaq:2.6.2 + cpe:/a:phpmyfaq:phpmyfaq:1.4.2 + cpe:/a:phpmyfaq:phpmyfaq:2.6.1 + cpe:/a:phpmyfaq:phpmyfaq:1.4.3 + + CVE-2014-0813 + 2014-02-14T11:55:13.843-05:00 + 2014-02-21T00:06:29.047-05:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-18T11:52:02.657-05:00 + + + + + CONFIRM + http://www.phpmyfaq.de/advisory_2014-02-04.php + + + XF + phpmyfaq-cve20140813-csrf(90963) + + + BID + 65368 + + + SECUNIA + 56006 + + + OSVDB + 102939 + + + JVNDB + JVNDB-2014-000016 + + + JVN + JVN#50943964 + + Cross-site request forgery (CSRF) vulnerability in phpMyFAQ before 2.8.6 allows remote attackers to hijack the authentication of arbitrary users for requests that modify settings. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:phpmyfaq:phpmyfaq:2.5.5 + cpe:/a:phpmyfaq:phpmyfaq:1.3.9 + cpe:/a:phpmyfaq:phpmyfaq:2.5.6 + cpe:/a:phpmyfaq:phpmyfaq:1.3.8 + cpe:/a:phpmyfaq:phpmyfaq:2.5.7 + cpe:/a:phpmyfaq:phpmyfaq:1.0 + cpe:/a:phpmyfaq:phpmyfaq:1.4 + cpe:/a:phpmyfaq:phpmyfaq:1.4.0 + cpe:/a:phpmyfaq:phpmyfaq:1.4.1 + cpe:/a:phpmyfaq:phpmyfaq:1.2.0 + cpe:/a:phpmyfaq:phpmyfaq:1.4.0a + cpe:/a:phpmyfaq:phpmyfaq:1.2.5 + cpe:/a:phpmyfaq:phpmyfaq:1.2.4 + cpe:/a:phpmyfaq:phpmyfaq:1.5.8 + cpe:/a:phpmyfaq:phpmyfaq:2.7.3 + cpe:/a:phpmyfaq:phpmyfaq:1.5.7 + cpe:/a:phpmyfaq:phpmyfaq:2.7.4 + cpe:/a:phpmyfaq:phpmyfaq:1.4:alpha1 + cpe:/a:phpmyfaq:phpmyfaq:1.5.6 + cpe:/a:phpmyfaq:phpmyfaq:2.7.5 + cpe:/a:phpmyfaq:phpmyfaq:1.4:alpha2 + cpe:/a:phpmyfaq:phpmyfaq:2.7.6 + cpe:/a:phpmyfaq:phpmyfaq:2.7.7 + cpe:/a:phpmyfaq:phpmyfaq:2.7.8 + cpe:/a:phpmyfaq:phpmyfaq:2.7.9 + cpe:/a:phpmyfaq:phpmyfaq:1.5.9 + cpe:/a:phpmyfaq:phpmyfaq:1.5:alpha2 + cpe:/a:phpmyfaq:phpmyfaq:1.5:alpha1 + cpe:/a:phpmyfaq:phpmyfaq:1.4.11 + cpe:/a:phpmyfaq:phpmyfaq:1.4.10 + cpe:/a:phpmyfaq:phpmyfaq:2.0.4 + cpe:/a:phpmyfaq:phpmyfaq:2.0.3 + cpe:/a:phpmyfaq:phpmyfaq:2.0.2 + cpe:/a:phpmyfaq:phpmyfaq:1.3.9:pl1 + cpe:/a:phpmyfaq:phpmyfaq:1.3.12 + cpe:/a:phpmyfaq:phpmyfaq:1.3.13 + cpe:/a:phpmyfaq:phpmyfaq:1.5.0 + cpe:/a:phpmyfaq:phpmyfaq:1.3.11 + cpe:/a:phpmyfaq:phpmyfaq:1.6.5 + cpe:/a:phpmyfaq:phpmyfaq:1.6.7 + cpe:/a:phpmyfaq:phpmyfaq:1.6.6 + cpe:/a:phpmyfaq:phpmyfaq:1.6.9 + cpe:/a:phpmyfaq:phpmyfaq:1.6.8 + cpe:/a:phpmyfaq:phpmyfaq:2.0.1 + cpe:/a:phpmyfaq:phpmyfaq:2.0.0 + cpe:/a:phpmyfaq:phpmyfaq:2.0.9 + cpe:/a:phpmyfaq:phpmyfaq:2.0.17 + cpe:/a:phpmyfaq:phpmyfaq:2.0.6 + cpe:/a:phpmyfaq:phpmyfaq:1.6.10 + cpe:/a:phpmyfaq:phpmyfaq:2.0.5 + cpe:/a:phpmyfaq:phpmyfaq:2.0.8 + cpe:/a:phpmyfaq:phpmyfaq:1.6.12 + cpe:/a:phpmyfaq:phpmyfaq:2.0.7 + cpe:/a:phpmyfaq:phpmyfaq:1.6.11 + cpe:/a:phpmyfaq:phpmyfaq:2.6.7 + cpe:/a:phpmyfaq:phpmyfaq:2.8.3 + cpe:/a:phpmyfaq:phpmyfaq:2.6.8 + cpe:/a:phpmyfaq:phpmyfaq:2.8.4 + cpe:/a:phpmyfaq:phpmyfaq:2.6.9 + cpe:/a:phpmyfaq:phpmyfaq:2.8.2 + cpe:/a:phpmyfaq:phpmyfaq:1.1.4a + cpe:/a:phpmyfaq:phpmyfaq:1.3.0 + cpe:/a:phpmyfaq:phpmyfaq:1.3.1 + cpe:/a:phpmyfaq:phpmyfaq:1.0.1 + cpe:/a:phpmyfaq:phpmyfaq:1.3.2 + cpe:/a:phpmyfaq:phpmyfaq:1.4.9 + cpe:/a:phpmyfaq:phpmyfaq:2.6.4 + cpe:/a:phpmyfaq:phpmyfaq:1.4.8 + cpe:/a:phpmyfaq:phpmyfaq:2.6.5 + cpe:/a:phpmyfaq:phpmyfaq:2.8.5 + cpe:/a:phpmyfaq:phpmyfaq:1.4.7 + cpe:/a:phpmyfaq:phpmyfaq:2.6.6 + cpe:/a:phpmyfaq:phpmyfaq:1.1.2 + cpe:/a:phpmyfaq:phpmyfaq:1.3.10 + cpe:/a:phpmyfaq:phpmyfaq:1.1.4 + cpe:/a:phpmyfaq:phpmyfaq:1.1.3 + cpe:/a:phpmyfaq:phpmyfaq:1.3.14 + cpe:/a:phpmyfaq:phpmyfaq:1.1.0 + cpe:/a:phpmyfaq:phpmyfaq:1.1.1 + cpe:/a:phpmyfaq:phpmyfaq:2.0.14 + cpe:/a:phpmyfaq:phpmyfaq:1.5:rc2 + cpe:/a:phpmyfaq:phpmyfaq:2.0.15 + cpe:/a:phpmyfaq:phpmyfaq:2.0.12 + cpe:/a:phpmyfaq:phpmyfaq:1.1.5 + cpe:/a:phpmyfaq:phpmyfaq:1.5:rc4 + cpe:/a:phpmyfaq:phpmyfaq:2.0.13 + cpe:/a:phpmyfaq:phpmyfaq:1.5:rc1 + cpe:/a:phpmyfaq:phpmyfaq:2.0.16 + cpe:/a:phpmyfaq:phpmyfaq:1.5:rc5 + cpe:/a:phpmyfaq:phpmyfaq:2.5.0 + cpe:/a:phpmyfaq:phpmyfaq:1.3.6 + cpe:/a:phpmyfaq:phpmyfaq:1.6.4 + cpe:/a:phpmyfaq:phpmyfaq:2.5.1 + cpe:/a:phpmyfaq:phpmyfaq:1.3.5 + cpe:/a:phpmyfaq:phpmyfaq:2.5.2 + cpe:/a:phpmyfaq:phpmyfaq:1.3.4 + cpe:/a:phpmyfaq:phpmyfaq:2.5.3 + cpe:/a:phpmyfaq:phpmyfaq:1.3.3 + cpe:/a:phpmyfaq:phpmyfaq:2.6.18 + cpe:/a:phpmyfaq:phpmyfaq:2.5.4 + cpe:/a:phpmyfaq:phpmyfaq:1.5:rc3 + cpe:/a:phpmyfaq:phpmyfaq:1.6.0 + cpe:/a:phpmyfaq:phpmyfaq:1.6.1 + cpe:/a:phpmyfaq:phpmyfaq:1.6.2 + cpe:/a:phpmyfaq:phpmyfaq:1.3.7 + cpe:/a:phpmyfaq:phpmyfaq:1.6.3 + cpe:/a:phpmyfaq:phpmyfaq:2.6.14 + cpe:/a:phpmyfaq:phpmyfaq:1.2.3 + cpe:/a:phpmyfaq:phpmyfaq:1.2.2 + cpe:/a:phpmyfaq:phpmyfaq:1.2.1 + cpe:/a:phpmyfaq:phpmyfaq:2.7.2 + cpe:/a:phpmyfaq:phpmyfaq:2.7.0 + cpe:/a:phpmyfaq:phpmyfaq:2.6.10 + cpe:/a:phpmyfaq:phpmyfaq:2.6.11 + cpe:/a:phpmyfaq:phpmyfaq:2.7.1 + cpe:/a:phpmyfaq:phpmyfaq:2.6.12 + cpe:/a:phpmyfaq:phpmyfaq:2.6.13 + cpe:/a:phpmyfaq:phpmyfaq:1.0.1a + cpe:/a:phpmyfaq:phpmyfaq:2.6.17 + cpe:/a:phpmyfaq:phpmyfaq:2.6.16 + cpe:/a:phpmyfaq:phpmyfaq:2.6.15 + cpe:/a:phpmyfaq:phpmyfaq:1.5:beta2 + cpe:/a:phpmyfaq:phpmyfaq:2.8.0 + cpe:/a:phpmyfaq:phpmyfaq:1.5:beta3 + cpe:/a:phpmyfaq:phpmyfaq:1.5:beta1 + cpe:/a:phpmyfaq:phpmyfaq:2.0.11 + cpe:/a:phpmyfaq:phpmyfaq:1.2.5b + cpe:/a:phpmyfaq:phpmyfaq:2.0.10 + cpe:/a:phpmyfaq:phpmyfaq:1.2.5a + cpe:/a:phpmyfaq:phpmyfaq:2.8.1 + cpe:/a:phpmyfaq:phpmyfaq:1.5 + cpe:/a:phpmyfaq:phpmyfaq:1.5.2 + cpe:/a:phpmyfaq:phpmyfaq:2.6.3 + cpe:/a:phpmyfaq:phpmyfaq:1.5.1 + cpe:/a:phpmyfaq:phpmyfaq:1.4.6 + cpe:/a:phpmyfaq:phpmyfaq:1.5.4 + cpe:/a:phpmyfaq:phpmyfaq:1.5.3 + cpe:/a:phpmyfaq:phpmyfaq:2.6.0 + cpe:/a:phpmyfaq:phpmyfaq:1.4.4 + cpe:/a:phpmyfaq:phpmyfaq:1.4.5 + cpe:/a:phpmyfaq:phpmyfaq:1.5.5 + cpe:/a:phpmyfaq:phpmyfaq:2.6.2 + cpe:/a:phpmyfaq:phpmyfaq:1.4.2 + cpe:/a:phpmyfaq:phpmyfaq:2.6.1 + cpe:/a:phpmyfaq:phpmyfaq:1.4.3 + + CVE-2014-0814 + 2014-02-14T11:55:13.857-05:00 + 2014-02-21T00:06:29.127-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-18T11:53:03.407-05:00 + + + + + CONFIRM + http://www.phpmyfaq.de/advisory_2014-02-04.php + + + BID + 65368 + + + SECUNIA + 56006 + + + OSVDB + 102940 + + + JVNDB + JVNDB-2014-000015 + + + JVN + JVN#30050348 + + Cross-site scripting (XSS) vulnerability in phpMyFAQ before 2.8.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:opera:opera_browser:11.64 + cpe:/a:opera:opera_browser:11.65 + cpe:/a:opera:opera_browser:11.66 + cpe:/a:opera:opera_browser:11.67 + cpe:/a:opera:opera_browser:12.00 + cpe:/a:opera:opera_browser:12.02 + cpe:/a:opera:opera_browser:12.01 + cpe:/a:opera:opera_browser:10.60:beta1 + cpe:/a:opera:opera_browser:16.00 + cpe:/a:opera:opera_browser:11.10 + cpe:/a:opera:opera_browser:10.00 + cpe:/a:opera:opera_browser:11.11 + cpe:/a:opera:opera_browser:11.61 + cpe:/a:opera:opera_browser:11.60 + cpe:/a:opera:opera_browser:11.62 + cpe:/a:opera:opera_browser:12.11 + cpe:/a:opera:opera_browser:10.01 + cpe:/a:opera:opera_browser:12.10 + cpe:/a:opera:opera_browser:12.13 + cpe:/a:opera:opera_browser:12.12 + cpe:/a:opera:opera_browser:10.00:beta2 + cpe:/a:opera:opera_browser:11.00:beta + cpe:/a:opera:opera_browser:10.00:beta3 + cpe:/a:opera:opera_browser:10.00:beta1 + cpe:/a:opera:opera_browser:11.01 + cpe:/a:opera:opera_browser:11.00 + cpe:/a:opera:opera_browser:10.00:alpha + cpe:/a:opera:opera_browser:1.00 + cpe:/a:opera:opera_browser:10.61 + cpe:/a:opera:opera_browser:15.00 + cpe:/a:opera:opera_browser:10.62 + cpe:/a:opera:opera_browser:10.60:alpha + cpe:/a:opera:opera_browser:10.60 + cpe:/a:opera:opera_browser:15.00:next + cpe:/a:opera:opera_browser:11.10:beta + cpe:/a:opera:opera_browser:10.10:beta1 + cpe:/a:opera:opera_browser:10.52:beta2 + cpe:/a:opera:opera_browser:17.00 + cpe:/a:opera:opera_browser:10.52:beta1 + cpe:/a:opera:opera_browser:11.50:beta + cpe:/a:opera:opera_browser:10.53:beta1 + cpe:/a:opera:opera_browser:10.50:beta2 + cpe:/a:opera:opera_browser:12.14 + cpe:/a:opera:opera_browser:12.15 + cpe:/a:opera:opera_browser:11.52.1100 + cpe:/a:opera:opera_browser:12.00:beta + cpe:/a:opera:opera_browser:10.53:b + cpe:/a:opera:opera_browser:10.63 + cpe:/a:opera:opera_browser:12.10:beta + cpe:/a:opera:opera_browser:10.50 + cpe:/a:opera:opera_browser:10.51 + cpe:/a:opera:opera_browser:11.60:beta + cpe:/a:opera:opera_browser:10.50:beta1 + cpe:/a:opera:opera_browser:10.20:alpha + cpe:/a:opera:opera_browser:10.10 + cpe:/a:opera:opera_browser:10.11 + cpe:/a:opera:opera_browser:11.52 + cpe:/a:opera:opera_browser:11.51 + cpe:/a:opera:opera_browser:11.50 + cpe:/a:opera:opera_browser:10.53 + cpe:/a:opera:opera_browser:10.52 + cpe:/a:opera:opera_browser:10.54 + + CVE-2014-0815 + 2014-02-06T17:55:03.403-05:00 + 2014-02-21T00:06:29.360-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-02-07T12:53:39.153-05:00 + + + + + XF + opera-android-cve20140815-info-disc(91090) + + + BID + 65391 + + + JVNDB + JVNDB-2014-000014 + + + JVN + JVN#23256725 + + + CONFIRM + http://blogs.opera.com/security/2014/01/security-changes-features-opera-19/ + + The intent: URL implementation in Opera before 18 on Android allows attackers to read local files by leveraging an interaction error, as demonstrated by reading stored cookies. + + + + + + + + + + + cpe:/a:norman:security_suite:8.0 + cpe:/a:norman:security_suite:10.1 + cpe:/a:norman:security_suite:10.0 + + CVE-2014-0816 + 2014-02-26T20:55:03.477-05:00 + 2014-02-27T11:38:13.297-05:00 + + + 7.2 + LOCAL + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-27T11:38:10.203-05:00 + + + + + JVNDB + JVNDB-2014-000026 + + + JVN + JVN#02017463 + + + CONFIRM + http://jvn.jp/en/jp/JVN02017463/995510/index.html + + Unspecified vulnerability in Norman Security Suite 10.1 and earlier allows local users to gain privileges via unknown vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cybozu:garoon:2.1:sp1 + cpe:/a:cybozu:garoon:2.0:sp4 + cpe:/a:cybozu:garoon:2.1:sp2 + cpe:/a:cybozu:garoon:2.0:sp1 + cpe:/a:cybozu:garoon:2.0:sp2 + cpe:/a:cybozu:garoon:2.0:sp5 + cpe:/a:cybozu:garoon:2.0:sp6 + cpe:/a:cybozu:garoon:2.5.4 + cpe:/a:cybozu:garoon:2.5:sp3 + cpe:/a:cybozu:garoon:2.5:sp4 + cpe:/a:cybozu:garoon:2.5.2 + cpe:/a:cybozu:garoon:2.5:sp1 + cpe:/a:cybozu:garoon:2.5.3 + cpe:/a:cybozu:garoon:2.5:sp2 + cpe:/a:cybozu:garoon:2.5.0 + cpe:/a:cybozu:garoon:2.5.1 + cpe:/a:cybozu:garoon:3.7:sp3 + cpe:/a:cybozu:garoon:3.0:sp2 + cpe:/a:cybozu:garoon:3.0:sp1 + cpe:/a:cybozu:garoon:3.1:sp2 + cpe:/a:cybozu:garoon:3.5:sp5 + cpe:/a:cybozu:garoon:3.5:sp2 + cpe:/a:cybozu:garoon:3.5:sp1 + cpe:/a:cybozu:garoon:3.7:sp2 + cpe:/a:cybozu:garoon:3.5:sp4 + cpe:/a:cybozu:garoon:3.5:sp3 + cpe:/a:cybozu:garoon:3.7:sp1 + cpe:/a:cybozu:garoon:2.0.0 + cpe:/a:cybozu:garoon:2.0.1 + cpe:/a:cybozu:garoon:3.1:sp3 + cpe:/a:cybozu:garoon:3.0:sp3 + cpe:/a:cybozu:garoon:3.1:sp1 + cpe:/a:cybozu:garoon:2.1.0 + cpe:/a:cybozu:garoon:3.0 + cpe:/a:cybozu:garoon:3.1 + cpe:/a:cybozu:garoon:2.0:sp3 + cpe:/a:cybozu:garoon:2.5 + cpe:/a:cybozu:garoon:2.1:sp3 + cpe:/a:cybozu:garoon:3.7 + cpe:/a:cybozu:garoon:2.1.3 + cpe:/a:cybozu:garoon:2.1.2 + cpe:/a:cybozu:garoon:2.1.1 + cpe:/a:cybozu:garoon:2.1 + cpe:/a:cybozu:garoon:3.5 + cpe:/a:cybozu:garoon:2.0.6 + cpe:/a:cybozu:garoon:2.0.5 + cpe:/a:cybozu:garoon:2.0.4 + cpe:/a:cybozu:garoon:2.0.3 + cpe:/a:cybozu:garoon:2.0.2 + cpe:/a:cybozu:garoon:3.5.3 + + CVE-2014-0817 + 2014-02-26T20:55:03.507-05:00 + 2014-02-27T12:08:54.437-05:00 + + + 4.9 + NETWORK + MEDIUM + SINGLE_INSTANCE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-27T12:08:53.360-05:00 + + + + + CONFIRM + https://support.cybozu.com/ja-jp/article/7992 + + + JVNDB + JVNDB-2014-000021 + + + JVN + JVN#24035499 + + + CONFIRM + http://cs.cybozu.co.jp/information/gr20140225up03.php + + Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 does not properly manage sessions, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors. + + + + + + + + + + + + + + + + cpe:/a:autodesk:autocad:2010 + cpe:/a:autodesk:autocad:2005:::english + cpe:/a:autodesk:autocad:2007:::english + cpe:/a:autodesk:autocad:2006 + cpe:/a:autodesk:autocad:2005 + cpe:/a:autodesk:autocad:2013 + cpe:/a:autodesk:autocad:2012 + cpe:/a:autodesk:autocad:2011 + + CVE-2014-0818 + 2014-02-22T16:55:09.797-05:00 + 2014-03-05T23:50:40.300-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-24T13:26:15.040-05:00 + + + + + JVNDB + JVNDB-2014-000019 + + + JVN + JVN#33382534 + + Untrusted search path vulnerability in Autodesk AutoCAD before 2014 allows local users to gain privileges and execute arbitrary VBScript code via a Trojan horse FAS file in the FAS file search path. + + + + + + + + + + + + + + + + cpe:/a:autodesk:autocad:2010 + cpe:/a:autodesk:autocad:2005:::english + cpe:/a:autodesk:autocad:2007:::english + cpe:/a:autodesk:autocad:2006 + cpe:/a:autodesk:autocad:2005 + cpe:/a:autodesk:autocad:2013 + cpe:/a:autodesk:autocad:2012 + cpe:/a:autodesk:autocad:2011 + + CVE-2014-0819 + 2014-02-22T16:55:09.827-05:00 + 2014-02-24T13:29:08.230-05:00 + + + 4.4 + LOCAL + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-24T13:29:08.167-05:00 + + + + + JVNDB + JVNDB-2014-000020 + + + JVN + JVN#43254599 + + Untrusted search path vulnerability in Autodesk AutoCAD before 2014 allows local users to gain privileges via a Trojan horse DLL in the current working directory. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cybozu:garoon:2.1:sp1 + cpe:/a:cybozu:garoon:2.0:sp4 + cpe:/a:cybozu:garoon:2.1:sp2 + cpe:/a:cybozu:garoon:3.7 + cpe:/a:cybozu:garoon:2.0:sp1 + cpe:/a:cybozu:garoon:2.0:sp2 + cpe:/a:cybozu:garoon:2.1.3 + cpe:/a:cybozu:garoon:2.1.2 + cpe:/a:cybozu:garoon:2.0:sp5 + cpe:/a:cybozu:garoon:2.1.1 + cpe:/a:cybozu:garoon:2.0:sp6 + cpe:/a:cybozu:garoon:2.5:sp3 + cpe:/a:cybozu:garoon:2.5.4 + cpe:/a:cybozu:garoon:2.5:sp4 + cpe:/a:cybozu:garoon:2.5:sp1 + cpe:/a:cybozu:garoon:2.5.2 + cpe:/a:cybozu:garoon:2.5:sp2 + cpe:/a:cybozu:garoon:2.5.3 + cpe:/a:cybozu:garoon:2.5.0 + cpe:/a:cybozu:garoon:2.1 + cpe:/a:cybozu:garoon:3.5 + cpe:/a:cybozu:garoon:2.5.1 + cpe:/a:cybozu:garoon:3.7:sp3 + cpe:/a:cybozu:garoon:2.0.6 + cpe:/a:cybozu:garoon:3.0:sp2 + cpe:/a:cybozu:garoon:2.0.5 + cpe:/a:cybozu:garoon:3.1:sp2 + cpe:/a:cybozu:garoon:3.0:sp1 + cpe:/a:cybozu:garoon:2.0.4 + cpe:/a:cybozu:garoon:3.5:sp5 + cpe:/a:cybozu:garoon:2.0.3 + cpe:/a:cybozu:garoon:2.0.2 + cpe:/a:cybozu:garoon:3.5:sp2 + cpe:/a:cybozu:garoon:3.5:sp1 + cpe:/a:cybozu:garoon:3.5:sp4 + cpe:/a:cybozu:garoon:3.7:sp2 + cpe:/a:cybozu:garoon:3.5:sp3 + cpe:/a:cybozu:garoon:3.7:sp1 + cpe:/a:cybozu:garoon:2.0.0 + cpe:/a:cybozu:garoon:2.0.1 + cpe:/a:cybozu:garoon:3.1:sp3 + cpe:/a:cybozu:garoon:3.0:sp3 + cpe:/a:cybozu:garoon:3.1:sp1 + cpe:/a:cybozu:garoon:2.1.0 + cpe:/a:cybozu:garoon:3.0 + cpe:/a:cybozu:garoon:3.1 + cpe:/a:cybozu:garoon:3.5.3 + cpe:/a:cybozu:garoon:2.5 + cpe:/a:cybozu:garoon:2.0:sp3 + cpe:/a:cybozu:garoon:2.1:sp3 + + CVE-2014-0820 + 2014-02-26T20:55:03.540-05:00 + 2014-03-10T14:52:45.260-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-02-27T12:08:46.877-05:00 + + + + + CONFIRM + https://support.cybozu.com/ja-jp/article/7994 + + + JVNDB + JVNDB-2014-000023 + + + JVN + JVN#26393529 + + + CONFIRM + http://cs.cybozu.co.jp/information/gr20140225up05.php + + Directory traversal vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to read arbitrary files via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cybozu:garoon:2.1:sp1 + cpe:/a:cybozu:garoon:2.0:sp4 + cpe:/a:cybozu:garoon:2.1:sp2 + cpe:/a:cybozu:garoon:2.0:sp1 + cpe:/a:cybozu:garoon:2.0:sp2 + cpe:/a:cybozu:garoon:2.0:sp5 + cpe:/a:cybozu:garoon:2.0:sp6 + cpe:/a:cybozu:garoon:2.5.4 + cpe:/a:cybozu:garoon:2.5:sp3 + cpe:/a:cybozu:garoon:2.5:sp4 + cpe:/a:cybozu:garoon:2.5.2 + cpe:/a:cybozu:garoon:2.5:sp1 + cpe:/a:cybozu:garoon:2.5.3 + cpe:/a:cybozu:garoon:2.5:sp2 + cpe:/a:cybozu:garoon:2.5.0 + cpe:/a:cybozu:garoon:2.5.1 + cpe:/a:cybozu:garoon:3.7:sp3 + cpe:/a:cybozu:garoon:3.0:sp2 + cpe:/a:cybozu:garoon:3.0:sp1 + cpe:/a:cybozu:garoon:3.1:sp2 + cpe:/a:cybozu:garoon:3.5:sp5 + cpe:/a:cybozu:garoon:3.5:sp2 + cpe:/a:cybozu:garoon:3.5:sp1 + cpe:/a:cybozu:garoon:3.7:sp2 + cpe:/a:cybozu:garoon:3.5:sp4 + cpe:/a:cybozu:garoon:3.5:sp3 + cpe:/a:cybozu:garoon:3.7:sp1 + cpe:/a:cybozu:garoon:2.0.0 + cpe:/a:cybozu:garoon:2.0.1 + cpe:/a:cybozu:garoon:3.1:sp3 + cpe:/a:cybozu:garoon:3.0:sp3 + cpe:/a:cybozu:garoon:3.1:sp1 + cpe:/a:cybozu:garoon:2.1.0 + cpe:/a:cybozu:garoon:3.0 + cpe:/a:cybozu:garoon:3.1 + cpe:/a:cybozu:garoon:2.0:sp3 + cpe:/a:cybozu:garoon:2.5 + cpe:/a:cybozu:garoon:2.1:sp3 + cpe:/a:cybozu:garoon:3.7 + cpe:/a:cybozu:garoon:2.1.3 + cpe:/a:cybozu:garoon:2.1.2 + cpe:/a:cybozu:garoon:2.1.1 + cpe:/a:cybozu:garoon:2.1 + cpe:/a:cybozu:garoon:3.5 + cpe:/a:cybozu:garoon:2.0.6 + cpe:/a:cybozu:garoon:2.0.5 + cpe:/a:cybozu:garoon:2.0.4 + cpe:/a:cybozu:garoon:2.0.3 + cpe:/a:cybozu:garoon:2.0.2 + cpe:/a:cybozu:garoon:3.5.3 + + CVE-2014-0821 + 2014-02-26T20:55:03.570-05:00 + 2014-03-07T15:43:51.553-05:00 + + + 6.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-27T07:10:38.000-05:00 + + + + + CONFIRM + https://support.cybozu.com/ja-jp/article/7993 + + + JVNDB + JVNDB-2014-000024 + + + JVN + JVN#71045461 + + + CONFIRM + http://cs.cybozu.co.jp/information/gr20140225up04.php + + SQL injection vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2013-6930 and CVE-2013-6931. + + + + + + + + + + + + + + + cpe:/a:ibm:lotus_domino_server:8.5.3.4 + cpe:/a:ibm:lotus_domino_server:8.5.3.3 + cpe:/a:ibm:lotus_domino_server:8.5.3.5 + cpe:/a:ibm:lotus_domino_server:8.5.3.1 + cpe:/a:ibm:lotus_domino_server:8.5.3.2 + cpe:/a:ibm:lotus_domino_server:8.5.3.0 + cpe:/a:ibm:lotus_domino_server:9.0.0.0 + + CVE-2014-0822 + 2014-02-06T18:55:04.007-05:00 + 2014-02-07T13:49:56.720-05:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-02-07T13:49:56.657-05:00 + + + + XF + ibm-domino-cve20140822-dos(90235) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21663023 + + The IMAP server in IBM Domino 8.5.x before 8.5.3 FP6 IF1 and 9.0.x before 9.0.1 FP1 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, aka SPR KLYH9F4S2Z. + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:ibm:websphere_application_server:8.0.0.4 + cpe:/a:ibm:websphere_application_server:8.0.0.3 + cpe:/a:ibm:websphere_application_server:8.0.0.2 + cpe:/a:ibm:websphere_application_server:8.0.0.0 + cpe:/a:ibm:websphere_application_server:8.0.0.8 + cpe:/a:ibm:websphere_application_server:8.5.0.0 + cpe:/a:ibm:websphere_application_server:8.0.0.1 + cpe:/a:ibm:websphere_application_server:8.0.0.7 + cpe:/a:ibm:websphere_application_server:8.5.0.1 + cpe:/a:ibm:websphere_application_server:8.0.0.6 + cpe:/a:ibm:websphere_application_server:8.5.0.2 + cpe:/a:ibm:websphere_application_server:8.0.0.5 + cpe:/a:ibm:websphere_application_server:8.5.5.1 + cpe:/a:ibm:websphere_application_server:8.5.5.0 + + CVE-2014-0823 + 2014-05-01T13:29:56.713-04:00 + 2014-05-02T09:54:20.187-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-05-02T09:54:20.043-04:00 + + + + + XF + ibm-was-cve20140823-viewfiles(90498) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21669554 + + + AIXAPAR + PI05324 + + IBM WebSphere Application Server (WAS) 8.x before 8.0.0.9 and 8.5.x before 8.5.5.2 allows remote attackers to read arbitrary files via a crafted URL. + + + + + + + + + cpe:/a:ibm:optim_workload_replay:1.1 + + CVE-2014-0827 + 2014-04-05T00:01:37.560-04:00 + 2014-04-07T10:46:45.923-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-07T10:46:45.877-04:00 + + + + + XF + ibm-infosphere-cve20140827-xss(90503) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21669093 + + Cross-site scripting (XSS) vulnerability in IBM InfoSphere Optim Workload Replay 1.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:ibm:websphere_portal:8.0.0.0 + cpe:/a:ibm:websphere_portal:6.1.0.1 + cpe:/a:ibm:websphere_portal:6.1.0.0 + cpe:/a:ibm:websphere_portal:8.0.0.1 + cpe:/a:ibm:websphere_portal:6.1.0.2 + cpe:/a:ibm:websphere_portal:7.0.0.0 + cpe:/a:ibm:websphere_portal:7.0.0.1 + cpe:/a:ibm:websphere_portal:7.0.0.2 + cpe:/a:ibm:websphere_portal:6.1.5.0 + cpe:/a:ibm:websphere_portal:6.1.5.1 + cpe:/a:ibm:websphere_portal:6.1.5.2 + cpe:/a:ibm:websphere_portal:6.1.0.3 + cpe:/a:ibm:websphere_portal:6.1.0.5 + cpe:/a:ibm:websphere_portal:6.1.0.4 + cpe:/a:ibm:websphere_portal:6.1.5.3 + cpe:/a:ibm:websphere_portal:6.1.0.6 + + CVE-2014-0828 + 2014-04-01T23:58:16.997-04:00 + 2014-04-02T11:53:35.773-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-02T11:53:06.773-04:00 + + + + + XF + ibm-wsportal-cve20140828-wcm-xss(90566) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21667016 + + + AIXAPAR + PI10734 + + Cross-site scripting (XSS) vulnerability in the WCM (Web Content Manager) UI in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF27, and 8.0.0.x before 8.0.0.1 CF11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:ibm:rational_clearcase:7.0.1.11 + cpe:/a:ibm:rational_clearcase:7.0.1.10 + cpe:/a:ibm:rational_clearcase:7.1 + cpe:/a:ibm:rational_clearcase:8.0.1 + cpe:/a:ibm:rational_clearcase:8.0.0 + cpe:/a:ibm:rational_clearcase:7.1.2.12 + cpe:/a:ibm:rational_clearcase:8.0 + cpe:/a:ibm:rational_clearcase:7.1.1.9 + cpe:/a:ibm:rational_clearcase:7.1.2.11 + cpe:/a:ibm:rational_clearcase:7.0.1.1 + cpe:/a:ibm:rational_clearcase:8.0.0.1 + cpe:/a:ibm:rational_clearcase:7.1.2.10 + cpe:/a:ibm:rational_clearcase:7.1.2 + cpe:/a:ibm:rational_clearcase:7.1.1 + cpe:/a:ibm:rational_clearcase:7.1.1.7 + cpe:/a:ibm:rational_clearcase:7.1.1.6 + cpe:/a:ibm:rational_clearcase:7.1.1.5 + cpe:/a:ibm:rational_clearcase:7.1.0.2 + cpe:/a:ibm:rational_clearcase:7.1.1.4 + cpe:/a:ibm:rational_clearcase:7.1.1.3 + cpe:/a:ibm:rational_clearcase:8.0.1.1 + cpe:/a:ibm:rational_clearcase:7.1.1.2 + cpe:/a:ibm:rational_clearcase:8.0.1.2 + cpe:/a:ibm:rational_clearcase:7.1.1.1 + cpe:/a:ibm:rational_clearcase:7.1.1.8 + cpe:/a:ibm:rational_clearcase:7.1.0.1 + cpe:/a:ibm:rational_clearcase:7.1.2.9 + cpe:/a:ibm:rational_clearcase:7.1.2.7 + cpe:/a:ibm:rational_clearcase:7.0.1.2 + cpe:/a:ibm:rational_clearcase:7.0.1.3 + cpe:/a:ibm:rational_clearcase:7.0.1.4 + cpe:/a:ibm:rational_clearcase:7.0.1.5 + cpe:/a:ibm:rational_clearcase:7.0.1 + cpe:/a:ibm:rational_clearcase:7.0.1.6 + cpe:/a:ibm:rational_clearcase:8.0.0.9 + cpe:/a:ibm:rational_clearcase:7.0.1.7 + cpe:/a:ibm:rational_clearcase:7.0.1.8 + cpe:/a:ibm:rational_clearcase:8.0.0.7 + cpe:/a:ibm:rational_clearcase:7.0.1.9 + cpe:/a:ibm:rational_clearcase:8.0.0.8 + cpe:/a:ibm:rational_clearcase:7.1.2.2 + cpe:/a:ibm:rational_clearcase:8.0.0.5 + cpe:/a:ibm:rational_clearcase:8.0.0.6 + cpe:/a:ibm:rational_clearcase:7.1.2.1 + cpe:/a:ibm:rational_clearcase:7.1.2.4 + cpe:/a:ibm:rational_clearcase:8.0.0.3 + cpe:/a:ibm:rational_clearcase:7.1.2.3 + cpe:/a:ibm:rational_clearcase:8.0.0.4 + cpe:/a:ibm:rational_clearcase:7.1.2.6 + cpe:/a:ibm:rational_clearcase:7.1.2.5 + cpe:/a:ibm:rational_clearcase:8.0.0.2 + cpe:/a:ibm:rational_clearcase:7.0.0.9 + cpe:/a:ibm:rational_clearcase:7.0.0.8 + cpe:/a:ibm:rational_clearcase:7.0.0.7 + cpe:/a:ibm:rational_clearcase:7.0.0.6 + cpe:/a:ibm:rational_clearcase:7.0.0.5 + cpe:/a:ibm:rational_clearcase:7.0.0.4 + cpe:/a:ibm:rational_clearcase:7.0.0.3 + + CVE-2014-0829 + 2014-03-21T06:55:05.127-04:00 + 2014-03-24T18:46:45.717-04:00 + + + 6.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-21T11:33:14.393-04:00 + + + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?&uid=swg21662086 + + + XF + ibm-clearcase-cve20140829-bo(90568) + + Multiple buffer overflows in IBM Rational ClearCase 7.x before 7.1.2.13, 8.0.0.x before 8.0.0.10, and 8.0.1.x before 8.0.1.3 allow remote authenticated users to obtain privileged access via unspecified vectors. + + + + + + + + + + + + cpe:/a:ibm:financial_transaction_manager:2.0.0.0 + cpe:/a:ibm:financial_transaction_manager:2.0.0.2 + cpe:/a:ibm:financial_transaction_manager:2.0.0.1 + cpe:/a:ibm:financial_transaction_manager:2.1.0.0 + + CVE-2014-0830 + 2014-02-01T10:55:04.573-05:00 + 2014-02-03T11:52:34.357-05:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-02-03T11:52:34.297-05:00 + + + + + XF + ibm-ftm-cve20140830-trav(90584) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21662714 + + Directory traversal vulnerability in the table-export implementation in the OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 and 2.1 before 2.1.0.1 allows remote authenticated users to read arbitrary files via a modified pathname. + + + + + + + + + + + cpe:/a:ibm:financial_transaction_manager:2.0.0.0 + cpe:/a:ibm:financial_transaction_manager:2.0.0.2 + cpe:/a:ibm:financial_transaction_manager:2.0.0.1 + + CVE-2014-0831 + 2014-02-01T10:55:04.607-05:00 + 2014-02-03T11:54:13.423-05:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-03T11:54:13.297-05:00 + + + + + XF + ibm-ftm-cve20140831-csrf(90585) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21662714 + + Cross-site request forgery (CSRF) vulnerability in the OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 allows remote attackers to hijack the authentication of arbitrary users for requests that modify configuration data. + + + + + + + + + + + cpe:/a:ibm:financial_transaction_manager:2.0.0.0 + cpe:/a:ibm:financial_transaction_manager:2.0.0.2 + cpe:/a:ibm:financial_transaction_manager:2.0.0.1 + + CVE-2014-0832 + 2014-02-01T10:55:04.620-05:00 + 2014-02-03T11:55:22.253-05:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-03T11:54:58.047-05:00 + + + + + XF + ibm-ftm-cve20140832-xss(90586) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21662714 + + Multiple cross-site scripting (XSS) vulnerabilities in configuration-details screens in the OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 allow remote authenticated users to inject arbitrary web script or HTML via a crafted text value. + + + + + + + + + + + cpe:/a:ibm:financial_transaction_manager:2.0.0.0 + cpe:/a:ibm:financial_transaction_manager:2.0.0.2 + cpe:/a:ibm:financial_transaction_manager:2.0.0.1 + + CVE-2014-0833 + 2014-02-01T10:55:04.653-05:00 + 2014-02-03T11:58:26.523-05:00 + + + 5.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-03T11:58:26.477-05:00 + + + + + XF + ibm-ftm-cve20140833-auth(90612) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21662714 + + The OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 does not properly enforce operator-intervention requirements, which allows remote authenticated users to bypass intended access restrictions via an unspecified process step. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:ibm:general_parallel_file_system:3.4.0.22 + cpe:/a:ibm:general_parallel_file_system:3.4.0.21 + cpe:/a:ibm:general_parallel_file_system:3.4.0.20 + cpe:/a:ibm:general_parallel_file_system:3.5.0.0 + cpe:/a:ibm:general_parallel_file_system:3.4.0.0 + cpe:/a:ibm:general_parallel_file_system:3.4.0.2 + cpe:/a:ibm:general_parallel_file_system:3.4.0.26 + cpe:/a:ibm:general_parallel_file_system:3.4.0.25 + cpe:/a:ibm:general_parallel_file_system:3.4.0.24 + cpe:/a:ibm:general_parallel_file_system:3.4.0.23 + cpe:/a:ibm:general_parallel_file_system:3.4.0.19 + cpe:/a:ibm:general_parallel_file_system:3.5.0.8 + cpe:/a:ibm:general_parallel_file_system:3.4.0.18 + cpe:/a:ibm:general_parallel_file_system:3.5.0.9 + cpe:/a:ibm:general_parallel_file_system:3.4.0.17 + cpe:/a:ibm:general_parallel_file_system:3.5.0.6 + cpe:/a:ibm:general_parallel_file_system:3.4.0.16 + cpe:/a:ibm:general_parallel_file_system:3.5.0.7 + cpe:/a:ibm:general_parallel_file_system:3.5.0.4 + cpe:/a:ibm:general_parallel_file_system:3.5.0.2 + cpe:/a:ibm:general_parallel_file_system:3.5.0.3 + cpe:/a:ibm:general_parallel_file_system:3.4.0.12 + cpe:/a:ibm:general_parallel_file_system:3.5.0.11 + cpe:/a:ibm:general_parallel_file_system:3.4.0.13 + cpe:/a:ibm:general_parallel_file_system:3.5.0.12 + cpe:/a:ibm:general_parallel_file_system:3.4.0.9 + cpe:/a:ibm:general_parallel_file_system:3.4.0.14 + cpe:/a:ibm:general_parallel_file_system:3.4.0.8 + cpe:/a:ibm:general_parallel_file_system:3.4.0.15 + cpe:/a:ibm:general_parallel_file_system:3.5.0.10 + cpe:/a:ibm:general_parallel_file_system:3.4.0.7 + cpe:/a:ibm:general_parallel_file_system:3.5.0.15 + cpe:/a:ibm:general_parallel_file_system:3.4.0.6 + cpe:/a:ibm:general_parallel_file_system:3.5.0.16 + cpe:/a:ibm:general_parallel_file_system:3.4.0.5 + cpe:/a:ibm:general_parallel_file_system:3.4.0.10 + cpe:/a:ibm:general_parallel_file_system:3.5.0.13 + cpe:/a:ibm:general_parallel_file_system:3.4.0.4 + cpe:/a:ibm:general_parallel_file_system:3.4.0.11 + cpe:/a:ibm:general_parallel_file_system:3.5.0.14 + cpe:/a:ibm:general_parallel_file_system:3.4.0.3 + cpe:/a:ibm:general_parallel_file_system:3.4.0.27 + + CVE-2014-0834 + 2014-02-04T00:39:08.527-05:00 + 2014-02-06T23:51:53.597-05:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-02-04T13:50:33.717-05:00 + + + + + XF + ibm-gpfs-cve20140834-dos(90647) + + + BID + 65297 + + + AIXAPAR + IV54381 + + + AIXAPAR + IV52863 + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=isg3T1020542 + + + OSVDB + 102765 + + IBM General Parallel File System (GPFS) 3.4 through 3.4.0.27 and 3.5 through 3.5.0.16 allows attackers to cause a denial of service (daemon crash) via crafted arguments to a setuid program. + + + + + + + + + cpe:/a:ibm:qradar_security_information_and_event_manager:7.2.0 + + CVE-2014-0835 + 2014-01-30T00:17:46.220-05:00 + 2014-02-11T23:50:28.547-05:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-30T18:08:17.863-05:00 + + + + + XF + ibm-qradar-cve20140835-csrf(90678) + + + BID + 65127 + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21663066 + + + MISC + http://thomaspollet.blogspot.be/2014/01/ibm-qradar-siem-csrf-xss-mitm-rce.html + + + SECUNIA + 56653 + + + FULLDISC + 20140124 ADV: IBM QRadar SIEM + + + OSVDB + 102554 + + Cross-site request forgery (CSRF) vulnerability in IBM Security QRadar SIEM 7.2 MR1 and earlier allows remote attackers to hijack the authentication of administrators for requests that modify console Auto Update settings. + + + + + + + + + cpe:/a:ibm:qradar_security_information_and_event_manager:7.2.0 + + CVE-2014-0836 + 2014-01-30T00:17:46.267-05:00 + 2014-02-11T23:50:28.627-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-30T18:09:00.707-05:00 + + + + + XF + ibm-qradar-cve20140836-xss(90679) + + + BID + 65127 + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21663066 + + + SECUNIA + 56653 + + + FULLDISC + 20140124 ADV: IBM QRadar SIEM + + + OSVDB + 102555 + + Cross-site scripting (XSS) vulnerability in IBM Security QRadar SIEM 7.2 MR1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL. + + + + + + + + + cpe:/a:ibm:qradar_security_information_and_event_manager:7.2.0 + + CVE-2014-0837 + 2014-01-30T00:17:46.313-05:00 + 2014-02-11T23:50:28.703-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-30T18:15:48.030-05:00 + + + + + XF + ibm-qradar-cve20140837-mitm(90680) + + + BID + 65127 + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21663066 + + + SECUNIA + 56653 + + + FULLDISC + 20140124 ADV: IBM QRadar SIEM + + + OSVDB + 102552 + + The AutoUpdate process in IBM Security QRadar SIEM 7.2 MR1 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate. + + + + + + + + + cpe:/a:ibm:qradar_security_information_and_event_manager:7.2.0 + + CVE-2014-0838 + 2014-01-30T00:17:46.377-05:00 + 2014-02-06T23:51:53.957-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-30T18:17:23.703-05:00 + + + + XF + ibm-qradar-cve20140838-command-exec(90681) + + + BID + 65127 + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21663066 + + + OSVDB + 102553 + + The AutoUpdate package before 6.4 for IBM Security QRadar SIEM 7.2 MR1 and earlier allows remote attackers to execute arbitrary console commands by leveraging control of the server. + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:ibm:rational_focal_point:6.6.0.1 + cpe:/a:ibm:rational_focal_point:6.4.0.1 + cpe:/a:ibm:rational_focal_point:6.5.0.1 + cpe:/a:ibm:rational_focal_point:6.5.0.2 + cpe:/a:ibm:rational_focal_point:6.5.2.1 + cpe:/a:ibm:rational_focal_point:6.5.2.2 + cpe:/a:ibm:rational_focal_point:6.5.2.3 + cpe:/a:ibm:rational_focal_point:6.5.1.1 + cpe:/a:ibm:rational_focal_point:6.5 + cpe:/a:ibm:rational_focal_point:6.4 + cpe:/a:ibm:rational_focal_point:6.6 + cpe:/a:ibm:rational_focal_point:6.5.2 + cpe:/a:ibm:rational_focal_point:6.4.1.3 + cpe:/a:ibm:rational_focal_point:6.5.1 + cpe:/a:ibm:rational_focal_point:6.4.1.2 + cpe:/a:ibm:rational_focal_point:6.4.1.1 + cpe:/a:ibm:rational_focal_point:6.4.1.0 + + CVE-2014-0839 + 2014-02-25T20:29:36.577-05:00 + 2014-02-26T10:49:55.883-05:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-26T05:44:47.000-05:00 + + + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21665005 + + + XF + ibm-focalpoint-cve20140839-sec-bypass(90696) + + IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 allows remote authenticated users to modify data via vectors involving a direct object reference. + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:ibm:rational_focal_point:6.6.0.1 + cpe:/a:ibm:rational_focal_point:6.4.0.1 + cpe:/a:ibm:rational_focal_point:6.5.0.1 + cpe:/a:ibm:rational_focal_point:6.5.0.2 + cpe:/a:ibm:rational_focal_point:6.5.2.1 + cpe:/a:ibm:rational_focal_point:6.5.2.2 + cpe:/a:ibm:rational_focal_point:6.5.2.3 + cpe:/a:ibm:rational_focal_point:6.5.1.1 + cpe:/a:ibm:rational_focal_point:6.5 + cpe:/a:ibm:rational_focal_point:6.4 + cpe:/a:ibm:rational_focal_point:6.6 + cpe:/a:ibm:rational_focal_point:6.5.2 + cpe:/a:ibm:rational_focal_point:6.4.1.3 + cpe:/a:ibm:rational_focal_point:6.5.1 + cpe:/a:ibm:rational_focal_point:6.4.1.2 + cpe:/a:ibm:rational_focal_point:6.4.1.1 + cpe:/a:ibm:rational_focal_point:6.4.1.0 + + CVE-2014-0840 + 2014-02-25T20:29:36.657-05:00 + 2014-02-26T10:52:05.903-05:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-26T10:49:12.663-05:00 + + + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21665005 + + + XF + ibm-focalpoint-cve20140840-xss(90698) + + Multiple cross-site scripting (XSS) vulnerabilities in IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:ibm:rational_focal_point:6.6.0.1 + cpe:/a:ibm:rational_focal_point:6.4.0.1 + cpe:/a:ibm:rational_focal_point:6.5.0.1 + cpe:/a:ibm:rational_focal_point:6.5.0.2 + cpe:/a:ibm:rational_focal_point:6.5.2.1 + cpe:/a:ibm:rational_focal_point:6.5.2.2 + cpe:/a:ibm:rational_focal_point:6.5.2.3 + cpe:/a:ibm:rational_focal_point:6.5.1.1 + cpe:/a:ibm:rational_focal_point:6.5 + cpe:/a:ibm:rational_focal_point:6.4 + cpe:/a:ibm:rational_focal_point:6.6 + cpe:/a:ibm:rational_focal_point:6.5.2 + cpe:/a:ibm:rational_focal_point:6.4.1.3 + cpe:/a:ibm:rational_focal_point:6.5.1 + cpe:/a:ibm:rational_focal_point:6.4.1.2 + cpe:/a:ibm:rational_focal_point:6.4.1.1 + cpe:/a:ibm:rational_focal_point:6.4.1.0 + + CVE-2014-0842 + 2014-02-25T20:29:36.717-05:00 + 2014-02-26T11:07:11.923-05:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-02-26T10:53:51.310-05:00 + + + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21665005 + + + XF + ibm-focalpoint-cve20140842-default-pw(90706) + + The account-creation functionality in IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 places the new user's default password within the creation page, which allows remote attackers to obtain sensitive information by reading the HTML source code. + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:ibm:rational_focal_point:6.6.0.1 + cpe:/a:ibm:rational_focal_point:6.4.0.1 + cpe:/a:ibm:rational_focal_point:6.5.0.1 + cpe:/a:ibm:rational_focal_point:6.5.0.2 + cpe:/a:ibm:rational_focal_point:6.5.2.1 + cpe:/a:ibm:rational_focal_point:6.5.2.2 + cpe:/a:ibm:rational_focal_point:6.5.2.3 + cpe:/a:ibm:rational_focal_point:6.5.1.1 + cpe:/a:ibm:rational_focal_point:6.5 + cpe:/a:ibm:rational_focal_point:6.4 + cpe:/a:ibm:rational_focal_point:6.6 + cpe:/a:ibm:rational_focal_point:6.5.2 + cpe:/a:ibm:rational_focal_point:6.4.1.3 + cpe:/a:ibm:rational_focal_point:6.5.1 + cpe:/a:ibm:rational_focal_point:6.4.1.2 + cpe:/a:ibm:rational_focal_point:6.4.1.1 + cpe:/a:ibm:rational_focal_point:6.4.1.0 + + CVE-2014-0843 + 2014-02-25T20:29:36.780-05:00 + 2014-02-26T11:00:47.947-05:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-26T10:58:33.130-05:00 + + + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21665005 + + + XF + ibm-focalpoint-cve20140843-file-upload(90714) + + Cross-site scripting (XSS) vulnerability in IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 allows remote authenticated users to inject arbitrary web script or HTML by uploading a file. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:ibm:rational_requirements_composer:4.0.0 + cpe:/a:ibm:rational_doors_next_generation:4.0.3 + cpe:/a:ibm:rational_requirements_composer:4.0.0.1 + cpe:/a:ibm:rational_doors_next_generation:4.0.2 + cpe:/a:ibm:rational_requirements_composer:4.0.0.2 + cpe:/a:ibm:rational_doors_next_generation:4.0.1 + cpe:/a:ibm:rational_doors_next_generation:4.0.0 + cpe:/a:ibm:rational_requirements_composer:3.0.1.1 + cpe:/a:ibm:rational_requirements_composer:4.0.5 + cpe:/a:ibm:rational_requirements_composer:3.0.1.2 + cpe:/a:ibm:rational_doors_next_generation:4.0.5 + cpe:/a:ibm:rational_doors_next_generation:4.0.4 + cpe:/a:ibm:rational_requirements_composer:3.0.1 + cpe:/a:ibm:rational_requirements_composer:3.0.1.5 + cpe:/a:ibm:rational_requirements_composer:4.0.2 + cpe:/a:ibm:rational_requirements_composer:4.0.1 + cpe:/a:ibm:rational_requirements_composer:4.0.4 + cpe:/a:ibm:rational_requirements_composer:3.0.1.3 + cpe:/a:ibm:rational_requirements_composer:3.0.1.4 + cpe:/a:ibm:rational_requirements_composer:4.0.3 + cpe:/a:ibm:rational_requirements_composer:3.0.1.6 + + CVE-2014-0844 + 2014-03-04T17:55:03.303-05:00 + 2014-03-05T10:42:11.510-05:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-03-05T10:42:00.637-05:00 + + + + XF + ibm-rrc-cve20140844-retrieval(90718) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21664412 + + Unspecified vulnerability in IBM Rational Requirements Composer 3.x before 3.0.1.6 iFix2 and 4.x before 4.0.6, and Rational DOORS Next Generation 4.x before 4.0.6, allows remote authenticated users to read arbitrary data via unknown vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:ibm:rational_requirements_composer:4.0.0 + cpe:/a:ibm:rational_doors_next_generation:4.0.3 + cpe:/a:ibm:rational_requirements_composer:4.0.0.1 + cpe:/a:ibm:rational_doors_next_generation:4.0.2 + cpe:/a:ibm:rational_requirements_composer:4.0.0.2 + cpe:/a:ibm:rational_doors_next_generation:4.0.1 + cpe:/a:ibm:rational_doors_next_generation:4.0.0 + cpe:/a:ibm:rational_requirements_composer:3.0.1.1 + cpe:/a:ibm:rational_requirements_composer:4.0.5 + cpe:/a:ibm:rational_requirements_composer:3.0.1.2 + cpe:/a:ibm:rational_doors_next_generation:4.0.5 + cpe:/a:ibm:rational_doors_next_generation:4.0.4 + cpe:/a:ibm:rational_requirements_composer:3.0.1 + cpe:/a:ibm:rational_requirements_composer:3.0.1.5 + cpe:/a:ibm:rational_requirements_composer:4.0.2 + cpe:/a:ibm:rational_requirements_composer:4.0.1 + cpe:/a:ibm:rational_requirements_composer:4.0.4 + cpe:/a:ibm:rational_requirements_composer:3.0.1.3 + cpe:/a:ibm:rational_requirements_composer:3.0.1.4 + cpe:/a:ibm:rational_requirements_composer:4.0.3 + cpe:/a:ibm:rational_requirements_composer:3.0.1.6 + + CVE-2014-0845 + 2014-03-04T17:55:03.320-05:00 + 2014-03-05T10:53:37.857-05:00 + + + 4.9 + NETWORK + MEDIUM + SINGLE_INSTANCE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-05T10:53:34.717-05:00 + + + + + XF + ibm-rrc-cve20140845-redirect(90719) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21664412 + + Open redirect vulnerability in IBM Rational Requirements Composer 3.x before 3.0.1.6 iFix2 and 4.x before 4.0.6, and Rational DOORS Next Generation 4.x before 4.0.6, allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:ibm:rational_requirements_composer:4.0.0 + cpe:/a:ibm:rational_doors_next_generation:4.0.3 + cpe:/a:ibm:rational_requirements_composer:4.0.0.1 + cpe:/a:ibm:rational_doors_next_generation:4.0.2 + cpe:/a:ibm:rational_requirements_composer:4.0.0.2 + cpe:/a:ibm:rational_doors_next_generation:4.0.1 + cpe:/a:ibm:rational_doors_next_generation:4.0.0 + cpe:/a:ibm:rational_requirements_composer:3.0.1.1 + cpe:/a:ibm:rational_requirements_composer:3.0.1.2 + cpe:/a:ibm:rational_requirements_composer:4.0.5 + cpe:/a:ibm:rational_doors_next_generation:4.0.5 + cpe:/a:ibm:rational_requirements_composer:3.0.1 + cpe:/a:ibm:rational_doors_next_generation:4.0.4 + cpe:/a:ibm:rational_requirements_composer:3.0.1.5 + cpe:/a:ibm:rational_requirements_composer:4.0.2 + cpe:/a:ibm:rational_requirements_composer:4.0.1 + cpe:/a:ibm:rational_requirements_composer:3.0.1.3 + cpe:/a:ibm:rational_requirements_composer:4.0.4 + cpe:/a:ibm:rational_requirements_composer:3.0.1.4 + cpe:/a:ibm:rational_requirements_composer:4.0.3 + cpe:/a:ibm:rational_requirements_composer:3.0.1.6 + + CVE-2014-0846 + 2014-03-04T17:55:03.337-05:00 + 2014-03-05T10:54:53.280-05:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-05T10:54:53.170-05:00 + + + + + XF + ibm-rrc-cve20140846-xss(90720) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21664412 + + Cross-site scripting (XSS) vulnerability in IBM Rational Requirements Composer 3.x before 3.0.1.6 iFix2 and 4.x before 4.0.6, and Rational DOORS Next Generation 4.x before 4.0.6, allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. + + + + + + + + + + + + cpe:/a:ibm:netezza_performance_portal:2.0.0.3 + cpe:/a:ibm:netezza_performance_portal:2.0.0.2 + cpe:/a:ibm:netezza_performance_portal:2.0.0.1 + cpe:/a:ibm:netezza_performance_portal:2.0.0.0 + + CVE-2014-0848 + 2014-03-26T06:55:05.193-04:00 + 2014-03-26T13:50:53.127-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-03-26T13:50:36.127-04:00 + + + + + XF + ibm-netezza-cve20140848-weak-sec(90723) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21665278 + + The (1) ssl.conf and (2) httpd.conf files in the Apache HTTP Server component in IBM Netezza Performance Portal 2.0 before 2.0.0.4 have weak SSLCipherSuite values, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack. + + + + + + + + + + cpe:/a:ibm:infosphere_master_data_management_reference_data_management_hub:10.1 + cpe:/a:ibm:infosphere_master_data_management_reference_data_management_hub:11.0 + + CVE-2014-0850 + 2014-03-16T10:06:45.163-04:00 + 2014-03-17T14:19:30.150-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-17T14:19:24.117-04:00 + + + + + XF + ibm-mdm-rdm-cve20140850-xss(90751) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21666119 + + Cross-site scripting (XSS) vulnerability in IBM InfoSphere Master Data Management Reference Data Management (RDM) Hub 10.1 and 11.0 before 11.0.0.0-MDM-IF008 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:ibm:rational_focal_point:6.6.0.1 + cpe:/a:ibm:rational_focal_point:6.4.0.1 + cpe:/a:ibm:rational_focal_point:6.5.0.1 + cpe:/a:ibm:rational_focal_point:6.5.0.2 + cpe:/a:ibm:rational_focal_point:6.5.2.1 + cpe:/a:ibm:rational_focal_point:6.5.2.2 + cpe:/a:ibm:rational_focal_point:6.5.2.3 + cpe:/a:ibm:rational_focal_point:6.5.1.1 + cpe:/a:ibm:rational_focal_point:6.5 + cpe:/a:ibm:rational_focal_point:6.4 + cpe:/a:ibm:rational_focal_point:6.6 + cpe:/a:ibm:rational_focal_point:6.5.2 + cpe:/a:ibm:rational_focal_point:6.4.1.3 + cpe:/a:ibm:rational_focal_point:6.5.1 + cpe:/a:ibm:rational_focal_point:6.4.1.2 + cpe:/a:ibm:rational_focal_point:6.4.1.1 + cpe:/a:ibm:rational_focal_point:6.4.1.0 + + CVE-2014-0853 + 2014-02-25T20:29:36.843-05:00 + 2014-02-26T11:11:00.743-05:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-26T11:03:47.403-05:00 + + + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21665005 + + + XF + ibm-focalpoint-cve20140853-xss(90754) + + Multiple cross-site scripting (XSS) vulnerabilities in the (1) ForwardController and (2) AttributeEditor scripts in IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + + + + + cpe:/a:ibm:cognos_business_intelligence:10.1 + cpe:/a:ibm:cognos_business_intelligence:10.2 + cpe:/a:ibm:cognos_business_intelligence:8.4.1 + cpe:/a:ibm:cognos_business_intelligence:10.2.1 + cpe:/a:ibm:cognos_business_intelligence:10.2.1.1 + cpe:/a:ibm:cognos_business_intelligence:10.1.1 + + CVE-2014-0854 + 2014-02-22T16:55:09.860-05:00 + 2014-03-05T23:50:42.173-05:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-02-24T13:40:18.403-05:00 + + + + + XF + ibm-cognos-cve20140854-xxe(90794) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21662856 + + The server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1 before IF6, 10.1.1 before IF5, 10.2 before IF7, 10.2.1 before IF4, and 10.2.1.1 before IF4 allows remote authenticated users to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. + + + + + + + + + + + + + + + + + cpe:/a:ibm:connections_portlets:4.0 + cpe:/a:ibm:connections_portlets:4.5.1 + cpe:/a:ibm:connections_portlets:4.5 + + CVE-2014-0855 + 2014-02-14T08:10:30.623-05:00 + 2014-02-14T11:57:25.503-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-14T11:57:22.037-05:00 + + + + + XF + ibm-websphere-cve20140855-xss(90802) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21663921 + + Multiple cross-site scripting (XSS) vulnerabilities in IBM Connections Portlets 4.x before 4.5.1 FP1 for IBM WebSphere Portal 7.0.0.2 and 8.0.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:ibm:websphere_application_server:8.0.0.4 + cpe:/a:ibm:websphere_application_server:8.0.0.3 + cpe:/a:ibm:websphere_application_server:8.0.0.2 + cpe:/a:ibm:websphere_application_server:8.0.0.0 + cpe:/a:ibm:websphere_application_server:8.0.0.8 + cpe:/a:ibm:websphere_application_server:8.5.0.0 + cpe:/a:ibm:websphere_application_server:8.0.0.7 + cpe:/a:ibm:websphere_application_server:8.5.0.1 + cpe:/a:ibm:websphere_application_server:8.0.0.1 + cpe:/a:ibm:websphere_application_server:8.5.0.2 + cpe:/a:ibm:websphere_application_server:8.0.0.6 + cpe:/a:ibm:websphere_application_server:8.0.0.5 + cpe:/a:ibm:websphere_application_server:8.5.5.1 + cpe:/a:ibm:websphere_application_server:8.5.5.0 + + CVE-2014-0857 + 2014-05-01T13:29:56.713-04:00 + 2014-05-02T09:57:31.300-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-05-02T09:57:30.973-04:00 + + + + + XF + ibm-was-cve20140857-info-disc(90863) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21669554 + + + AIXAPAR + PI07808 + + The Administrative Console in IBM WebSphere Application Server (WAS) 8.x before 8.0.0.9 and 8.5.x before 8.5.5.2 allows remote authenticated users to obtain sensitive information via a crafted request. + + + + + + + + + + + cpe:/a:ibm:content_navigator:2.0.1 + cpe:/a:ibm:content_navigator:2.0.0 + cpe:/a:ibm:content_navigator:2.0.2 + + CVE-2014-0858 + 2014-02-27T15:55:06.927-05:00 + 2014-02-28T11:40:13.397-05:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-28T11:40:13.333-05:00 + + + + + XF + ibm-navigator-cve20140858-xss(90864) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21665358 + + IBM Content Navigator 2.x before 2.0.2.2-ICN-FP002 allows remote authenticated users to bypass intended access restrictions and conduct deleteAction attacks via a modified URL. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:ibm:websphere_application_server:8.0.0.4 + cpe:/a:ibm:websphere_application_server:8.0.0.3 + cpe:/a:ibm:websphere_application_server:8.0.0.2 + cpe:/a:ibm:websphere_application_server:7.0.0.4 + cpe:/a:ibm:websphere_application_server:7.0.0.5 + cpe:/a:ibm:websphere_application_server:7.0.0.27 + cpe:/a:ibm:websphere_application_server:7.0.0.3 + cpe:/a:ibm:websphere_application_server:7.0.0.29 + cpe:/a:ibm:websphere_application_server:7.0.0.8 + cpe:/a:ibm:websphere_application_server:7.0.0.9 + cpe:/a:ibm:websphere_application_server:7.0.0.6 + cpe:/a:ibm:websphere_application_server:8.0.0.0 + cpe:/a:ibm:websphere_application_server:7.0.0.7 + cpe:/a:ibm:websphere_application_server:8.5.0.0 + cpe:/a:ibm:websphere_application_server:8.0.0.8 + cpe:/a:ibm:websphere_application_server:8.5.0.1 + cpe:/a:ibm:websphere_application_server:8.0.0.7 + cpe:/a:ibm:websphere_application_server:8.0.0.1 + cpe:/a:ibm:websphere_application_server:8.5.0.2 + cpe:/a:ibm:websphere_application_server:8.0.0.6 + cpe:/a:ibm:websphere_application_server:8.0.0.5 + cpe:/a:ibm:websphere_application_server:8.5.5.1 + cpe:/a:ibm:websphere_application_server:7.0.0.15 + cpe:/a:ibm:websphere_application_server:8.5.5.0 + cpe:/a:ibm:websphere_application_server:7.0.0.2 + cpe:/a:ibm:websphere_application_server:7.0.0.1 + cpe:/a:ibm:websphere_application_server:7.0.0.12 + cpe:/a:ibm:websphere_application_server:7.0.0.11 + cpe:/a:ibm:websphere_application_server:7.0.0.14 + cpe:/a:ibm:websphere_application_server:7.0.0.13 + cpe:/a:ibm:websphere_application_server:7.0.0.16 + cpe:/a:ibm:websphere_application_server:7.0.0.10 + cpe:/a:ibm:websphere_application_server:7.0.0.18 + cpe:/a:ibm:websphere_application_server:7.0.0.17 + cpe:/a:ibm:websphere_application_server:7.0.0.19 + cpe:/a:ibm:websphere_application_server:7.0.0.31 + cpe:/a:ibm:websphere_application_server:7.0 + cpe:/a:ibm:websphere_application_server:7.0.0.25 + cpe:/a:ibm:websphere_application_server:7.0.0.24 + cpe:/a:ibm:websphere_application_server:7.0.0.23 + cpe:/a:ibm:websphere_application_server:7.0.0.22 + cpe:/a:ibm:websphere_application_server:7.0.0.21 + + CVE-2014-0859 + 2014-05-01T13:29:56.730-04:00 + 2014-05-02T10:01:30.323-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-05-02T10:01:29.917-04:00 + + + + XF + ibm-was-cve20140859-retry(90879) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21669554 + + + AIXAPAR + PI08892 + + The web-server plugin in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.33, 8.x before 8.0.0.9, and 8.5.x before 8.5.5.2, when POST retries are enabled, allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors. + + + + + + + + + + + + + + cpe:/a:ibm:cognos_business_intelligence:10.1 + cpe:/a:ibm:cognos_business_intelligence:10.2 + cpe:/a:ibm:cognos_business_intelligence:8.4.1 + cpe:/a:ibm:cognos_business_intelligence:10.2.1 + cpe:/a:ibm:cognos_business_intelligence:10.2.1.1 + cpe:/a:ibm:cognos_business_intelligence:10.1.1 + + CVE-2014-0861 + 2014-02-22T16:55:09.877-05:00 + 2014-03-05T23:50:42.360-05:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-24T13:38:09.963-05:00 + + + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21662856 + + Cross-site scripting (XSS) vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1 before IF6, 10.1.1 before IF5, 10.2 before IF7, 10.2.1 before IF4, and 10.2.1.1 before IF4 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter that is not properly handled during use of the Back button. + + + + + + + + + + + + + + + + + + + + + + cpe:/a:ibm:rational_collaborative_lifecycle_management:3.0.1.2 + cpe:/a:ibm:rational_collaborative_lifecycle_management:3.0.1.3 + cpe:/a:ibm:rational_collaborative_lifecycle_management:3.0.1.1 + cpe:/a:ibm:rational_collaborative_lifecycle_management:3.0.1.6 + cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.0 + cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.1 + cpe:/a:ibm:rational_collaborative_lifecycle_management:3.0.0 + cpe:/a:ibm:rational_collaborative_lifecycle_management:3.0.1 + cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.4 + cpe:/a:ibm:rational_collaborative_lifecycle_management:3.0.1.5 + cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.5 + cpe:/a:ibm:rational_collaborative_lifecycle_management:3.0.1.4 + cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.2 + cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.3 + + CVE-2014-0862 + 2014-03-01T23:57:25.777-05:00 + 2014-03-03T11:54:19.397-05:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-03T11:54:19.317-05:00 + + + + XF + ibm-rationalclm-cve20140862-rce(90895) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21664566 + + Unspecified vulnerability in Jazz Team Server in IBM Rational Collaborative Lifecycle Management (CLM) 3.x before 3.0.1.6 iFix 2 and 4.x before 4.0.6 allows remote attackers to execute arbitrary code via unknown vectors. + + + + + + + + + + + + + cpe:/a:ibm:infosphere_master_data_management_server:8.5 + cpe:/a:ibm:infosphere_master_data_management_server:10.0 + cpe:/a:ibm:infosphere_master_data_management_server:10.1 + cpe:/a:ibm:infosphere_master_data_management_server:9.0.1 + cpe:/a:ibm:infosphere_master_data_management_server:9.0.2 + + CVE-2014-0873 + 2014-03-16T10:06:45.193-04:00 + 2014-03-27T17:50:37.103-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-17T15:15:16.497-04:00 + + + + + XF + ibm-infosphere-cve20140873-csrf(90994) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21666462 + + Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) Data Stewardship, (2) Business Admin, and (3) Product interfaces in IBM InfoSphere Master Data Management (MDM) Server 8.5 before 8.5.0.82, 9.0.1 before 9.0.1.38, 9.0.2 before 9.0.2.35, 10.0 before 10.0.0.0.26, and 10.1 before 10.1.0.0.15 allow remote attackers to hijack the authentication of arbitrary users. + + + + + + + + + + + cpe:/a:ibm:content_navigator:2.0.1 + cpe:/a:ibm:content_navigator:2.0.0 + cpe:/a:ibm:content_navigator:2.0.2 + + CVE-2014-0874 + 2014-02-28T01:18:54.353-05:00 + 2014-02-28T13:00:50.923-05:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-28T13:00:50.733-05:00 + + + + + XF + ibm-cn-cve20140874-xss(91002) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21665362 + + Cross-site scripting (XSS) vulnerability in IBM Content Navigator 2.x before 2.0.2.2-ICN-FP002 allows remote authenticated users to inject arbitrary web script or HTML via an unspecified parameter. + + + + + + + + + + cpe:/a:ibm:datacap_taskmaster_capture:8.1 + cpe:/a:ibm:datacap_taskmaster_capture:8.0.1 + + CVE-2014-0879 + 2014-03-21T06:55:05.143-04:00 + 2014-03-24T18:45:18.727-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-21T08:44:17.000-04:00 + + + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21666888 + + + XF + ibm-taskmaster-cve20140879-code-exec(91115) + + Stack-based buffer overflow in the Taskmaster Capture ActiveX control in IBM Datacap Taskmaster Capture 8.0.1, and 8.1 before FP2, allows remote attackers to execute arbitrary code via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:ibm:storwize_v7000_software:6.3.0.0 + cpe:/a:ibm:storwize_v3500_software:7.2.0.0 + cpe:/a:ibm:flex_system_v7000_software:7.2.0.0 + cpe:/a:ibm:storwize_v5000_software:7.2.0.0 + cpe:/a:ibm:san_volume_controller_software:6.2.0.0 + cpe:/a:ibm:san_volume_controller_software:6.1.0.10 + cpe:/a:ibm:san_volume_controller_software:7.2.0.1 + cpe:/a:ibm:san_volume_controller_software:7.2.0.2 + cpe:/a:ibm:san_volume_controller_software:6.2.0.1 + cpe:/a:ibm:san_volume_controller_software:7.1.0.0 + cpe:/a:ibm:storwize_v7000_software:7.2.0.2 + cpe:/a:ibm:storwize_v7000_software:7.2.0.1 + cpe:/a:ibm:san_volume_controller_software:7.1.0.1 + cpe:/a:ibm:san_volume_controller_software:6.3.0.2 + cpe:/a:ibm:flex_system_v7000_software:7.1.0.6 + cpe:/a:ibm:san_volume_controller_software:6.3.0.3 + cpe:/a:ibm:flex_system_v7000_software:7.1.0.7 + cpe:/a:ibm:san_volume_controller_software:6.3.0.1 + cpe:/a:ibm:san_volume_controller_software:6.3.0.6 + cpe:/a:ibm:storwize_v3500_software:6.4.1.7 + cpe:/a:ibm:san_volume_controller_software:6.3.0.7 + cpe:/a:ibm:san_volume_controller_software:6.3.0.4 + cpe:/a:ibm:san_volume_controller_software:6.3.0.5 + cpe:/a:ibm:storwize_v5000_software:7.2.0.2 + cpe:/a:ibm:storwize_v5000_software:7.2.0.1 + cpe:/a:ibm:flex_system_v7000_software:7.1.0.2 + cpe:/a:ibm:flex_system_v7000_software:7.1.0.3 + cpe:/a:ibm:flex_system_v7000_software:7.1.0.5 + cpe:/a:ibm:san_volume_controller_software:6.1.0.0 + cpe:/a:ibm:san_volume_controller_software:6.1.0.1 + cpe:/a:ibm:san_volume_controller_software:6.1.0.2 + cpe:/a:ibm:storwize_v3500_software:7.1.0.5 + cpe:/a:ibm:storwize_v3500_software:7.1.0.6 + cpe:/a:ibm:san_volume_controller_software:6.4.0.3 + cpe:/a:ibm:san_volume_controller_software:6.4.0.4 + cpe:/a:ibm:san_volume_controller_software:6.4.0.1 + cpe:/a:ibm:san_volume_controller_software:6.4.0.2 + cpe:/a:ibm:storwize_v3500_software:7.1.0.2 + cpe:/a:ibm:storwize_v3500_software:7.1.0.3 + cpe:/a:ibm:san_volume_controller_software:6.4.0.0 + cpe:/a:ibm:storwize_v7000_software:6.4.0.4 + cpe:/a:ibm:storwize_v7000_software:6.4.0.1 + cpe:/a:ibm:storwize_v7000_software:6.4.0.0 + cpe:/a:ibm:storwize_v7000_software:7.2.0.0 + cpe:/a:ibm:storwize_v7000_software:6.4.0.3 + cpe:/a:ibm:storwize_v7000_software:6.4.0.2 + cpe:/a:ibm:storwize_v3500_software:6.4.1.6 + cpe:/a:ibm:storwize_v3500_software:6.4.1.5 + cpe:/a:ibm:storwize_v3500_software:6.4.1.4 + cpe:/a:ibm:storwize_v3500_software:6.4.1.3 + cpe:/h:ibm:storwize_v7000:- + cpe:/a:ibm:storwize_v3500_software:6.4.1.2 + cpe:/a:ibm:storwize_v3500_software:6.4.1.1 + cpe:/a:ibm:storwize_v3500_software:6.4.1.0 + cpe:/a:ibm:flex_system_v7000_software:6.4.1.5 + cpe:/a:ibm:storwize_v7000_software:7.1.0.5 + cpe:/a:ibm:san_volume_controller_software:7.1.0.7 + cpe:/a:ibm:flex_system_v7000_software:6.4.1.6 + cpe:/a:ibm:flex_system_v7000_software:6.4.1.3 + cpe:/a:ibm:storwize_v7000_software:7.1.0.3 + cpe:/a:ibm:san_volume_controller_software:7.1.0.6 + cpe:/a:ibm:san_volume_controller_software:7.1.0.5 + cpe:/a:ibm:flex_system_v7000_software:6.4.1.4 + cpe:/a:ibm:storwize_v7000_software:7.1.0.2 + cpe:/a:ibm:storwize_v3500_software:7.1.0.0 + cpe:/a:ibm:san_volume_controller_software:7.2.0.0 + cpe:/a:ibm:san_volume_controller_software:7.1.0.3 + cpe:/a:ibm:san_volume_controller_software:7.1.0.2 + cpe:/a:ibm:storwize_v7000_software:7.1.0.7 + cpe:/a:ibm:storwize_v7000_software:7.1.0.6 + cpe:/a:ibm:storwize_v3700_software:7.2.0.0 + cpe:/a:ibm:flex_system_v7000_software:6.4.1.2 + cpe:/a:ibm:storwize_v7000_software:6.4.1.7 + cpe:/a:ibm:storwize_v3700_software:7.1.0.3 + cpe:/a:ibm:storwize_v3700_software:7.1.0.6 + cpe:/a:ibm:storwize_v3700_software:7.1.0.5 + cpe:/a:ibm:storwize_v3700_software:7.1.0.2 + cpe:/a:ibm:storwize_v7000_software:6.4.1.2 + cpe:/a:ibm:storwize_v3500_software:7.1.0.1 + cpe:/a:ibm:storwize_v7000_software:6.4.1.1 + cpe:/a:ibm:storwize_v7000_software:6.4.1.4 + cpe:/a:ibm:storwize_v7000_software:6.4.1.3 + cpe:/a:ibm:storwize_v7000_software:6.4.1.6 + cpe:/a:ibm:storwize_v7000_software:6.4.1.5 + cpe:/a:ibm:san_volume_controller_software:6.2.0.4 + cpe:/a:ibm:san_volume_controller_software:6.2.0.3 + cpe:/a:ibm:san_volume_controller_software:6.2.0.2 + cpe:/h:ibm:flex_system_v7000:- + cpe:/a:ibm:san_volume_controller_software:6.2.0.6 + cpe:/a:ibm:san_volume_controller_software:6.2.0.5 + cpe:/a:ibm:storwize_v3700_software:7.1.0.7 + cpe:/a:ibm:flex_system_v7000_software:6.4.1.7 + cpe:/a:ibm:flex_system_v7000_software:7.1.0.1 + cpe:/h:ibm:storwize_v3500:- + cpe:/a:ibm:storwize_v5000_software:7.1.0.2 + cpe:/a:ibm:storwize_v5000_software:7.1.0.3 + cpe:/a:ibm:storwize_v5000_software:7.1.0.4 + cpe:/a:ibm:storwize_v5000_software:7.1.0.5 + cpe:/h:ibm:storwize_v3700:- + cpe:/a:ibm:storwize_v5000_software:7.1.0.6 + cpe:/a:ibm:storwize_v5000_software:7.1.0.7 + cpe:/a:ibm:storwize_v3700_software:7.1.0.0 + cpe:/a:ibm:storwize_v3700_software:7.1.0.1 + cpe:/a:ibm:storwize_v3700_software:6.4.1.5 + cpe:/a:ibm:storwize_v3700_software:6.4.1.4 + cpe:/a:ibm:storwize_v3700_software:6.4.1.6 + cpe:/a:ibm:san_volume_controller_software:6.4.1.6 + cpe:/a:ibm:storwize_v3500_software:7.2.0.2 + cpe:/a:ibm:storwize_v3500_software:7.2.0.1 + cpe:/a:ibm:storwize_v7000_software:6.3.0.2 + cpe:/a:ibm:storwize_v7000_software:6.3.0.1 + cpe:/a:ibm:storwize_v7000_software:6.3.0.4 + cpe:/a:ibm:storwize_v7000_software:6.3.0.3 + cpe:/a:ibm:san_volume_controller_software:6.4.1.1 + cpe:/a:ibm:san_volume_controller_software:6.4.1.2 + cpe:/a:ibm:storwize_v7000_software:6.3.0.6 + cpe:/a:ibm:storwize_v7000_software:6.3.0.5 + cpe:/a:ibm:san_volume_controller_software:6.4.1.3 + cpe:/h:ibm:storwize_v5000:- + cpe:/a:ibm:san_volume_controller_software:6.4.1.4 + cpe:/a:ibm:storwize_v7000_software:6.3.0.7 + cpe:/a:ibm:san_volume_controller_software:6.4.1.5 + cpe:/a:ibm:storwize_v3700_software:7.2.0.2 + cpe:/a:ibm:storwize_v7000_software:7.1.0.0 + cpe:/a:ibm:storwize_v7000_software:7.1.0.1 + cpe:/a:ibm:san_volume_controller_software:6.4.1.7 + cpe:/a:ibm:storwize_v3700_software:7.2.0.1 + cpe:/a:ibm:san_volume_controller_software:6.1.0.6 + cpe:/a:ibm:san_volume_controller_software:6.1.0.7 + cpe:/h:ibm:san_volume_controller:- + cpe:/a:ibm:san_volume_controller_software:6.1.0.8 + cpe:/a:ibm:san_volume_controller_software:6.1.0.9 + cpe:/a:ibm:san_volume_controller_software:6.1.0.3 + cpe:/a:ibm:san_volume_controller_software:6.1.0.4 + cpe:/a:ibm:san_volume_controller_software:6.1.0.5 + cpe:/a:ibm:storwize_v3700_software:6.4.1.7 + cpe:/a:ibm:san_volume_controller_software:6.3.0.0 + cpe:/a:ibm:flex_system_v7000_software:7.2.0.1 + cpe:/a:ibm:storwize_v3700_software:6.4.1.2 + cpe:/a:ibm:flex_system_v7000_software:7.2.0.2 + cpe:/a:ibm:storwize_v3700_software:6.4.1.3 + cpe:/a:ibm:storwize_v3700_software:6.4.1.0 + cpe:/a:ibm:storwize_v3700_software:6.4.1.1 + + CVE-2014-0880 + 2014-03-28T21:55:07.047-04:00 + 2014-03-31T13:06:08.423-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-31T13:06:06.203-04:00 + + + + XF + ibm-storwize-cve20140880-cli(91145) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004570 + + IBM SAN Volume Controller; Storwize V3500, V3700, V5000, and V7000; and Flex System V7000 with software 6.3 and 6.4 before 6.4.1.8, and 7.1 and 7.2 before 7.2.0.3, allow remote attackers to obtain CLI access, and consequently cause a denial of service, via unspecified traffic to the administrative IP address. + + + + + + + + + + cpe:/a:ibm:lotus_protector_for_mail_security:2.8.1 + cpe:/a:ibm:lotus_protector_for_mail_security:2.8 + + CVE-2014-0884 + 2014-03-25T16:55:07.170-04:00 + 2014-03-26T12:00:48.157-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-26T12:00:40.047-04:00 + + + + + XF + ibm-lpms-cve20140884-xss(91170) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21668124 + + Cross-site scripting (XSS) vulnerability in the Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + cpe:/a:ibm:lotus_protector_for_mail_security:2.8.1 + cpe:/a:ibm:lotus_protector_for_mail_security:2.8 + + CVE-2014-0885 + 2014-03-25T16:55:07.293-04:00 + 2014-03-26T12:10:14.957-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-26T12:09:28.813-04:00 + + + + + XF + ibm-lpms-cve20140885-csrf(91171) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21668124 + + Cross-site request forgery (CSRF) vulnerability in the Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors. + + + + + + + + + + cpe:/a:ibm:lotus_protector_for_mail_security:2.8.1 + cpe:/a:ibm:lotus_protector_for_mail_security:2.8 + + CVE-2014-0886 + 2014-03-25T16:55:07.450-04:00 + 2014-03-26T12:34:34.490-04:00 + + + 7.1 + NETWORK + HIGH + SINGLE_INSTANCE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-26T12:11:58.320-04:00 + + + + + XF + ibm-lpms-cve20140886-command(91172) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21668124 + + The Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to bypass intended access restrictions and execute arbitrary commands via unspecified vectors. + + + + + + + + + + cpe:/a:ibm:lotus_protector_for_mail_security:2.8.1 + cpe:/a:ibm:lotus_protector_for_mail_security:2.8 + + CVE-2014-0887 + 2014-03-25T16:55:07.590-04:00 + 2014-03-26T12:33:21.097-04:00 + + + 7.1 + NETWORK + HIGH + SINGLE_INSTANCE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-26T12:12:44.070-04:00 + + + + + XF + ibm-lpms-cve20140887-command-root(91173) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21668124 + + The Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors. + + + + + + + + + + + + + + + cpe:/a:ibm:sametime:8.5.2.0 + cpe:/a:ibm:sametime:8.5.1.1 + cpe:/a:ibm:sametime:9.0.0.1 + cpe:/a:ibm:sametime:8.5.1.0 + cpe:/a:ibm:sametime:9.0.0.0 + cpe:/a:ibm:sametime:8.5.1.2 + cpe:/a:ibm:sametime:8.5.2.1 + + CVE-2014-0890 + 2014-03-06T06:55:05.460-05:00 + 2014-03-07T13:55:56.940-05:00 + + + 1.9 + LOCAL + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-03-06T08:56:51.000-05:00 + + + + + XF + ibm-lotus-cve20148090-info-disc(91282) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21665658 + + The Connect client in IBM Sametime 8.5.1, 8.5.1.1, 8.5.1.2, 8.5.2, 8.5.2.1, 9.0, and 9.0.0.1, when a certain com.ibm.collaboration.realtime.telephony.*.level setting is used, logs cleartext passwords during Audio/Video chat sessions, which allows local users to obtain sensitive information by reading a log file. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:ibm:lotus_notes:8.5.3.1 + cpe:/a:ibm:lotus_domino:8.5.2.4 + cpe:/a:ibm:lotus_notes:8.5.0.1 + cpe:/a:ibm:lotus_domino:8.5.2.3 + cpe:/a:ibm:lotus_notes:8.5.0.0 + cpe:/a:ibm:lotus_notes:8.5.2.3 + cpe:/a:ibm:lotus_domino:8.5.0.1 + cpe:/a:ibm:lotus_notes:8.5.3.6 + cpe:/a:ibm:lotus_domino:8.5.2.1 + cpe:/a:ibm:lotus_domino:8.5.2.0 + cpe:/a:ibm:lotus_notes:8.5.3.4 + cpe:/a:ibm:lotus_notes:8.5.3.5 + cpe:/a:ibm:lotus_notes:8.5.3.2 + cpe:/a:ibm:lotus_notes:8.5.3.3 + cpe:/a:ibm:lotus_domino:8.5.2.2 + cpe:/a:ibm:lotus_notes:8.5.2.2 + cpe:/a:ibm:lotus_notes:8.5.2.1 + cpe:/a:ibm:lotus_notes:8.5.2.0 + cpe:/a:ibm:lotus_domino:8.5.3.2 + cpe:/a:ibm:lotus_domino:9.0.1.0 + cpe:/a:ibm:lotus_domino:8.5.3.4 + cpe:/a:ibm:lotus_domino:8.5.3.3 + cpe:/a:ibm:lotus_domino:8.5.1.4 + cpe:/a:ibm:lotus_domino:8.5.3.6 + cpe:/a:ibm:lotus_domino:8.5.3.5 + cpe:/a:ibm:lotus_domino:8.5.1.5 + cpe:/a:ibm:lotus_notes:9.0.1.0 + cpe:/a:ibm:lotus_notes:8.5.1.4 + cpe:/a:ibm:lotus_notes:8.5.1.5 + cpe:/a:ibm:lotus_domino:9.0.0.0 + cpe:/a:ibm:lotus_notes:9.0.0.0 + cpe:/a:ibm:lotus_domino:8.5.3.0 + cpe:/a:ibm:lotus_domino:8.5.3.1 + cpe:/a:ibm:lotus_notes:8.5 + cpe:/a:ibm:lotus_notes:8.5.1 + cpe:/a:ibm:lotus_notes:8.5.3 + cpe:/a:ibm:lotus_notes:8.5.1.1 + cpe:/a:ibm:lotus_domino:8.5.1.3 + cpe:/a:ibm:lotus_notes:8.5.1.0 + cpe:/a:ibm:lotus_notes:8.5.1.3 + cpe:/a:ibm:lotus_domino:8.5.0 + cpe:/a:ibm:lotus_notes:8.5.1.2 + cpe:/a:ibm:lotus_domino:8.5.1 + cpe:/a:ibm:lotus_domino:8.5.1.1 + cpe:/a:ibm:lotus_domino:8.5.1.2 + + CVE-2014-0892 + 2014-04-23T15:55:05.173-04:00 + 2014-04-24T13:45:47.737-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-24T13:45:46.847-04:00 + + + + + CERT-VN + VU#350089 + + + XF + ibm-notes-cve20140892-linux32-rce(91286) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21670264 + + IBM Notes and Domino 8.5.x before 8.5.3 FP6 IF3 and 9.x before 9.0.1 FP1 on 32-bit Linux platforms use incorrect gcc options, which makes it easier for remote attackers to execute arbitrary code by leveraging the absence of the NX protection mechanism and placing crafted x86 code on the stack, aka SPR KLYH9GGS9W. + + + + + + + + + cpe:/a:ibm:spss_samplepower:3.0.1.0 + + CVE-2014-0895 + 2014-03-16T10:06:45.227-04:00 + 2014-03-17T14:21:28.213-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-17T14:21:28.183-04:00 + + + + + XF + ibm-spss-cve20140895-code-exec(91314) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21666790 + + + AIXAPAR + PI09800 + + Buffer overflow in the vsflex8l ActiveX control in IBM SPSS SamplePower 3.0.1 before FP1 3.0.1-IM-S3SAMPC-WIN32-FP001-IF02 allows remote attackers to execute arbitrary code via a crafted ComboList property value. + + + + + + + + + + + + + cpe:/a:ibm:websphere_application_server:8.5.0.0:-:liberty_profile + cpe:/a:ibm:websphere_application_server:8.5.0.2:-:liberty_profile + cpe:/a:ibm:websphere_application_server:8.5.0.1:-:liberty_profile + cpe:/a:ibm:websphere_application_server:8.5.5.0:-:liberty_profile + cpe:/a:ibm:websphere_application_server:8.5.5.1:-:liberty_profile + + CVE-2014-0896 + 2014-05-01T13:29:56.747-04:00 + 2014-05-02T10:14:42.947-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-05-02T10:14:42.897-04:00 + + + + + XF + ibm-was-cve20140896-info-disc(91326) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21669554 + + + AIXAPAR + PI10134 + + IBM WebSphere Application Server (WAS) Liberty Profile 8.5.x before 8.5.5.2 allows remote attackers to obtain sensitive information via a crafted request. + + + + + + + + + + cpe:/o:ibm:aix:7.1.2 + cpe:/o:ibm:aix:7.1.1 + + CVE-2014-0899 + 2014-03-11T09:01:09.607-04:00 + 2014-03-11T10:57:10.420-04:00 + + + 6.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-11T10:57:10.390-04:00 + + + + + XF + ibm-aix-wpar-ftpd(91396) + + + AIXAPAR + IV51421 + + + AIXAPAR + IV51420 + + + CONFIRM + http://aix.software.ibm.com/aix/efixes/security/wparcre_advisory.asc + + ftpd in IBM AIX 7.1.1 before SP10 and 7.1.2 before SP5, when a Workload Partition (aka WPAR) for AIX 5.2 or 5.3 is used, allows remote authenticated users to bypass intended permission settings and modify arbitrary files via FTP commands. + + + + + + + + + + cpe:/a:ibm:websphere_portal:8.0.0.0 + cpe:/a:ibm:websphere_portal:8.0.0.1 + + CVE-2014-0901 + 2014-04-01T23:58:17.043-04:00 + 2014-04-02T11:55:00.730-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-02T11:55:00.357-04:00 + + + + + XF + ibm-wsportal-cve20140901-sr-xss(91398) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21667016 + + + AIXAPAR + PI12659 + + Cross-site scripting (XSS) vulnerability in the Social Rendering implementation in the IBM Connections integration in IBM WebSphere Portal 8.0.0.x before 8.0.0.1 CF11 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + + + + + cpe:/a:ibm:security_appscan:8.6:-:standard + cpe:/a:ibm:security_appscan:8.8:-:standard + cpe:/a:ibm:security_appscan:8.7:-:standard + cpe:/a:ibm:security_appscan:8.0:-:standard + cpe:/a:ibm:security_appscan:8.5:-:standard + cpe:/a:ibm:security_appscan:7.9:-:standard + + CVE-2014-0904 + 2014-03-26T06:55:05.207-04:00 + 2014-03-26T14:03:18.013-04:00 + + + 7.6 + NETWORK + HIGH + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-26T14:03:17.873-04:00 + + + + + XF + ibm-appscan-cve20140904-code-exec(91536) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21666775 + + The update process in IBM Security AppScan Standard 7.9 through 8.8 does not require integrity checks of downloaded files, which allows remote attackers to execute arbitrary code via a crafted file. + + + + + + + + + + + + + + + + + + + cpe:/a:ibm:business_process_manager:8.5.0.1 + cpe:/a:ibm:business_process_manager:8.5.0.0 + cpe:/a:ibm:business_process_manager:8.0.0.0 + cpe:/a:ibm:business_process_manager:7.5.0.1 + cpe:/a:ibm:business_process_manager:8.0.1.2 + cpe:/a:ibm:business_process_manager:7.5.0.0 + cpe:/a:ibm:business_process_manager:7.5.1.1 + cpe:/a:ibm:business_process_manager:7.5.1.0 + cpe:/a:ibm:business_process_manager:8.0.1.1 + cpe:/a:ibm:business_process_manager:8.0.1.0 + cpe:/a:ibm:business_process_manager:7.5.1.2 + + CVE-2014-0908 + 2014-04-10T19:55:04.730-04:00 + 2014-04-11T15:21:12.270-04:00 + + + 6.0 + NETWORK + MEDIUM + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-11T15:21:12.160-04:00 + + + + + XF + ibm-bpm-cve20140908-priv-escalation(91870) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21669330 + + + AIXAPAR + JR49505 + + The User Attribute implementation in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.2, and 8.5.x through 8.5.0.1 does not verify authorization for read or write access to attribute values, which allows remote authenticated users to obtain sensitive information, configure e-mail notifications, or modify task assignments via REST API calls. + + + + + + + + + + cpe:/a:ibm:spss_analytic_server:1.0.1.0 + cpe:/a:ibm:spss_analytic_server:1.0.0.0 + + CVE-2014-0920 + 2014-04-10T19:55:24.357-04:00 + 2014-04-11T15:15:37.397-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-11T15:15:37.367-04:00 + + + + + XF + ibm-spssas-cve20140920-plaintext-pw(92073) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21669506 + + + AIXAPAR + PI13527 + + IBM SPSS Analytic Server 1.0 before IF002 and 1.0.1 before IF004 logs cleartext passwords, which allows remote authenticated users to obtain sensitive information via unspecified vectors. + + + + + + + + + + + + + + + + cpe:/a:ibm:messagesight_jms_client:1.1.0.0 + cpe:/h:ibm:messagesight:- + cpe:/a:ibm:messagesight_jms_client:1.0.0.1 + cpe:/a:ibm:messagesight_jms_client:1.0.0.0 + + CVE-2014-0921 + 2014-04-15T19:13:17.023-04:00 + 2014-04-16T10:30:14.037-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-16T10:29:58.757-04:00 + + + + + XF + ibm-messagesight-cve20140921-dos(92074) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21670278 + + + AIXAPAR + IC98583 + + The server in IBM MessageSight 1.x before 1.1.0.0-IBM-IMA-IT01015 allows remote attackers to cause a denial of service (daemon crash and message data loss) via malformed headers during a WebSockets connection upgrade. + + + + + + + + + + + + + + + + cpe:/a:ibm:messagesight_jms_client:1.1.0.0 + cpe:/h:ibm:messagesight:- + cpe:/a:ibm:messagesight_jms_client:1.0.0.1 + cpe:/a:ibm:messagesight_jms_client:1.0.0.0 + + CVE-2014-0922 + 2014-04-15T19:13:17.057-04:00 + 2014-04-16T10:33:22.310-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-16T10:33:21.373-04:00 + + + + + XF + ibm-messagesight-cve20140922-dos(92075) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21670278 + + + AIXAPAR + IC98692 + + IBM MessageSight 1.x before 1.1.0.0-IBM-IMA-IT01015 allows remote attackers to cause a denial of service (resource consumption) via WebSockets MQ Telemetry Transport (MQTT) data. + + + + + + + + + + + + + + + + cpe:/a:ibm:messagesight_jms_client:1.1.0.0 + cpe:/h:ibm:messagesight:- + cpe:/a:ibm:messagesight_jms_client:1.0.0.1 + cpe:/a:ibm:messagesight_jms_client:1.0.0.0 + + CVE-2014-0923 + 2014-04-15T19:13:17.087-04:00 + 2014-04-16T10:33:41.607-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-16T10:33:40.733-04:00 + + + + + XF + ibm-messagesight-cve20140923-dos(92076) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21670278 + + + AIXAPAR + IT00582 + + IBM MessageSight 1.x before 1.1.0.0-IBM-IMA-IT01015 allows remote attackers to cause a denial of service (daemon restart) via crafted MQ Telemetry Transport (MQTT) authentication data. + + + + + + + + + + + + + + + + cpe:/a:ibm:messagesight_jms_client:1.1.0.0 + cpe:/h:ibm:messagesight:- + cpe:/a:ibm:messagesight_jms_client:1.0.0.1 + cpe:/a:ibm:messagesight_jms_client:1.0.0.0 + + CVE-2014-0924 + 2014-04-15T19:13:17.117-04:00 + 2014-04-16T10:33:43.763-04:00 + + + 4.6 + NETWORK + HIGH + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-16T10:33:43.717-04:00 + + + + + XF + ibm-messagesight-cve20140924-sec-bypass(92077) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21670278 + + + AIXAPAR + IT00583 + + IBM MessageSight 1.x before 1.1.0.0-IBM-IMA-IT01015 does not verify that all of the characters of a password are correct, which makes it easier for remote authenticated users to bypass intended access restrictions by leveraging knowledge of a password substring. + + + + + + + + + + cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.0 + cpe:/a:ibm:sterling_order_management:8.5 + + CVE-2014-0932 + 2014-04-21T18:55:08.303-04:00 + 2014-04-22T10:55:56.307-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-22T10:55:56.197-04:00 + + + + + XF + ibm-sterlingom-cve20140932-xss(92264) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21670912 + + + AIXAPAR + IT00419 + + Cross-site scripting (XSS) vulnerability in IBM Sterling Order Management 8.5 before HF105 and Sterling Selling and Fulfillment Foundation 9.0 before HF85 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. + + + + + + + + + cpe:/a:ibm:tivoli_netcool%2fomnibus:7.4.0 + + CVE-2014-0941 + 2014-05-01T13:29:56.760-04:00 + 2014-05-02T10:25:37.247-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-05-02T10:25:37.233-04:00 + + + + + XF + ibm-netcoolomnibus-cve20140941-xss(92400) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21671686 + + Cross-site scripting (XSS) vulnerability in webtop/eventviewer/eventViewer.jsp in the Web GUI in IBM Netcool/OMNIbus 7.4.0 before FP2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2014-0942. + + + + + + + + + cpe:/a:ibm:tivoli_netcool%2fomnibus:7.4.0 + + CVE-2014-0942 + 2014-05-01T13:29:56.777-04:00 + 2014-05-02T10:28:48.147-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-05-02T10:28:46.083-04:00 + + + + + XF + ibm-netcoolomnibus-cve20140942-xss(92401) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21671686 + + Cross-site scripting (XSS) vulnerability in webtop/eventviewer/eventViewer.jsp in the Web GUI in IBM Netcool/OMNIbus 7.4.0 before FP2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2014-0941. + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:sixapart:movabletype:5.2.6 + cpe:/a:sixapart:movabletype:5.0:rc2 + cpe:/a:sixapart:movabletype:5.2.7 + cpe:/a:sixapart:movabletype:5.2.2 + cpe:/a:sixapart:movabletype:5.2.3 + cpe:/a:sixapart:movabletype:6.0 + cpe:/a:sixapart:movabletype:5.031 + cpe:/a:sixapart:movabletype:5.2 + cpe:/a:sixapart:movabletype:5.15 + cpe:/a:sixapart:movabletype:5.04 + cpe:/a:sixapart:movabletype:5.03 + cpe:/a:sixapart:movabletype:5.12 + cpe:/a:sixapart:movabletype:5.02 + cpe:/a:sixapart:movabletype:5.11 + cpe:/a:sixapart:movabletype:5.01 + cpe:/a:sixapart:movabletype:5.14 + cpe:/a:sixapart:movabletype:5.13 + + CVE-2014-0977 + 2014-01-10T12:55:03.113-05:00 + 2014-02-21T00:06:30.517-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-10T16:39:37.883-05:00 + + + + + XF + movabletype-richtexteditor-xss(90095) + + + SECTRACK + 1029588 + + + BID + 64657 + + + DEBIAN + DSA-2841 + + + SECUNIA + 56405 + + + SECUNIA + 56295 + + + MLIST + [oss-security] 20140107 Re: CVE Request: cross-site scripting vulnerabilities in movable type 6.0.1, 5.2.9, and 5.161 + + + MLIST + [oss-security] 20140106 CVE Request: cross-site scripting vulnerabilities in movable type 6.0.1, 5.2.9, and 5.161 + + + CONFIRM + http://movabletype.org/news/2013/11/movable_type_601_529_and_5161_released_to_close_security_vul.html + + + CONFIRM + http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=734304 + + Cross-site scripting (XSS) vulnerability in the Rich Text Editor in Movable Type 5.0x, 5.1x before 5.161, 5.2.x before 5.2.9, and 6.0.x before 6.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + cpe:/a:graphviz:graphviz:2.34.0 + + CVE-2014-0978 + 2014-01-10T12:55:03.237-05:00 + 2014-02-21T00:06:30.593-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-01-10T13:39:40.947-05:00 + + + + + CONFIRM + https://github.com/ellson/graphviz/commit/7aaddf52cd98589fb0c3ab72a393f8411838438a + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1049165 + + + MISC + https://bugs.gentoo.org/show_bug.cgi?id=497274 + + + XF + graphviz-yyerror-bo(90085) + + + BID + 64674 + + + MANDRIVA + MDVSA-2014:024 + + + DEBIAN + DSA-2843 + + + SECUNIA + 56244 + + + SECUNIA + 55666 + + + MLIST + [oss-security] 20140107 Re: CVE Request: graphviz: stack-based buffer overflow in yyerror() + + + MLIST + [oss-security] 20140107 CVE Request: graphviz: stack-based buffer overflow in yyerror() + + Stack-based buffer overflow in the yyerror function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via a long line in a dot file. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:novell:opensuse:12.3 + cpe:/a:lightdm_gtk%2b_greeter_project:lightdm_gtk%2b_greeter:1.3.1 + cpe:/o:novell:opensuse:12.2 + cpe:/a:lightdm_gtk%2b_greeter_project:lightdm_gtk%2b_greeter:1.1.2 + cpe:/o:novell:opensuse:13.1 + cpe:/a:lightdm_gtk%2b_greeter_project:lightdm_gtk%2b_greeter:1.1.5 + cpe:/a:lightdm_gtk%2b_greeter_project:lightdm_gtk%2b_greeter:1.1.6 + cpe:/a:lightdm_gtk%2b_greeter_project:lightdm_gtk%2b_greeter:1.1.3 + cpe:/a:lightdm_gtk%2b_greeter_project:lightdm_gtk%2b_greeter:1.1.4 + cpe:/a:lightdm_gtk%2b_greeter_project:lightdm_gtk%2b_greeter:1.3.0 + cpe:/a:lightdm_gtk%2b_greeter_project:lightdm_gtk%2b_greeter:1.6.1 + cpe:/a:lightdm_gtk%2b_greeter_project:lightdm_gtk%2b_greeter:1.6.0 + cpe:/a:lightdm_gtk%2b_greeter_project:lightdm_gtk%2b_greeter:1.1.1 + cpe:/a:lightdm_gtk%2b_greeter_project:lightdm_gtk%2b_greeter:1.7.0 + cpe:/a:lightdm_gtk%2b_greeter_project:lightdm_gtk%2b_greeter:1.5.2 + cpe:/a:lightdm_gtk%2b_greeter_project:lightdm_gtk%2b_greeter:1.5.1 + cpe:/a:lightdm_gtk%2b_greeter_project:lightdm_gtk%2b_greeter:1.5.0 + + CVE-2014-0979 + 2014-01-22T20:55:04.460-05:00 + 2014-02-21T00:06:30.670-05:00 + + + 2.1 + LOCAL + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-01-23T13:43:35.513-05:00 + + + + CONFIRM + https://bugzilla.novell.com/show_bug.cgi?id=857303 + + + CONFIRM + https://bugs.launchpad.net/lightdm-gtk-greeter/+bug/1266449 + + + BID + 64679 + + + MLIST + [oss-security] 20140107 Re: CVE request: lightdm-gtk-greeter - local DOS due to NULL pointer dereference + + + SECUNIA + 56423 + + + SECUNIA + 56211 + + + SUSE + openSUSE-SU-2014:0071 + + + FEDORA + FEDORA-2014-1648 + + + FEDORA + FEDORA-2014-1647 + + The start_authentication function in lightdm-gtk-greeter.c in LightDM GTK+ Greeter before 1.7.1 does not properly handle the return value from the lightdm_greeter_get_authentication_user function, which allows local users to cause a denial of service (NULL pointer dereference) via an empty username. + + + + + + + + + cpe:/a:poster_software:publish_it:3.6d + + CVE-2014-0980 + 2014-02-11T12:55:06.793-05:00 + 2014-02-21T00:06:30.767-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-12T05:46:35.000-05:00 + + + + + XF + publishit-cve20140980-bo(90989) + + + BID + 65366 + + + BUGTRAQ + 20140205 CORE-2014-0001 - Publish-It Buffer Overflow Vulnerability + + + EXPLOIT-DB + 31461 + + + MISC + http://www.coresecurity.com/advisories/publish-it-buffer-overflow-vulnerability + + + SECUNIA + 56618 + + + FULLDISC + 20140205 CORE-2014-0001 - Publish-It Buffer Overflow Vulnerability + + + MISC + http://packetstormsecurity.com/files/125089 + + + OSVDB + 102911 + + Buffer overflow in Poster Software PUBLISH-iT 3.6d allows remote attackers to execute arbitrary code via a crafted PUI file. + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:vm_virtualbox:4.2.14 + cpe:/a:oracle:vm_virtualbox:4.2.16 + cpe:/a:oracle:vm_virtualbox:4.2.8 + cpe:/a:oracle:vm_virtualbox:4.2.6 + cpe:/a:oracle:vm_virtualbox:4.3.0 + cpe:/a:oracle:vm_virtualbox:4.3.2 + cpe:/a:oracle:vm_virtualbox:4.2.4 + cpe:/a:oracle:vm_virtualbox:4.3.4 + cpe:/a:oracle:vm_virtualbox:4.2.2 + cpe:/a:oracle:vm_virtualbox:4.2.12 + cpe:/a:oracle:vm_virtualbox:4.2.0 + cpe:/a:oracle:vm_virtualbox:4.2.10 + cpe:/a:oracle:vm_virtualbox:4.2.20 + cpe:/a:oracle:vm_virtualbox:4.3.6 + cpe:/a:oracle:vm_virtualbox:4.2.18 + + CVE-2014-0981 + 2014-03-31T10:58:35.570-04:00 + 2014-04-24T01:04:39.873-04:00 + + + 4.4 + LOCAL + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-31T13:54:34.427-04:00 + + + + + CONFIRM + https://www.virtualbox.org/changeset/50437/vbox + + + BUGTRAQ + 20140311 CORE-2014-0002 - Oracle VirtualBox 3D Acceleration Multiple Memory Corruption Vulnerabilities + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + EXPLOIT-DB + 32208 + + + MISC + http://www.coresecurity.com/advisories/oracle-virtualbox-3d-acceleration-multiple-memory-corruption-vulnerabilities + + + SECUNIA + 57384 + + + FULLDISC + 20140311 CORE-2014-0002 - Oracle VirtualBox 3D Acceleration Multiple Memory Corruption Vulnerabilities + + VBox/GuestHost/OpenGL/util/net.c in Oracle VirtualBox before 3.2.22, 4.0.x before 4.0.24, 4.1.x before 4.1.32, 4.2.x before 4.2.24, and 4.3.x before 4.3.8, when using 3D Acceleration allows local guest OS users to execute arbitrary code on the Chromium server via crafted Chromium network pointer in a (1) CR_MESSAGE_READBACK or (2) CR_MESSAGE_WRITEBACK message to the VBoxSharedCrOpenGL service, which triggers an arbitrary pointer dereference and memory corruption. NOTE: this issue was MERGED with CVE-2014-0982 because it is the same type of vulnerability affecting the same set of versions. All CVE users should reference CVE-2014-0981 instead of CVE-2014-0982. + + + CVE-2014-0982 + 2014-03-31T10:58:35.587-04:00 + 2014-03-31T10:58:35.663-04:00 + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-0981. Reason: This issue was MERGED into CVE-2014-0981 in accordance with CVE content decisions, because it is the same type of vulnerability and affects the same versions. Notes: All CVE users should reference CVE-2014-0981 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:vm_virtualbox:4.2.14 + cpe:/a:oracle:vm_virtualbox:4.2.16 + cpe:/a:oracle:vm_virtualbox:4.2.8 + cpe:/a:oracle:vm_virtualbox:4.2.6 + cpe:/a:oracle:vm_virtualbox:4.3.0 + cpe:/a:oracle:vm_virtualbox:4.3.2 + cpe:/a:oracle:vm_virtualbox:4.2.4 + cpe:/a:oracle:vm_virtualbox:4.3.4 + cpe:/a:oracle:vm_virtualbox:4.2.2 + cpe:/a:oracle:vm_virtualbox:4.2.12 + cpe:/a:oracle:vm_virtualbox:4.2.0 + cpe:/a:oracle:vm_virtualbox:4.2.10 + cpe:/a:oracle:vm_virtualbox:4.2.20 + cpe:/a:oracle:vm_virtualbox:4.3.6 + cpe:/a:oracle:vm_virtualbox:4.2.18 + + CVE-2014-0983 + 2014-03-31T10:58:35.663-04:00 + 2014-04-24T01:04:39.997-04:00 + + + 6.9 + LOCAL + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-31T14:04:55.150-04:00 + + + + + CONFIRM + https://www.virtualbox.org/changeset/50441/vbox + + + BUGTRAQ + 20140311 CORE-2014-0002 - Oracle VirtualBox 3D Acceleration Multiple Memory Corruption Vulnerabilities + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + EXPLOIT-DB + 32208 + + + MISC + http://www.coresecurity.com/advisories/oracle-virtualbox-3d-acceleration-multiple-memory-corruption-vulnerabilities + + + SECUNIA + 57384 + + + FULLDISC + 20140311 CORE-2014-0002 - Oracle VirtualBox 3D Acceleration Multiple Memory Corruption Vulnerabilities + + Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D Acceleration, allow local guest OS users to execute arbitrary code on the Chromium server via certain CR_MESSAGE_OPCODES messages with a crafted index, which are not properly handled by the (1) CR_VERTEXATTRIB4NUBARB_OPCODE to the crServerDispatchVertexAttrib4NubARB function, (2) CR_VERTEXATTRIB1DARB_OPCODE to the crServerDispatchVertexAttrib1dARB function, (3) CR_VERTEXATTRIB1FARB_OPCODE to the crServerDispatchVertexAttrib1fARB function, (4) CR_VERTEXATTRIB1SARB_OPCODE to the crServerDispatchVertexAttrib1sARB function, (5) CR_VERTEXATTRIB2DARB_OPCODE to the crServerDispatchVertexAttrib2dARB function, (6) CR_VERTEXATTRIB2FARB_OPCODE to the crServerDispatchVertexAttrib2fARB function, (7) CR_VERTEXATTRIB2SARB_OPCODE to the crServerDispatchVertexAttrib2sARB function, (8) CR_VERTEXATTRIB3DARB_OPCODE to the crServerDispatchVertexAttrib3dARB function, (9) CR_VERTEXATTRIB3FARB_OPCODE to the crServerDispatchVertexAttrib3fARB function, (10) CR_VERTEXATTRIB3SARB_OPCODE to the crServerDispatchVertexAttrib3sARB function, (11) CR_VERTEXATTRIB4DARB_OPCODE to the crServerDispatchVertexAttrib4dARB function, (12) CR_VERTEXATTRIB4FARB_OPCODE to the crServerDispatchVertexAttrib4fARB function, and (13) CR_VERTEXATTRIB4SARB_OPCODE to the crServerDispatchVertexAttrib4sARB function. + + + + + + + + + + + cpe:/a:sap:router:720:411 + cpe:/a:sap:router:721:117 + cpe:/a:sap:router:710:029 + + CVE-2014-0984 + 2014-04-17T10:55:08.857-04:00 + 2014-04-24T01:04:40.263-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-18T11:46:12.347-04:00 + + + + + CONFIRM + https://service.sap.com/sap/support/notes/1986895 + + + BUGTRAQ + 20140416 [CORE-2014-0003] - SAP Router Password Timing Attack + + + EXPLOIT-DB + 32919 + + + MISC + http://www.coresecurity.com/advisories/sap-router-password-timing-attack + + + CONFIRM + http://scn.sap.com/docs/DOC-8218 + + The passwordCheck function in SAP Router 721 patch 117, 720 patch 411, 710 patch 029, and earlier terminates validation of a Route Permission Table entry password upon encountering the first incorrect character, which allows remote attackers to obtrain passwords via a brute-force attack that relies on timing differences in responses to incorrect password guesses, aka a timing side-channel attack. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/h:lorextechnology:edge3:lh340 + cpe:/h:lorextechnology:edge2:lh330 + cpe:/a:lorex_technology:edge_lh310_firmware:7-35-28-1b26e + cpe:/h:lorextechnology:edge%2b:lh320 + cpe:/a:lorex_technology:edge3_lh340_firmware:11.19.85_1fe3a + cpe:/a:lorex_technology:edge%2b_lh320_firmware:7-35-28-1b26e + cpe:/a:lorex_technology:edge2_lh330_firmware:11.17.38-33_1d97a + cpe:/h:lorextechnology:edge:lh310 + + CVE-2014-1201 + 2014-01-15T11:08:18.297-05:00 + 2014-04-22T13:06:51.477-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-01-16T10:59:23.000-05:00 + + + + + MISC + https://github.com/pedrib/PoC/blob/master/lorexActivex/lorex-testcase.html + + + MISC + https://github.com/pedrib/PoC/blob/master/lorexActivex/lorex-report.txt + + + XF + lorex-cve20141201-bo(90223) + + + BUGTRAQ + 20140110 [CVE -2014-1201] Lorex security DVR ActiveX control buffer overflow + + + OSVDB + 101903 + + Buffer overflow in the INetViewX ActiveX control in the Lorex Edge LH310 and Edge+ LH320 series with firmware 7-35-28-1B26E, Edge2 LH330 series with firmware 11.17.38-33_1D97A, and Edge3 LH340 series with firmware 11.19.85_1FE3A allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the HTTP_PORT parameter. + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:eviware:soapui:3.6.1 + cpe:/a:smartbear:soapui:4.0 + cpe:/a:eviware:soapui:3.0.1 + cpe:/a:eviware:soapui:3.5.1 + cpe:/a:smartbear:soapui:4.6.2 + cpe:/a:smartbear:soapui:4.0:beta2 + cpe:/a:smartbear:soapui:4.6.3 + cpe:/a:smartbear:soapui:4.5 + cpe:/a:smartbear:soapui:4.5.1 + cpe:/a:smartbear:soapui:4.5.2 + cpe:/a:eviware:soapui:2.5.1 + cpe:/a:smartbear:soapui:4.6.0 + cpe:/a:smartbear:soapui:4.6.1 + cpe:/a:smartbear:soapui:4.0:beta1 + cpe:/a:smartbear:soapui:4.0.1 + cpe:/a:eviware:soapui:3.5 + cpe:/a:eviware:soapui:3.6 + + CVE-2014-1202 + 2014-01-24T20:55:05.973-05:00 + 2014-01-27T23:57:33.627-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-01-27T09:54:51.780-05:00 + + + + + CONFIRM + https://github.com/SmartBear/soapui/blob/master/RELEASENOTES.txt + + + MISC + http://www.youtube.com/watch?v=3lCLE64rsc0 + + + EXPLOIT-DB + 30908 + + + MISC + http://packetstormsecurity.com/files/124773/SoapUI-Remote-Code-Execution.html + + + MISC + http://baraktawily.blogspot.com/2014/01/soapui-code-execution-vulnerability-cve.html + + The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file. + + + + + + + + + + + + + + + + + cpe:/a:tableau_software:tableau_server:8.0 + cpe:/a:tableau_software:tableau_server:8.1 + cpe:/a:tableau_software:tableau_server:8.0.6 + cpe:/a:tableau_software:tableau_server:8.0.1 + cpe:/a:tableau_software:tableau_server:8.1.1 + cpe:/a:tableau_software:tableau_server:8.0.5 + cpe:/a:tableau_software:tableau_server:8.0.2 + cpe:/a:tableau_software:tableau_server:8.0.4 + cpe:/a:tableau_software:tableau_server:8.0.3 + + CVE-2014-1204 + 2014-01-31T10:07:36.467-05:00 + 2014-02-21T00:06:31.217-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-03T13:59:48.293-05:00 + + + + + MISC + https://www.trustwave.com/spiderlabs/advisories/TWSL2014-003.txt + + + XF + tableau-server-cve20141204-sql-injection(90730) + + + CONFIRM + http://www.tableausoftware.com/support/releases/812 + + + CONFIRM + http://www.tableausoftware.com/support/releases/8.0.7 + + + SECTRACK + 1029706 + + + BID + 65171 + + + EXPLOIT-DB + 31578 + + + SECUNIA + 56620 + + + OSVDB + 102568 + + SQL injection vulnerability in Tableau Server 8.0.x before 8.0.7 and 8.1.x before 8.1.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. NOTE: this can be exploited by unauthenticated remote attackers if the guest user is enabled. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:openwebanalytics:open_web_analytics:1.5.0 + cpe:/a:openwebanalytics:open_web_analytics:1.2.4 + cpe:/a:openwebanalytics:open_web_analytics:1.5.2 + cpe:/a:openwebanalytics:open_web_analytics:1.2.2 + cpe:/a:openwebanalytics:open_web_analytics:1.5.1 + cpe:/a:openwebanalytics:open_web_analytics:1.2.3 + cpe:/a:openwebanalytics:open_web_analytics:1.5.4 + cpe:/a:openwebanalytics:open_web_analytics:1.0.3 + cpe:/a:openwebanalytics:open_web_analytics:1.5.3 + cpe:/a:openwebanalytics:open_web_analytics:1.3.0:rc1 + cpe:/a:openwebanalytics:open_web_analytics:1.0.6 + cpe:/a:openwebanalytics:open_web_analytics:1.0.7 + cpe:/a:openwebanalytics:open_web_analytics:1.1.1 + cpe:/a:openwebanalytics:open_web_analytics:1.0.4 + cpe:/a:openwebanalytics:open_web_analytics:1.2.1:rc1 + cpe:/a:openwebanalytics:open_web_analytics:1.0.5 + cpe:/a:openwebanalytics:open_web_analytics:1.2.1 + cpe:/a:openwebanalytics:open_web_analytics:1.0.8 + cpe:/a:openwebanalytics:open_web_analytics:1.1.0:rc2 + cpe:/a:openwebanalytics:open_web_analytics:1.4.0:rc1 + cpe:/a:openwebanalytics:open_web_analytics:1.0.2 + cpe:/a:openwebanalytics:open_web_analytics:1.4.0:rc2 + cpe:/a:openwebanalytics:open_web_analytics:1.0.1 + cpe:/a:openwebanalytics:open_web_analytics:1.1.0:rc4 + cpe:/a:openwebanalytics:open_web_analytics:1.4.0:rc3 + cpe:/a:openwebanalytics:open_web_analytics:1.1.0:rc1 + cpe:/a:openwebanalytics:open_web_analytics:1.4.0:rc4 + cpe:/a:openwebanalytics:open_web_analytics:1.5.0:rc2 + cpe:/a:openwebanalytics:open_web_analytics:1.1.0:rc3 + cpe:/a:openwebanalytics:open_web_analytics:1.5.0:rc1 + cpe:/a:openwebanalytics:open_web_analytics:1.4.1 + cpe:/a:openwebanalytics:open_web_analytics:1.4.0 + cpe:/a:openwebanalytics:open_web_analytics:1.5.0:rc3 + cpe:/a:openwebanalytics:open_web_analytics:1.2.0 + cpe:/a:openwebanalytics:open_web_analytics:1.2.0:rc1 + cpe:/a:openwebanalytics:open_web_analytics:1.3.0 + cpe:/a:openwebanalytics:open_web_analytics:1.0 + cpe:/a:openwebanalytics:open_web_analytics:1.2.0:rc2 + cpe:/a:openwebanalytics:open_web_analytics:1.2.0:rc3 + cpe:/a:openwebanalytics:open_web_analytics:1.3.1 + + CVE-2014-1206 + 2014-01-15T11:08:18.580-05:00 + 2014-02-21T00:06:31.483-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-16T12:36:39.920-05:00 + + + + + BID + 64774 + + + BUGTRAQ + 20140214 [SWRX-2014-001] Open Web Analytics Pre-Auth SQL Injection + + + MISC + http://www.secureworks.com/advisories/SWRX-2014-001/SWRX-2014-001.pdf + + + EXPLOIT-DB + 31738 + + + CONFIRM + http://wiki.openwebanalytics.com/index.php?title=1.5.5 + + + SECUNIA + 56350 + + SQL injection vulnerability in the password reset page in Open Web Analytics (OWA) before 1.5.5 allows remote attackers to execute arbitrary SQL commands via the owa_email_address parameter in a base.passwordResetRequest action to index.php. + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:vmware:esxi:5.0:1 + cpe:/o:vmware:esxi:4.0 + cpe:/o:vmware:esx:4.0 + cpe:/o:vmware:esxi:4.1 + cpe:/o:vmware:esxi:5.1 + cpe:/o:vmware:esx:4.1 + cpe:/o:vmware:esxi:4.0:4 + cpe:/o:vmware:esxi:5.0:2 + cpe:/o:vmware:esxi:4.1:1 + cpe:/o:vmware:esxi:5.0 + cpe:/o:vmware:esxi:4.0:1 + cpe:/o:vmware:esxi:4.1:2 + cpe:/o:vmware:esxi:4.0:2 + cpe:/o:vmware:esxi:4.0:3 + + CVE-2014-1207 + 2014-01-17T16:55:19.660-05:00 + 2014-01-30T00:17:35.717-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-01-21T11:14:23.040-05:00 + + + + XF + vmware-esx-cve20141207-dos(90559) + + + CONFIRM + http://www.vmware.com/security/advisories/VMSA-2014-0001.html + + + SECTRACK + 1029643 + + + BID + 64995 + + + SECUNIA + 56499 + + + OSVDB + 102196 + + VMware ESXi 4.0 through 5.1 and ESX 4.0 and 4.1 allow remote attackers to cause a denial of service (NULL pointer dereference) by intercepting and modifying Network File Copy (NFC) traffic. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:vmware:esxi:5.0:1 + cpe:/a:vmware:workstation:9.0 + cpe:/o:vmware:esxi:4.0 + cpe:/o:vmware:esx:4.0 + cpe:/o:vmware:esxi:4.1 + cpe:/o:vmware:esxi:5.1 + cpe:/o:vmware:esx:4.1 + cpe:/a:vmware:player:5.0 + cpe:/a:vmware:fusion:5.0 + cpe:/o:vmware:esxi:4.0:4 + cpe:/o:vmware:esxi:5.0:2 + cpe:/o:vmware:esxi:4.1:1 + cpe:/o:vmware:esxi:5.0 + cpe:/o:vmware:esxi:4.0:1 + cpe:/o:vmware:esxi:4.1:2 + cpe:/o:vmware:esxi:4.0:2 + cpe:/o:vmware:esxi:4.0:3 + + CVE-2014-1208 + 2014-01-17T16:55:19.690-05:00 + 2014-01-30T00:17:35.813-05:00 + + + 3.3 + ADJACENT_NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-01-21T11:20:43.127-05:00 + + + + XF + vmware-esx-cve20141208-dos(90558) + + + CONFIRM + http://www.vmware.com/security/advisories/VMSA-2014-0001.html + + + SECTRACK + 1029644 + + + SECTRACK + 1029643 + + + BID + 64994 + + + SECUNIA + 56499 + + + OSVDB + 102197 + + VMware Workstation 9.x before 9.0.1, VMware Player 5.x before 5.0.1, VMware Fusion 5.x before 5.0.1, VMware ESXi 4.0 through 5.1, and VMware ESX 4.0 and 4.1 allow guest OS users to cause a denial of service (VMX process disruption) by using an invalid port. + + + + + + + + + + + + cpe:/a:vmware:vsphere_client:5.0 + cpe:/a:vmware:vsphere_client:5.1 + cpe:/a:vmware:vsphere_client:4.1 + cpe:/a:vmware:vsphere_client:4.0 + + CVE-2014-1209 + 2014-04-11T15:55:04.493-04:00 + 2014-04-14T12:51:35.073-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-14T12:51:34.870-04:00 + + + + + CONFIRM + http://www.vmware.com/security/advisories/VMSA-2014-0003.html + + VMware vSphere Client 4.0, 4.1, 5.0 before Update 3, and 5.1 before Update 2 does not properly validate updates to Client files, which allows remote attackers to trigger the downloading and execution of an arbitrary program via unspecified vectors. + + + + + + + + + + cpe:/a:vmware:vsphere_client:5.0 + cpe:/a:vmware:vsphere_client:5.1 + + CVE-2014-1210 + 2014-04-11T15:55:04.510-04:00 + 2014-04-14T12:58:12.650-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-14T12:58:10.150-04:00 + + + + + CONFIRM + http://www.vmware.com/security/advisories/VMSA-2014-0003.html + + VMware vSphere Client 5.0 before Update 3 and 5.1 before Update 2 does not properly validate X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate. + + + + + + + + + + + cpe:/a:vmware:vcloud_director:5.1.1 + cpe:/a:vmware:vcloud_director:5.1.2 + cpe:/a:vmware:vcloud_director:5.1.0 + + CVE-2014-1211 + 2014-01-17T16:55:19.707-05:00 + 2014-01-30T00:17:35.890-05:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-21T18:39:26.130-05:00 + + + + + XF + vmware-vcloud-cve20141211-csrf(90560) + + + CONFIRM + http://www.vmware.com/security/advisories/VMSA-2014-0001.html + + + SECTRACK + 1029645 + + + BID + 64993 + + + OSVDB + 102198 + + Cross-site request forgery (CSRF) vulnerability in VMware vCloud Director 5.1.x before 5.1.3 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout. + + + + + + + + + + cpe:/a:sophos:sophos_anti-virus:10.0.11 + cpe:/a:sophos:scanning_engine:3.48 + + CVE-2014-1213 + 2014-02-10T18:55:05.057-05:00 + 2014-02-11T15:40:48.087-05:00 + + + 5.6 + LOCAL + LOW + NONE + NONE + PARTIAL + COMPLETE + http://nvd.nist.gov + 2014-02-11T15:40:48.037-05:00 + + + + + CONFIRM + http://www.sophos.com/en-us/support/knowledgebase/2300/7200/1031/120401.aspx + + + BID + 65286 + + + BUGTRAQ + 20140131 CVE-2014-1213 - Denial of Service in Sophos Anti Virus + + + MISC + http://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1213/ + + + FULLDISC + 20140131 CVE-2014-1213 - Denial of Service in Sophos Anti Virus + + + MISC + http://packetstormsecurity.com/files/125024/Sophos-Anti-Virus-Denial-Of-Service.html + + + OSVDB + 102762 + + Sophos Anti-Virus engine (SAVi) before 3.50.1, as used in VDL 4.97G 9.7.x before 9.7.9, 10.0.x before 10.0.11, and 10.3.x before 10.3.1 does not set an ACL for certain global and session objects, which allows local users to bypass anti-virus protection, cause a denial of service (resource consumption, CPU consumption, and eventual crash) or spoof "ready for update" messages by performing certain operations on mutexes or events including (1) DataUpdateRequest, (2) MmfMutexSAV-****, (3) MmfMutexSAV-Info, (4) ReadyForUpdateSAV-****, (5) ReadyForUpdateSAV-Info, (6) SAV-****, (7) SAV-Info, (8) StateChange, (9) SuspendedSAV-****, (10) SuspendedSAV-Info, (11) UpdateComplete, (12) UpdateMutex, (13) UpdateRequest, or (14) SophosALMonSessionInstance, as demonstrated by triggering a ReadyForUpdateSAV event and modifying the UpdateComplete, UpdateMutex, and UpdateRequest objects. + + + + + + + + + + cpe:/a:fitnesse:fitnesse_wiki:20140201 + cpe:/a:fitnesse:fitnesse_wiki:20131110 + + CVE-2014-1216 + 2014-04-22T09:06:28.227-04:00 + 2014-04-22T12:24:55.520-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-22T12:24:55.473-04:00 + + + + MISC + https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1216/ + + + EXPLOIT-DB + 32568 + + FitNesse Wiki 20131110, 20140201, and earlier allows remote attackers to execute arbitrary commands by defining a COMMAND_PATTERN and TEST_RUNNER in the pageContent parameter when editing a page. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:livetecs:timeline:6.2.7 + cpe:/a:livetecs:timeline:2.94 + cpe:/a:livetecs:timeline:3.1.1 + cpe:/a:livetecs:timeline:3.5.1 + cpe:/a:livetecs:timeline:2.91 + cpe:/a:livetecs:timeline:3.0.3 + cpe:/a:livetecs:timeline:3.0.1 + cpe:/a:livetecs:timeline:4.2.1 + cpe:/a:livetecs:timeline:2.81 + cpe:/a:livetecs:timeline:6.0.1 + cpe:/a:livetecs:timeline:3.0.5 + cpe:/a:livetecs:timeline:7.1.1 + cpe:/a:livetecs:timeline:6.2.71 + cpe:/a:livetecs:timeline:3.6.1 + cpe:/a:livetecs:timeline:4.3.1 + cpe:/a:livetecs:timeline:6.2.1 + cpe:/a:livetecs:timeline:6.2.3 + cpe:/a:livetecs:timeline:3.8.1 + cpe:/a:livetecs:timeline:3.2.1 + cpe:/a:livetecs:timeline:6.2.4 + cpe:/a:livetecs:timeline:5.2.1 + cpe:/a:livetecs:timeline:4.9.1 + cpe:/a:livetecs:timeline:6.2.6 + cpe:/a:livetecs:timeline:3.7.1 + + CVE-2014-1217 + 2014-04-28T10:09:06.440-04:00 + 2014-04-29T08:09:11.557-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-29T08:09:11.210-04:00 + + + + + MISC + https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1217/ + + + BID + 67043 + + + BUGTRAQ + 20140423 CVE-2014-1217 - Unauthenticated access to sensitive information and functionality in Livetecs Timelive + + + FULLDISC + 20140423 CVE-2014-1217 - Unauthenticated access to sensitive information and functionality in Livetecs Timelive + + Livetecs Timelive before 6.2.8 does not properly restrict access to systemsetting.aspx, which allows remote attackers to change configurations and obtain the database connection string and credentials via unspecified vectors. + + + + + + + + + cpe:/a:ca:2e_web_option:r8.1.2 + + CVE-2014-1219 + 2014-02-14T08:10:48.623-05:00 + 2014-02-21T00:06:31.983-05:00 + + + 5.1 + NETWORK + HIGH + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-14T12:55:53.843-05:00 + + + + + BID + 65537 + + + MISC + http://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1219/ + + CA 2E Web Option r8.1.2 accepts a predictable substring of a W2E_SSNID session token in place of the entire token, which allows remote attackers to hijack sessions by changing characters at the end of this substring, as demonstrated by terminating a session via a modified SSNID parameter to web2edoc/close.htm. + + + + + + + + + + + + + cpe:/a:telligent:evolution:7.5.0 + cpe:/a:telligent:evolution:6.1.19 + cpe:/a:telligent:evolution:7.6.7 + cpe:/a:telligent:evolution:7.5.0.32466 + cpe:/a:telligent:evolution:7.1.12 + + CVE-2014-1223 + 2014-02-27T10:55:15.453-05:00 + 2014-02-28T10:17:32.570-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-28T10:17:32.507-05:00 + + + + + MISC + https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1223 + + + BUGTRAQ + 20140221 CVE-2014-1223 - Cross-site Scripting in Telligent Evolution + + + SECUNIA + 56779 + + Cross-site scripting (XSS) vulnerability in controlpanel/loading.aspx in Telligent Evolution before 6.1.19.36103, 7.x before 7.1.12.36162, 7.5.x, and 7.6.x before 7.6.7.36651 allows remote attackers to inject arbitrary web script or HTML via the msg parameter. NOTE: some of these details are obtained from third party information. + + + + + + + + + + + + + + + + + + cpe:/a:foliovision:foliopress_wysiwyg:2.6.8.4 + cpe:/a:foliovision:foliopress_wysiwyg:2.6.8.1 + cpe:/a:foliovision:foliopress_wysiwyg:2.6.8.2 + cpe:/a:foliovision:foliopress_wysiwyg:2.6.8.3 + cpe:/a:foliovision:foliopress_wysiwyg:2.6.8 + + CVE-2014-1232 + 2014-01-08T10:30:02.747-05:00 + 2014-01-13T23:29:52.533-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-09T14:51:45.117-05:00 + + + + + CONFIRM + http://wordpress.org/plugins/foliopress-wysiwyg/changelog + + + XF + foliopress-unspecified-xss(90102) + + + SECUNIA + 56261 + + Cross-site scripting (XSS) vulnerability in the Foliopress WYSIWYG plugin before 2.6.8.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + cpe:/a:tobias_maier:paratrooper-pingdom:1.0.0:-:~-~-~ruby~~ + + CVE-2014-1233 + 2014-01-10T07:02:51.747-05:00 + 2014-01-10T12:53:31.767-05:00 + + + 2.1 + LOCAL + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-10T12:53:31.673-05:00 + + + + + MISC + http://www.vapid.dhs.org/advisories/paratrooper-api-key-pingdom.html + + + MLIST + [oss-security] 20140107 paratrooper-pingdom-1.0.0 ruby gem exposes API login credentials + + The paratrooper-pingdom gem 1.0.0 for Ruby allows local users to obtain the App-Key, username, and password values by listing the curl process. + + + + + + + + + cpe:/a:paratrooper-newrelic_project:paratrooper-newrelic:1.0.1:-:~-~-~ruby~~ + + CVE-2014-1234 + 2014-01-10T07:02:51.777-05:00 + 2014-01-10T12:57:30.427-05:00 + + + 2.1 + LOCAL + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-10T12:57:30.397-05:00 + + + + + MISC + http://www.vapid.dhs.org/advisories/paratrooper-newrelic-api.html + + + MLIST + [oss-security] 20140107 Paratrooper-newrelic 1.0.1 Ruby Gem exposes API key + + The paratrooper-newrelic gem 1.0.1 for Ruby allows local users to obtain the X-Api-Key value by listing the curl process. + + + + + + + + + cpe:/a:graphviz:graphviz:2.34.0 + + CVE-2014-1236 + 2014-01-10T10:55:06.307-05:00 + 2014-03-05T23:50:44.267-05:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-01-10T13:24:55.023-05:00 + + + + + CONFIRM + https://github.com/ellson/graphviz/commit/1d1bdec6318746f6f19f245db589eddc887ae8ff + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1050872 + + + BID + 64737 + + + MANDRIVA + MDVSA-2014:024 + + + DEBIAN + DSA-2843 + + + SECUNIA + 56244 + + + SECUNIA + 55666 + + + MLIST + [oss-security] 20140108 Re: CVE Request: graphviz: stack-based buffer overflow in yyerror() + + + MLIST + [oss-security] 20140108 Re: Re: CVE Request: graphviz: stack-based buffer overflow in yyerror() + + + MLIST + [oss-security] 20140108 Re: Re: CVE Request: graphviz: stack-based buffer overflow in yyerror() + + Stack-based buffer overflow in the chkNum function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via vectors related to a "badly formed number" and a "long digit list." + + + + + + + + + + + + + cpe:/a:i-doit:i-doit:1.1.2::~~pro~~~ + cpe:/a:i-doit:i-doit:1.1.1::~~pro~~~ + cpe:/a:i-doit:i-doit:1.2.1::~~pro~~~ + cpe:/a:i-doit:i-doit:1.2.2::~~pro~~~ + cpe:/a:i-doit:i-doit:1.2.3::~~pro~~~ + + CVE-2014-1237 + 2014-02-11T12:55:06.827-05:00 + 2014-02-21T00:06:33.390-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-12T10:53:15.270-05:00 + + + + + XF + idoit-cve20141237-xss(90969) + + + BID + 65353 + + + CONFIRM + http://www.i-doit.com/en/company/news/single-news/?tx_ttnews%5Btt_news%5D=136 + + + MISC + http://www.csnc.ch/misc/files/advisories/CVE-2014-1237_i-doit_Cross-site_Scripting_-_XSS.txt + + + SECUNIA + 56834 + + + SECUNIA + 56802 + + + FULLDISC + 20140205 CVE-2014-1237 (XSS in i-doit Pro) + + + MISC + http://packetstormsecurity.com/files/125062 + + + OSVDB + 102910 + + Cross-site scripting (XSS) vulnerability in synetics i-doit pro before 1.2.4 allows remote attackers to inject arbitrary web script or HTML via the call parameter. + + + + + + + + + + + + + + + + + + cpe:/a:apple:itunes:11.0 + cpe:/a:apple:itunes:11.1.2 + cpe:/a:apple:itunes:11.1.3 + cpe:/a:apple:itunes:11.0.2 + cpe:/a:apple:itunes:11.0.1 + cpe:/a:apple:itunes:11.0.4 + cpe:/a:apple:itunes:11.0.3 + cpe:/a:apple:itunes:11.0.5 + cpe:/a:apple:itunes:11.1 + cpe:/a:apple:itunes:11.1.1 + + CVE-2014-1242 + 2014-01-23T14:55:04.097-05:00 + 2014-01-30T00:17:36.593-05:00 + + + 5.8 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-24T10:25:23.850-05:00 + + + + + XF + apple-itunes-cve20141242-mitm(90653) + + + SECTRACK + 1029671 + + + BID + 65088 + + + CONFIRM + http://support.apple.com/kb/HT6001 + + + OSVDB + 102410 + + Apple iTunes before 11.1.4 uses HTTP for the iTunes Tutorials window, which allows man-in-the-middle attackers to spoof content by gaining control over the client-server data stream. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:quicktime:7.0.2 + cpe:/a:apple:quicktime:7.0.3 + cpe:/a:apple:quicktime:7.5.5 + cpe:/a:apple:quicktime:7.6.6 + cpe:/a:apple:quicktime:7.0.0 + cpe:/a:apple:quicktime:7.0.1 + cpe:/a:apple:quicktime:7.4.1 + cpe:/a:apple:quicktime:7.6.5 + cpe:/a:apple:quicktime:7.69.80.9 + cpe:/a:apple:quicktime:7.6.2 + cpe:/a:apple:quicktime:7.0.4 + cpe:/a:apple:quicktime:7.6.0 + cpe:/a:apple:quicktime:7.6.1 + cpe:/a:apple:quicktime:7.1.4 + cpe:/a:apple:quicktime:7.3.1.70 + cpe:/a:apple:quicktime:7.1.5 + cpe:/a:apple:quicktime:7.5.0 + cpe:/a:apple:quicktime:7.67.75.0 + cpe:/a:apple:quicktime:7.1.6 + cpe:/a:apple:quicktime:7.4.5 + cpe:/a:apple:quicktime:7.65.17.80 + cpe:/a:apple:quicktime:7.7.0 + cpe:/a:apple:quicktime:7.7.3 + cpe:/a:apple:quicktime:7.7.4 + cpe:/a:apple:quicktime:7.7.1 + cpe:/a:apple:quicktime:7.7.2 + cpe:/a:apple:quicktime:7.60.92.0 + cpe:/a:apple:quicktime:7.70.80.34 + cpe:/a:apple:quicktime:7.64.17.73 + cpe:/a:apple:quicktime:7.62.14.0 + cpe:/a:apple:quicktime:7.68.75.0 + cpe:/a:apple:quicktime:7.6.7 + cpe:/a:apple:quicktime:7.6.9 + cpe:/a:apple:quicktime:7.1.3 + cpe:/a:apple:quicktime:7.6.8 + cpe:/a:apple:quicktime:7.71.80.42 + cpe:/a:apple:quicktime:7.1.1 + cpe:/a:apple:quicktime:7.1.2 + cpe:/a:apple:quicktime:7.4.0 + cpe:/a:apple:quicktime:7.66.71.0 + cpe:/a:apple:quicktime:7.1.0 + cpe:/a:apple:quicktime:7.2.0 + cpe:/a:apple:quicktime:7.2.1 + cpe:/a:apple:quicktime:7.3.1 + cpe:/a:apple:quicktime:7.3.0 + + CVE-2014-1243 + 2014-02-26T20:55:03.617-05:00 + 2014-02-27T08:47:06.060-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-27T08:47:04.810-05:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6151 + + Apple QuickTime before 7.7.5 does not initialize an unspecified pointer, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted track list in a movie file. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:quicktime:7.0.2 + cpe:/a:apple:quicktime:7.0.3 + cpe:/a:apple:quicktime:7.5.5 + cpe:/a:apple:quicktime:7.6.6 + cpe:/a:apple:quicktime:7.0.0 + cpe:/a:apple:quicktime:7.0.1 + cpe:/a:apple:quicktime:7.4.1 + cpe:/a:apple:quicktime:7.6.5 + cpe:/a:apple:quicktime:7.69.80.9 + cpe:/a:apple:quicktime:7.6.2 + cpe:/a:apple:quicktime:7.0.4 + cpe:/a:apple:quicktime:7.6.0 + cpe:/a:apple:quicktime:7.6.1 + cpe:/a:apple:quicktime:7.1.4 + cpe:/a:apple:quicktime:7.3.1.70 + cpe:/a:apple:quicktime:7.1.5 + cpe:/a:apple:quicktime:7.5.0 + cpe:/a:apple:quicktime:7.67.75.0 + cpe:/a:apple:quicktime:7.1.6 + cpe:/a:apple:quicktime:7.4.5 + cpe:/a:apple:quicktime:7.65.17.80 + cpe:/a:apple:quicktime:7.7.0 + cpe:/a:apple:quicktime:7.7.3 + cpe:/a:apple:quicktime:7.7.4 + cpe:/a:apple:quicktime:7.7.1 + cpe:/a:apple:quicktime:7.7.2 + cpe:/a:apple:quicktime:7.60.92.0 + cpe:/a:apple:quicktime:7.70.80.34 + cpe:/a:apple:quicktime:7.64.17.73 + cpe:/a:apple:quicktime:7.62.14.0 + cpe:/a:apple:quicktime:7.68.75.0 + cpe:/a:apple:quicktime:7.6.7 + cpe:/a:apple:quicktime:7.6.9 + cpe:/a:apple:quicktime:7.1.3 + cpe:/a:apple:quicktime:7.6.8 + cpe:/a:apple:quicktime:7.71.80.42 + cpe:/a:apple:quicktime:7.1.1 + cpe:/a:apple:quicktime:7.1.2 + cpe:/a:apple:quicktime:7.4.0 + cpe:/a:apple:quicktime:7.66.71.0 + cpe:/a:apple:quicktime:7.1.0 + cpe:/a:apple:quicktime:7.2.0 + cpe:/a:apple:quicktime:7.2.1 + cpe:/a:apple:quicktime:7.3.1 + cpe:/a:apple:quicktime:7.3.0 + + CVE-2014-1244 + 2014-02-26T20:55:03.647-05:00 + 2014-03-10T13:40:00.047-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-27T12:17:49.763-05:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6151 + + Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with H.264 encoding. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:quicktime:7.0.2 + cpe:/a:apple:quicktime:7.0.3 + cpe:/a:apple:quicktime:7.5.5 + cpe:/a:apple:quicktime:7.6.6 + cpe:/a:apple:quicktime:7.0.0 + cpe:/a:apple:quicktime:7.0.1 + cpe:/a:apple:quicktime:7.4.1 + cpe:/a:apple:quicktime:7.6.5 + cpe:/a:apple:quicktime:7.69.80.9 + cpe:/a:apple:quicktime:7.6.2 + cpe:/a:apple:quicktime:7.0.4 + cpe:/a:apple:quicktime:7.6.0 + cpe:/a:apple:quicktime:7.6.1 + cpe:/a:apple:quicktime:7.1.4 + cpe:/a:apple:quicktime:7.3.1.70 + cpe:/a:apple:quicktime:7.1.5 + cpe:/a:apple:quicktime:7.5.0 + cpe:/a:apple:quicktime:7.67.75.0 + cpe:/a:apple:quicktime:7.1.6 + cpe:/a:apple:quicktime:7.4.5 + cpe:/a:apple:quicktime:7.65.17.80 + cpe:/a:apple:quicktime:7.7.0 + cpe:/a:apple:quicktime:7.7.3 + cpe:/a:apple:quicktime:7.7.4 + cpe:/a:apple:quicktime:7.7.1 + cpe:/a:apple:quicktime:7.7.2 + cpe:/a:apple:quicktime:7.60.92.0 + cpe:/a:apple:quicktime:7.70.80.34 + cpe:/a:apple:quicktime:7.64.17.73 + cpe:/a:apple:quicktime:7.62.14.0 + cpe:/a:apple:quicktime:7.68.75.0 + cpe:/a:apple:quicktime:7.6.7 + cpe:/a:apple:quicktime:7.6.9 + cpe:/a:apple:quicktime:7.1.3 + cpe:/a:apple:quicktime:7.6.8 + cpe:/a:apple:quicktime:7.71.80.42 + cpe:/a:apple:quicktime:7.1.1 + cpe:/a:apple:quicktime:7.1.2 + cpe:/a:apple:quicktime:7.4.0 + cpe:/a:apple:quicktime:7.66.71.0 + cpe:/a:apple:quicktime:7.1.0 + cpe:/a:apple:quicktime:7.2.0 + cpe:/a:apple:quicktime:7.2.1 + cpe:/a:apple:quicktime:7.3.1 + cpe:/a:apple:quicktime:7.3.0 + + CVE-2014-1245 + 2014-02-26T20:55:03.663-05:00 + 2014-03-10T13:40:43.907-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-27T12:17:14.997-05:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6151 + + + CONFIRM + http://support.apple.com/kb/HT6150 + + Integer signedness error in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted stsz atom in a movie file. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:quicktime:7.0.2 + cpe:/a:apple:quicktime:7.0.3 + cpe:/a:apple:quicktime:7.5.5 + cpe:/a:apple:quicktime:7.6.6 + cpe:/a:apple:quicktime:7.0.0 + cpe:/a:apple:quicktime:7.0.1 + cpe:/a:apple:quicktime:7.4.1 + cpe:/a:apple:quicktime:7.6.5 + cpe:/a:apple:quicktime:7.69.80.9 + cpe:/a:apple:quicktime:7.6.2 + cpe:/a:apple:quicktime:7.0.4 + cpe:/a:apple:quicktime:7.6.0 + cpe:/a:apple:quicktime:7.6.1 + cpe:/a:apple:quicktime:7.1.4 + cpe:/a:apple:quicktime:7.3.1.70 + cpe:/a:apple:quicktime:7.1.5 + cpe:/a:apple:quicktime:7.5.0 + cpe:/a:apple:quicktime:7.67.75.0 + cpe:/a:apple:quicktime:7.1.6 + cpe:/a:apple:quicktime:7.4.5 + cpe:/a:apple:quicktime:7.65.17.80 + cpe:/a:apple:quicktime:7.7.0 + cpe:/a:apple:quicktime:7.7.3 + cpe:/a:apple:quicktime:7.7.4 + cpe:/a:apple:quicktime:7.7.1 + cpe:/a:apple:quicktime:7.7.2 + cpe:/a:apple:quicktime:7.60.92.0 + cpe:/a:apple:quicktime:7.70.80.34 + cpe:/a:apple:quicktime:7.64.17.73 + cpe:/a:apple:quicktime:7.62.14.0 + cpe:/a:apple:quicktime:7.68.75.0 + cpe:/a:apple:quicktime:7.6.7 + cpe:/a:apple:quicktime:7.6.9 + cpe:/a:apple:quicktime:7.1.3 + cpe:/a:apple:quicktime:7.6.8 + cpe:/a:apple:quicktime:7.71.80.42 + cpe:/a:apple:quicktime:7.1.1 + cpe:/a:apple:quicktime:7.1.2 + cpe:/a:apple:quicktime:7.4.0 + cpe:/a:apple:quicktime:7.66.71.0 + cpe:/a:apple:quicktime:7.1.0 + cpe:/a:apple:quicktime:7.2.0 + cpe:/a:apple:quicktime:7.2.1 + cpe:/a:apple:quicktime:7.3.1 + cpe:/a:apple:quicktime:7.3.0 + + CVE-2014-1246 + 2014-02-26T20:55:03.680-05:00 + 2014-02-27T12:13:57.537-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-27T12:13:56.163-05:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6151 + + + CONFIRM + http://support.apple.com/kb/HT6150 + + Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted ftab atom in a movie file. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:quicktime:7.0.2 + cpe:/a:apple:quicktime:7.0.3 + cpe:/a:apple:quicktime:7.5.5 + cpe:/a:apple:quicktime:7.6.6 + cpe:/a:apple:quicktime:7.0.0 + cpe:/a:apple:quicktime:7.0.1 + cpe:/a:apple:quicktime:7.4.1 + cpe:/a:apple:quicktime:7.6.5 + cpe:/a:apple:quicktime:7.69.80.9 + cpe:/a:apple:quicktime:7.6.2 + cpe:/a:apple:quicktime:7.0.4 + cpe:/a:apple:quicktime:7.6.0 + cpe:/a:apple:quicktime:7.6.1 + cpe:/a:apple:quicktime:7.1.4 + cpe:/a:apple:quicktime:7.3.1.70 + cpe:/a:apple:quicktime:7.1.5 + cpe:/a:apple:quicktime:7.5.0 + cpe:/a:apple:quicktime:7.67.75.0 + cpe:/a:apple:quicktime:7.1.6 + cpe:/a:apple:quicktime:7.4.5 + cpe:/a:apple:quicktime:7.65.17.80 + cpe:/a:apple:quicktime:7.7.0 + cpe:/a:apple:quicktime:7.7.3 + cpe:/a:apple:quicktime:7.7.4 + cpe:/a:apple:quicktime:7.7.1 + cpe:/a:apple:quicktime:7.7.2 + cpe:/a:apple:quicktime:7.60.92.0 + cpe:/a:apple:quicktime:7.70.80.34 + cpe:/a:apple:quicktime:7.64.17.73 + cpe:/a:apple:quicktime:7.62.14.0 + cpe:/a:apple:quicktime:7.68.75.0 + cpe:/a:apple:quicktime:7.6.7 + cpe:/a:apple:quicktime:7.6.9 + cpe:/a:apple:quicktime:7.1.3 + cpe:/a:apple:quicktime:7.6.8 + cpe:/a:apple:quicktime:7.71.80.42 + cpe:/a:apple:quicktime:7.1.1 + cpe:/a:apple:quicktime:7.1.2 + cpe:/a:apple:quicktime:7.4.0 + cpe:/a:apple:quicktime:7.66.71.0 + cpe:/a:apple:quicktime:7.1.0 + cpe:/a:apple:quicktime:7.2.0 + cpe:/a:apple:quicktime:7.2.1 + cpe:/a:apple:quicktime:7.3.1 + cpe:/a:apple:quicktime:7.3.0 + + CVE-2014-1247 + 2014-02-26T20:55:03.710-05:00 + 2014-03-10T13:37:59.343-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-27T12:23:12.413-05:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6151 + + + CONFIRM + http://support.apple.com/kb/HT6150 + + Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted dref atom in a movie file. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:quicktime:7.0.2 + cpe:/a:apple:quicktime:7.0.3 + cpe:/a:apple:quicktime:7.5.5 + cpe:/a:apple:quicktime:7.6.6 + cpe:/a:apple:quicktime:7.0.0 + cpe:/a:apple:quicktime:7.0.1 + cpe:/a:apple:quicktime:7.4.1 + cpe:/a:apple:quicktime:7.6.5 + cpe:/a:apple:quicktime:7.69.80.9 + cpe:/a:apple:quicktime:7.6.2 + cpe:/a:apple:quicktime:7.0.4 + cpe:/a:apple:quicktime:7.6.0 + cpe:/a:apple:quicktime:7.6.1 + cpe:/a:apple:quicktime:7.1.4 + cpe:/a:apple:quicktime:7.3.1.70 + cpe:/a:apple:quicktime:7.1.5 + cpe:/a:apple:quicktime:7.5.0 + cpe:/a:apple:quicktime:7.67.75.0 + cpe:/a:apple:quicktime:7.1.6 + cpe:/a:apple:quicktime:7.4.5 + cpe:/a:apple:quicktime:7.65.17.80 + cpe:/a:apple:quicktime:7.7.0 + cpe:/a:apple:quicktime:7.7.3 + cpe:/a:apple:quicktime:7.7.4 + cpe:/a:apple:quicktime:7.7.1 + cpe:/a:apple:quicktime:7.7.2 + cpe:/a:apple:quicktime:7.60.92.0 + cpe:/a:apple:quicktime:7.70.80.34 + cpe:/a:apple:quicktime:7.64.17.73 + cpe:/a:apple:quicktime:7.62.14.0 + cpe:/a:apple:quicktime:7.68.75.0 + cpe:/a:apple:quicktime:7.6.7 + cpe:/a:apple:quicktime:7.6.9 + cpe:/a:apple:quicktime:7.1.3 + cpe:/a:apple:quicktime:7.6.8 + cpe:/a:apple:quicktime:7.71.80.42 + cpe:/a:apple:quicktime:7.1.1 + cpe:/a:apple:quicktime:7.1.2 + cpe:/a:apple:quicktime:7.4.0 + cpe:/a:apple:quicktime:7.66.71.0 + cpe:/a:apple:quicktime:7.1.0 + cpe:/a:apple:quicktime:7.2.0 + cpe:/a:apple:quicktime:7.2.1 + cpe:/a:apple:quicktime:7.3.1 + cpe:/a:apple:quicktime:7.3.0 + + CVE-2014-1248 + 2014-02-26T20:55:03.727-05:00 + 2014-03-10T13:39:30.513-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-27T12:20:11.843-05:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6151 + + + CONFIRM + http://support.apple.com/kb/HT6150 + + Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted ldat atom in a movie file. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:quicktime:7.0.2 + cpe:/a:apple:quicktime:7.0.3 + cpe:/a:apple:quicktime:7.5.5 + cpe:/a:apple:quicktime:7.6.6 + cpe:/a:apple:quicktime:7.0.0 + cpe:/a:apple:quicktime:7.0.1 + cpe:/a:apple:quicktime:7.4.1 + cpe:/a:apple:quicktime:7.6.5 + cpe:/a:apple:quicktime:7.69.80.9 + cpe:/a:apple:quicktime:7.6.2 + cpe:/a:apple:quicktime:7.0.4 + cpe:/a:apple:quicktime:7.6.0 + cpe:/a:apple:quicktime:7.6.1 + cpe:/a:apple:quicktime:7.1.4 + cpe:/a:apple:quicktime:7.3.1.70 + cpe:/a:apple:quicktime:7.1.5 + cpe:/a:apple:quicktime:7.5.0 + cpe:/a:apple:quicktime:7.67.75.0 + cpe:/a:apple:quicktime:7.1.6 + cpe:/a:apple:quicktime:7.4.5 + cpe:/a:apple:quicktime:7.65.17.80 + cpe:/a:apple:quicktime:7.7.0 + cpe:/a:apple:quicktime:7.7.3 + cpe:/a:apple:quicktime:7.7.4 + cpe:/a:apple:quicktime:7.7.1 + cpe:/a:apple:quicktime:7.7.2 + cpe:/a:apple:quicktime:7.60.92.0 + cpe:/a:apple:quicktime:7.70.80.34 + cpe:/a:apple:quicktime:7.64.17.73 + cpe:/a:apple:quicktime:7.62.14.0 + cpe:/a:apple:quicktime:7.68.75.0 + cpe:/a:apple:quicktime:7.6.7 + cpe:/a:apple:quicktime:7.6.9 + cpe:/a:apple:quicktime:7.1.3 + cpe:/a:apple:quicktime:7.6.8 + cpe:/a:apple:quicktime:7.71.80.42 + cpe:/a:apple:quicktime:7.1.1 + cpe:/a:apple:quicktime:7.1.2 + cpe:/a:apple:quicktime:7.4.0 + cpe:/a:apple:quicktime:7.66.71.0 + cpe:/a:apple:quicktime:7.1.0 + cpe:/a:apple:quicktime:7.2.0 + cpe:/a:apple:quicktime:7.2.1 + cpe:/a:apple:quicktime:7.3.1 + cpe:/a:apple:quicktime:7.3.0 + + CVE-2014-1249 + 2014-02-26T20:55:03.757-05:00 + 2014-03-10T13:38:27.717-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-27T12:22:24.973-05:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6151 + + + CONFIRM + http://support.apple.com/kb/HT6150 + + Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PSD image. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:quicktime:7.0.2 + cpe:/a:apple:quicktime:7.0.3 + cpe:/a:apple:quicktime:7.5.5 + cpe:/a:apple:quicktime:7.6.6 + cpe:/a:apple:quicktime:7.0.0 + cpe:/a:apple:quicktime:7.0.1 + cpe:/a:apple:quicktime:7.4.1 + cpe:/a:apple:quicktime:7.6.5 + cpe:/a:apple:quicktime:7.69.80.9 + cpe:/a:apple:quicktime:7.6.2 + cpe:/a:apple:quicktime:7.0.4 + cpe:/a:apple:quicktime:7.6.0 + cpe:/a:apple:quicktime:7.6.1 + cpe:/a:apple:quicktime:7.1.4 + cpe:/a:apple:quicktime:7.3.1.70 + cpe:/a:apple:quicktime:7.1.5 + cpe:/a:apple:quicktime:7.5.0 + cpe:/a:apple:quicktime:7.67.75.0 + cpe:/a:apple:quicktime:7.1.6 + cpe:/a:apple:quicktime:7.4.5 + cpe:/a:apple:quicktime:7.65.17.80 + cpe:/a:apple:quicktime:7.7.0 + cpe:/a:apple:quicktime:7.7.3 + cpe:/a:apple:quicktime:7.7.4 + cpe:/a:apple:quicktime:7.7.1 + cpe:/a:apple:quicktime:7.7.2 + cpe:/a:apple:quicktime:7.60.92.0 + cpe:/a:apple:quicktime:7.70.80.34 + cpe:/a:apple:quicktime:7.64.17.73 + cpe:/a:apple:quicktime:7.62.14.0 + cpe:/a:apple:quicktime:7.68.75.0 + cpe:/a:apple:quicktime:7.6.7 + cpe:/a:apple:quicktime:7.6.9 + cpe:/a:apple:quicktime:7.1.3 + cpe:/a:apple:quicktime:7.6.8 + cpe:/a:apple:quicktime:7.71.80.42 + cpe:/a:apple:quicktime:7.1.1 + cpe:/a:apple:quicktime:7.1.2 + cpe:/a:apple:quicktime:7.4.0 + cpe:/a:apple:quicktime:7.66.71.0 + cpe:/a:apple:quicktime:7.1.0 + cpe:/a:apple:quicktime:7.2.0 + cpe:/a:apple:quicktime:7.2.1 + cpe:/a:apple:quicktime:7.3.1 + cpe:/a:apple:quicktime:7.3.0 + + CVE-2014-1250 + 2014-02-26T20:55:03.773-05:00 + 2014-03-10T13:37:40.170-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-27T12:24:36.287-05:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6151 + + + CONFIRM + http://support.apple.com/kb/HT6150 + + Apple QuickTime before 7.7.5 does not properly perform a byte-swapping operation, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds memory access and application crash) via a crafted ttfo element in a movie file. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:quicktime:7.0.2 + cpe:/a:apple:quicktime:7.0.3 + cpe:/a:apple:quicktime:7.5.5 + cpe:/a:apple:quicktime:7.6.6 + cpe:/a:apple:quicktime:7.0.0 + cpe:/a:apple:quicktime:7.0.1 + cpe:/a:apple:quicktime:7.4.1 + cpe:/a:apple:quicktime:7.6.5 + cpe:/a:apple:quicktime:7.69.80.9 + cpe:/a:apple:quicktime:7.6.2 + cpe:/a:apple:quicktime:7.0.4 + cpe:/a:apple:quicktime:7.6.0 + cpe:/a:apple:quicktime:7.6.1 + cpe:/a:apple:quicktime:7.1.4 + cpe:/a:apple:quicktime:7.3.1.70 + cpe:/a:apple:quicktime:7.1.5 + cpe:/a:apple:quicktime:7.5.0 + cpe:/a:apple:quicktime:7.67.75.0 + cpe:/a:apple:quicktime:7.1.6 + cpe:/a:apple:quicktime:7.4.5 + cpe:/a:apple:quicktime:7.65.17.80 + cpe:/a:apple:quicktime:7.7.0 + cpe:/a:apple:quicktime:7.7.3 + cpe:/a:apple:quicktime:7.7.4 + cpe:/a:apple:quicktime:7.7.1 + cpe:/a:apple:quicktime:7.7.2 + cpe:/a:apple:quicktime:7.60.92.0 + cpe:/a:apple:quicktime:7.70.80.34 + cpe:/a:apple:quicktime:7.64.17.73 + cpe:/a:apple:quicktime:7.62.14.0 + cpe:/a:apple:quicktime:7.68.75.0 + cpe:/a:apple:quicktime:7.6.7 + cpe:/a:apple:quicktime:7.6.9 + cpe:/a:apple:quicktime:7.1.3 + cpe:/a:apple:quicktime:7.6.8 + cpe:/a:apple:quicktime:7.71.80.42 + cpe:/a:apple:quicktime:7.1.1 + cpe:/a:apple:quicktime:7.1.2 + cpe:/a:apple:quicktime:7.4.0 + cpe:/a:apple:quicktime:7.66.71.0 + cpe:/a:apple:quicktime:7.1.0 + cpe:/a:apple:quicktime:7.2.0 + cpe:/a:apple:quicktime:7.2.1 + cpe:/a:apple:quicktime:7.3.1 + cpe:/a:apple:quicktime:7.3.0 + + CVE-2014-1251 + 2014-02-26T20:55:03.807-05:00 + 2014-03-07T15:44:20.697-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-27T12:32:50.583-05:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6151 + + Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted clef atom in a movie file. + + + + + + + + + + + + + cpe:/a:apple:pages:5.0.1 + cpe:/a:apple:pages:5.0 + cpe:/a:apple:pages:2.0.2 + cpe:/a:apple:pages:2.0.1 + cpe:/a:apple:pages:2.0 + + CVE-2014-1252 + 2014-01-24T10:08:00.933-05:00 + 2014-04-04T23:59:53.040-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-24T18:12:07.563-05:00 + + + + + XF + apple-pages-cve20141252-code-exec(90672) + + + SECTRACK + 1029683 + + + BID + 65113 + + + CONFIRM + http://support.apple.com/kb/HT6162 + + + CONFIRM + http://support.apple.com/kb/HT6150 + + + CONFIRM + http://support.apple.com/kb/HT6117 + + + SECUNIA + 56630 + + + SECUNIA + 56615 + + + OSVDB + 102460 + + Double free vulnerability in Apple Pages 2.x before 2.1 and 5.x before 5.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Microsoft Word file. + + + + + + + + + cpe:/a:apple:boot_camp:5.0 + + CVE-2014-1253 + 2014-02-14T08:10:48.780-05:00 + 2014-02-14T12:42:06.047-05:00 + + + 4.7 + LOCAL + MEDIUM + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-02-14T12:42:05.140-05:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6126 + + + APPLE + APPLE-SA-2014-02-11-1 + + AppleMNT.sys in Apple Boot Camp 5 before 5.1 allows local users to cause a denial of service (kernel memory corruption) or possibly have unspecified other impact via a malformed header in a Portable Executable (PE) file. + + + + + + + + + + + + + + + + + cpe:/o:apple:mac_os_x:10.9.1 + cpe:/o:apple:mac_os_x:10.8.0 + cpe:/o:apple:mac_os_x:10.8.5 + cpe:/o:apple:mac_os_x:10.9 + cpe:/o:apple:mac_os_x:10.8.5:supplemental_update + cpe:/o:apple:mac_os_x:10.8.3 + cpe:/o:apple:mac_os_x:10.8.4 + cpe:/o:apple:mac_os_x:10.8.1 + cpe:/o:apple:mac_os_x:10.8.2 + + CVE-2014-1254 + 2014-02-26T20:55:03.820-05:00 + 2014-02-27T08:50:25.627-05:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-27T08:50:25.203-05:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6150 + + Apple Type Services (ATS) in Apple OS X before 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Type 1 font that is embedded in a document. + + + + + + + + + + cpe:/o:apple:mac_os_x:10.9.1 + cpe:/o:apple:mac_os_x:10.9 + + CVE-2014-1255 + 2014-02-26T20:55:03.850-05:00 + 2014-02-27T14:36:56.437-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-27T14:36:53.953-05:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6150 + + Apple Type Services (ATS) in Apple OS X before 10.9.2 does not properly validate calls to the free function, which allows attackers to bypass the App Sandbox protection mechanism via crafted Mach messages. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:apple:mac_os_x:10.9.1 + cpe:/o:apple:mac_os_x_server:10.7.2 + cpe:/o:apple:mac_os_x_server:10.7.3 + cpe:/o:apple:mac_os_x_server:10.7.4 + cpe:/o:apple:mac_os_x_server:10.7.5 + cpe:/o:apple:mac_os_x:10.7.1 + cpe:/o:apple:mac_os_x:10.7.0 + cpe:/o:apple:mac_os_x:10.9 + cpe:/o:apple:mac_os_x:10.8.5:supplemental_update + cpe:/o:apple:mac_os_x:10.8.3 + cpe:/o:apple:mac_os_x:10.8.4 + cpe:/o:apple:mac_os_x:10.8.1 + cpe:/o:apple:mac_os_x_server:10.7.0 + cpe:/o:apple:mac_os_x:10.8.2 + cpe:/o:apple:mac_os_x_server:10.7.1 + cpe:/o:apple:mac_os_x:10.8.0 + cpe:/o:apple:mac_os_x:10.8.5 + cpe:/o:apple:mac_os_x:10.7.4 + cpe:/o:apple:mac_os_x:10.7.5 + cpe:/o:apple:mac_os_x:10.7.2 + cpe:/o:apple:mac_os_x:10.7.3 + + CVE-2014-1256 + 2014-02-26T20:55:03.867-05:00 + 2014-02-27T14:38:01.080-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-27T14:38:00.003-05:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6150 + + Buffer overflow in Apple Type Services (ATS) in Apple OS X before 10.9.2 allows attackers to bypass the App Sandbox protection mechanism via crafted Mach messages. + + + + + + + + + + + + + + + cpe:/o:apple:mac_os_x:10.8.0 + cpe:/o:apple:mac_os_x:10.8.5 + cpe:/o:apple:mac_os_x:10.8.5:supplemental_update + cpe:/o:apple:mac_os_x:10.8.3 + cpe:/o:apple:mac_os_x:10.8.4 + cpe:/o:apple:mac_os_x:10.8.1 + cpe:/o:apple:mac_os_x:10.8.2 + + CVE-2014-1257 + 2014-02-26T20:55:03.897-05:00 + 2014-02-27T08:55:11.227-05:00 + + + 3.6 + LOCAL + LOW + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-27T08:55:10.900-05:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6150 + + CFNetwork in Apple OS X through 10.8.5 does not remove session cookies upon a Safari reset action, which allows physically proximate attackers to bypass intended access restrictions by leveraging an unattended workstation. + + + + + + + + + + + + + + + + + cpe:/o:apple:mac_os_x:10.9.1 + cpe:/o:apple:mac_os_x:10.8.0 + cpe:/o:apple:mac_os_x:10.8.5 + cpe:/o:apple:mac_os_x:10.9 + cpe:/o:apple:mac_os_x:10.8.5:supplemental_update + cpe:/o:apple:mac_os_x:10.8.3 + cpe:/o:apple:mac_os_x:10.8.4 + cpe:/o:apple:mac_os_x:10.8.1 + cpe:/o:apple:mac_os_x:10.8.2 + + CVE-2014-1258 + 2014-02-26T20:55:03.913-05:00 + 2014-02-27T12:59:28.967-05:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-27T12:59:28.730-05:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6150 + + Heap-based buffer overflow in CoreAnimation in Apple OS X before 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted image. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:apple:mac_os_x:10.9.1 + cpe:/o:apple:mac_os_x_server:10.7.2 + cpe:/o:apple:mac_os_x_server:10.7.3 + cpe:/o:apple:mac_os_x_server:10.7.4 + cpe:/o:apple:mac_os_x_server:10.7.5 + cpe:/o:apple:mac_os_x:10.7.1 + cpe:/o:apple:mac_os_x:10.7.0 + cpe:/o:apple:mac_os_x:10.9 + cpe:/o:apple:mac_os_x:10.8.5:supplemental_update + cpe:/o:apple:mac_os_x:10.8.3 + cpe:/o:apple:mac_os_x:10.8.4 + cpe:/o:apple:mac_os_x:10.8.1 + cpe:/o:apple:mac_os_x_server:10.7.0 + cpe:/o:apple:mac_os_x:10.8.2 + cpe:/o:apple:mac_os_x_server:10.7.1 + cpe:/o:apple:mac_os_x:10.8.0 + cpe:/o:apple:mac_os_x:10.8.5 + cpe:/o:apple:mac_os_x:10.7.4 + cpe:/o:apple:mac_os_x:10.7.5 + cpe:/o:apple:mac_os_x:10.7.2 + cpe:/o:apple:mac_os_x:10.7.3 + + CVE-2014-1259 + 2014-02-26T20:55:03.947-05:00 + 2014-03-10T13:37:01.217-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-27T13:03:41.940-05:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6150 + + Buffer overflow in File Bookmark in Apple OS X before 10.9.2 allows attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted filename. + + + + + + + + + + + + + + + cpe:/o:apple:mac_os_x:10.8.0 + cpe:/o:apple:mac_os_x:10.8.5 + cpe:/o:apple:mac_os_x:10.8.5:supplemental_update + cpe:/o:apple:mac_os_x:10.8.3 + cpe:/o:apple:mac_os_x:10.8.4 + cpe:/o:apple:mac_os_x:10.8.1 + cpe:/o:apple:mac_os_x:10.8.2 + + CVE-2014-1260 + 2014-02-26T20:55:03.977-05:00 + 2014-03-10T13:36:00.850-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-27T13:08:42.197-05:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6150 + + QuickLook in Apple OS X through 10.8.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Microsoft Office document. + + + + + + + + + + cpe:/o:apple:mac_os_x:10.9.1 + cpe:/o:apple:mac_os_x:10.9 + + CVE-2014-1261 + 2014-02-26T20:55:03.993-05:00 + 2014-02-27T13:07:51.040-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-27T13:07:50.977-05:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6150 + + Integer signedness error in CoreText in Apple OS X before 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Unicode font. + + + + + + + + + + cpe:/o:apple:mac_os_x:10.9.1 + cpe:/o:apple:mac_os_x:10.9 + + CVE-2014-1262 + 2014-02-26T20:55:04.023-05:00 + 2014-02-27T14:36:02.000-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-27T14:35:56.157-05:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6150 + + Apple Type Services (ATS) in Apple OS X before 10.9.2 allows attackers to bypass the App Sandbox protection mechanism via crafted Mach messages that trigger memory corruption. + + + + + + + + + + cpe:/o:apple:mac_os_x:10.9.1 + cpe:/o:apple:mac_os_x:10.9 + + CVE-2014-1263 + 2014-02-26T20:55:04.070-05:00 + 2014-04-24T01:04:51.077-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-02-27T13:22:07.953-05:00 + + + + + MISC + https://gist.github.com/rmoriz/fb2b0a6a0ce10550ab73 + + + CONFIRM + http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/ + + + CONFIRM + http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/ + + + CONFIRM + http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/ + + + MISC + http://twitter.com/okoeroo/statuses/437272014043496449 + + + MISC + http://twitter.com/agl__/statuses/437029812046422016 + + + CONFIRM + http://support.apple.com/kb/HT6150 + + + SECUNIA + 57968 + + + SECUNIA + 57966 + + + SECUNIA + 57836 + + curl in Apple OS X 10.9.x before 10.9.2 does not verify X.509 certificates from HTTPS servers that are accessed using a numerical IP address, which allows man-in-the-middle attackers to spoof servers via a crafted certificate. + + + + + + + + + + cpe:/o:apple:mac_os_x:10.9.1 + cpe:/o:apple:mac_os_x:10.9 + + CVE-2014-1264 + 2014-02-26T20:55:04.100-05:00 + 2014-03-10T13:32:44.690-04:00 + + + 3.3 + LOCAL + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-27T08:32:41.000-05:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6150 + + Finder in Apple OS X before 10.9.2 does not ensure ACL integrity after the viewing of file ACL information, which allows local users to bypass intended access restrictions in opportunistic circumstances via standard filesystem operations on a file with a damaged ACL. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:apple:mac_os_x:10.9.1 + cpe:/o:apple:mac_os_x_server:10.7.2 + cpe:/o:apple:mac_os_x_server:10.7.3 + cpe:/o:apple:mac_os_x_server:10.7.4 + cpe:/o:apple:mac_os_x_server:10.7.5 + cpe:/o:apple:mac_os_x:10.7.1 + cpe:/o:apple:mac_os_x:10.7.0 + cpe:/o:apple:mac_os_x:10.9 + cpe:/o:apple:mac_os_x:10.8.5:supplemental_update + cpe:/o:apple:mac_os_x:10.8.3 + cpe:/o:apple:mac_os_x:10.8.4 + cpe:/o:apple:mac_os_x:10.8.1 + cpe:/o:apple:mac_os_x_server:10.7.0 + cpe:/o:apple:mac_os_x:10.8.2 + cpe:/o:apple:mac_os_x_server:10.7.1 + cpe:/o:apple:mac_os_x:10.8.0 + cpe:/o:apple:mac_os_x:10.8.5 + cpe:/o:apple:mac_os_x:10.7.4 + cpe:/o:apple:mac_os_x:10.7.5 + cpe:/o:apple:mac_os_x:10.7.2 + cpe:/o:apple:mac_os_x:10.7.3 + + CVE-2014-1265 + 2014-02-26T20:55:04.133-05:00 + 2014-02-27T16:39:23.210-05:00 + + + 4.6 + LOCAL + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-27T08:45:31.000-05:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6150 + + The systemsetup program in the Date and Time subsystem in Apple OS X before 10.9.2 allows local users to bypass intended access restrictions by changing the current time on the system clock. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:apple:mac_os_x:10.9.1 + cpe:/o:apple:iphone_os:6.1 + cpe:/o:apple:iphone_os:6.0 + cpe:/o:apple:mac_os_x:10.9 + cpe:/o:apple:iphone_os:7.0.4 + cpe:/o:apple:iphone_os:7.0.3 + cpe:/o:apple:iphone_os:7.0.2 + cpe:/o:apple:iphone_os:7.0 + cpe:/a:apple:apple_tv:6.0 + cpe:/o:apple:iphone_os:6.0.1 + cpe:/o:apple:iphone_os:6.0.2 + cpe:/o:apple:iphone_os:7.0.1 + cpe:/a:apple:apple_tv:6.0.1 + cpe:/o:apple:iphone_os:6.1.5 + cpe:/o:apple:iphone_os:6.1.4 + cpe:/o:apple:iphone_os:6.1.3 + cpe:/o:apple:iphone_os:6.1.2 + cpe:/o:apple:iphone_os:7.0.5 + + CVE-2014-1266 + 2014-02-22T12:05:21.767-05:00 + 2014-03-05T23:50:46.533-05:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-24T09:32:40.820-05:00 + + + + + MISC + https://www.imperialviolet.org/2014/02/22/applebug.html + + + MISC + https://www.cs.columbia.edu/~smb/blog/2014-02/2014-02-24.html + + + MISC + https://www.cs.columbia.edu/~smb/blog/2014-02/2014-02-23.html + + + MISC + https://news.ycombinator.com/item?id=7281378 + + + CONFIRM + http://support.apple.com/kb/HT6150 + + + CONFIRM + http://support.apple.com/kb/HT6148 + + + CONFIRM + http://support.apple.com/kb/HT6147 + + + CONFIRM + http://support.apple.com/kb/HT6146 + + + MISC + http://it.slashdot.org/comments.pl?sid=4821073&cid=46310187 + + The SSLVerifySignedServerKeyExchange function in libsecurity_ssl/lib/sslKeyExchange.c in the Secure Transport feature in the Data Security component in Apple iOS 6.x before 6.1.6 and 7.x before 7.0.6, Apple TV 6.x before 6.0.2, and Apple OS X 10.9.x before 10.9.2 does not check the signature in a TLS Server Key Exchange message, which allows man-in-the-middle attackers to spoof SSL servers by (1) using an arbitrary private key for the signing step or (2) omitting the signing step. + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:apple_tv:6.0.2 + cpe:/o:apple:iphone_os:7.0.1 + cpe:/a:apple:apple_tv:6.0.1 + cpe:/o:apple:iphone_os:7.0.6 + cpe:/o:apple:iphone_os:7.0.4 + cpe:/o:apple:iphone_os:7.0.3 + cpe:/o:apple:iphone_os:7.0.2 + cpe:/o:apple:iphone_os:7.0 + cpe:/a:apple:apple_tv:6.0 + cpe:/o:apple:iphone_os:7.0.5 + + CVE-2014-1267 + 2014-03-14T06:55:05.897-04:00 + 2014-03-14T10:47:34.160-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-14T10:47:32.350-04:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6163 + + + CONFIRM + http://support.apple.com/kb/HT6162 + + The Configuration Profiles component in Apple iOS before 7.1 and Apple TV before 6.1 does not properly evaluate the expiration date of a mobile configuration profile, which allows attackers to bypass intended access restrictions by using a profile after the date has passed. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:apple:mac_os_x:10.9 + cpe:/o:apple:mac_os_x:10.8.3 + cpe:/o:apple:mac_os_x:10.8.4 + cpe:/o:apple:mac_os_x:10.8.1 + cpe:/o:apple:mac_os_x:10.8.2 + cpe:/a:apple:safari:7.0 + cpe:/o:apple:mac_os_x:10.8.0 + cpe:/a:apple:safari:6.1.1 + cpe:/o:apple:mac_os_x_server:10.7.2 + cpe:/o:apple:mac_os_x:10.9.1 + cpe:/a:apple:safari:6.0.1 + cpe:/o:apple:mac_os_x_server:10.7.3 + cpe:/a:apple:safari:6.0.2 + cpe:/o:apple:mac_os_x_server:10.7.4 + cpe:/a:apple:safari:6.1 + cpe:/o:apple:mac_os_x_server:10.7.5 + cpe:/a:apple:safari:6.0.5 + cpe:/o:apple:mac_os_x:10.7.1 + cpe:/o:apple:mac_os_x:10.7.0 + cpe:/a:apple:safari:6.0.3 + cpe:/a:apple:safari:6.0.4 + cpe:/o:apple:mac_os_x:10.8.5:supplemental_update + cpe:/a:apple:safari:6.0 + cpe:/o:apple:mac_os_x_server:10.7.0 + cpe:/a:apple:webkit + cpe:/o:apple:mac_os_x_server:10.7.1 + cpe:/o:apple:mac_os_x:10.8.5 + cpe:/a:apple:safari:7.0.1 + cpe:/o:apple:mac_os_x:10.7.4 + cpe:/o:apple:mac_os_x:10.7.5 + cpe:/o:apple:mac_os_x:10.7.2 + cpe:/o:apple:mac_os_x:10.7.3 + + CVE-2014-1268 + 2014-02-26T20:55:04.163-05:00 + 2014-02-27T10:35:04.610-05:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-27T10:35:01.877-05:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6145 + + WebKit, as used in Apple Safari before 6.1.2 and 7.x before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1269 and CVE-2014-1270. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:apple:mac_os_x:10.9 + cpe:/o:apple:mac_os_x:10.8.3 + cpe:/o:apple:mac_os_x:10.8.4 + cpe:/o:apple:mac_os_x:10.8.1 + cpe:/o:apple:mac_os_x:10.8.2 + cpe:/a:apple:safari:7.0 + cpe:/o:apple:mac_os_x:10.8.0 + cpe:/a:apple:safari:6.1.1 + cpe:/o:apple:mac_os_x_server:10.7.2 + cpe:/o:apple:mac_os_x:10.9.1 + cpe:/a:apple:safari:6.0.1 + cpe:/o:apple:mac_os_x_server:10.7.3 + cpe:/a:apple:safari:6.0.2 + cpe:/o:apple:mac_os_x_server:10.7.4 + cpe:/a:apple:safari:6.1 + cpe:/o:apple:mac_os_x_server:10.7.5 + cpe:/a:apple:safari:6.0.5 + cpe:/o:apple:mac_os_x:10.7.1 + cpe:/o:apple:mac_os_x:10.7.0 + cpe:/a:apple:safari:6.0.3 + cpe:/a:apple:safari:6.0.4 + cpe:/o:apple:mac_os_x:10.8.5:supplemental_update + cpe:/a:apple:safari:6.0 + cpe:/o:apple:mac_os_x_server:10.7.0 + cpe:/a:apple:webkit + cpe:/o:apple:mac_os_x_server:10.7.1 + cpe:/o:apple:mac_os_x:10.8.5 + cpe:/a:apple:safari:7.0.1 + cpe:/o:apple:mac_os_x:10.7.4 + cpe:/o:apple:mac_os_x:10.7.5 + cpe:/o:apple:mac_os_x:10.7.2 + cpe:/o:apple:mac_os_x:10.7.3 + + CVE-2014-1269 + 2014-02-26T20:55:04.180-05:00 + 2014-03-16T00:45:09.677-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-27T13:41:20.293-05:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6163 + + + CONFIRM + http://support.apple.com/kb/HT6162 + + + CONFIRM + http://support.apple.com/kb/HT6145 + + WebKit, as used in Apple Safari before 6.1.2 and 7.x before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1268 and CVE-2014-1270. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:apple:mac_os_x:10.9 + cpe:/o:apple:mac_os_x:10.8.3 + cpe:/o:apple:mac_os_x:10.8.4 + cpe:/o:apple:mac_os_x:10.8.1 + cpe:/o:apple:mac_os_x:10.8.2 + cpe:/a:apple:safari:7.0 + cpe:/o:apple:mac_os_x:10.8.0 + cpe:/a:apple:safari:6.1.1 + cpe:/o:apple:mac_os_x_server:10.7.2 + cpe:/o:apple:mac_os_x:10.9.1 + cpe:/a:apple:safari:6.0.1 + cpe:/o:apple:mac_os_x_server:10.7.3 + cpe:/a:apple:safari:6.0.2 + cpe:/o:apple:mac_os_x_server:10.7.4 + cpe:/a:apple:safari:6.1 + cpe:/o:apple:mac_os_x_server:10.7.5 + cpe:/a:apple:safari:6.0.5 + cpe:/o:apple:mac_os_x:10.7.1 + cpe:/o:apple:mac_os_x:10.7.0 + cpe:/a:apple:safari:6.0.3 + cpe:/a:apple:safari:6.0.4 + cpe:/o:apple:mac_os_x:10.8.5:supplemental_update + cpe:/a:apple:safari:6.0 + cpe:/o:apple:mac_os_x_server:10.7.0 + cpe:/a:apple:webkit + cpe:/o:apple:mac_os_x_server:10.7.1 + cpe:/o:apple:mac_os_x:10.8.5 + cpe:/a:apple:safari:7.0.1 + cpe:/o:apple:mac_os_x:10.7.4 + cpe:/o:apple:mac_os_x:10.7.5 + cpe:/o:apple:mac_os_x:10.7.2 + cpe:/o:apple:mac_os_x:10.7.3 + + CVE-2014-1270 + 2014-02-26T20:55:04.210-05:00 + 2014-03-16T00:45:09.753-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-27T13:49:45.040-05:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6163 + + + CONFIRM + http://support.apple.com/kb/HT6162 + + + CONFIRM + http://support.apple.com/kb/HT6145 + + WebKit, as used in Apple Safari before 6.1.2 and 7.x before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1268 and CVE-2014-1269. + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:apple_tv:6.0.2 + cpe:/o:apple:iphone_os:7.0.1 + cpe:/a:apple:apple_tv:6.0.1 + cpe:/o:apple:iphone_os:7.0.6 + cpe:/o:apple:iphone_os:7.0.4 + cpe:/o:apple:iphone_os:7.0.3 + cpe:/o:apple:iphone_os:7.0.2 + cpe:/o:apple:iphone_os:7.0 + cpe:/a:apple:apple_tv:6.0 + cpe:/o:apple:iphone_os:7.0.5 + + CVE-2014-1271 + 2014-03-14T06:55:05.910-04:00 + 2014-03-14T11:01:10.243-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-03-14T11:01:10.167-04:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6163 + + + CONFIRM + http://support.apple.com/kb/HT6162 + + CoreCapture in Apple iOS before 7.1 and Apple TV before 6.1 does not properly validate IOKit API calls, which allows attackers to cause a denial of service (assertion failure and device crash) via a crafted app. + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:apple_tv:6.0.2 + cpe:/o:apple:iphone_os:7.0.1 + cpe:/a:apple:apple_tv:6.0.1 + cpe:/o:apple:iphone_os:7.0.6 + cpe:/o:apple:iphone_os:7.0.4 + cpe:/o:apple:iphone_os:7.0.3 + cpe:/o:apple:iphone_os:7.0.2 + cpe:/o:apple:iphone_os:7.0 + cpe:/a:apple:apple_tv:6.0 + cpe:/o:apple:iphone_os:7.0.5 + + CVE-2014-1272 + 2014-03-14T06:55:05.943-04:00 + 2014-03-14T10:56:21.567-04:00 + + + 6.3 + LOCAL + MEDIUM + NONE + NONE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-14T10:56:19.267-04:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6163 + + + CONFIRM + http://support.apple.com/kb/HT6162 + + CrashHouseKeeping in Crash Reporting in Apple iOS before 7.1 and Apple TV before 6.1 allows local users to change arbitrary file permissions by leveraging a symlink. + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:apple_tv:6.0.2 + cpe:/o:apple:iphone_os:7.0.1 + cpe:/a:apple:apple_tv:6.0.1 + cpe:/o:apple:iphone_os:7.0.6 + cpe:/o:apple:iphone_os:7.0.4 + cpe:/o:apple:iphone_os:7.0.3 + cpe:/o:apple:iphone_os:7.0.2 + cpe:/o:apple:iphone_os:7.0 + cpe:/a:apple:apple_tv:6.0 + cpe:/o:apple:iphone_os:7.0.5 + + CVE-2014-1273 + 2014-03-14T06:55:05.957-04:00 + 2014-03-14T11:10:34.570-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-14T11:10:34.490-04:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6163 + + + CONFIRM + http://support.apple.com/kb/HT6162 + + dyld in Apple iOS before 7.1 and Apple TV before 6.1 allows attackers to bypass code-signing requirements by leveraging use of text-relocation instructions in a dynamic library. + + + + + + + + + + + + + + + cpe:/o:apple:iphone_os:7.0.1 + cpe:/o:apple:iphone_os:7.0.6 + cpe:/o:apple:iphone_os:7.0.4 + cpe:/o:apple:iphone_os:7.0.3 + cpe:/o:apple:iphone_os:7.0.2 + cpe:/o:apple:iphone_os:7.0 + cpe:/o:apple:iphone_os:7.0.5 + + CVE-2014-1274 + 2014-03-14T06:55:05.990-04:00 + 2014-03-14T11:03:16.777-04:00 + + + 2.1 + LOCAL + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-03-14T11:03:10.230-04:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6162 + + FaceTime in Apple iOS before 7.1 allows physically proximate attackers to obtain sensitive FaceTime contact information by using the lock screen for an invalid FaceTime call. + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:apple_tv:6.0.2 + cpe:/o:apple:iphone_os:7.0.1 + cpe:/a:apple:apple_tv:6.0.1 + cpe:/o:apple:iphone_os:7.0.6 + cpe:/o:apple:iphone_os:7.0.4 + cpe:/o:apple:iphone_os:7.0.3 + cpe:/o:apple:iphone_os:7.0.2 + cpe:/o:apple:iphone_os:7.0 + cpe:/a:apple:apple_tv:6.0 + cpe:/o:apple:iphone_os:7.0.5 + + CVE-2014-1275 + 2014-03-14T06:55:06.007-04:00 + 2014-03-14T11:17:27.627-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-14T11:17:23.457-04:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6163 + + + CONFIRM + http://support.apple.com/kb/HT6162 + + Buffer overflow in ImageIO in Apple iOS before 7.1 and Apple TV before 6.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted JPEG2000 data in a PDF document. + + + + + + + + + + + + + + + cpe:/o:apple:iphone_os:7.0.1 + cpe:/o:apple:iphone_os:7.0.6 + cpe:/o:apple:iphone_os:7.0.4 + cpe:/o:apple:iphone_os:7.0.3 + cpe:/o:apple:iphone_os:7.0.2 + cpe:/o:apple:iphone_os:7.0 + cpe:/o:apple:iphone_os:7.0.5 + + CVE-2014-1276 + 2014-03-14T06:55:06.037-04:00 + 2014-03-14T11:20:59.397-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-03-14T11:20:59.350-04:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6162 + + IOKit HID Event in Apple iOS before 7.1 allows attackers to conduct user-action monitoring attacks against arbitrary apps via a crafted app that accesses an IOKit framework interface. + + + CVE-2014-1277 + 2014-03-13T06:55:03.427-04:00 + 2014-03-13T06:55:03.503-04:00 + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-3948. Reason: This candidate is a duplicate of CVE-2013-3948. Notes: All CVE users should reference CVE-2013-3948 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:apple_tv:6.0.2 + cpe:/o:apple:iphone_os:7.0.1 + cpe:/a:apple:apple_tv:6.0.1 + cpe:/o:apple:iphone_os:7.0.6 + cpe:/o:apple:iphone_os:7.0.4 + cpe:/o:apple:iphone_os:7.0.3 + cpe:/o:apple:iphone_os:7.0.2 + cpe:/o:apple:iphone_os:7.0 + cpe:/a:apple:apple_tv:6.0 + cpe:/o:apple:iphone_os:7.0.5 + + CVE-2014-1278 + 2014-03-14T06:55:06.053-04:00 + 2014-03-14T11:46:04.873-04:00 + + + 7.2 + LOCAL + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-14T11:46:01.560-04:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6163 + + + CONFIRM + http://support.apple.com/kb/HT6162 + + The ptmx_get_ioctl function in the ARM kernel in Apple iOS before 7.1 and Apple TV before 6.1 allows local users to gain privileges or cause a denial of service (out-of-bounds memory access and device crash) via a crafted call. + + + + + + + + + + + cpe:/a:apple:apple_tv:6.0.2 + cpe:/a:apple:apple_tv:6.0.1 + cpe:/a:apple:apple_tv:6.0 + + CVE-2014-1279 + 2014-03-14T06:55:06.083-04:00 + 2014-03-14T11:47:33.750-04:00 + + + 2.1 + LOCAL + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-03-14T11:47:33.657-04:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6163 + + Apple TV before 6.1 does not properly restrict logging, which allows local users to obtain sensitive information by reading log data. + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:apple_tv:6.0.2 + cpe:/o:apple:iphone_os:7.0.1 + cpe:/a:apple:apple_tv:6.0.1 + cpe:/o:apple:iphone_os:7.0.6 + cpe:/o:apple:iphone_os:7.0.4 + cpe:/o:apple:iphone_os:7.0.3 + cpe:/o:apple:iphone_os:7.0.2 + cpe:/o:apple:iphone_os:7.0 + cpe:/a:apple:apple_tv:6.0 + cpe:/o:apple:iphone_os:7.0.5 + + CVE-2014-1280 + 2014-03-14T06:55:06.100-04:00 + 2014-03-14T11:52:21.803-04:00 + + + 7.1 + NETWORK + MEDIUM + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-03-14T11:52:21.740-04:00 + + + + CONFIRM + http://support.apple.com/kb/HT6163 + + + CONFIRM + http://support.apple.com/kb/HT6162 + + Video Driver in Apple iOS before 7.1 and Apple TV before 6.1 allows remote attackers to cause a denial of service (NULL pointer dereference and device hang) via a crafted video file with MPEG-4 encoding. + + + + + + + + + + + + + + + cpe:/o:apple:iphone_os:7.0.1 + cpe:/o:apple:iphone_os:7.0.6 + cpe:/o:apple:iphone_os:7.0.4 + cpe:/o:apple:iphone_os:7.0.3 + cpe:/o:apple:iphone_os:7.0.2 + cpe:/o:apple:iphone_os:7.0 + cpe:/o:apple:iphone_os:7.0.5 + + CVE-2014-1281 + 2014-03-14T06:55:06.113-04:00 + 2014-03-14T11:50:03.097-04:00 + + + 1.9 + LOCAL + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-03-14T11:50:03.050-04:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6162 + + Photos Backend in Apple iOS before 7.1 does not properly manage the asset-library cache during deletions, which allows physically proximate attackers to obtain sensitive photo data by launching the Photos app and looking under a transparent image. + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:apple_tv:6.0.2 + cpe:/o:apple:iphone_os:7.0.1 + cpe:/a:apple:apple_tv:6.0.1 + cpe:/o:apple:iphone_os:7.0.6 + cpe:/o:apple:iphone_os:7.0.4 + cpe:/o:apple:iphone_os:7.0.3 + cpe:/o:apple:iphone_os:7.0.2 + cpe:/o:apple:iphone_os:7.0 + cpe:/a:apple:apple_tv:6.0 + cpe:/o:apple:iphone_os:7.0.5 + + CVE-2014-1282 + 2014-03-14T06:55:06.147-04:00 + 2014-03-14T11:55:37.650-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-14T11:55:37.510-04:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6163 + + + CONFIRM + http://support.apple.com/kb/HT6162 + + The Profiles component in Apple iOS before 7.1 and Apple TV before 6.1 allows attackers to bypass intended configuration-profile visibility requirements via a long name. + + + CVE-2014-1284 + 2014-03-13T06:55:03.520-04:00 + 2014-03-13T06:55:03.597-04:00 + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-2019. Reason: This candidate is a duplicate of CVE-2014-2019. Notes: All CVE users should reference CVE-2014-2019 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. + + + + + + + + + + + + + + + cpe:/o:apple:iphone_os:7.0.1 + cpe:/o:apple:iphone_os:7.0.6 + cpe:/o:apple:iphone_os:7.0.4 + cpe:/o:apple:iphone_os:7.0.3 + cpe:/o:apple:iphone_os:7.0.2 + cpe:/o:apple:iphone_os:7.0 + cpe:/o:apple:iphone_os:7.0.5 + + CVE-2014-1285 + 2014-03-14T06:55:06.160-04:00 + 2014-03-14T11:57:36.093-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-14T11:57:36.013-04:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6162 + + Springboard in Apple iOS before 7.1 allows physically proximate attackers to bypass intended access restrictions and read the home screen by leveraging an application crash during activation of an unactivated device. + + + + + + + + + + + + + + + cpe:/o:apple:iphone_os:7.0.1 + cpe:/o:apple:iphone_os:7.0.6 + cpe:/o:apple:iphone_os:7.0.4 + cpe:/o:apple:iphone_os:7.0.3 + cpe:/o:apple:iphone_os:7.0.2 + cpe:/o:apple:iphone_os:7.0 + cpe:/o:apple:iphone_os:7.0.5 + + CVE-2014-1286 + 2014-03-14T06:55:06.193-04:00 + 2014-03-14T12:06:50.450-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-03-14T12:06:50.403-04:00 + + + + CONFIRM + http://support.apple.com/kb/HT6162 + + SpringBoard Lock Screen in Apple iOS before 7.1 allows remote attackers to cause a denial of service (lock-screen hang) by leveraging a state-management error. + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:apple_tv:6.0.2 + cpe:/o:apple:iphone_os:7.0.1 + cpe:/a:apple:apple_tv:6.0.1 + cpe:/o:apple:iphone_os:7.0.6 + cpe:/o:apple:iphone_os:7.0.4 + cpe:/o:apple:iphone_os:7.0.3 + cpe:/o:apple:iphone_os:7.0.2 + cpe:/o:apple:iphone_os:7.0 + cpe:/a:apple:apple_tv:6.0 + cpe:/o:apple:iphone_os:7.0.5 + + CVE-2014-1287 + 2014-03-14T06:55:06.207-04:00 + 2014-03-14T12:11:54.723-04:00 + + + 7.2 + LOCAL + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-14T12:11:54.660-04:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6163 + + + CONFIRM + http://support.apple.com/kb/HT6162 + + USB Host in Apple iOS before 7.1 and Apple TV before 6.1 allows physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted USB messages. + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:apple_tv:6.0.2 + cpe:/o:apple:iphone_os:7.0.1 + cpe:/a:apple:apple_tv:6.0.1 + cpe:/o:apple:iphone_os:7.0.6 + cpe:/o:apple:iphone_os:7.0.4 + cpe:/o:apple:iphone_os:7.0.3 + cpe:/o:apple:iphone_os:7.0.2 + cpe:/o:apple:iphone_os:7.0 + cpe:/a:apple:apple_tv:6.0 + cpe:/o:apple:iphone_os:7.0.5 + + CVE-2014-1289 + 2014-03-14T06:55:06.240-04:00 + 2014-04-04T23:59:56.353-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-14T12:15:49.057-04:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6163 + + + CONFIRM + http://support.apple.com/kb/HT6162 + + + APPLE + APPLE-SA-2014-04-01-1 + + WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1290, CVE-2014-1291, CVE-2014-1292, CVE-2014-1293, and CVE-2014-1294. + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:apple_tv:6.0.2 + cpe:/o:apple:iphone_os:7.0.1 + cpe:/a:apple:apple_tv:6.0.1 + cpe:/o:apple:iphone_os:7.0.6 + cpe:/o:apple:iphone_os:7.0.4 + cpe:/o:apple:iphone_os:7.0.3 + cpe:/o:apple:iphone_os:7.0.2 + cpe:/o:apple:iphone_os:7.0 + cpe:/a:apple:apple_tv:6.0 + cpe:/o:apple:iphone_os:7.0.5 + + CVE-2014-1290 + 2014-03-14T06:55:06.270-04:00 + 2014-04-04T23:59:58.307-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-14T12:24:15.913-04:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6163 + + + CONFIRM + http://support.apple.com/kb/HT6162 + + + APPLE + APPLE-SA-2014-04-01-1 + + WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1291, CVE-2014-1292, CVE-2014-1293, and CVE-2014-1294. + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:apple_tv:6.0.2 + cpe:/o:apple:iphone_os:7.0.1 + cpe:/a:apple:apple_tv:6.0.1 + cpe:/o:apple:iphone_os:7.0.6 + cpe:/o:apple:iphone_os:7.0.4 + cpe:/o:apple:iphone_os:7.0.3 + cpe:/o:apple:iphone_os:7.0.2 + cpe:/o:apple:iphone_os:7.0 + cpe:/a:apple:apple_tv:6.0 + cpe:/o:apple:iphone_os:7.0.5 + + CVE-2014-1291 + 2014-03-14T06:55:06.287-04:00 + 2014-04-04T23:59:58.387-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-14T12:28:29.247-04:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6163 + + + CONFIRM + http://support.apple.com/kb/HT6162 + + + APPLE + APPLE-SA-2014-04-01-1 + + WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1292, CVE-2014-1293, and CVE-2014-1294. + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:apple_tv:6.0.2 + cpe:/o:apple:iphone_os:7.0.1 + cpe:/a:apple:apple_tv:6.0.1 + cpe:/o:apple:iphone_os:7.0.6 + cpe:/o:apple:iphone_os:7.0.4 + cpe:/o:apple:iphone_os:7.0.3 + cpe:/o:apple:iphone_os:7.0.2 + cpe:/o:apple:iphone_os:7.0 + cpe:/a:apple:apple_tv:6.0 + cpe:/o:apple:iphone_os:7.0.5 + + CVE-2014-1292 + 2014-03-14T06:55:06.317-04:00 + 2014-04-04T23:59:58.480-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-14T12:29:33.390-04:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6163 + + + CONFIRM + http://support.apple.com/kb/HT6162 + + + APPLE + APPLE-SA-2014-04-01-1 + + WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1291, CVE-2014-1293, and CVE-2014-1294. + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:apple_tv:6.0.2 + cpe:/o:apple:iphone_os:7.0.1 + cpe:/a:apple:apple_tv:6.0.1 + cpe:/o:apple:iphone_os:7.0.6 + cpe:/o:apple:iphone_os:7.0.4 + cpe:/o:apple:iphone_os:7.0.3 + cpe:/o:apple:iphone_os:7.0.2 + cpe:/o:apple:iphone_os:7.0 + cpe:/a:apple:apple_tv:6.0 + cpe:/o:apple:iphone_os:7.0.5 + + CVE-2014-1293 + 2014-03-14T06:55:06.333-04:00 + 2014-04-05T00:00:07.557-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-14T12:34:17.600-04:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6163 + + + CONFIRM + http://support.apple.com/kb/HT6162 + + + APPLE + APPLE-SA-2014-04-01-1 + + WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1291, CVE-2014-1292, and CVE-2014-1294. + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:apple_tv:6.0.2 + cpe:/o:apple:iphone_os:7.0.1 + cpe:/a:apple:apple_tv:6.0.1 + cpe:/o:apple:iphone_os:7.0.6 + cpe:/o:apple:iphone_os:7.0.4 + cpe:/o:apple:iphone_os:7.0.3 + cpe:/o:apple:iphone_os:7.0.2 + cpe:/o:apple:iphone_os:7.0 + cpe:/a:apple:apple_tv:6.0 + cpe:/o:apple:iphone_os:7.0.5 + + CVE-2014-1294 + 2014-03-14T06:55:06.363-04:00 + 2014-04-05T00:00:07.637-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-14T12:35:45.197-04:00 + + + + + CONFIRM + http://support.apple.com/kb/HT6163 + + + CONFIRM + http://support.apple.com/kb/HT6162 + + + APPLE + APPLE-SA-2014-04-01-1 + + WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1291, CVE-2014-1292, and CVE-2014-1293. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:apple:mac_os_x:10.9.1 + cpe:/o:apple:mac_os_x:10.9.2 + cpe:/o:apple:mac_os_x:10.9 + cpe:/o:apple:iphone_os:7.0.4 + cpe:/o:apple:mac_os_x:10.8.5:supplemental_update + cpe:/o:apple:iphone_os:7.0.3 + cpe:/o:apple:iphone_os:7.0.2 + cpe:/o:apple:mac_os_x:10.8.3 + cpe:/o:apple:iphone_os:7.1 + cpe:/o:apple:mac_os_x:10.8.4 + cpe:/o:apple:iphone_os:7.0 + cpe:/o:apple:mac_os_x:10.8.1 + cpe:/a:apple:apple_tv:6.0 + cpe:/o:apple:mac_os_x:10.8.2 + cpe:/a:apple:apple_tv:6.1 + cpe:/o:apple:mac_os_x:10.8.0 + cpe:/a:apple:apple_tv:6.0.2 + cpe:/o:apple:mac_os_x:10.8.5 + cpe:/o:apple:iphone_os:7.0.1 + cpe:/a:apple:apple_tv:6.0.1 + cpe:/o:apple:iphone_os:7.0.6 + cpe:/o:apple:iphone_os:7.0.5 + + CVE-2014-1295 + 2014-04-23T07:52:59.383-04:00 + 2014-04-23T13:34:57.227-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-23T13:34:53.537-04:00 + + + + + MISC + https://secure-resumption.com/ + + + APPLE + APPLE-SA-2014-04-22-2 + + + APPLE + APPLE-SA-2014-04-22-3 + + + APPLE + APPLE-SA-2014-04-22-1 + + Secure Transport in Apple iOS before 7.1.1, Apple OS X 10.8.x and 10.9.x through 10.9.2, and Apple TV before 6.1.1 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which allows man-in-the-middle attackers to obtain sensitive information or modify TLS session data via a "triple handshake attack." + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:apple:mac_os_x:10.9 + cpe:/o:apple:iphone_os:7.0.4 + cpe:/o:apple:iphone_os:7.0.3 + cpe:/o:apple:iphone_os:7.0.2 + cpe:/o:apple:mac_os_x:10.8.3 + cpe:/o:apple:iphone_os:7.1 + cpe:/o:apple:iphone_os:7.0 + cpe:/o:apple:mac_os_x:10.8.4 + cpe:/o:apple:mac_os_x:10.8.1 + cpe:/o:apple:mac_os_x:10.8.2 + cpe:/o:apple:mac_os_x:10.8.0 + cpe:/o:apple:iphone_os:7.0.1 + cpe:/o:apple:mac_os_x:10.9.1 + cpe:/o:apple:mac_os_x_server:10.7.2 + cpe:/o:apple:mac_os_x_server:10.7.3 + cpe:/o:apple:mac_os_x_server:10.7.4 + cpe:/o:apple:mac_os_x:10.9.2 + cpe:/o:apple:mac_os_x_server:10.7.5 + cpe:/o:apple:mac_os_x:10.7.1 + cpe:/o:apple:mac_os_x:10.7.0 + cpe:/o:apple:mac_os_x:10.8.5:supplemental_update + cpe:/a:apple:apple_tv:6.0 + cpe:/o:apple:mac_os_x_server:10.7.0 + cpe:/a:apple:apple_tv:6.1 + cpe:/o:apple:mac_os_x_server:10.7.1 + cpe:/a:apple:apple_tv:6.0.2 + cpe:/o:apple:mac_os_x:10.8.5 + cpe:/a:apple:apple_tv:6.0.1 + cpe:/o:apple:mac_os_x:10.7.4 + cpe:/o:apple:iphone_os:7.0.6 + cpe:/o:apple:mac_os_x:10.7.5 + cpe:/o:apple:mac_os_x:10.7.2 + cpe:/o:apple:mac_os_x:10.7.3 + cpe:/o:apple:iphone_os:7.0.5 + + CVE-2014-1296 + 2014-04-23T07:52:59.400-04:00 + 2014-04-23T13:36:27.820-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-23T13:36:27.557-04:00 + + + + + APPLE + APPLE-SA-2014-04-22-2 + + + APPLE + APPLE-SA-2014-04-22-3 + + + APPLE + APPLE-SA-2014-04-22-1 + + CFNetwork in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 does not ensure that a Set-Cookie HTTP header is complete before interpreting the header's value, which allows remote attackers to bypass intended access restrictions by triggering the closing of a TCP connection during transmission of a header, as demonstrated by an HTTPOnly restriction. + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:safari:6.0.1 + cpe:/a:apple:safari:7.0 + cpe:/a:apple:safari:6.0.2 + cpe:/a:apple:safari:7.0.2 + cpe:/a:apple:safari:6.1 + cpe:/a:apple:safari:6.0.5 + cpe:/a:apple:safari:7.0.1 + cpe:/a:apple:safari:6.0.3 + cpe:/a:apple:safari:6.0.4 + cpe:/a:apple:safari:6.1.2 + cpe:/a:apple:safari:6.0 + cpe:/a:apple:safari:6.1.1 + + CVE-2014-1297 + 2014-04-02T12:17:06.870-04:00 + 2014-04-02T13:07:49.410-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-02T13:07:45.410-04:00 + + + + + APPLE + APPLE-SA-2014-04-01-1 + + WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, does not properly validate WebProcess IPC messages, which allows remote attackers to bypass a sandbox protection mechanism and read arbitrary files by leveraging WebProcess access. + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:safari:6.0.1 + cpe:/a:apple:safari:7.0 + cpe:/a:apple:safari:6.0.2 + cpe:/a:apple:safari:7.0.2 + cpe:/a:apple:safari:6.1 + cpe:/a:apple:safari:6.0.5 + cpe:/a:apple:safari:7.0.1 + cpe:/a:apple:safari:6.0.3 + cpe:/a:apple:safari:6.0.4 + cpe:/a:apple:safari:6.1.2 + cpe:/a:apple:safari:6.0 + cpe:/a:apple:safari:6.1.1 + + CVE-2014-1298 + 2014-04-02T12:17:06.900-04:00 + 2014-04-24T01:04:56.543-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-02T13:13:26.203-04:00 + + + + + APPLE + APPLE-SA-2014-04-22-2 + + + APPLE + APPLE-SA-2014-04-22-3 + + + APPLE + APPLE-SA-2014-04-01-1 + + WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1. + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:safari:6.0.1 + cpe:/a:apple:safari:7.0 + cpe:/a:apple:safari:6.0.2 + cpe:/a:apple:safari:7.0.2 + cpe:/a:apple:safari:6.1 + cpe:/a:apple:safari:6.0.5 + cpe:/a:apple:safari:7.0.1 + cpe:/a:apple:safari:6.0.3 + cpe:/a:apple:safari:6.0.4 + cpe:/a:apple:safari:6.1.2 + cpe:/a:apple:safari:6.0 + cpe:/a:apple:safari:6.1.1 + + CVE-2014-1299 + 2014-04-02T12:17:06.917-04:00 + 2014-04-24T01:04:56.763-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-02T13:17:28.617-04:00 + + + + + APPLE + APPLE-SA-2014-04-22-2 + + + APPLE + APPLE-SA-2014-04-22-3 + + + APPLE + APPLE-SA-2014-04-01-1 + + WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1. + + + + + + + + + + + + + + cpe:/a:apple:safari:7.0.2 + + CVE-2014-1300 + 2014-03-26T10:55:05.740-04:00 + 2014-04-24T01:04:56.997-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-26T14:42:34.170-04:00 + + + + MISC + http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/ + + + MISC + http://twitter.com/thezdi/statuses/443796547872903168 + + + APPLE + APPLE-SA-2014-04-22-2 + + + APPLE + APPLE-SA-2014-04-22-3 + + + APPLE + APPLE-SA-2014-04-01-1 + + Unspecified vulnerability in Apple Safari 7.0.2 on OS X allows remote attackers to execute arbitrary code with root privileges via unknown vectors, as demonstrated by Google during a Pwn4Fun competition at CanSecWest 2014. + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:safari:6.0.1 + cpe:/a:apple:safari:7.0 + cpe:/a:apple:safari:6.0.2 + cpe:/a:apple:safari:7.0.2 + cpe:/a:apple:safari:6.1 + cpe:/a:apple:safari:6.0.5 + cpe:/a:apple:safari:7.0.1 + cpe:/a:apple:safari:6.0.3 + cpe:/a:apple:safari:6.0.4 + cpe:/a:apple:safari:6.1.2 + cpe:/a:apple:safari:6.0 + cpe:/a:apple:safari:6.1.1 + + CVE-2014-1301 + 2014-04-02T12:17:06.947-04:00 + 2014-04-02T14:12:48.837-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-02T14:12:48.760-04:00 + + + + + APPLE + APPLE-SA-2014-04-01-1 + + WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1. + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:safari:6.0.1 + cpe:/a:apple:safari:7.0 + cpe:/a:apple:safari:6.0.2 + cpe:/a:apple:safari:7.0.2 + cpe:/a:apple:safari:6.1 + cpe:/a:apple:safari:6.0.5 + cpe:/a:apple:safari:7.0.1 + cpe:/a:apple:safari:6.0.3 + cpe:/a:apple:safari:6.0.4 + cpe:/a:apple:safari:6.1.2 + cpe:/a:apple:safari:6.0 + cpe:/a:apple:safari:6.1.1 + + CVE-2014-1302 + 2014-04-02T12:17:06.963-04:00 + 2014-04-24T01:04:57.420-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-02T14:13:47.403-04:00 + + + + + APPLE + APPLE-SA-2014-04-22-2 + + + APPLE + APPLE-SA-2014-04-22-3 + + + APPLE + APPLE-SA-2014-04-01-1 + + WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1. + + + + + + + + + cpe:/a:apple:safari:7.0.2 + + CVE-2014-1303 + 2014-03-26T10:55:05.773-04:00 + 2014-04-24T01:04:57.637-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-26T14:48:23.590-04:00 + + + + + MISC + http://www.pwn2own.com/2014/03/pwn2own-results-thursday-day-two/ + + + MISC + http://twitter.com/thezdi/statuses/444157530139136000 + + + APPLE + APPLE-SA-2014-04-22-2 + + + APPLE + APPLE-SA-2014-04-22-3 + + + APPLE + APPLE-SA-2014-04-01-1 + + Heap-based buffer overflow in Apple Safari 7.0.2 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors, as demonstrated by Liang Chen during a Pwn2Own competition at CanSecWest 2014. + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:safari:6.0.1 + cpe:/a:apple:safari:7.0 + cpe:/a:apple:safari:6.0.2 + cpe:/a:apple:safari:7.0.2 + cpe:/a:apple:safari:6.1 + cpe:/a:apple:safari:6.0.5 + cpe:/a:apple:safari:7.0.1 + cpe:/a:apple:safari:6.0.3 + cpe:/a:apple:safari:6.0.4 + cpe:/a:apple:safari:6.1.2 + cpe:/a:apple:safari:6.0 + cpe:/a:apple:safari:6.1.1 + + CVE-2014-1304 + 2014-04-02T12:17:06.993-04:00 + 2014-04-24T01:04:57.840-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-02T14:26:17.083-04:00 + + + + + APPLE + APPLE-SA-2014-04-22-2 + + + APPLE + APPLE-SA-2014-04-22-3 + + + APPLE + APPLE-SA-2014-04-01-1 + + WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1. + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:safari:6.0.1 + cpe:/a:apple:safari:7.0 + cpe:/a:apple:safari:6.0.2 + cpe:/a:apple:safari:7.0.2 + cpe:/a:apple:safari:6.1 + cpe:/a:apple:safari:6.0.5 + cpe:/a:apple:safari:7.0.1 + cpe:/a:apple:safari:6.0.3 + cpe:/a:apple:safari:6.0.4 + cpe:/a:apple:safari:6.1.2 + cpe:/a:apple:safari:6.0 + cpe:/a:apple:safari:6.1.1 + + CVE-2014-1305 + 2014-04-02T12:17:07.027-04:00 + 2014-04-24T01:04:58.060-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-02T14:40:02.987-04:00 + + + + + APPLE + APPLE-SA-2014-04-22-2 + + + APPLE + APPLE-SA-2014-04-22-3 + + + APPLE + APPLE-SA-2014-04-01-1 + + WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1. + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:safari:6.0.1 + cpe:/a:apple:safari:7.0 + cpe:/a:apple:safari:6.0.2 + cpe:/a:apple:safari:7.0.2 + cpe:/a:apple:safari:6.1 + cpe:/a:apple:safari:6.0.5 + cpe:/a:apple:safari:7.0.1 + cpe:/a:apple:safari:6.0.3 + cpe:/a:apple:safari:6.0.4 + cpe:/a:apple:safari:6.1.2 + cpe:/a:apple:safari:6.0 + cpe:/a:apple:safari:6.1.1 + + CVE-2014-1307 + 2014-04-02T12:17:07.040-04:00 + 2014-04-24T01:04:58.277-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-02T14:44:05.807-04:00 + + + + + APPLE + APPLE-SA-2014-04-22-2 + + + APPLE + APPLE-SA-2014-04-22-3 + + + APPLE + APPLE-SA-2014-04-01-1 + + WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1. + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:safari:6.0.1 + cpe:/a:apple:safari:7.0 + cpe:/a:apple:safari:6.0.2 + cpe:/a:apple:safari:7.0.2 + cpe:/a:apple:safari:6.1 + cpe:/a:apple:safari:6.0.5 + cpe:/a:apple:safari:7.0.1 + cpe:/a:apple:safari:6.0.3 + cpe:/a:apple:safari:6.0.4 + cpe:/a:apple:safari:6.1.2 + cpe:/a:apple:safari:6.0 + cpe:/a:apple:safari:6.1.1 + + CVE-2014-1308 + 2014-04-02T12:17:07.073-04:00 + 2014-04-24T01:04:58.497-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-02T14:45:37.637-04:00 + + + + + APPLE + APPLE-SA-2014-04-22-2 + + + APPLE + APPLE-SA-2014-04-22-3 + + + APPLE + APPLE-SA-2014-04-01-1 + + WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1. + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:safari:6.0.1 + cpe:/a:apple:safari:7.0 + cpe:/a:apple:safari:6.0.2 + cpe:/a:apple:safari:7.0.2 + cpe:/a:apple:safari:6.1 + cpe:/a:apple:safari:6.0.5 + cpe:/a:apple:safari:7.0.1 + cpe:/a:apple:safari:6.0.3 + cpe:/a:apple:safari:6.0.4 + cpe:/a:apple:safari:6.1.2 + cpe:/a:apple:safari:6.0 + cpe:/a:apple:safari:6.1.1 + + CVE-2014-1309 + 2014-04-02T12:17:07.087-04:00 + 2014-04-24T01:04:58.733-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-02T14:46:24.547-04:00 + + + + + APPLE + APPLE-SA-2014-04-22-2 + + + APPLE + APPLE-SA-2014-04-22-3 + + + APPLE + APPLE-SA-2014-04-01-1 + + WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1. + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:safari:6.0.1 + cpe:/a:apple:safari:7.0 + cpe:/a:apple:safari:6.0.2 + cpe:/a:apple:safari:7.0.2 + cpe:/a:apple:safari:6.1 + cpe:/a:apple:safari:6.0.5 + cpe:/a:apple:safari:7.0.1 + cpe:/a:apple:safari:6.0.3 + cpe:/a:apple:safari:6.0.4 + cpe:/a:apple:safari:6.1.2 + cpe:/a:apple:safari:6.0 + cpe:/a:apple:safari:6.1.1 + + CVE-2014-1310 + 2014-04-02T12:17:07.120-04:00 + 2014-04-24T01:04:58.950-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-02T14:50:30.523-04:00 + + + + + APPLE + APPLE-SA-2014-04-22-2 + + + APPLE + APPLE-SA-2014-04-22-3 + + + APPLE + APPLE-SA-2014-04-01-1 + + WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1. + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:safari:6.0.1 + cpe:/a:apple:safari:7.0 + cpe:/a:apple:safari:6.0.2 + cpe:/a:apple:safari:7.0.2 + cpe:/a:apple:safari:6.1 + cpe:/a:apple:safari:6.0.5 + cpe:/a:apple:safari:7.0.1 + cpe:/a:apple:safari:6.0.3 + cpe:/a:apple:safari:6.0.4 + cpe:/a:apple:safari:6.1.2 + cpe:/a:apple:safari:6.0 + cpe:/a:apple:safari:6.1.1 + + CVE-2014-1311 + 2014-04-02T12:17:07.150-04:00 + 2014-04-24T01:04:59.170-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-02T14:55:36.657-04:00 + + + + + APPLE + APPLE-SA-2014-04-22-2 + + + APPLE + APPLE-SA-2014-04-22-3 + + + APPLE + APPLE-SA-2014-04-01-1 + + WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1. + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:safari:6.0.1 + cpe:/a:apple:safari:7.0 + cpe:/a:apple:safari:6.0.2 + cpe:/a:apple:safari:7.0.2 + cpe:/a:apple:safari:6.1 + cpe:/a:apple:safari:6.0.5 + cpe:/a:apple:safari:7.0.1 + cpe:/a:apple:safari:6.0.3 + cpe:/a:apple:safari:6.0.4 + cpe:/a:apple:safari:6.1.2 + cpe:/a:apple:safari:6.0 + cpe:/a:apple:safari:6.1.1 + + CVE-2014-1312 + 2014-04-02T12:17:07.167-04:00 + 2014-04-24T01:04:59.387-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-02T14:57:07.583-04:00 + + + + + APPLE + APPLE-SA-2014-04-22-2 + + + APPLE + APPLE-SA-2014-04-22-3 + + + APPLE + APPLE-SA-2014-04-01-1 + + WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1. + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:safari:6.0.1 + cpe:/a:apple:safari:7.0 + cpe:/a:apple:safari:6.0.2 + cpe:/a:apple:safari:7.0.2 + cpe:/a:apple:safari:6.1 + cpe:/a:apple:safari:6.0.5 + cpe:/a:apple:safari:7.0.1 + cpe:/a:apple:safari:6.0.3 + cpe:/a:apple:safari:6.0.4 + cpe:/a:apple:safari:6.1.2 + cpe:/a:apple:safari:6.0 + cpe:/a:apple:safari:6.1.1 + + CVE-2014-1313 + 2014-04-02T12:17:07.197-04:00 + 2014-04-24T01:04:59.623-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-02T14:59:03.290-04:00 + + + + + APPLE + APPLE-SA-2014-04-22-2 + + + APPLE + APPLE-SA-2014-04-22-3 + + + APPLE + APPLE-SA-2014-04-01-1 + + WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1. + + + + + + + + + + + + + + + + + + + + + + cpe:/o:apple:mac_os_x:10.8.0 + cpe:/o:apple:mac_os_x:10.9.1 + cpe:/o:apple:mac_os_x:10.9.2 + cpe:/o:apple:mac_os_x:10.8.5 + cpe:/o:apple:mac_os_x:10.9 + cpe:/o:apple:mac_os_x:10.8.5:supplemental_update + cpe:/o:apple:mac_os_x:10.8.3 + cpe:/o:apple:mac_os_x:10.8.4 + cpe:/o:apple:mac_os_x:10.8.1 + cpe:/o:apple:mac_os_x:10.8.2 + + CVE-2014-1314 + 2014-04-23T07:52:59.417-04:00 + 2014-04-24T07:24:47.747-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-23T13:42:06.160-04:00 + + + + + APPLE + APPLE-SA-2014-04-22-1 + + WindowServer in Apple OS X through 10.9.2 does not prevent session creation by a sandboxed application, which allows attackers to bypass the sandbox protection mechanism and execute arbitrary code via a crafted application. + + + + + + + + + + + cpe:/o:apple:mac_os_x:10.9.1 + cpe:/o:apple:mac_os_x:10.9.2 + cpe:/o:apple:mac_os_x:10.9 + + CVE-2014-1315 + 2014-04-23T07:52:59.417-04:00 + 2014-04-23T13:48:42.920-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-23T13:48:42.890-04:00 + + + + + APPLE + APPLE-SA-2014-04-22-1 + + Format string vulnerability in CoreServicesUIAgent in Apple OS X 10.9.x through 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a URL. + + + + + + + + + + + cpe:/o:apple:mac_os_x:10.9.1 + cpe:/o:apple:mac_os_x:10.9.2 + cpe:/o:apple:mac_os_x:10.9 + + CVE-2014-1316 + 2014-04-23T07:52:59.430-04:00 + 2014-04-23T13:52:56.883-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-23T13:52:56.837-04:00 + + + + + APPLE + APPLE-SA-2014-04-22-1 + + Heimdal, as used in Apple OS X through 10.9.2, allows remote attackers to cause a denial of service (abort and daemon exit) via ASN.1 data encountered in the Kerberos 5 protocol. + + + + + + + + + + + + + + + + + + + + + + cpe:/o:apple:mac_os_x:10.8.0 + cpe:/o:apple:mac_os_x:10.9.1 + cpe:/o:apple:mac_os_x:10.9.2 + cpe:/o:apple:mac_os_x:10.8.5 + cpe:/o:apple:mac_os_x:10.9 + cpe:/o:apple:mac_os_x:10.8.5:supplemental_update + cpe:/o:apple:mac_os_x:10.8.3 + cpe:/o:apple:mac_os_x:10.8.4 + cpe:/o:apple:mac_os_x:10.8.1 + cpe:/o:apple:mac_os_x:10.8.2 + + CVE-2014-1318 + 2014-04-23T07:52:59.430-04:00 + 2014-04-23T13:58:50.017-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-23T13:58:49.923-04:00 + + + + + APPLE + APPLE-SA-2014-04-22-1 + + The Intel Graphics Driver in Apple OS X through 10.9.2 does not properly validate a certain pointer, which allows attackers to execute arbitrary code via a crafted application. + + + + + + + + + + + cpe:/o:apple:mac_os_x:10.9.1 + cpe:/o:apple:mac_os_x:10.9.2 + cpe:/o:apple:mac_os_x:10.9 + + CVE-2014-1319 + 2014-04-23T07:52:59.430-04:00 + 2014-04-23T14:02:41.353-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-23T14:02:41.117-04:00 + + + + + APPLE + APPLE-SA-2014-04-22-1 + + Buffer overflow in ImageIO in Apple OS X 10.9.x through 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JPEG image. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:apple:mac_os_x:10.9.1 + cpe:/o:apple:mac_os_x:10.9.2 + cpe:/o:apple:mac_os_x:10.9 + cpe:/o:apple:iphone_os:7.0.4 + cpe:/o:apple:iphone_os:7.0.3 + cpe:/o:apple:iphone_os:7.0.2 + cpe:/o:apple:iphone_os:7.1 + cpe:/o:apple:iphone_os:7.0 + cpe:/a:apple:apple_tv:6.0 + cpe:/a:apple:apple_tv:6.1 + cpe:/a:apple:apple_tv:6.0.2 + cpe:/o:apple:iphone_os:7.0.1 + cpe:/a:apple:apple_tv:6.0.1 + cpe:/o:apple:iphone_os:7.0.6 + cpe:/o:apple:iphone_os:7.0.5 + + CVE-2014-1320 + 2014-04-23T07:52:59.447-04:00 + 2014-04-24T09:56:26.283-04:00 + + + 4.9 + LOCAL + LOW + NONE + COMPLETE + NONE + NONE + http://nvd.nist.gov + 2014-04-24T09:56:23.157-04:00 + + + + + APPLE + APPLE-SA-2014-04-22-2 + + + APPLE + APPLE-SA-2014-04-22-3 + + + APPLE + APPLE-SA-2014-04-22-1 + + IOKit in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 places kernel pointers into an object data structure, which makes it easier for local users to bypass the ASLR protection mechanism by reading unspecified attributes of the object. + + + + + + + + + + + cpe:/o:apple:mac_os_x:10.9.1 + cpe:/o:apple:mac_os_x:10.9.2 + cpe:/o:apple:mac_os_x:10.9 + + CVE-2014-1321 + 2014-04-23T07:52:59.447-04:00 + 2014-04-24T09:52:18.557-04:00 + + + 3.3 + LOCAL + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-24T09:52:18.433-04:00 + + + + + APPLE + APPLE-SA-2014-04-22-1 + + Power Management in Apple OS X 10.9.x through 10.9.2 allows physically proximate attackers to bypass an intended transition into the locked-screen state by touching (1) a key or (2) the trackpad during a lid-close action. + + + + + + + + + + + cpe:/o:apple:mac_os_x:10.9.1 + cpe:/o:apple:mac_os_x:10.9.2 + cpe:/o:apple:mac_os_x:10.9 + + CVE-2014-1322 + 2014-04-23T07:52:59.463-04:00 + 2014-04-24T09:56:55.097-04:00 + + + 4.9 + LOCAL + LOW + NONE + COMPLETE + NONE + NONE + http://nvd.nist.gov + 2014-04-24T09:56:55.067-04:00 + + + + + APPLE + APPLE-SA-2014-04-22-1 + + The kernel in Apple OS X through 10.9.2 places a kernel pointer into an XNU object data structure accessible from user space, which makes it easier for local users to bypass the ASLR protection mechanism by reading an unspecified attribute of the object. + + + + + + + + + + + + + + + + + + + + + cpe:/a:auracms:auracms:1.62 + cpe:/a:auracms:auracms:1.61 + cpe:/a:auracms:auracms:2.2.2 + cpe:/a:auracms:auracms:2.2.1 + cpe:/a:auracms:auracms:1.1 + cpe:/a:auracms:auracms:1.0 + cpe:/a:auracms:auracms:1.3 + cpe:/a:auracms:auracms:1.2 + cpe:/a:auracms:auracms:2.0 + cpe:/a:auracms:auracms:2.1 + cpe:/a:auracms:auracms:2.2 + cpe:/a:auracms:auracms:2.3 + cpe:/a:auracms:auracms:1.5 + + CVE-2014-1401 + 2014-02-11T12:55:06.857-05:00 + 2014-02-21T00:06:33.843-05:00 + + + 6.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-12T11:03:39.590-05:00 + + + + + MISC + https://www.htbridge.com/advisory/HTB23196 + + + CONFIRM + https://github.com/auracms/AuraCMS/commit/790f66ffbc4f23a6e13636fc79d0aa1a7d81e747 + + + CONFIRM + https://github.com/auracms/AuraCMS/commit/4fe9d0d31a32df392f4d6ced8e5c25ed4af19ade + + + XF + auracms-cve20141401-sql-injection(90965) + + + BUGTRAQ + 20140205 Multiple SQL Injection Vulnerabilities in AuraCMS + + + EXPLOIT-DB + 31520 + + + SECUNIA + 56804 + + + MISC + http://packetstormsecurity.com/files/125079 + + Multiple SQL injection vulnerabilities in AuraCMS 2.3 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) search parameter to mod/content/content.php or (2) CLIENT_IP, (3) X_FORWARDED_FOR, (4) X_FORWARDED, (5) FORWARDED_FOR, or (6) FORWARDED HTTP header to index.php. + + + + + + + + + + + + + + + + + + cpe:/a:easyxdm:easyxdm:2.4.18 + cpe:/a:easyxdm:easyxdm:2.4.0 + cpe:/a:easyxdm:easyxdm:2.4.6 + cpe:/a:easyxdm:easyxdm:2.4.1 + cpe:/a:easyxdm:easyxdm:2.4.2 + cpe:/a:easyxdm:easyxdm:2.3.2 + cpe:/a:easyxdm:easyxdm:2.4.3 + cpe:/a:easyxdm:easyxdm:2.3.3 + cpe:/a:easyxdm:easyxdm:2.4.4 + cpe:/a:easyxdm:easyxdm:2.4.5 + + CVE-2014-1403 + 2014-02-05T10:10:05.503-05:00 + 2014-02-21T00:06:35.250-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-06T10:57:50.417-05:00 + + + + + CONFIRM + https://github.com/oyvindkinsey/easyXDM/releases/tag/2.4.19 + + + CONFIRM + https://github.com/oyvindkinsey/easyXDM/commit/a3194d32c25a0d27a10a47304eb9c9be93ffbf13#diff-6489956f1e1f52236929b4d33cbeb2db + + + XF + easyxdm-cve20141403-xss(90876) + + + BID + 65291 + + + SECUNIA + 56634 + + + FULLDISC + 20140131 [CVE-2014-1403] DOM XSS in EasyXDM 2.4.18 + + + OSVDB + 102803 + + + MISC + http://blog.kotowicz.net/2014/01/xssing-with-shakespeare-name-calling.html + + Cross-site scripting (XSS) vulnerability in name.html in easyXDM before 2.4.19 allows remote attackers to inject arbitrary web script or HTML via the location.hash value. + + + + + + + + + cpe:/h:conceptronic:c54apm:1.26 + + CVE-2014-1405 + 2014-01-10T11:47:06.130-05:00 + 2014-01-10T16:23:38.130-05:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-10T16:23:38.023-05:00 + + + + + MISC + http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf + + Multiple open redirect vulnerabilities on the Conceptronic C54APM access point with runtime code 1.26 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via (1) the submit-url parameter in a Refresh action to goform/formWlSiteSurvey or (2) the wlan-url parameter to goform/formWlanSetup. + + + + + + + + + cpe:/h:conceptronic:c54apm:1.26 + + CVE-2014-1406 + 2014-01-10T11:47:06.160-05:00 + 2014-01-10T16:25:37.837-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-10T16:25:27.167-05:00 + + + + + MISC + http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf + + CRLF injection vulnerability in goform/formWlSiteSurvey on the Conceptronic C54APM access point with runtime code 1.26 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the submit-url parameter in a Refresh action. + + + + + + + + + cpe:/h:conceptronic:c54apm:1.26 + + CVE-2014-1407 + 2014-01-10T11:47:06.193-05:00 + 2014-01-10T16:26:17.603-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-10T16:26:17.573-05:00 + + + + + MISC + http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf + + Multiple cross-site scripting (XSS) vulnerabilities on the Conceptronic C54APM access point with runtime code 1.26 allow remote attackers to inject arbitrary web script or HTML via (1) the submit-url parameter in a Refresh action to goform/formWlSiteSurvey or (2) the wlan-url parameter to goform/formWlanSetup. + + + + + + + + + cpe:/h:conceptronic:c54apm:1.26 + + CVE-2014-1408 + 2014-01-10T11:47:06.333-05:00 + 2014-01-13T09:18:59.177-05:00 + + + 7.8 + NETWORK + LOW + NONE + COMPLETE + NONE + NONE + http://nvd.nist.gov + 2014-01-10T16:27:43.433-05:00 + + + + + CONFIRM + http://download.conceptronic.net/manuals/C04-058_C54APM_v2.0_Quick_Guide_ML.pdf + + + MISC + http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf + + The Conceptronic C54APM access point with runtime code 1.26 has a default password of admin for the admin account, which makes it easier for remote attackers to obtain access via an HTTP request, as demonstrated by stored XSS attacks. + + + + + + + + + + + + + + + + cpe:/o:linux:linux_kernel:3.12.7 + cpe:/o:linux:linux_kernel:3.12.3 + cpe:/o:linux:linux_kernel:3.12.4 + cpe:/o:linux:linux_kernel:3.12.5 + cpe:/o:linux:linux_kernel:3.12.6 + cpe:/o:linux:linux_kernel:3.12.1 + cpe:/o:linux:linux_kernel:3.12.2 + cpe:/o:linux:linux_kernel:3.12 + + CVE-2014-1438 + 2014-01-18T17:55:03.210-05:00 + 2014-03-16T00:45:12.443-04:00 + + + 4.7 + LOCAL + MEDIUM + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-01-21T16:00:04.710-05:00 + + + + + CONFIRM + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=26bef1318adc1b3a530ecc807ef99346db2aa8b0 + + + MLIST + [linux-kernel] 20140110 Re: Sanitize CPU-state when switching tasks (was sanitize CPU-state when switching from virtual-8086 mode to other task) + + + CONFIRM + https://github.com/torvalds/linux/commit/26bef1318adc1b3a530ecc807ef99346db2aa8b0 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1052914 + + + UBUNTU + USN-2141-1 + + + UBUNTU + USN-2139-1 + + + UBUNTU + USN-2138-1 + + + UBUNTU + USN-2136-1 + + + UBUNTU + USN-2135-1 + + + UBUNTU + USN-2134-1 + + + UBUNTU + USN-2133-1 + + + UBUNTU + USN-2117-1 + + + UBUNTU + USN-2113-1 + + + SECTRACK + 1029592 + + + BID + 64781 + + + MLIST + [oss-security] 20140114 Re: Linux kernel: missing CPU-state sanitation during task-switch causes DOS / privilege escalation + + + MANDRIVA + MDVSA-2014:038 + + + CONFIRM + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.8 + + + MISC + http://www.halfdog.net/Security/2013/Vm86SyscallTaskSwitchKernelPanic/ + + + FEDORA + FEDORA-2014-1062 + + + FEDORA + FEDORA-2014-1072 + + The restore_fpu_checking function in arch/x86/include/asm/fpu-internal.h in the Linux kernel before 3.12.8 on the AMD K7 and K8 platforms does not clear pending exceptions before proceeding to an EMMS instruction, which allows local users to cause a denial of service (task kill) or possibly gain privileges via a crafted application. + + + + + + + + + + + + + + + + cpe:/a:hiphop_virtual_machine_for_php_project:hiphop_virtual_machine_for_php:2.3.0 + cpe:/a:hiphop_virtual_machine_for_php_project:hiphop_virtual_machine_for_php:2.3.1 + cpe:/a:hiphop_virtual_machine_for_php_project:hiphop_virtual_machine_for_php:2.1.0 + cpe:/a:hiphop_virtual_machine_for_php_project:hiphop_virtual_machine_for_php:2.3.2 + cpe:/a:hiphop_virtual_machine_for_php_project:hiphop_virtual_machine_for_php:2.2.0 + cpe:/a:hiphop_virtual_machine_for_php_project:hiphop_virtual_machine_for_php:2.0.0 + cpe:/a:hiphop_virtual_machine_for_php_project:hiphop_virtual_machine_for_php:2.0.1 + cpe:/a:hiphop_virtual_machine_for_php_project:hiphop_virtual_machine_for_php:2.0.2 + + CVE-2014-1439 + 2014-02-05T14:55:28.873-05:00 + 2014-02-21T00:06:36.500-05:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-02-06T13:00:02.287-05:00 + + + + CONFIRM + https://github.com/facebook/hhvm/commit/95f96e7287effe2fcdfb9a5338d1a7e4f55b083b + + + XF + hhvm-cve20141439-info-disc(90979) + + + CONFIRM + http://www.hhvm.com/blog/3287/hhvm-2-4-0 + + The libxml_disable_entity_loader function in runtime/ext/ext_simplexml.cpp in HipHop Virtual Machine for PHP (HHVM) before 2.4.0 and 2.3.x before 2.3.3 does not properly disable a certain libxml handler, which allows remote attackers to conduct XML External Entity (XXE) attacks. + + + + + + + + + cpe:/a:coreftp:core_ftp:1.2 + + CVE-2014-1441 + 2014-05-01T21:59:22.357-04:00 + 2014-05-02T11:11:59.343-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-05-02T11:11:59.140-04:00 + + + + + OSVDB + 102966 + + + SECUNIA + 56850 + + + FULLDISC + 20140205 Core FTP Server Vulnerabilities + + + MISC + http://packetstormsecurity.com/files/125073/Core-FTP-Server-1.2-DoS-Traversal-Disclosure.html + + + CONFIRM + http://coreftp.com/forums/viewtopic.php?t=2985707 + + Core FTP Server 1.2 before build 515 allows remote attackers to cause a denial of service (reachable assertion and crash) via an AUTH SSL command with malformed data, as demonstrated by pressing the enter key twice. + + + + + + + + + cpe:/a:coreftp:core_ftp:1.2 + + CVE-2014-1442 + 2014-05-01T21:59:22.390-04:00 + 2014-05-02T11:19:26.310-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-05-02T11:19:26.280-04:00 + + + + + OSVDB + 102967 + + + SECUNIA + 56850 + + + FULLDISC + 20140205 Core FTP Server Vulnerabilities + + + MISC + http://packetstormsecurity.com/files/125073/Core-FTP-Server-1.2-DoS-Traversal-Disclosure.html + + + CONFIRM + http://coreftp.com/forums/viewtopic.php?t=2985707 + + Directory traversal vulnerability in Core FTP Server 1.2 before build 515 allows remote authenticated users to determine the existence of arbitrary files via a /../ sequence in an XCRC command. + + + + + + + + + cpe:/a:coreftp:core_ftp:1.2 + + CVE-2014-1443 + 2014-05-01T21:59:22.420-04:00 + 2014-05-02T11:21:20.283-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-05-02T11:21:20.220-04:00 + + + + + OSVDB + 102968 + + + SECUNIA + 56850 + + + FULLDISC + 20140205 Core FTP Server Vulnerabilities + + + MISC + http://packetstormsecurity.com/files/125073/Core-FTP-Server-1.2-DoS-Traversal-Disclosure.html + + + CONFIRM + http://coreftp.com/forums/viewtopic.php?t=2985707 + + Core FTP Server 1.2 before build 515 allows remote authenticated users to obtain sensitive information (password for the previous user) via a USER command with a specific length, possibly related to an out-of-bounds read. + + + + + + + + + + + + + + + cpe:/o:linux:linux_kernel:3.11.1 + cpe:/o:linux:linux_kernel:3.11.2 + cpe:/o:linux:linux_kernel:3.11.3 + cpe:/o:linux:linux_kernel:3.11.5 + cpe:/o:linux:linux_kernel:3.11.4 + cpe:/o:linux:linux_kernel:3.11 + cpe:/o:linux:linux_kernel:3.11.6 + + CVE-2014-1444 + 2014-01-18T17:55:03.257-05:00 + 2014-03-16T00:45:12.770-04:00 + + + 1.7 + LOCAL + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-21T11:30:59.920-05:00 + + + + + CONFIRM + https://github.com/torvalds/linux/commit/96b340406724d87e4621284ebac5e059d67b2194 + + + MLIST + [oss-security] 20140115 Re: CVE request: assorted kernel infoleak security fixes + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1053610 + + + XF + linux-kernel-cve20141444-info-disc(90443) + + + UBUNTU + USN-2129-1 + + + UBUNTU + USN-2128-1 + + + BID + 64952 + + + CONFIRM + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.11.7 + + + CONFIRM + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=96b340406724d87e4621284ebac5e059d67b2194 + + The fst_get_iface function in drivers/net/wan/farsync.c in the Linux kernel before 3.11.7 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability for an SIOCWANDEV ioctl call. + + + + + + + + + + + + + + + cpe:/o:linux:linux_kernel:3.11.1 + cpe:/o:linux:linux_kernel:3.11.2 + cpe:/o:linux:linux_kernel:3.11.3 + cpe:/o:linux:linux_kernel:3.11.5 + cpe:/o:linux:linux_kernel:3.11.4 + cpe:/o:linux:linux_kernel:3.11 + cpe:/o:linux:linux_kernel:3.11.6 + + CVE-2014-1445 + 2014-01-18T17:55:03.320-05:00 + 2014-03-16T00:45:14.473-04:00 + + + 2.1 + LOCAL + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-21T11:35:44.567-05:00 + + + + + CONFIRM + https://github.com/torvalds/linux/commit/2b13d06c9584b4eb773f1e80bbaedab9a1c344e1 + + + MLIST + [oss-security] 20140115 Re: CVE request: assorted kernel infoleak security fixes + + + CONFIRM + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2b13d06c9584b4eb773f1e80bbaedab9a1c344e1 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1053613 + + + XF + linux-kernel-cve20141445-info-disc(90444) + + + UBUNTU + USN-2129-1 + + + UBUNTU + USN-2128-1 + + + BID + 64953 + + + CONFIRM + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.11.7 + + The wanxl_ioctl function in drivers/net/wan/wanxl.c in the Linux kernel before 3.11.7 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via an ioctl call. + + + + + + + + + + + + + + + + cpe:/o:linux:linux_kernel:3.12.7 + cpe:/o:linux:linux_kernel:3.12.3 + cpe:/o:linux:linux_kernel:3.12.4 + cpe:/o:linux:linux_kernel:3.12.5 + cpe:/o:linux:linux_kernel:3.12.6 + cpe:/o:linux:linux_kernel:3.12.1 + cpe:/o:linux:linux_kernel:3.12.2 + cpe:/o:linux:linux_kernel:3.12 + + CVE-2014-1446 + 2014-01-18T17:55:03.397-05:00 + 2014-03-16T00:45:14.567-04:00 + + + 1.9 + LOCAL + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-21T16:05:18.717-05:00 + + + + + CONFIRM + https://github.com/torvalds/linux/commit/8e3fbf870481eb53b2d3a322d1fc395ad8b367ed + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1053620 + + + XF + linux-kernel-cve20141446-info-disc(90445) + + + UBUNTU + USN-2141-1 + + + UBUNTU + USN-2139-1 + + + UBUNTU + USN-2138-1 + + + UBUNTU + USN-2136-1 + + + UBUNTU + USN-2135-1 + + + UBUNTU + USN-2134-1 + + + UBUNTU + USN-2133-1 + + + UBUNTU + USN-2129-1 + + + UBUNTU + USN-2128-1 + + + UBUNTU + USN-2117-1 + + + UBUNTU + USN-2113-1 + + + BID + 64954 + + + MLIST + [oss-security] 20140115 Re: CVE request: assorted kernel infoleak security fixes + + + MANDRIVA + MDVSA-2014:038 + + + CONFIRM + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.8 + + + FEDORA + FEDORA-2014-1062 + + + FEDORA + FEDORA-2014-1072 + + + CONFIRM + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8e3fbf870481eb53b2d3a322d1fc395ad8b367ed + + The yam_ioctl function in drivers/net/hamradio/yam.c in the Linux kernel before 3.12.8 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability for an SIOCYAMGCFG ioctl call. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:redhat:libvirt:0.3.2 + cpe:/a:redhat:libvirt:0.3.3 + cpe:/a:redhat:libvirt:0.3.1 + cpe:/a:redhat:libvirt:0.7.2 + cpe:/a:redhat:libvirt:0.7.3 + cpe:/a:redhat:libvirt:0.7.0 + cpe:/a:redhat:libvirt:0.7.1 + cpe:/a:redhat:libvirt:0.7.4 + cpe:/a:redhat:libvirt:0.3.0 + cpe:/a:redhat:libvirt:0.10.0 + cpe:/a:redhat:libvirt:1.2.0 + cpe:/a:redhat:libvirt:1.0.5.4 + cpe:/a:redhat:libvirt:1.0.5.5 + cpe:/a:redhat:libvirt:1.0.5.6 + cpe:/a:redhat:libvirt:0.0.3 + cpe:/a:redhat:libvirt:1.0.4 + cpe:/a:redhat:libvirt:1.0.5 + cpe:/a:redhat:libvirt:0.0.2 + cpe:/a:redhat:libvirt:0.0.1 + cpe:/a:redhat:libvirt:1.0.3 + cpe:/a:redhat:libvirt:0.4.5 + cpe:/a:redhat:libvirt:0.4.6 + cpe:/a:redhat:libvirt:0.4.3 + cpe:/a:redhat:libvirt:0.4.4 + cpe:/a:redhat:libvirt:0.4.0 + cpe:/a:redhat:libvirt:0.4.2 + cpe:/a:redhat:libvirt:0.4.1 + cpe:/a:redhat:libvirt:1.0.6 + cpe:/a:redhat:libvirt:0.10.2 + cpe:/a:redhat:libvirt:0.10.1 + cpe:/a:redhat:libvirt:0.0.5 + cpe:/a:redhat:libvirt:0.0.6 + cpe:/a:redhat:libvirt:1.0.1 + cpe:/a:redhat:libvirt:0.0.4 + cpe:/a:redhat:libvirt:1.0.0 + cpe:/a:redhat:libvirt:1.0.2 + cpe:/a:redhat:libvirt:1.0.5.3 + cpe:/a:redhat:libvirt:1.0.5.1 + cpe:/a:redhat:libvirt:1.0.5.2 + cpe:/a:redhat:libvirt:0.2.3 + cpe:/a:redhat:libvirt:0.2.2 + cpe:/a:redhat:libvirt:0.6.5 + cpe:/a:redhat:libvirt:0.6.4 + cpe:/a:redhat:libvirt:0.6.3 + cpe:/a:redhat:libvirt:0.6.2 + cpe:/a:redhat:libvirt:0.6.1 + cpe:/a:redhat:libvirt:0.2.1 + cpe:/a:redhat:libvirt:0.6.0 + cpe:/a:redhat:libvirt:0.8.3 + cpe:/a:redhat:libvirt:0.8.2 + cpe:/a:redhat:libvirt:0.8.1 + cpe:/a:redhat:libvirt:0.8.0 + cpe:/a:redhat:libvirt:0.2.0 + cpe:/a:redhat:libvirt:0.10.2.8 + cpe:/a:redhat:libvirt:0.9.6.2 + cpe:/a:redhat:libvirt:0.10.2.4 + cpe:/a:redhat:libvirt:0.10.2.3 + cpe:/a:redhat:libvirt:0.10.2.2 + cpe:/a:redhat:libvirt:0.10.2.1 + cpe:/a:redhat:libvirt:0.9.6.1 + cpe:/a:redhat:libvirt:0.10.2.6 + cpe:/a:redhat:libvirt:0.9.6.3 + cpe:/a:redhat:libvirt:0.10.2.7 + cpe:/a:redhat:libvirt:0.10.2.5 + cpe:/a:redhat:libvirt:0.7.6 + cpe:/a:redhat:libvirt:0.7.7 + cpe:/a:redhat:libvirt:0.7.5 + cpe:/a:redhat:libvirt:1.1.4 + cpe:/a:redhat:libvirt:0.1.3 + cpe:/a:redhat:libvirt:1.1.3 + cpe:/a:redhat:libvirt:1.1.2 + cpe:/a:redhat:libvirt:0.1.5 + cpe:/a:redhat:libvirt:0.1.4 + cpe:/a:redhat:libvirt:0.9.11.8 + cpe:/a:redhat:libvirt:0.9.11.7 + cpe:/a:redhat:libvirt:0.9.11.6 + cpe:/a:redhat:libvirt:0.9.11.2 + cpe:/a:redhat:libvirt:0.9.11.1 + cpe:/a:redhat:libvirt:0.9.11 + cpe:/a:redhat:libvirt:0.9.12 + cpe:/a:redhat:libvirt:0.9.13 + cpe:/a:redhat:libvirt:0.9.11.3 + cpe:/a:redhat:libvirt:0.9.2 + cpe:/a:redhat:libvirt:0.9.11.4 + cpe:/a:redhat:libvirt:0.9.11.5 + cpe:/a:redhat:libvirt:0.9.1 + cpe:/a:redhat:libvirt:0.9.0 + cpe:/a:redhat:libvirt:0.9.10 + cpe:/a:redhat:libvirt:0.1.8 + cpe:/a:redhat:libvirt:0.8.5 + cpe:/a:redhat:libvirt:0.9.8 + cpe:/a:redhat:libvirt:0.1.9 + cpe:/a:redhat:libvirt:0.8.6 + cpe:/a:redhat:libvirt:0.9.9 + cpe:/a:redhat:libvirt:0.1.6 + cpe:/a:redhat:libvirt:0.9.6 + cpe:/a:redhat:libvirt:0.1.7 + cpe:/a:redhat:libvirt:0.8.4 + cpe:/a:redhat:libvirt:0.9.7 + cpe:/a:redhat:libvirt:1.1.1 + cpe:/a:redhat:libvirt:0.5.0 + cpe:/a:redhat:libvirt:0.9.4 + cpe:/a:redhat:libvirt:0.5.1 + cpe:/a:redhat:libvirt:0.9.5 + cpe:/a:redhat:libvirt:0.8.7 + cpe:/a:redhat:libvirt:0.8.8 + cpe:/a:redhat:libvirt:0.9.3 + cpe:/a:redhat:libvirt:0.1.0 + cpe:/a:redhat:libvirt:0.1.1 + cpe:/a:redhat:libvirt:1.1.0 + + CVE-2014-1447 + 2014-01-24T13:55:04.963-05:00 + 2014-03-05T23:50:48.987-05:00 + + + 3.3 + ADJACENT_NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-01-24T17:15:00.187-05:00 + + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1047577 + + + UBUNTU + USN-2093-1 + + + SECTRACK + 1029695 + + + DEBIAN + DSA-2846 + + + SECUNIA + 56446 + + + SECUNIA + 56321 + + + REDHAT + RHSA-2014:0103 + + + SUSE + openSUSE-SU-2014:0270 + + + SUSE + openSUSE-SU-2014:0268 + + + CONFIRM + http://libvirt.org/news.html + + Race condition in the virNetServerClientStartKeepAlive function in libvirt before 1.2.1 allows remote attackers to cause a denial of service (libvirtd crash) by closing a connection before a keepalive response is sent. + + + CVE-2014-1448 + 2014-01-15T11:13:04.117-05:00 + 2014-01-15T11:13:04.197-05:00 + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-1447. Reason: This candidate is a reservation duplicate of CVE-2014-1447. Only one candidate was needed for the disclosure in question. Notes: All CVE users should reference CVE-2014-1447 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. + + + + + + + + + + + + + + + + + + + cpe:/o:freebsd:freebsd:9.2:rc1 + cpe:/o:freebsd:freebsd:9.2:rc2 + cpe:/o:freebsd:freebsd:8.4 + cpe:/o:freebsd:freebsd:9.1 + cpe:/o:freebsd:freebsd:8.3 + cpe:/o:freebsd:freebsd:9.2:prerelease + cpe:/o:freebsd:freebsd:9.1:release-p4 + cpe:/o:freebsd:freebsd:9.0 + cpe:/o:freebsd:freebsd:10.0 + cpe:/o:freebsd:freebsd:9.1:release-p5 + cpe:/o:freebsd:freebsd:9.2 + + CVE-2014-1452 + 2014-01-21T10:17:12.180-05:00 + 2014-02-21T00:06:36.907-05:00 + + + 5.8 + ADJACENT_NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-22T13:46:01.050-05:00 + + + + + CONFIRM + http://svnweb.freebsd.org/base?view=revision&amp;revision=260636 + + + SECTRACK + 1029616 + + + FREEBSD + FreeBSD-SA-14:01 + + + SECUNIA + 56496 + + Stack-based buffer overflow in lib/snmpagent.c in bsnmpd, as used in FreeBSD 8.3 through 10.0, allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a crafted GETBULK PDU request. + + + + + + + + + + + + + + + + + + + + + + cpe:/o:freebsd:freebsd:9.2:rc1 + cpe:/o:freebsd:freebsd:9.2:rc2 + cpe:/o:freebsd:freebsd:9.1 + cpe:/o:freebsd:freebsd:8.4 + cpe:/o:freebsd:freebsd:9.2:prerelease + cpe:/o:freebsd:freebsd:9.1:release-p4 + cpe:/o:freebsd:freebsd:9.0 + cpe:/o:freebsd:freebsd:8.3 + cpe:/o:freebsd:freebsd:10.0 + cpe:/o:freebsd:freebsd:9.1:release-p5 + cpe:/o:freebsd:freebsd:9.0:beta1 + cpe:/o:freebsd:freebsd:9.0:beta2 + cpe:/o:freebsd:freebsd:9.0:beta3 + cpe:/o:freebsd:freebsd:9.2 + + CVE-2014-1453 + 2014-04-16T14:37:13.413-04:00 + 2014-04-17T10:38:58.780-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-17T10:38:58.563-04:00 + + + + + SECTRACK + 1030041 + + + BID + 66726 + + + FREEBSD + FreeBSD-SA-14:05 + + + SECUNIA + 57760 + + The NFS server (nfsserver) in FreeBSD 8.3 through 10.0 does not acquire locks in the proper order when converting a directory file handle to a vnode, which allows remote authenticated users to cause a denial of service (deadlock) via vectors involving a thread that uses the correct locking order. + + + + + + + + + cpe:/a:pearson:esis_enterprise_student_information_system:3.3.0.13 + + CVE-2014-1455 + 2014-04-10T16:29:20.487-04:00 + 2014-04-11T11:40:59.163-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-11T11:40:59.117-04:00 + + + + + BUGTRAQ + 20140406 Pearson eSIS Enterprise Student Information System SQL Injection + + SQL injection vulnerability in the password reset functionality in Pearson eSIS Enterprise Student Information System, possibly 3.3.0.13 and earlier, allows remote attackers to execute arbitrary SQL commands via the new password. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:openwebanalytics:open_web_analytics:1.5.0 + cpe:/a:openwebanalytics:open_web_analytics:1.2.4 + cpe:/a:openwebanalytics:open_web_analytics:1.5.2 + cpe:/a:openwebanalytics:open_web_analytics:1.2.2 + cpe:/a:openwebanalytics:open_web_analytics:1.5.1 + cpe:/a:openwebanalytics:open_web_analytics:1.2.3 + cpe:/a:openwebanalytics:open_web_analytics:1.5.4 + cpe:/a:openwebanalytics:open_web_analytics:1.5.3 + cpe:/a:openwebanalytics:open_web_analytics:1.0.3 + cpe:/a:openwebanalytics:open_web_analytics:1.3.0:rc1 + cpe:/a:openwebanalytics:open_web_analytics:1.5.5 + cpe:/a:openwebanalytics:open_web_analytics:1.0.6 + cpe:/a:openwebanalytics:open_web_analytics:1.0.7 + cpe:/a:openwebanalytics:open_web_analytics:1.1.1 + cpe:/a:openwebanalytics:open_web_analytics:1.2.1:rc1 + cpe:/a:openwebanalytics:open_web_analytics:1.0.4 + cpe:/a:openwebanalytics:open_web_analytics:1.1.0 + cpe:/a:openwebanalytics:open_web_analytics:1.0.5 + cpe:/a:openwebanalytics:open_web_analytics:1.2.1 + cpe:/a:openwebanalytics:open_web_analytics:1.0.8 + cpe:/a:openwebanalytics:open_web_analytics:1.4.0:rc1 + cpe:/a:openwebanalytics:open_web_analytics:1.1.0:rc2 + cpe:/a:openwebanalytics:open_web_analytics:1.4.0:rc2 + cpe:/a:openwebanalytics:open_web_analytics:1.0.2 + cpe:/a:openwebanalytics:open_web_analytics:1.4.0:rc3 + cpe:/a:openwebanalytics:open_web_analytics:1.0.1 + cpe:/a:openwebanalytics:open_web_analytics:1.1.0:rc4 + cpe:/a:openwebanalytics:open_web_analytics:1.4.0:rc4 + cpe:/a:openwebanalytics:open_web_analytics:1.1.0:rc1 + cpe:/a:openwebanalytics:open_web_analytics:1.5.0:rc2 + cpe:/a:openwebanalytics:open_web_analytics:1.1.0:rc3 + cpe:/a:openwebanalytics:open_web_analytics:1.5.0:rc1 + cpe:/a:openwebanalytics:open_web_analytics:1.4.1 + cpe:/a:openwebanalytics:open_web_analytics:1.5.0:rc3 + cpe:/a:openwebanalytics:open_web_analytics:1.4.0 + cpe:/a:openwebanalytics:open_web_analytics:1.2.0 + cpe:/a:openwebanalytics:open_web_analytics:1.0.8:rc4 + cpe:/a:openwebanalytics:open_web_analytics:1.0.8:rc3 + cpe:/a:openwebanalytics:open_web_analytics:1.0.8:rc2 + cpe:/a:openwebanalytics:open_web_analytics:1.0.8:rc1 + cpe:/a:openwebanalytics:open_web_analytics:1.0.8:rc5 + cpe:/a:openwebanalytics:open_web_analytics:1.3.0 + cpe:/a:openwebanalytics:open_web_analytics:1.2.0:rc1 + cpe:/a:openwebanalytics:open_web_analytics:1.0 + cpe:/a:openwebanalytics:open_web_analytics:1.2.0:rc2 + cpe:/a:openwebanalytics:open_web_analytics:1.2.0:rc3 + cpe:/a:openwebanalytics:open_web_analytics:1.3.1 + + CVE-2014-1456 + 2014-02-28T19:01:07.717-05:00 + 2014-03-03T09:49:10.523-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-03T09:49:05.727-05:00 + + + + + XF + owa-cve20141456-xss(91124) + + + MISC + http://www.secureworks.com/cyber-threat-intelligence/advisories/SWRX-2014-004 + + + MISC + http://www.openwebanalytics.com/?p=384 + + + SECUNIA + 56885 + + Cross-site scripting (XSS) vulnerability in the login page in Open Web Analytics (OWA) before 1.5.6 allows remote attackers to inject arbitrary web script or HTML via the owa_user_id parameter to index.php. + + + + + + + + + cpe:/a:fortinet:fortiweb:5.0.3 + + CVE-2014-1458 + 2014-02-04T16:55:08.077-05:00 + 2014-02-21T00:06:37.000-05:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-05T09:32:02.227-05:00 + + + + + XF + fortiweb-cve20141458-xss(90978) + + + CONFIRM + http://www.fortiguard.com/advisory/FG-IR-14-001/ + + Cross-site scripting (XSS) vulnerability in the web administration interface in FortiGuard FortiWeb 5.0.3 and earlier allows remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + + cpe:/a:doorgets:doorgets_cms:3.0 + cpe:/a:doorgets:doorgets_cms:5.2 + cpe:/a:doorgets:doorgets_cms:4.0 + + CVE-2014-1459 + 2014-02-11T12:55:06.903-05:00 + 2014-02-21T00:06:37.077-05:00 + + + 6.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-12T11:12:45.440-05:00 + + + + + MISC + https://www.htbridge.com/advisory/HTB23197 + + + CONFIRM + https://github.com/doorgets/doorGets/commit/6b81541fc1e5dd1c70614585c1a04d04ccdb3b19 + + + XF + doorgets-cve20141459-sql-injection(90967) + + + BID + 65439 + + + BUGTRAQ + 20140205 SQL Injection in doorGets CMS + + + EXPLOIT-DB + 31521 + + + MISC + http://packetstormsecurity.com/files/125078 + + SQL injection vulnerability in dg-admin/index.php in doorGets CMS 5.2 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the _position_down_id parameter. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands. + + + + + + + + + cpe:/a:csp_mysql_user_manager_project:csp_mysql_user_manager:2.3 + + CVE-2014-1466 + 2014-01-15T11:08:18.640-05:00 + 2014-01-16T13:31:09.430-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-16T13:31:07.133-05:00 + + + + + XF + cpsmysql-login-sql-injection(90210) + + + BID + 64731 + + + SECUNIA + 56348 + + + MISC + http://packetstormsecurity.com/files/124724/cspmysql-sql.txt + + + OSVDB + 101867 + + SQL injection vulnerability in CSP MySQL User Manager 2.3 allows remote attackers to execute arbitrary SQL commands via the login field of the login page. + + + + + + + + + + + + + + + + + + cpe:/a:blackberry:blackberry_enterprise_service:10.2.0 + cpe:/a:blackberry:enterprise_server:5.0.4:mr6:~~~lotus_domino~~ + cpe:/a:blackberry:blackberry_enterprise_service:10.1.0 + cpe:/a:blackberry:enterprise_server:5.0.4:mr6:~~~exchange_server~~ + cpe:/a:blackberry:blackberry_enterprise_service:10.1.2 + cpe:/a:blackberry:blackberry_universal_device_service:6.0 + cpe:/a:blackberry:enterprise_server_express:5.0.4::~~~exchange_server~~ + cpe:/a:blackberry:blackberry_enterprise_service:10.0 + cpe:/a:blackberry:enterprise_server:5.0.4:mr6:~~~groupwise~~ + cpe:/a:blackberry:enterprise_server_express:5.0.4::~~~lotus_domino~~ + + CVE-2014-1467 + 2014-02-14T08:10:30.637-05:00 + 2014-02-14T12:34:51.747-05:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-02-14T12:34:51.670-05:00 + + + + + CONFIRM + http://www.blackberry.com/btsc/KB35647 + + BlackBerry Enterprise Service 10 before 10.2.1, Universal Device Service 6, Enterprise Server Express for Domino through 5.0.4, Enterprise Server Express for Exchange through 5.0.4, Enterprise Server for Domino through 5.0.4 MR6, Enterprise Server for Exchange through 5.0.4 MR6, and Enterprise Server for GroupWise through 5.0.4 MR6 log cleartext credentials during exception handling, which might allow context-dependent attackers to obtain sensitive information by reading a log file. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:otrs:otrs:3.1.4 + cpe:/a:otrs:otrs:3.1.13 + cpe:/a:otrs:otrs:3.1.3 + cpe:/a:otrs:otrs:3.2.10 + cpe:/a:otrs:otrs:3.3.0 + cpe:/a:otrs:otrs:3.1.6 + cpe:/a:otrs:otrs:3.1.5 + cpe:/a:otrs:otrs:3.1.11 + cpe:/a:otrs:otrs:3.1.7 + cpe:/a:otrs:otrs:3.2.0:beta4 + cpe:/a:otrs:otrs:3.2.0:beta5 + cpe:/a:otrs:otrs:3.2.0 + cpe:/a:otrs:otrs:3.3.0:beta3 + cpe:/a:otrs:otrs:3.2.1 + cpe:/a:otrs:otrs:3.3.0:beta2 + cpe:/a:otrs:otrs:3.2.0:beta1 + cpe:/a:otrs:otrs:3.2.0:beta3 + cpe:/a:otrs:otrs:3.2.0:beta2 + cpe:/a:otrs:otrs:3.3.0:beta4 + cpe:/a:otrs:otrs:3.3.0:beta1 + cpe:/a:otrs:otrs:3.3.0:beta5 + cpe:/a:otrs:otrs:3.2.7 + cpe:/a:otrs:otrs:3.1.9 + cpe:/a:otrs:otrs:3.1.8 + cpe:/a:otrs:otrs:3.2.9 + cpe:/a:otrs:otrs:3.2.8 + cpe:/a:otrs:otrs:3.1.10 + cpe:/a:otrs:otrs:3.2.0:rc1 + cpe:/a:otrs:otrs:3.1.1 + cpe:/a:otrs:otrs:3.2.6 + cpe:/a:otrs:otrs:3.3.2 + cpe:/a:otrs:otrs:3.1.18 + cpe:/a:otrs:otrs:3.1.2 + cpe:/a:otrs:otrs:3.3.1 + cpe:/a:otrs:otrs:3.1.0 + cpe:/a:otrs:otrs:3.3.3 + cpe:/a:otrs:otrs:3.1.15 + cpe:/a:otrs:otrs:3.2.2 + cpe:/a:otrs:otrs:3.1.14 + cpe:/a:otrs:otrs:3.2.3 + cpe:/a:otrs:otrs:3.1.17 + cpe:/a:otrs:otrs:3.2.4 + cpe:/a:otrs:otrs:3.1.16 + cpe:/a:otrs:otrs:3.2.5 + cpe:/a:otrs:otrs:3.3.0:rc1 + + CVE-2014-1471 + 2014-02-04T16:55:05.310-05:00 + 2014-03-05T23:50:49.580-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-05T10:31:57.830-05:00 + + + + + CONFIRM + https://www.otrs.com/security-advisory-2014-02-sql-injection-issue + + + CONFIRM + https://github.com/OTRS/otrs/commit/c4ec9205bde9c49770ddad94c1a980c006164949 + + + CONFIRM + https://github.com/OTRS/otrs/commit/2997b36a7c84e933c4b025930cabe93efc4d261d + + + CONFIRM + https://github.com/OTRS/otrs/commit/0680603a07b8dc37c2ddca6ff14e0236babefc82 + + + CONFIRM + https://www.otrs.com/release-notes-otrs-help-desk-3-3-4 + + + MLIST + [oss-security] 20140129 Re: CVE Request: otrs: CSRF issue in customer web interface + + + DEBIAN + DSA-2867 + + + SECUNIA + 56655 + + + SECUNIA + 56644 + + + OSVDB + 102661 + + SQL injection vulnerability in the StateGetStatesByType function in Kernel/System/State.pm in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allows remote attackers to execute arbitrary SQL commands via vectors related to a ticket search URL. + + + + + + + + + + + cpe:/a:mcafee:vulnerability_manager:7.0.11 + cpe:/a:mcafee:vulnerability_manager:7.5.5 + cpe:/a:mcafee:vulnerability_manager:7.5.4 + + CVE-2014-1472 + 2014-01-16T00:05:26.600-05:00 + 2014-01-27T23:57:36.427-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-17T10:10:17.797-05:00 + + + + + CONFIRM + https://kc.mcafee.com/corporate/index?page=content&id=SB10061 + + + XF + mcafee-vm-unspec-xss(90244) + + + SECTRACK + 1029591 + + + BID + 64795 + + + SECUNIA + 56394 + + + OSVDB + 101940 + + Multiple cross-site scripting (XSS) vulnerabilities in the Enterprise Manager in McAfee Vulnerability Manager (MVM) 7.5.5 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + + cpe:/a:mcafee:vulnerability_manager:7.0.11 + cpe:/a:mcafee:vulnerability_manager:7.5.5 + cpe:/a:mcafee:vulnerability_manager:7.5.4 + + CVE-2014-1473 + 2014-01-16T00:05:26.663-05:00 + 2014-01-27T23:57:36.520-05:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-17T10:12:04.830-05:00 + + + + + CONFIRM + https://kc.mcafee.com/corporate/index?page=content&id=SB10061 + + + XF + mcafee-vm-unspec-csrf(90245) + + + SECTRACK + 1029591 + + + BID + 64795 + + + SECUNIA + 56394 + + + OSVDB + 101939 + + Multiple cross-site request forgery (CSRF) vulnerabilities in the Enterprise Manager in McAfee Vulnerability Manager (MVM) 7.5.5 and earlier allow remote attackers to hijack the authentication of users for requests that modify HTML via unspecified vectors related to the "response web page." + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:drupal:drupal:6.0:rc-3 + cpe:/a:drupal:drupal:6.21 + cpe:/a:drupal:drupal:6.0:rc-1 + cpe:/a:drupal:drupal:6.0:rc-4 + cpe:/a:drupal:drupal:6.0:rc3 + cpe:/a:drupal:drupal:6.20 + cpe:/a:drupal:drupal:6.0:rc2 + cpe:/a:drupal:drupal:6.0:rc4 + cpe:/a:drupal:drupal:6.0:rc1 + cpe:/a:drupal:drupal:6.24 + cpe:/a:drupal:drupal:6.23 + cpe:/a:drupal:drupal:6.22 + cpe:/a:drupal:drupal:7.0:rc1 + cpe:/a:drupal:drupal:7.0:rc2 + cpe:/a:drupal:drupal:6.28 + cpe:/a:drupal:drupal:7.0:rc3 + cpe:/a:drupal:drupal:6.27 + cpe:/a:drupal:drupal:7.0:rc4 + cpe:/a:drupal:drupal:6.26 + cpe:/a:drupal:drupal:6.25 + cpe:/a:drupal:drupal:7.11 + cpe:/a:drupal:drupal:6.10 + cpe:/a:drupal:drupal:7.17 + cpe:/a:drupal:drupal:6.18 + cpe:/a:drupal:drupal:7.18 + cpe:/a:drupal:drupal:7.15 + cpe:/a:drupal:drupal:7.16 + cpe:/a:drupal:drupal:7.13 + cpe:/a:drupal:drupal:7.14 + cpe:/a:drupal:drupal:7.12 + cpe:/a:drupal:drupal:6.11 + cpe:/a:drupal:drupal:7.0:alpha3 + cpe:/a:drupal:drupal:7.10 + cpe:/a:drupal:drupal:7.0:alpha2 + cpe:/a:drupal:drupal:6.13 + cpe:/a:drupal:drupal:6.12 + cpe:/a:drupal:drupal:6.15 + cpe:/a:drupal:drupal:7.0:alpha7 + cpe:/a:drupal:drupal:6.14 + cpe:/a:drupal:drupal:7.0:alpha6 + cpe:/a:drupal:drupal:6.17 + cpe:/a:drupal:drupal:7.19 + cpe:/a:drupal:drupal:6.16 + cpe:/a:drupal:drupal:7.0:alpha4 + cpe:/a:drupal:drupal:6.0:beta2 + cpe:/a:drupal:drupal:7.0:alpha5 + cpe:/a:drupal:drupal:7.22 + cpe:/a:drupal:drupal:7.0:alpha1 + cpe:/a:drupal:drupal:6.0:beta1 + cpe:/a:drupal:drupal:6.0:beta3 + cpe:/a:drupal:drupal:7.0:dev + cpe:/a:drupal:drupal:7.23 + cpe:/a:drupal:drupal:7.24 + cpe:/a:drupal:drupal:6.0:dev + cpe:/a:drupal:drupal:6.0:beta4 + cpe:/a:drupal:drupal:7.20 + cpe:/a:drupal:drupal:7.21 + cpe:/a:drupal:drupal:6.19 + cpe:/a:drupal:drupal:7.2 + cpe:/a:drupal:drupal:7.1 + cpe:/a:drupal:drupal:7.0 + cpe:/a:drupal:drupal:6.2 + cpe:/a:drupal:drupal:6.1 + cpe:/a:drupal:drupal:7.0:beta2 + cpe:/a:drupal:drupal:6.0 + cpe:/a:drupal:drupal:7.0:beta3 + cpe:/a:drupal:drupal:7.0:beta1 + cpe:/a:drupal:drupal:6.0:rc-2 + + CVE-2014-1475 + 2014-01-24T13:55:05.057-05:00 + 2014-02-21T00:06:38.483-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-24T17:47:41.623-05:00 + + + + CONFIRM + https://drupal.org/SA-CORE-2014-001 + + + BID + 64973 + + + MANDRIVA + MDVSA-2014:031 + + + DEBIAN + DSA-2851 + + + DEBIAN + DSA-2847 + + + SECUNIA + 56601 + + + SECUNIA + 56260 + + The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to authenticate as other users via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:drupal:drupal:7.0:alpha4 + cpe:/a:drupal:drupal:7.22 + cpe:/a:drupal:drupal:7.0:alpha5 + cpe:/a:drupal:drupal:7.0:alpha1 + cpe:/a:drupal:drupal:7.0:dev + cpe:/a:drupal:drupal:7.23 + cpe:/a:drupal:drupal:7.24 + cpe:/a:drupal:drupal:7.0:rc1 + cpe:/a:drupal:drupal:7.0:rc2 + cpe:/a:drupal:drupal:7.0:rc3 + cpe:/a:drupal:drupal:7.0:rc4 + cpe:/a:drupal:drupal:7.20 + cpe:/a:drupal:drupal:7.21 + cpe:/a:drupal:drupal:7.11 + cpe:/a:drupal:drupal:7.2 + cpe:/a:drupal:drupal:7.1 + cpe:/a:drupal:drupal:7.0 + cpe:/a:drupal:drupal:7.17 + cpe:/a:drupal:drupal:7.18 + cpe:/a:drupal:drupal:7.0:beta2 + cpe:/a:drupal:drupal:7.15 + cpe:/a:drupal:drupal:7.0:beta3 + cpe:/a:drupal:drupal:7.16 + cpe:/a:drupal:drupal:7.13 + cpe:/a:drupal:drupal:7.0:beta1 + cpe:/a:drupal:drupal:7.14 + cpe:/a:drupal:drupal:7.12 + cpe:/a:drupal:drupal:7.0:alpha3 + cpe:/a:drupal:drupal:7.0:alpha2 + cpe:/a:drupal:drupal:7.10 + cpe:/a:drupal:drupal:7.0:alpha7 + cpe:/a:drupal:drupal:7.0:alpha6 + cpe:/a:drupal:drupal:7.19 + + CVE-2014-1476 + 2014-01-24T13:55:05.150-05:00 + 2014-02-21T00:06:38.563-05:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-24T17:48:34.030-05:00 + + + + + CONFIRM + https://drupal.org/SA-CORE-2014-001 + + + BID + 64973 + + + MANDRIVA + MDVSA-2014:031 + + + DEBIAN + DSA-2847 + + + SECUNIA + 56260 + + The Taxonomy module in Drupal 7.x before 7.26, when upgraded from an earlier version of Drupal, does not properly restrict access to unpublished content, which allows remote authenticated users to obtain sensitive information via a listing page. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:thunderbird:6.0.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:thunderbird:1.0 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:thunderbird:16.0 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:thunderbird:1.5 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:thunderbird:11.0 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:thunderbird:6.0.2 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:thunderbird:0.7.1 + cpe:/a:mozilla:thunderbird:0.7.2 + cpe:/a:mozilla:thunderbird:0.7.3 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:thunderbird:1.5.2 + cpe:/a:mozilla:thunderbird:1.0.3 + cpe:/a:mozilla:thunderbird:1.0.4 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:thunderbird:1.0.5 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:thunderbird:1.0.6 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:thunderbird:3.1.15 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:thunderbird:3.1.16 + cpe:/a:mozilla:thunderbird:3.1.17 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:thunderbird:1.0.2 + cpe:/a:mozilla:thunderbird:1.0.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:thunderbird:3.1.10 + cpe:/a:mozilla:thunderbird:1.5.1 + cpe:/a:mozilla:thunderbird:1.0.8 + cpe:/a:mozilla:thunderbird:1.0.7 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:thunderbird:3.1.14 + cpe:/a:mozilla:thunderbird:3.1.13 + cpe:/a:mozilla:thunderbird:3.1.12 + cpe:/a:mozilla:thunderbird:3.1.11 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:thunderbird:17.0.4 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:thunderbird:12.0.1 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:thunderbird:1.5.0.3 + cpe:/a:mozilla:thunderbird:1.5.0.2 + cpe:/a:mozilla:thunderbird:1.5.0.1 + cpe:/a:mozilla:thunderbird:3.0.11 + cpe:/a:mozilla:thunderbird:3.0.10 + cpe:/a:mozilla:thunderbird:13.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:thunderbird:14.0 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:thunderbird:7.0 + cpe:/a:mozilla:thunderbird:8.0 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:thunderbird:0.2 + cpe:/a:mozilla:thunderbird:0.3 + cpe:/a:mozilla:thunderbird:0.4 + cpe:/a:mozilla:thunderbird:0.5 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:thunderbird:0.1 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:thunderbird:1.7.1 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:thunderbird:1.7.3 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:thunderbird:0.9 + cpe:/a:mozilla:thunderbird:0.8 + cpe:/a:mozilla:thunderbird:0.7 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:thunderbird:0.6 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:thunderbird:15.0.1 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:thunderbird:9.0 + cpe:/a:mozilla:thunderbird:6.0 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:thunderbird:12.0 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:thunderbird:15.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:thunderbird:24.0.1 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:thunderbird:2.0.0.5 + cpe:/a:mozilla:thunderbird:2.0.0.4 + cpe:/a:mozilla:thunderbird:2.0.0.7 + cpe:/a:mozilla:thunderbird:11.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.6 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:thunderbird:2.0.0.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:thunderbird:2.0.0.3 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:thunderbird:2.0.0.0 + cpe:/a:mozilla:thunderbird:2.0.0.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:thunderbird:1.5.0.9 + cpe:/a:mozilla:thunderbird:1.5.0.8 + cpe:/a:mozilla:thunderbird:1.5.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.6 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.8 + cpe:/a:mozilla:thunderbird:2.0.0.9 + cpe:/a:mozilla:thunderbird:16.0.2 + cpe:/a:mozilla:thunderbird:16.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:thunderbird:24.2 + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:thunderbird:24.1 + cpe:/a:mozilla:thunderbird:3.0.9 + cpe:/a:mozilla:thunderbird:24.0 + cpe:/a:mozilla:thunderbird:24.1.1 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:thunderbird:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:thunderbird:5.0 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:thunderbird:3.0.4 + cpe:/a:mozilla:thunderbird:3.0.3 + cpe:/a:mozilla:thunderbird:3.0.2 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:thunderbird:3.0.1 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:thunderbird:3.1.3 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:thunderbird:3.1.2 + cpe:/a:mozilla:thunderbird:3.1.1 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:thunderbird:3.1.4 + cpe:/a:mozilla:thunderbird:3.1.5 + cpe:/a:mozilla:thunderbird:3.1.6 + cpe:/a:mozilla:thunderbird:3.1.7 + cpe:/a:mozilla:thunderbird:2.0.0.18 + cpe:/a:mozilla:thunderbird:2.0.0.17 + cpe:/a:mozilla:thunderbird:2.0.0.16 + cpe:/a:mozilla:thunderbird:2.0.0.15 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:thunderbird:3.0.5 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:thunderbird:3.0.6 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:thunderbird:3.0.7 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:thunderbird:3.0.8 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:thunderbird:3.0 + cpe:/a:mozilla:thunderbird:3.1 + cpe:/a:mozilla:thunderbird:1.0.5:beta + cpe:/a:mozilla:thunderbird:2.0.0.21 + cpe:/a:mozilla:thunderbird:2.0.0.20 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:thunderbird:2.0.0.11 + cpe:/a:mozilla:thunderbird:2.0.0.12 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:thunderbird:2.0.0.13 + cpe:/a:mozilla:thunderbird:2.0.0.14 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:thunderbird:3.1.9 + cpe:/a:mozilla:thunderbird:3.1.8 + cpe:/a:mozilla:thunderbird:2.0.0.19 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:thunderbird:2.0.0.22 + cpe:/a:mozilla:thunderbird:2.0.0.23 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:thunderbird:1.5.0.10 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:thunderbird:1.5.0.13 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:thunderbird:7.0.1 + cpe:/a:mozilla:thunderbird:1.5.0.14 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.11 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:thunderbird:1.5.0.12 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:thunderbird:13.0.1 + cpe:/a:mozilla:thunderbird:2.0 + cpe:/a:mozilla:thunderbird:9.0.1 + cpe:/a:mozilla:thunderbird:10.0 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:thunderbird:10.0.3 + cpe:/a:mozilla:thunderbird:10.0.4 + cpe:/a:mozilla:thunderbird:10.0.1 + cpe:/a:mozilla:thunderbird:10.0.2 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1477 + 2014-02-06T00:44:24.393-05:00 + 2014-04-01T02:28:51.297-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-06T12:02:49.840-05:00 + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=953114 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=951366 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=950438 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=950000 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=945939 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=945334 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=937697 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=937132 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=936808 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=925896 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=921470 + + + CONFIRM + https://8pecxstudios.com/?page_id=44080 + + + UBUNTU + USN-2119-1 + + + UBUNTU + USN-2102-2 + + + UBUNTU + USN-2102-1 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-01.html + + + DEBIAN + DSA-2858 + + + SECUNIA + 56706 + + + REDHAT + RHSA-2014:0133 + + + REDHAT + RHSA-2014:0132 + + + SUSE + openSUSE-SU-2014:0419 + + + SUSE + SUSE-SU-2014:0248 + + + SUSE + openSUSE-SU-2014:0213 + + + SUSE + openSUSE-SU-2014:0212 + + + FEDORA + FEDORA-2014-2083 + + + FEDORA + FEDORA-2014-2041 + + Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:7.0 + cpe:/a:mozilla:firefox:1.5.6 + + CVE-2014-1478 + 2014-02-06T00:44:24.783-05:00 + 2014-04-01T02:28:51.467-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-06T13:11:57.147-05:00 + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=953373 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=950452 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=946733 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=945585 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=944851 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=944321 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=944278 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=942940 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=942152 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=939472 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=938431 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=932162 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=925308 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=924348 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=922603 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=916635 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=911845 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=911707 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=867597 + + + CONFIRM + https://8pecxstudios.com/?page_id=44080 + + + UBUNTU + USN-2102-2 + + + UBUNTU + USN-2102-1 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-01.html + + + SECUNIA + 56706 + + + SUSE + openSUSE-SU-2014:0419 + + + SUSE + openSUSE-SU-2014:0213 + + + SUSE + openSUSE-SU-2014:0212 + + Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the MPostWriteBarrier class in js/src/jit/MIR.h and stack alignment in js/src/jit/AsmJS.cpp in OdinMonkey, and unknown other vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:thunderbird:6.0.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:thunderbird:1.0 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:thunderbird:16.0 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:thunderbird:1.5 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:thunderbird:11.0 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:thunderbird:6.0.2 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:thunderbird:0.7.1 + cpe:/a:mozilla:thunderbird:0.7.2 + cpe:/a:mozilla:thunderbird:0.7.3 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:thunderbird:1.5.2 + cpe:/a:mozilla:thunderbird:1.0.3 + cpe:/a:mozilla:thunderbird:1.0.4 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:thunderbird:1.0.5 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:thunderbird:1.0.6 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:thunderbird:3.1.15 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:thunderbird:3.1.16 + cpe:/a:mozilla:thunderbird:3.1.17 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:thunderbird:1.0.2 + cpe:/a:mozilla:thunderbird:1.0.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:thunderbird:3.1.10 + cpe:/a:mozilla:thunderbird:1.5.1 + cpe:/a:mozilla:thunderbird:1.0.8 + cpe:/a:mozilla:thunderbird:1.0.7 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:thunderbird:3.1.14 + cpe:/a:mozilla:thunderbird:3.1.13 + cpe:/a:mozilla:thunderbird:3.1.12 + cpe:/a:mozilla:thunderbird:3.1.11 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:thunderbird:17.0.4 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:thunderbird:12.0.1 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:thunderbird:1.5.0.3 + cpe:/a:mozilla:thunderbird:1.5.0.2 + cpe:/a:mozilla:thunderbird:1.5.0.1 + cpe:/a:mozilla:thunderbird:3.0.11 + cpe:/a:mozilla:thunderbird:3.0.10 + cpe:/a:mozilla:thunderbird:13.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:thunderbird:14.0 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:thunderbird:7.0 + cpe:/a:mozilla:thunderbird:8.0 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:thunderbird:0.2 + cpe:/a:mozilla:thunderbird:0.3 + cpe:/a:mozilla:thunderbird:0.4 + cpe:/a:mozilla:thunderbird:0.5 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:thunderbird:0.1 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:thunderbird:1.7.1 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:thunderbird:1.7.3 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:thunderbird:0.9 + cpe:/a:mozilla:thunderbird:0.8 + cpe:/a:mozilla:thunderbird:0.7 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:thunderbird:0.6 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:thunderbird:15.0.1 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:thunderbird:9.0 + cpe:/a:mozilla:thunderbird:6.0 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:thunderbird:12.0 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:thunderbird:15.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:thunderbird:24.0.1 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:thunderbird:2.0.0.5 + cpe:/a:mozilla:thunderbird:2.0.0.4 + cpe:/a:mozilla:thunderbird:2.0.0.7 + cpe:/a:mozilla:thunderbird:11.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.6 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:thunderbird:2.0.0.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:thunderbird:2.0.0.3 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:thunderbird:2.0.0.0 + cpe:/a:mozilla:thunderbird:2.0.0.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:thunderbird:1.5.0.9 + cpe:/a:mozilla:thunderbird:1.5.0.8 + cpe:/a:mozilla:thunderbird:1.5.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.6 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.8 + cpe:/a:mozilla:thunderbird:2.0.0.9 + cpe:/a:mozilla:thunderbird:16.0.2 + cpe:/a:mozilla:thunderbird:16.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:thunderbird:24.2 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:thunderbird:24.1 + cpe:/a:mozilla:thunderbird:3.0.9 + cpe:/a:mozilla:thunderbird:24.0 + cpe:/a:mozilla:thunderbird:24.1.1 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:thunderbird:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:thunderbird:5.0 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:thunderbird:3.0.4 + cpe:/a:mozilla:thunderbird:3.0.3 + cpe:/a:mozilla:thunderbird:3.0.2 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:thunderbird:3.0.1 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:thunderbird:3.1.3 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:thunderbird:3.1.2 + cpe:/a:mozilla:thunderbird:3.1.1 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:thunderbird:3.1.4 + cpe:/a:mozilla:thunderbird:3.1.5 + cpe:/a:mozilla:thunderbird:3.1.6 + cpe:/a:mozilla:thunderbird:3.1.7 + cpe:/a:mozilla:thunderbird:2.0.0.18 + cpe:/a:mozilla:thunderbird:2.0.0.17 + cpe:/a:mozilla:thunderbird:2.0.0.16 + cpe:/a:mozilla:thunderbird:2.0.0.15 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:thunderbird:3.0.5 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:thunderbird:3.0.6 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:thunderbird:3.0.7 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:thunderbird:3.0.8 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:thunderbird:3.0 + cpe:/a:mozilla:thunderbird:3.1 + cpe:/a:mozilla:thunderbird:1.0.5:beta + cpe:/a:mozilla:thunderbird:2.0.0.21 + cpe:/a:mozilla:thunderbird:2.0.0.20 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:thunderbird:2.0.0.11 + cpe:/a:mozilla:thunderbird:2.0.0.12 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:thunderbird:2.0.0.13 + cpe:/a:mozilla:thunderbird:2.0.0.14 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:thunderbird:3.1.9 + cpe:/a:mozilla:thunderbird:3.1.8 + cpe:/a:mozilla:thunderbird:2.0.0.19 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:thunderbird:2.0.0.22 + cpe:/a:mozilla:thunderbird:2.0.0.23 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:thunderbird:1.5.0.10 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:thunderbird:1.5.0.13 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:thunderbird:7.0.1 + cpe:/a:mozilla:thunderbird:1.5.0.14 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.11 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:thunderbird:1.5.0.12 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:thunderbird:13.0.1 + cpe:/a:mozilla:thunderbird:2.0 + cpe:/a:mozilla:thunderbird:9.0.1 + cpe:/a:mozilla:thunderbird:10.0 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:thunderbird:10.0.3 + cpe:/a:mozilla:thunderbird:10.0.4 + cpe:/a:mozilla:thunderbird:10.0.1 + cpe:/a:mozilla:thunderbird:10.0.2 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1479 + 2014-02-06T00:44:24.830-05:00 + 2014-04-01T02:28:51.640-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-06T13:44:30.477-05:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=911864 + + + CONFIRM + https://8pecxstudios.com/?page_id=44080 + + + UBUNTU + USN-2119-1 + + + UBUNTU + USN-2102-2 + + + UBUNTU + USN-2102-1 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-02.html + + + DEBIAN + DSA-2858 + + + SECUNIA + 56706 + + + REDHAT + RHSA-2014:0133 + + + REDHAT + RHSA-2014:0132 + + + SUSE + openSUSE-SU-2014:0419 + + + SUSE + SUSE-SU-2014:0248 + + + SUSE + openSUSE-SU-2014:0213 + + + SUSE + openSUSE-SU-2014:0212 + + + FEDORA + FEDORA-2014-2083 + + + FEDORA + FEDORA-2014-2041 + + The System Only Wrapper (SOW) implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent certain cloning operations, which allows remote attackers to bypass intended restrictions on XUL content via vectors involving XBL content scopes. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1480 + 2014-02-06T00:44:24.847-05:00 + 2014-04-01T02:28:51.827-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-06T13:48:37.497-05:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=916726 + + + UBUNTU + USN-2102-2 + + + UBUNTU + USN-2102-1 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-03.html + + + SUSE + openSUSE-SU-2014:0419 + + + SUSE + SUSE-SU-2014:0248 + + + SUSE + openSUSE-SU-2014:0212 + + The file-download implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 does not properly restrict the timing of button selections, which allows remote attackers to conduct clickjacking attacks, and trigger unintended launching of a downloaded file, via a crafted web site. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:thunderbird:6.0.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:thunderbird:1.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:thunderbird:16.0 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:thunderbird:1.5 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:thunderbird:11.0 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:thunderbird:6.0.2 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:thunderbird:0.7.1 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:thunderbird:0.7.2 + cpe:/a:mozilla:thunderbird:0.7.3 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:thunderbird:1.5.2 + cpe:/a:mozilla:thunderbird:1.0.3 + cpe:/a:mozilla:thunderbird:1.0.4 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:thunderbird:1.0.5 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:thunderbird:1.0.6 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:thunderbird:3.1.15 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:thunderbird:3.1.16 + cpe:/a:mozilla:thunderbird:3.1.17 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:thunderbird:1.0.2 + cpe:/a:mozilla:thunderbird:1.0.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:thunderbird:3.1.10 + cpe:/a:mozilla:thunderbird:1.5.1 + cpe:/a:mozilla:thunderbird:1.0.8 + cpe:/a:mozilla:thunderbird:1.0.7 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:thunderbird:3.1.14 + cpe:/a:mozilla:thunderbird:3.1.13 + cpe:/a:mozilla:thunderbird:3.1.12 + cpe:/a:mozilla:thunderbird:3.1.11 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:thunderbird:17.0.4 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:thunderbird:12.0.1 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:thunderbird:1.5.0.3 + cpe:/a:mozilla:thunderbird:1.5.0.2 + cpe:/a:mozilla:thunderbird:1.5.0.1 + cpe:/a:mozilla:thunderbird:3.0.11 + cpe:/a:mozilla:thunderbird:3.0.10 + cpe:/a:mozilla:thunderbird:13.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:thunderbird:14.0 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:thunderbird:7.0 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:thunderbird:8.0 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:thunderbird:0.2 + cpe:/a:mozilla:thunderbird:0.3 + cpe:/a:mozilla:thunderbird:0.4 + cpe:/a:mozilla:thunderbird:0.5 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:thunderbird:0.1 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:thunderbird:1.7.1 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:thunderbird:1.7.3 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:thunderbird:0.9 + cpe:/a:mozilla:thunderbird:0.8 + cpe:/a:mozilla:thunderbird:0.7 + cpe:/a:mozilla:thunderbird:0.6 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:thunderbird:15.0.1 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:thunderbird:9.0 + cpe:/a:mozilla:thunderbird:6.0 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:thunderbird:12.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:thunderbird:15.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:thunderbird:24.0.1 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:thunderbird:2.0.0.5 + cpe:/a:mozilla:thunderbird:2.0.0.4 + cpe:/a:mozilla:thunderbird:2.0.0.7 + cpe:/a:mozilla:thunderbird:2.0.0.6 + cpe:/a:mozilla:thunderbird:11.0.1 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:thunderbird:2.0.0.2 + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:thunderbird:2.0.0.3 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:thunderbird:2.0.0.0 + cpe:/a:mozilla:thunderbird:2.0.0.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:thunderbird:1.5.0.9 + cpe:/a:mozilla:thunderbird:1.5.0.8 + cpe:/a:mozilla:thunderbird:1.5.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.6 + cpe:/a:mozilla:thunderbird:2.0.0.8 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.9 + cpe:/a:mozilla:thunderbird:16.0.2 + cpe:/a:mozilla:thunderbird:16.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:thunderbird:24.2 + cpe:/a:mozilla:thunderbird:24.1 + cpe:/a:mozilla:thunderbird:3.0.9 + cpe:/a:mozilla:thunderbird:24.0 + cpe:/a:mozilla:thunderbird:24.1.1 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:thunderbird:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:thunderbird:5.0 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:thunderbird:3.0.4 + cpe:/a:mozilla:thunderbird:3.0.3 + cpe:/a:mozilla:thunderbird:3.0.2 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:thunderbird:3.0.1 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:thunderbird:3.1.3 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:thunderbird:3.1.2 + cpe:/a:mozilla:thunderbird:3.1.1 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:thunderbird:3.1.4 + cpe:/a:mozilla:thunderbird:3.1.5 + cpe:/a:mozilla:thunderbird:3.1.6 + cpe:/a:mozilla:thunderbird:3.1.7 + cpe:/a:mozilla:thunderbird:2.0.0.18 + cpe:/a:mozilla:thunderbird:2.0.0.17 + cpe:/a:mozilla:thunderbird:2.0.0.16 + cpe:/a:mozilla:thunderbird:2.0.0.15 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:thunderbird:3.0.5 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:thunderbird:3.0.6 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:thunderbird:3.0.7 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:thunderbird:3.0.8 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:thunderbird:3.0 + cpe:/a:mozilla:thunderbird:3.1 + cpe:/a:mozilla:thunderbird:1.0.5:beta + cpe:/a:mozilla:thunderbird:2.0.0.21 + cpe:/a:mozilla:thunderbird:2.0.0.20 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:thunderbird:2.0.0.11 + cpe:/a:mozilla:thunderbird:2.0.0.12 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:thunderbird:2.0.0.13 + cpe:/a:mozilla:thunderbird:2.0.0.14 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:thunderbird:3.1.9 + cpe:/a:mozilla:thunderbird:3.1.8 + cpe:/a:mozilla:thunderbird:2.0.0.19 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:thunderbird:2.0.0.22 + cpe:/a:mozilla:thunderbird:2.0.0.23 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:thunderbird:1.5.0.10 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:thunderbird:1.5.0.13 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:thunderbird:7.0.1 + cpe:/a:mozilla:thunderbird:1.5.0.14 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.11 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:thunderbird:1.5.0.12 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:thunderbird:13.0.1 + cpe:/a:mozilla:thunderbird:2.0 + cpe:/a:mozilla:thunderbird:9.0.1 + cpe:/a:mozilla:thunderbird:10.0 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:thunderbird:10.0.3 + cpe:/a:mozilla:thunderbird:10.0.4 + cpe:/a:mozilla:thunderbird:10.0.1 + cpe:/a:mozilla:thunderbird:10.0.2 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1481 + 2014-02-06T00:44:24.877-05:00 + 2014-04-01T02:28:51.983-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-06T13:58:58.247-05:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=936056 + + + CONFIRM + https://8pecxstudios.com/?page_id=44080 + + + UBUNTU + USN-2119-1 + + + UBUNTU + USN-2102-2 + + + UBUNTU + USN-2102-1 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-13.html + + + DEBIAN + DSA-2858 + + + SECUNIA + 56706 + + + REDHAT + RHSA-2014:0133 + + + REDHAT + RHSA-2014:0132 + + + SUSE + openSUSE-SU-2014:0419 + + + SUSE + SUSE-SU-2014:0248 + + + SUSE + openSUSE-SU-2014:0213 + + + SUSE + openSUSE-SU-2014:0212 + + + FEDORA + FEDORA-2014-2083 + + + FEDORA + FEDORA-2014-2041 + + Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow remote attackers to bypass intended restrictions on window objects by leveraging inconsistency in native getter methods across different JavaScript engines. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:thunderbird:6.0.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:thunderbird:1.0 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:thunderbird:16.0 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:thunderbird:1.5 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:thunderbird:11.0 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:thunderbird:6.0.2 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:thunderbird:0.7.1 + cpe:/a:mozilla:thunderbird:0.7.2 + cpe:/a:mozilla:thunderbird:0.7.3 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:thunderbird:1.0.3 + cpe:/a:mozilla:thunderbird:1.5.2 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:thunderbird:1.0.4 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:thunderbird:1.0.5 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:thunderbird:1.0.6 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:thunderbird:3.1.15 + cpe:/a:mozilla:thunderbird:3.1.16 + cpe:/a:mozilla:thunderbird:3.1.17 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:thunderbird:1.0.2 + cpe:/a:mozilla:thunderbird:1.0.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:thunderbird:3.1.10 + cpe:/a:mozilla:thunderbird:1.5.1 + cpe:/a:mozilla:thunderbird:1.0.8 + cpe:/a:mozilla:thunderbird:1.0.7 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:thunderbird:3.1.14 + cpe:/a:mozilla:thunderbird:3.1.13 + cpe:/a:mozilla:thunderbird:3.1.12 + cpe:/a:mozilla:thunderbird:3.1.11 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:thunderbird:17.0.4 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:thunderbird:12.0.1 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:thunderbird:1.5.0.3 + cpe:/a:mozilla:thunderbird:1.5.0.2 + cpe:/a:mozilla:thunderbird:1.5.0.1 + cpe:/a:mozilla:thunderbird:3.0.11 + cpe:/a:mozilla:thunderbird:3.0.10 + cpe:/a:mozilla:thunderbird:13.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:thunderbird:14.0 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:thunderbird:7.0 + cpe:/a:mozilla:thunderbird:8.0 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:thunderbird:0.2 + cpe:/a:mozilla:thunderbird:0.3 + cpe:/a:mozilla:thunderbird:0.4 + cpe:/a:mozilla:thunderbird:0.5 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:thunderbird:0.1 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:thunderbird:1.7.1 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:thunderbird:1.7.3 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:thunderbird:0.9 + cpe:/a:mozilla:thunderbird:0.8 + cpe:/a:mozilla:thunderbird:0.7 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:thunderbird:0.6 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:thunderbird:15.0.1 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:thunderbird:9.0 + cpe:/a:mozilla:thunderbird:6.0 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:thunderbird:12.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:thunderbird:15.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:thunderbird:24.0.1 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:thunderbird:2.0.0.5 + cpe:/a:mozilla:thunderbird:2.0.0.4 + cpe:/a:mozilla:thunderbird:2.0.0.7 + cpe:/a:mozilla:thunderbird:11.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.6 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:thunderbird:2.0.0.2 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:thunderbird:2.0.0.3 + cpe:/a:mozilla:thunderbird:2.0.0.0 + cpe:/a:mozilla:thunderbird:2.0.0.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:thunderbird:1.5.0.9 + cpe:/a:mozilla:thunderbird:1.5.0.8 + cpe:/a:mozilla:thunderbird:1.5.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.6 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.8 + cpe:/a:mozilla:thunderbird:2.0.0.9 + cpe:/a:mozilla:thunderbird:16.0.2 + cpe:/a:mozilla:thunderbird:16.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:thunderbird:24.2 + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:thunderbird:3.0.9 + cpe:/a:mozilla:thunderbird:24.1 + cpe:/a:mozilla:thunderbird:24.0 + cpe:/a:mozilla:thunderbird:24.1.1 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:thunderbird:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:thunderbird:5.0 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:thunderbird:3.0.4 + cpe:/a:mozilla:thunderbird:3.0.3 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:thunderbird:3.0.2 + cpe:/a:mozilla:thunderbird:3.0.1 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:thunderbird:3.1.3 + cpe:/a:mozilla:thunderbird:3.1.2 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:thunderbird:3.1.1 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:thunderbird:3.1.4 + cpe:/a:mozilla:thunderbird:3.1.5 + cpe:/a:mozilla:thunderbird:3.1.6 + cpe:/a:mozilla:thunderbird:3.1.7 + cpe:/a:mozilla:thunderbird:2.0.0.18 + cpe:/a:mozilla:thunderbird:2.0.0.17 + cpe:/a:mozilla:thunderbird:2.0.0.16 + cpe:/a:mozilla:thunderbird:2.0.0.15 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:thunderbird:3.0.5 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:thunderbird:3.0.6 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:thunderbird:3.0.7 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:thunderbird:3.0.8 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:thunderbird:3.0 + cpe:/a:mozilla:thunderbird:3.1 + cpe:/a:mozilla:thunderbird:1.0.5:beta + cpe:/a:mozilla:thunderbird:2.0.0.21 + cpe:/a:mozilla:thunderbird:2.0.0.20 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:thunderbird:2.0.0.11 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:thunderbird:2.0.0.12 + cpe:/a:mozilla:thunderbird:2.0.0.13 + cpe:/a:mozilla:thunderbird:2.0.0.14 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:thunderbird:3.1.9 + cpe:/a:mozilla:thunderbird:3.1.8 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:thunderbird:2.0.0.19 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:thunderbird:2.0.0.22 + cpe:/a:mozilla:thunderbird:2.0.0.23 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:thunderbird:1.5.0.10 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.13 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.14 + cpe:/a:mozilla:thunderbird:7.0.1 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:thunderbird:1.5.0.11 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.12 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:thunderbird:13.0.1 + cpe:/a:mozilla:thunderbird:2.0 + cpe:/a:mozilla:thunderbird:9.0.1 + cpe:/a:mozilla:thunderbird:10.0 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:thunderbird:10.0.3 + cpe:/a:mozilla:thunderbird:10.0.4 + cpe:/a:mozilla:thunderbird:10.0.1 + cpe:/a:mozilla:thunderbird:10.0.2 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1482 + 2014-02-06T00:44:24.893-05:00 + 2014-04-01T02:28:52.157-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-06T14:00:15.077-05:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=943803 + + + CONFIRM + https://8pecxstudios.com/?page_id=44080 + + + UBUNTU + USN-2119-1 + + + UBUNTU + USN-2102-2 + + + UBUNTU + USN-2102-1 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-04.html + + + DEBIAN + DSA-2858 + + + SECUNIA + 56706 + + + REDHAT + RHSA-2014:0133 + + + REDHAT + RHSA-2014:0132 + + + SUSE + openSUSE-SU-2014:0419 + + + SUSE + SUSE-SU-2014:0248 + + + SUSE + openSUSE-SU-2014:0213 + + + SUSE + openSUSE-SU-2014:0212 + + + FEDORA + FEDORA-2014-2083 + + + FEDORA + FEDORA-2014-2041 + + RasterImage.cpp in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent access to discarded data, which allows remote attackers to execute arbitrary code or cause a denial of service (incorrect write operations) via crafted image data, as demonstrated by Goo Create. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1483 + 2014-02-06T00:44:24.910-05:00 + 2014-04-01T02:28:52.327-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-02-06T14:02:05.640-05:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=950427 + + + CONFIRM + https://8pecxstudios.com/?page_id=44080 + + + UBUNTU + USN-2102-2 + + + UBUNTU + USN-2102-1 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-05.html + + + SECUNIA + 56706 + + + SUSE + openSUSE-SU-2014:0419 + + + SUSE + SUSE-SU-2014:0248 + + + SUSE + openSUSE-SU-2014:0212 + + Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allow remote attackers to bypass the Same Origin Policy and obtain sensitive information by using an IFRAME element in conjunction with certain timing measurements involving the document.caretPositionFromPoint and document.elementFromPoint functions. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1484 + 2014-02-06T00:44:24.940-05:00 + 2014-04-01T02:28:52.500-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-02-06T14:10:16.183-05:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=953993 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-06.html + + + SUSE + SUSE-SU-2014:0248 + + + SUSE + openSUSE-SU-2014:0212 + + + BUGTRAQ + 20140326 Firefox for Android Profile Directory Derandomization and Data Exfiltration (CVE-2014-1484, CVE-2014-1506, CVE-2014-1515, CVE-2014-1516) + + Mozilla Firefox before 27.0 on Android 4.2 and earlier creates system-log entries containing profile paths, which allows attackers to obtain sensitive information via a crafted application. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1485 + 2014-02-06T00:44:24.957-05:00 + 2014-04-01T02:28:52.670-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-06T14:12:25.750-05:00 + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=910139 + + + CONFIRM + https://8pecxstudios.com/?page_id=44080 + + + UBUNTU + USN-2102-2 + + + UBUNTU + USN-2102-1 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-07.html + + + SECUNIA + 56706 + + + SUSE + openSUSE-SU-2014:0419 + + + SUSE + SUSE-SU-2014:0248 + + + SUSE + openSUSE-SU-2014:0212 + + The Content Security Policy (CSP) implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 operates on XSLT stylesheets according to style-src directives instead of script-src directives, which might allow remote attackers to execute arbitrary XSLT code by leveraging insufficient style-src restrictions. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:thunderbird:6.0.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:thunderbird:1.0 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:thunderbird:16.0 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:thunderbird:1.5 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:thunderbird:11.0 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:thunderbird:6.0.2 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:thunderbird:0.7.1 + cpe:/a:mozilla:thunderbird:0.7.2 + cpe:/a:mozilla:thunderbird:0.7.3 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:thunderbird:1.0.3 + cpe:/a:mozilla:thunderbird:1.5.2 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:thunderbird:1.0.4 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:thunderbird:1.0.5 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:thunderbird:1.0.6 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:thunderbird:3.1.15 + cpe:/a:mozilla:thunderbird:3.1.16 + cpe:/a:mozilla:thunderbird:3.1.17 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:thunderbird:1.0.2 + cpe:/a:mozilla:thunderbird:1.0.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:thunderbird:3.1.10 + cpe:/a:mozilla:thunderbird:1.5.1 + cpe:/a:mozilla:thunderbird:1.0.8 + cpe:/a:mozilla:thunderbird:1.0.7 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:thunderbird:3.1.14 + cpe:/a:mozilla:thunderbird:3.1.13 + cpe:/a:mozilla:thunderbird:3.1.12 + cpe:/a:mozilla:thunderbird:3.1.11 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:thunderbird:17.0.4 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:thunderbird:12.0.1 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:thunderbird:1.5.0.3 + cpe:/a:mozilla:thunderbird:1.5.0.2 + cpe:/a:mozilla:thunderbird:1.5.0.1 + cpe:/a:mozilla:thunderbird:3.0.11 + cpe:/a:mozilla:thunderbird:3.0.10 + cpe:/a:mozilla:thunderbird:13.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:thunderbird:14.0 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:thunderbird:7.0 + cpe:/a:mozilla:thunderbird:8.0 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:thunderbird:0.2 + cpe:/a:mozilla:thunderbird:0.3 + cpe:/a:mozilla:thunderbird:0.4 + cpe:/a:mozilla:thunderbird:0.5 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:thunderbird:0.1 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:thunderbird:1.7.1 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:thunderbird:1.7.3 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:thunderbird:0.9 + cpe:/a:mozilla:thunderbird:0.8 + cpe:/a:mozilla:thunderbird:0.7 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:thunderbird:0.6 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:thunderbird:15.0.1 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:thunderbird:9.0 + cpe:/a:mozilla:thunderbird:6.0 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:thunderbird:12.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:thunderbird:15.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:thunderbird:24.0.1 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:thunderbird:2.0.0.5 + cpe:/a:mozilla:thunderbird:2.0.0.4 + cpe:/a:mozilla:thunderbird:2.0.0.7 + cpe:/a:mozilla:thunderbird:11.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.6 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:thunderbird:2.0.0.2 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:thunderbird:2.0.0.3 + cpe:/a:mozilla:thunderbird:2.0.0.0 + cpe:/a:mozilla:thunderbird:2.0.0.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:thunderbird:1.5.0.9 + cpe:/a:mozilla:thunderbird:1.5.0.8 + cpe:/a:mozilla:thunderbird:1.5.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.6 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.8 + cpe:/a:mozilla:thunderbird:2.0.0.9 + cpe:/a:mozilla:thunderbird:16.0.2 + cpe:/a:mozilla:thunderbird:16.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:thunderbird:24.2 + cpe:/a:mozilla:thunderbird:3.0.9 + cpe:/a:mozilla:thunderbird:24.1 + cpe:/a:mozilla:thunderbird:24.0 + cpe:/a:mozilla:thunderbird:24.1.1 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:thunderbird:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:thunderbird:5.0 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:thunderbird:3.0.4 + cpe:/a:mozilla:thunderbird:3.0.3 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:thunderbird:3.0.2 + cpe:/a:mozilla:thunderbird:3.0.1 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:thunderbird:3.1.3 + cpe:/a:mozilla:thunderbird:3.1.2 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:thunderbird:3.1.1 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:thunderbird:3.1.4 + cpe:/a:mozilla:thunderbird:3.1.5 + cpe:/a:mozilla:thunderbird:3.1.6 + cpe:/a:mozilla:thunderbird:3.1.7 + cpe:/a:mozilla:thunderbird:2.0.0.18 + cpe:/a:mozilla:thunderbird:2.0.0.17 + cpe:/a:mozilla:thunderbird:2.0.0.16 + cpe:/a:mozilla:thunderbird:2.0.0.15 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:thunderbird:3.0.5 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:thunderbird:3.0.6 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:thunderbird:3.0.7 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:thunderbird:3.0.8 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:thunderbird:3.0 + cpe:/a:mozilla:thunderbird:3.1 + cpe:/a:mozilla:thunderbird:1.0.5:beta + cpe:/a:mozilla:thunderbird:2.0.0.21 + cpe:/a:mozilla:thunderbird:2.0.0.20 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:thunderbird:2.0.0.11 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:thunderbird:2.0.0.12 + cpe:/a:mozilla:thunderbird:2.0.0.13 + cpe:/a:mozilla:thunderbird:2.0.0.14 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:thunderbird:3.1.9 + cpe:/a:mozilla:thunderbird:3.1.8 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:thunderbird:2.0.0.19 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:thunderbird:2.0.0.22 + cpe:/a:mozilla:thunderbird:2.0.0.23 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:thunderbird:1.5.0.10 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.13 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.14 + cpe:/a:mozilla:thunderbird:7.0.1 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:thunderbird:1.5.0.11 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.12 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:thunderbird:13.0.1 + cpe:/a:mozilla:thunderbird:2.0 + cpe:/a:mozilla:thunderbird:9.0.1 + cpe:/a:mozilla:thunderbird:10.0 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:thunderbird:10.0.3 + cpe:/a:mozilla:thunderbird:10.0.4 + cpe:/a:mozilla:thunderbird:10.0.1 + cpe:/a:mozilla:thunderbird:10.0.2 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1486 + 2014-02-06T00:44:24.987-05:00 + 2014-04-01T02:28:52.843-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-06T14:14:22.160-05:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=942164 + + + CONFIRM + https://8pecxstudios.com/?page_id=44080 + + + UBUNTU + USN-2119-1 + + + UBUNTU + USN-2102-2 + + + UBUNTU + USN-2102-1 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-08.html + + + DEBIAN + DSA-2858 + + + SECUNIA + 56706 + + + REDHAT + RHSA-2014:0133 + + + REDHAT + RHSA-2014:0132 + + + SUSE + openSUSE-SU-2014:0419 + + + SUSE + SUSE-SU-2014:0248 + + + SUSE + openSUSE-SU-2014:0213 + + + SUSE + openSUSE-SU-2014:0212 + + + FEDORA + FEDORA-2014-2083 + + + FEDORA + FEDORA-2014-2041 + + Use-after-free vulnerability in the imgRequestProxy function in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to execute arbitrary code via vectors involving unspecified Content-Type values for image data. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:thunderbird:6.0.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:thunderbird:1.0 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:thunderbird:16.0 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:thunderbird:1.5 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:thunderbird:11.0 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:thunderbird:6.0.2 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:thunderbird:0.7.1 + cpe:/a:mozilla:thunderbird:0.7.2 + cpe:/a:mozilla:thunderbird:0.7.3 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:thunderbird:1.0.3 + cpe:/a:mozilla:thunderbird:1.5.2 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:thunderbird:1.0.4 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:thunderbird:1.0.5 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:thunderbird:1.0.6 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:thunderbird:3.1.15 + cpe:/a:mozilla:thunderbird:3.1.16 + cpe:/a:mozilla:thunderbird:3.1.17 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:thunderbird:1.0.2 + cpe:/a:mozilla:thunderbird:1.0.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:thunderbird:3.1.10 + cpe:/a:mozilla:thunderbird:1.5.1 + cpe:/a:mozilla:thunderbird:1.0.8 + cpe:/a:mozilla:thunderbird:1.0.7 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:thunderbird:3.1.14 + cpe:/a:mozilla:thunderbird:3.1.13 + cpe:/a:mozilla:thunderbird:3.1.12 + cpe:/a:mozilla:thunderbird:3.1.11 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:thunderbird:17.0.4 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:thunderbird:12.0.1 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:thunderbird:1.5.0.3 + cpe:/a:mozilla:thunderbird:1.5.0.2 + cpe:/a:mozilla:thunderbird:1.5.0.1 + cpe:/a:mozilla:thunderbird:3.0.11 + cpe:/a:mozilla:thunderbird:3.0.10 + cpe:/a:mozilla:thunderbird:13.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:thunderbird:14.0 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:thunderbird:7.0 + cpe:/a:mozilla:thunderbird:8.0 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:thunderbird:0.2 + cpe:/a:mozilla:thunderbird:0.3 + cpe:/a:mozilla:thunderbird:0.4 + cpe:/a:mozilla:thunderbird:0.5 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:thunderbird:0.1 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:thunderbird:1.7.1 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:thunderbird:1.7.3 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:thunderbird:0.9 + cpe:/a:mozilla:thunderbird:0.8 + cpe:/a:mozilla:thunderbird:0.7 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:thunderbird:0.6 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:thunderbird:15.0.1 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:thunderbird:9.0 + cpe:/a:mozilla:thunderbird:6.0 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:thunderbird:12.0 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:thunderbird:15.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:thunderbird:24.0.1 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:thunderbird:2.0.0.5 + cpe:/a:mozilla:thunderbird:2.0.0.4 + cpe:/a:mozilla:thunderbird:2.0.0.7 + cpe:/a:mozilla:thunderbird:11.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.6 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:thunderbird:2.0.0.2 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:thunderbird:2.0.0.3 + cpe:/a:mozilla:thunderbird:2.0.0.0 + cpe:/a:mozilla:thunderbird:2.0.0.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:thunderbird:1.5.0.9 + cpe:/a:mozilla:thunderbird:1.5.0.8 + cpe:/a:mozilla:thunderbird:1.5.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.6 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.8 + cpe:/a:mozilla:thunderbird:2.0.0.9 + cpe:/a:mozilla:thunderbird:16.0.2 + cpe:/a:mozilla:thunderbird:16.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:thunderbird:24.2 + cpe:/a:mozilla:thunderbird:3.0.9 + cpe:/a:mozilla:thunderbird:24.1 + cpe:/a:mozilla:thunderbird:24.0 + cpe:/a:mozilla:thunderbird:24.1.1 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:thunderbird:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:thunderbird:5.0 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:thunderbird:3.0.4 + cpe:/a:mozilla:thunderbird:3.0.3 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:thunderbird:3.0.2 + cpe:/a:mozilla:thunderbird:3.0.1 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:thunderbird:3.1.3 + cpe:/a:mozilla:thunderbird:3.1.2 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:thunderbird:3.1.1 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:thunderbird:3.1.4 + cpe:/a:mozilla:thunderbird:3.1.5 + cpe:/a:mozilla:thunderbird:3.1.6 + cpe:/a:mozilla:thunderbird:3.1.7 + cpe:/a:mozilla:thunderbird:2.0.0.18 + cpe:/a:mozilla:thunderbird:2.0.0.17 + cpe:/a:mozilla:thunderbird:2.0.0.16 + cpe:/a:mozilla:thunderbird:2.0.0.15 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:thunderbird:3.0.5 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:thunderbird:3.0.6 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:thunderbird:3.0.7 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:thunderbird:3.0.8 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:thunderbird:3.0 + cpe:/a:mozilla:thunderbird:3.1 + cpe:/a:mozilla:thunderbird:1.0.5:beta + cpe:/a:mozilla:thunderbird:2.0.0.21 + cpe:/a:mozilla:thunderbird:2.0.0.20 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:thunderbird:2.0.0.11 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:thunderbird:2.0.0.12 + cpe:/a:mozilla:thunderbird:2.0.0.13 + cpe:/a:mozilla:thunderbird:2.0.0.14 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:thunderbird:3.1.9 + cpe:/a:mozilla:thunderbird:3.1.8 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:thunderbird:2.0.0.19 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:thunderbird:2.0.0.22 + cpe:/a:mozilla:thunderbird:2.0.0.23 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:thunderbird:1.5.0.10 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.13 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.14 + cpe:/a:mozilla:thunderbird:7.0.1 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:thunderbird:1.5.0.11 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.12 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:thunderbird:13.0.1 + cpe:/a:mozilla:thunderbird:2.0 + cpe:/a:mozilla:thunderbird:9.0.1 + cpe:/a:mozilla:thunderbird:10.0 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:thunderbird:10.0.3 + cpe:/a:mozilla:thunderbird:10.0.4 + cpe:/a:mozilla:thunderbird:10.0.1 + cpe:/a:mozilla:thunderbird:10.0.2 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1487 + 2014-02-06T00:44:25.017-05:00 + 2014-04-01T02:28:52.953-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-02-06T14:15:30.537-05:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=947592 + + + CONFIRM + https://8pecxstudios.com/?page_id=44080 + + + UBUNTU + USN-2119-1 + + + UBUNTU + USN-2102-2 + + + UBUNTU + USN-2102-1 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-09.html + + + DEBIAN + DSA-2858 + + + SECUNIA + 56706 + + + REDHAT + RHSA-2014:0133 + + + REDHAT + RHSA-2014:0132 + + + SUSE + openSUSE-SU-2014:0419 + + + SUSE + SUSE-SU-2014:0248 + + + SUSE + openSUSE-SU-2014:0213 + + + SUSE + openSUSE-SU-2014:0212 + + + FEDORA + FEDORA-2014-2083 + + + FEDORA + FEDORA-2014-2041 + + The Web workers implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to bypass the Same Origin Policy and obtain sensitive authentication information via vectors involving error messages. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1488 + 2014-02-06T00:44:25.050-05:00 + 2014-04-01T02:28:53.030-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-06T14:16:39.427-05:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=950604 + + + CONFIRM + https://8pecxstudios.com/?page_id=44080 + + + UBUNTU + USN-2102-2 + + + UBUNTU + USN-2102-1 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-11.html + + + SECUNIA + 56706 + + + SUSE + openSUSE-SU-2014:0419 + + + SUSE + SUSE-SU-2014:0248 + + + SUSE + openSUSE-SU-2014:0212 + + The Web workers implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allows remote attackers to execute arbitrary code via vectors involving termination of a worker process that has performed a cross-thread object-passing operation in conjunction with use of asm.js. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1489 + 2014-02-06T00:44:25.067-05:00 + 2014-03-05T23:50:51.173-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-02-06T14:20:34.950-05:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=959531 + + + UBUNTU + USN-2102-2 + + + UBUNTU + USN-2102-1 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-10.html + + + SUSE + SUSE-SU-2014:0248 + + + SUSE + openSUSE-SU-2014:0212 + + Mozilla Firefox before 27.0 does not properly restrict access to about:home buttons by script on other pages, which allows user-assisted remote attackers to cause a denial of service (session restore) via a crafted web site. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:thunderbird:6.0.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:thunderbird:1.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:thunderbird:16.0 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:thunderbird:1.5 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:thunderbird:11.0 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:thunderbird:6.0.2 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:thunderbird:0.7.1 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:thunderbird:0.7.2 + cpe:/a:mozilla:thunderbird:0.7.3 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:thunderbird:1.5.2 + cpe:/a:mozilla:thunderbird:1.0.3 + cpe:/a:mozilla:thunderbird:1.0.4 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:thunderbird:1.0.5 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:thunderbird:1.0.6 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:thunderbird:3.1.15 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:thunderbird:3.1.16 + cpe:/a:mozilla:thunderbird:3.1.17 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:thunderbird:1.0.2 + cpe:/a:mozilla:thunderbird:1.0.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:thunderbird:3.1.10 + cpe:/a:mozilla:thunderbird:1.5.1 + cpe:/a:mozilla:thunderbird:1.0.8 + cpe:/a:mozilla:thunderbird:1.0.7 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:network_security_services:3.2.1 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:network_security_services:3.3.2 + cpe:/a:mozilla:network_security_services:3.3.1 + cpe:/a:mozilla:thunderbird:3.1.14 + cpe:/a:mozilla:thunderbird:3.1.13 + cpe:/a:mozilla:thunderbird:3.1.12 + cpe:/a:mozilla:thunderbird:3.1.11 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:thunderbird:17.0.4 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:thunderbird:12.0.1 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:thunderbird:1.5.0.3 + cpe:/a:mozilla:thunderbird:1.5.0.2 + cpe:/a:mozilla:thunderbird:1.5.0.1 + cpe:/a:mozilla:thunderbird:3.0.11 + cpe:/a:mozilla:thunderbird:3.0.10 + cpe:/a:mozilla:thunderbird:13.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:thunderbird:14.0 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:network_security_services:3.7.1 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:thunderbird:7.0 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:thunderbird:8.0 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:network_security_services:3.15 + cpe:/a:mozilla:network_security_services:3.14 + cpe:/a:mozilla:network_security_services:3.12 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:thunderbird:0.2 + cpe:/a:mozilla:thunderbird:0.3 + cpe:/a:mozilla:thunderbird:0.4 + cpe:/a:mozilla:thunderbird:0.5 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:thunderbird:0.1 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:thunderbird:1.7.1 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:thunderbird:1.7.3 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:thunderbird:0.9 + cpe:/a:mozilla:thunderbird:0.8 + cpe:/a:mozilla:thunderbird:0.7 + cpe:/a:mozilla:thunderbird:0.6 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:thunderbird:15.0.1 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:thunderbird:9.0 + cpe:/a:mozilla:thunderbird:6.0 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:network_security_services:3.15.3 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:network_security_services:3.15.2 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:network_security_services:3.15.1 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:thunderbird:12.0 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:thunderbird:15.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:thunderbird:24.0.1 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:thunderbird:2.0.0.5 + cpe:/a:mozilla:thunderbird:2.0.0.4 + cpe:/a:mozilla:thunderbird:2.0.0.7 + cpe:/a:mozilla:thunderbird:2.0.0.6 + cpe:/a:mozilla:thunderbird:11.0.1 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:network_security_services:3.11.3 + cpe:/a:mozilla:network_security_services:3.11.4 + cpe:/a:mozilla:network_security_services:3.11.5 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:network_security_services:3.6.1 + cpe:/a:mozilla:network_security_services:3.14.2 + cpe:/a:mozilla:network_security_services:3.14.1 + cpe:/a:mozilla:network_security_services:3.4.1 + cpe:/a:mozilla:network_security_services:3.4.2 + cpe:/a:mozilla:thunderbird:2.0.0.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:thunderbird:2.0.0.3 + cpe:/a:mozilla:network_security_services:3.14.5 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:thunderbird:2.0.0.0 + cpe:/a:mozilla:network_security_services:3.14.4 + cpe:/a:mozilla:thunderbird:2.0.0.1 + cpe:/a:mozilla:network_security_services:3.14.3 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:thunderbird:1.5.0.9 + cpe:/a:mozilla:thunderbird:1.5.0.8 + cpe:/a:mozilla:thunderbird:1.5.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.6 + cpe:/a:mozilla:network_security_services:3.12.11 + cpe:/a:mozilla:network_security_services:3.12.10 + cpe:/a:mozilla:thunderbird:2.0.0.8 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.9 + cpe:/a:mozilla:network_security_services:3.7.3 + cpe:/a:mozilla:network_security_services:3.7.2 + cpe:/a:mozilla:thunderbird:16.0.2 + cpe:/a:mozilla:thunderbird:16.0.1 + cpe:/a:mozilla:network_security_services:3.7.7 + cpe:/a:mozilla:network_security_services:3.7.5 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:thunderbird:24.2 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:thunderbird:24.1 + cpe:/a:mozilla:thunderbird:3.0.9 + cpe:/a:mozilla:thunderbird:24.0 + cpe:/a:mozilla:thunderbird:24.1.1 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:thunderbird:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:thunderbird:5.0 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:thunderbird:3.0.4 + cpe:/a:mozilla:thunderbird:3.0.3 + cpe:/a:mozilla:thunderbird:3.0.2 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:thunderbird:3.0.1 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:thunderbird:3.1.3 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:thunderbird:3.1.2 + cpe:/a:mozilla:thunderbird:3.1.1 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:thunderbird:3.1.4 + cpe:/a:mozilla:thunderbird:3.1.5 + cpe:/a:mozilla:network_security_services:3.2 + cpe:/a:mozilla:thunderbird:3.1.6 + cpe:/a:mozilla:thunderbird:3.1.7 + cpe:/a:mozilla:thunderbird:2.0.0.18 + cpe:/a:mozilla:thunderbird:2.0.0.17 + cpe:/a:mozilla:thunderbird:2.0.0.16 + cpe:/a:mozilla:thunderbird:2.0.0.15 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:thunderbird:3.0.5 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:network_security_services:3.12.3.2 + cpe:/a:mozilla:network_security_services:3.7 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:thunderbird:3.0.6 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:network_security_services:3.6 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:thunderbird:3.0.7 + cpe:/a:mozilla:network_security_services:3.9 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:thunderbird:3.0.8 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:network_security_services:3.12.3.1 + cpe:/a:mozilla:network_security_services:3.8 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:network_security_services:3.3 + cpe:/a:mozilla:network_security_services:3.4 + cpe:/a:mozilla:network_security_services:3.5 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:thunderbird:3.0 + cpe:/a:mozilla:thunderbird:3.1 + cpe:/a:mozilla:thunderbird:1.0.5:beta + cpe:/a:mozilla:thunderbird:2.0.0.21 + cpe:/a:mozilla:thunderbird:2.0.0.20 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:thunderbird:2.0.0.11 + cpe:/a:mozilla:thunderbird:2.0.0.12 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:thunderbird:2.0.0.13 + cpe:/a:mozilla:thunderbird:2.0.0.14 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:network_security_services:3.11.2 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:thunderbird:3.1.9 + cpe:/a:mozilla:thunderbird:3.1.8 + cpe:/a:mozilla:thunderbird:2.0.0.19 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:thunderbird:2.0.0.22 + cpe:/a:mozilla:thunderbird:2.0.0.23 + cpe:/a:mozilla:network_security_services:3.12.9 + cpe:/a:mozilla:network_security_services:3.12.8 + cpe:/a:mozilla:network_security_services:3.12.7 + cpe:/a:mozilla:network_security_services:3.12.6 + cpe:/a:mozilla:network_security_services:3.12.5 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:network_security_services:3.12.4 + cpe:/a:mozilla:network_security_services:3.12.3 + cpe:/a:mozilla:network_security_services:3.12.2 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:thunderbird:1.5.0.10 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:thunderbird:1.5.0.13 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:thunderbird:7.0.1 + cpe:/a:mozilla:thunderbird:1.5.0.14 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.11 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:thunderbird:1.5.0.12 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:thunderbird:13.0.1 + cpe:/a:mozilla:thunderbird:2.0 + cpe:/a:mozilla:thunderbird:9.0.1 + cpe:/a:mozilla:thunderbird:10.0 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:thunderbird:10.0.3 + cpe:/a:mozilla:thunderbird:10.0.4 + cpe:/a:mozilla:thunderbird:10.0.1 + cpe:/a:mozilla:thunderbird:10.0.2 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:network_security_services:3.12.1 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1490 + 2014-02-06T00:44:25.097-05:00 + 2014-04-01T02:28:53.203-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-02-06T14:28:44.307-05:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=930874 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=930857 + + + CONFIRM + https://8pecxstudios.com/?page_id=44080 + + + UBUNTU + USN-2119-1 + + + UBUNTU + USN-2102-2 + + + UBUNTU + USN-2102-1 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-12.html + + + DEBIAN + DSA-2858 + + + SECUNIA + 56706 + + + SUSE + openSUSE-SU-2014:0419 + + + SUSE + SUSE-SU-2014:0248 + + + SUSE + openSUSE-SU-2014:0213 + + + SUSE + openSUSE-SU-2014:0212 + + + FEDORA + FEDORA-2014-2083 + + + FEDORA + FEDORA-2014-2041 + + Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors involving a resumption handshake that triggers incorrect replacement of a session ticket. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:thunderbird:6.0.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:thunderbird:1.0 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:thunderbird:16.0 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:thunderbird:1.5 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:thunderbird:11.0 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:thunderbird:6.0.2 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:thunderbird:0.7.1 + cpe:/a:mozilla:thunderbird:0.7.2 + cpe:/a:mozilla:thunderbird:0.7.3 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:thunderbird:1.0.3 + cpe:/a:mozilla:thunderbird:1.5.2 + cpe:/a:mozilla:thunderbird:1.0.4 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:thunderbird:1.0.5 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:thunderbird:1.0.6 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:thunderbird:3.1.15 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:thunderbird:3.1.16 + cpe:/a:mozilla:thunderbird:3.1.17 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:thunderbird:1.0.2 + cpe:/a:mozilla:thunderbird:1.0.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:thunderbird:3.1.10 + cpe:/a:mozilla:thunderbird:1.5.1 + cpe:/a:mozilla:thunderbird:1.0.8 + cpe:/a:mozilla:thunderbird:1.0.7 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:network_security_services:3.2.1 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:network_security_services:3.3.2 + cpe:/a:mozilla:network_security_services:3.3.1 + cpe:/a:mozilla:thunderbird:3.1.14 + cpe:/a:mozilla:thunderbird:3.1.13 + cpe:/a:mozilla:thunderbird:3.1.12 + cpe:/a:mozilla:thunderbird:3.1.11 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:thunderbird:17.0.4 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:thunderbird:12.0.1 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:thunderbird:1.5.0.3 + cpe:/a:mozilla:thunderbird:1.5.0.2 + cpe:/a:mozilla:thunderbird:1.5.0.1 + cpe:/a:mozilla:thunderbird:3.0.11 + cpe:/a:mozilla:thunderbird:3.0.10 + cpe:/a:mozilla:thunderbird:13.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:thunderbird:14.0 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:network_security_services:3.7.1 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:thunderbird:7.0 + cpe:/a:mozilla:thunderbird:8.0 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:network_security_services:3.15 + cpe:/a:mozilla:network_security_services:3.14 + cpe:/a:mozilla:network_security_services:3.12 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:thunderbird:0.2 + cpe:/a:mozilla:thunderbird:0.3 + cpe:/a:mozilla:thunderbird:0.4 + cpe:/a:mozilla:thunderbird:0.5 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:thunderbird:0.1 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:thunderbird:1.7.1 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:thunderbird:1.7.3 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:thunderbird:0.9 + cpe:/a:mozilla:thunderbird:0.8 + cpe:/a:mozilla:thunderbird:0.7 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:thunderbird:0.6 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:thunderbird:15.0.1 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:thunderbird:9.0 + cpe:/a:mozilla:thunderbird:6.0 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:network_security_services:3.15.3 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:network_security_services:3.15.2 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:network_security_services:3.15.1 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:thunderbird:12.0 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:thunderbird:15.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:thunderbird:24.0.1 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:thunderbird:2.0.0.5 + cpe:/a:mozilla:thunderbird:2.0.0.4 + cpe:/a:mozilla:thunderbird:2.0.0.7 + cpe:/a:mozilla:thunderbird:2.0.0.6 + cpe:/a:mozilla:thunderbird:11.0.1 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:network_security_services:3.11.3 + cpe:/a:mozilla:network_security_services:3.11.4 + cpe:/a:mozilla:network_security_services:3.11.5 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:network_security_services:3.6.1 + cpe:/a:mozilla:network_security_services:3.14.2 + cpe:/a:mozilla:network_security_services:3.14.1 + cpe:/a:mozilla:network_security_services:3.4.1 + cpe:/a:mozilla:network_security_services:3.4.2 + cpe:/a:mozilla:thunderbird:2.0.0.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:thunderbird:2.0.0.3 + cpe:/a:mozilla:network_security_services:3.14.5 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:thunderbird:2.0.0.0 + cpe:/a:mozilla:network_security_services:3.14.4 + cpe:/a:mozilla:thunderbird:2.0.0.1 + cpe:/a:mozilla:network_security_services:3.14.3 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:thunderbird:1.5.0.9 + cpe:/a:mozilla:thunderbird:1.5.0.8 + cpe:/a:mozilla:thunderbird:1.5.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.6 + cpe:/a:mozilla:network_security_services:3.12.11 + cpe:/a:mozilla:network_security_services:3.12.10 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.8 + cpe:/a:mozilla:thunderbird:2.0.0.9 + cpe:/a:mozilla:network_security_services:3.7.3 + cpe:/a:mozilla:network_security_services:3.7.2 + cpe:/a:mozilla:thunderbird:16.0.2 + cpe:/a:mozilla:thunderbird:16.0.1 + cpe:/a:mozilla:network_security_services:3.7.7 + cpe:/a:mozilla:network_security_services:3.7.5 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:thunderbird:24.2 + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:thunderbird:24.1 + cpe:/a:mozilla:thunderbird:3.0.9 + cpe:/a:mozilla:thunderbird:24.0 + cpe:/a:mozilla:thunderbird:24.1.1 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:thunderbird:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:thunderbird:5.0 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:thunderbird:3.0.4 + cpe:/a:mozilla:thunderbird:3.0.3 + cpe:/a:mozilla:thunderbird:3.0.2 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:thunderbird:3.0.1 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:thunderbird:3.1.3 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:thunderbird:3.1.2 + cpe:/a:mozilla:thunderbird:3.1.1 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:thunderbird:3.1.4 + cpe:/a:mozilla:thunderbird:3.1.5 + cpe:/a:mozilla:network_security_services:3.2 + cpe:/a:mozilla:thunderbird:3.1.6 + cpe:/a:mozilla:thunderbird:3.1.7 + cpe:/a:mozilla:thunderbird:2.0.0.18 + cpe:/a:mozilla:thunderbird:2.0.0.17 + cpe:/a:mozilla:thunderbird:2.0.0.16 + cpe:/a:mozilla:thunderbird:2.0.0.15 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:thunderbird:3.0.5 + cpe:/a:mozilla:network_security_services:3.12.3.2 + cpe:/a:mozilla:network_security_services:3.7 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:thunderbird:3.0.6 + cpe:/a:mozilla:network_security_services:3.6 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:thunderbird:3.0.7 + cpe:/a:mozilla:network_security_services:3.9 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:thunderbird:3.0.8 + cpe:/a:mozilla:network_security_services:3.12.3.1 + cpe:/a:mozilla:network_security_services:3.8 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:network_security_services:3.3 + cpe:/a:mozilla:network_security_services:3.4 + cpe:/a:mozilla:network_security_services:3.5 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:thunderbird:3.0 + cpe:/a:mozilla:thunderbird:3.1 + cpe:/a:mozilla:thunderbird:1.0.5:beta + cpe:/a:mozilla:thunderbird:2.0.0.21 + cpe:/a:mozilla:thunderbird:2.0.0.20 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:thunderbird:2.0.0.11 + cpe:/a:mozilla:thunderbird:2.0.0.12 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:thunderbird:2.0.0.13 + cpe:/a:mozilla:thunderbird:2.0.0.14 + cpe:/a:mozilla:network_security_services:3.11.2 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:thunderbird:3.1.9 + cpe:/a:mozilla:thunderbird:3.1.8 + cpe:/a:mozilla:thunderbird:2.0.0.19 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:thunderbird:2.0.0.22 + cpe:/a:mozilla:thunderbird:2.0.0.23 + cpe:/a:mozilla:network_security_services:3.12.9 + cpe:/a:mozilla:network_security_services:3.12.8 + cpe:/a:mozilla:network_security_services:3.12.7 + cpe:/a:mozilla:network_security_services:3.12.6 + cpe:/a:mozilla:network_security_services:3.12.5 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:network_security_services:3.12.4 + cpe:/a:mozilla:network_security_services:3.12.3 + cpe:/a:mozilla:network_security_services:3.12.2 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:thunderbird:1.5.0.10 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.13 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:thunderbird:7.0.1 + cpe:/a:mozilla:thunderbird:1.5.0.14 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:thunderbird:1.5.0.11 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.12 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:thunderbird:13.0.1 + cpe:/a:mozilla:thunderbird:2.0 + cpe:/a:mozilla:thunderbird:9.0.1 + cpe:/a:mozilla:thunderbird:10.0 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:thunderbird:10.0.3 + cpe:/a:mozilla:thunderbird:10.0.4 + cpe:/a:mozilla:thunderbird:10.0.1 + cpe:/a:mozilla:thunderbird:10.0.2 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:network_security_services:3.12.1 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1491 + 2014-02-06T00:44:25.127-05:00 + 2014-04-01T02:28:53.280-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-06T14:30:02.400-05:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=934545 + + + UBUNTU + USN-2119-1 + + + UBUNTU + USN-2102-2 + + + UBUNTU + USN-2102-1 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-12.html + + + DEBIAN + DSA-2858 + + + SUSE + openSUSE-SU-2014:0419 + + + SUSE + SUSE-SU-2014:0248 + + + SUSE + openSUSE-SU-2014:0213 + + + SUSE + openSUSE-SU-2014:0212 + + + FEDORA + FEDORA-2014-2083 + + + FEDORA + FEDORA-2014-2041 + + Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, does not properly restrict public values in Diffie-Hellman key exchanges, which makes it easier for remote attackers to bypass cryptographic protection mechanisms in ticket handling by leveraging use of a certain value. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:network_security_services:3.12.9 + cpe:/a:mozilla:network_security_services:3.12.8 + cpe:/a:mozilla:network_security_services:3.15.3.1 + cpe:/a:mozilla:network_security_services:3.12.7 + cpe:/a:mozilla:network_security_services:3.12.6 + cpe:/a:mozilla:network_security_services:3.12.5 + cpe:/a:mozilla:network_security_services:3.12.4 + cpe:/a:mozilla:network_security_services:3.12.3 + cpe:/a:mozilla:network_security_services:3.12.2 + cpe:/a:mozilla:network_security_services:3.11.3 + cpe:/a:mozilla:network_security_services:3.11.4 + cpe:/a:mozilla:network_security_services:3.11.5 + cpe:/a:mozilla:network_security_services:3.15.5 + cpe:/a:mozilla:network_security_services:3.15.4 + cpe:/a:mozilla:network_security_services:3.2 + cpe:/a:mozilla:network_security_services:3.15.3 + cpe:/a:mozilla:network_security_services:3.15.2 + cpe:/a:mozilla:network_security_services:3.12.3.2 + cpe:/a:mozilla:network_security_services:3.15.1 + cpe:/a:mozilla:network_security_services:3.7 + cpe:/a:mozilla:network_security_services:3.6 + cpe:/a:mozilla:network_security_services:3.9 + cpe:/a:mozilla:network_security_services:3.8 + cpe:/a:mozilla:network_security_services:3.12.3.1 + cpe:/a:mozilla:network_security_services:3.6.1 + cpe:/a:mozilla:network_security_services:3.14.2 + cpe:/a:mozilla:network_security_services:3.14.1 + cpe:/a:mozilla:network_security_services:3.3 + cpe:/a:mozilla:network_security_services:3.4 + cpe:/a:mozilla:network_security_services:3.5 + cpe:/a:mozilla:network_security_services:3.4.1 + cpe:/a:mozilla:network_security_services:3.4.2 + cpe:/a:mozilla:network_security_services:3.14.5 + cpe:/a:mozilla:network_security_services:3.14.4 + cpe:/a:mozilla:network_security_services:3.14.3 + cpe:/a:mozilla:network_security_services:3.2.1 + cpe:/a:mozilla:network_security_services:3.12.11 + cpe:/a:mozilla:network_security_services:3.12.10 + cpe:/a:mozilla:network_security_services:3.3.2 + cpe:/a:mozilla:network_security_services:3.3.1 + cpe:/a:mozilla:network_security_services:3.7.3 + cpe:/a:mozilla:network_security_services:3.7.2 + cpe:/a:mozilla:network_security_services:3.7.1 + cpe:/a:mozilla:network_security_services:3.7.7 + cpe:/a:mozilla:network_security_services:3.7.5 + cpe:/a:mozilla:network_security_services:3.11.2 + cpe:/a:mozilla:network_security_services:3.15 + cpe:/a:mozilla:network_security_services:3.14 + cpe:/a:mozilla:network_security_services:3.12 + cpe:/a:mozilla:network_security_services:3.12.1 + + CVE-2014-1492 + 2014-03-25T09:25:38.493-04:00 + 2014-04-19T00:47:43.410-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-25T11:21:50.383-04:00 + + + + + CONFIRM + https://hg.mozilla.org/projects/nss/rev/709d4e597979 + + + CONFIRM + https://developer.mozilla.org/en-US/docs/NSS/NSS_3.16_release_notes + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1079851 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=903885 + + + UBUNTU + USN-2159-1 + + The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:thunderbird:6.0.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:thunderbird:1.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:thunderbird:16.0 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:thunderbird:1.5 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:thunderbird:11.0 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:thunderbird:6.0.2 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:thunderbird:0.7.1 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:thunderbird:0.7.2 + cpe:/a:mozilla:thunderbird:0.7.3 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:thunderbird:1.5.2 + cpe:/a:mozilla:thunderbird:1.0.3 + cpe:/a:mozilla:thunderbird:1.0.4 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:thunderbird:1.0.5 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:thunderbird:1.0.6 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:thunderbird:3.1.15 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:thunderbird:3.1.16 + cpe:/a:mozilla:thunderbird:3.1.17 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:thunderbird:1.0.2 + cpe:/a:mozilla:thunderbird:1.0.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:thunderbird:3.1.10 + cpe:/a:mozilla:thunderbird:1.5.1 + cpe:/a:mozilla:thunderbird:1.0.8 + cpe:/a:mozilla:thunderbird:1.0.7 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:thunderbird:3.1.14 + cpe:/a:mozilla:thunderbird:3.1.13 + cpe:/a:mozilla:thunderbird:3.1.12 + cpe:/a:mozilla:thunderbird:3.1.11 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:thunderbird:17.0.4 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:thunderbird:12.0.1 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:thunderbird:1.5.0.3 + cpe:/a:mozilla:thunderbird:1.5.0.2 + cpe:/a:mozilla:thunderbird:1.5.0.1 + cpe:/a:mozilla:thunderbird:3.0.11 + cpe:/a:mozilla:thunderbird:3.0.10 + cpe:/a:mozilla:thunderbird:13.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:thunderbird:14.0 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:thunderbird:7.0 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:thunderbird:8.0 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:thunderbird:0.2 + cpe:/a:mozilla:thunderbird:0.3 + cpe:/a:mozilla:thunderbird:0.4 + cpe:/a:mozilla:thunderbird:0.5 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:thunderbird:0.1 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:thunderbird:1.7.1 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:thunderbird:1.7.3 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:thunderbird:0.9 + cpe:/a:mozilla:thunderbird:0.8 + cpe:/a:mozilla:thunderbird:0.7 + cpe:/a:mozilla:thunderbird:0.6 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:thunderbird:15.0.1 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:thunderbird:9.0 + cpe:/a:mozilla:thunderbird:6.0 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:thunderbird:12.0 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:thunderbird:15.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:thunderbird:24.0.1 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:thunderbird:2.0.0.5 + cpe:/a:mozilla:thunderbird:2.0.0.4 + cpe:/a:mozilla:thunderbird:2.0.0.7 + cpe:/a:mozilla:thunderbird:2.0.0.6 + cpe:/a:mozilla:thunderbird:11.0.1 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:thunderbird:2.0.0.2 + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:thunderbird:2.0.0.3 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:thunderbird:2.0.0.0 + cpe:/a:mozilla:thunderbird:2.0.0.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:thunderbird:1.5.0.9 + cpe:/a:mozilla:thunderbird:1.5.0.8 + cpe:/a:mozilla:thunderbird:1.5.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.6 + cpe:/a:mozilla:thunderbird:2.0.0.8 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.9 + cpe:/a:mozilla:thunderbird:16.0.2 + cpe:/a:mozilla:thunderbird:16.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:thunderbird:24.3 + cpe:/a:mozilla:thunderbird:24.2 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:thunderbird:24.1 + cpe:/a:mozilla:thunderbird:3.0.9 + cpe:/a:mozilla:firefox_esr:24.3 + cpe:/a:mozilla:thunderbird:24.0 + cpe:/a:mozilla:thunderbird:24.1.1 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:thunderbird:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:thunderbird:5.0 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:thunderbird:3.0.4 + cpe:/a:mozilla:thunderbird:3.0.3 + cpe:/a:mozilla:thunderbird:3.0.2 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:thunderbird:3.0.1 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:thunderbird:3.1.3 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:thunderbird:3.1.2 + cpe:/a:mozilla:thunderbird:3.1.1 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:thunderbird:3.1.4 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:thunderbird:3.1.5 + cpe:/a:mozilla:thunderbird:3.1.6 + cpe:/a:mozilla:thunderbird:3.1.7 + cpe:/a:mozilla:thunderbird:2.0.0.18 + cpe:/a:mozilla:thunderbird:2.0.0.17 + cpe:/a:mozilla:thunderbird:2.0.0.16 + cpe:/a:mozilla:thunderbird:2.0.0.15 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:thunderbird:3.0.5 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:thunderbird:3.0.6 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:thunderbird:3.0.7 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:thunderbird:3.0.8 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:thunderbird:3.0 + cpe:/a:mozilla:thunderbird:3.1 + cpe:/a:mozilla:thunderbird:1.0.5:beta + cpe:/a:mozilla:thunderbird:2.0.0.21 + cpe:/a:mozilla:thunderbird:2.0.0.20 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:thunderbird:2.0.0.11 + cpe:/a:mozilla:thunderbird:2.0.0.12 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:thunderbird:2.0.0.13 + cpe:/a:mozilla:thunderbird:2.0.0.14 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:thunderbird:3.1.9 + cpe:/a:mozilla:thunderbird:3.1.8 + cpe:/a:mozilla:thunderbird:2.0.0.19 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:thunderbird:2.0.0.22 + cpe:/a:mozilla:thunderbird:2.0.0.23 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:thunderbird:1.5.0.10 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:thunderbird:1.5.0.13 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:thunderbird:7.0.1 + cpe:/a:mozilla:thunderbird:1.5.0.14 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.11 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:thunderbird:1.5.0.12 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:thunderbird:13.0.1 + cpe:/a:mozilla:thunderbird:2.0 + cpe:/a:mozilla:thunderbird:9.0.1 + cpe:/a:mozilla:thunderbird:10.0 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:thunderbird:10.0.3 + cpe:/a:mozilla:thunderbird:10.0.4 + cpe:/a:mozilla:thunderbird:10.0.1 + cpe:/a:mozilla:thunderbird:10.0.2 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1493 + 2014-03-19T06:55:06.240-04:00 + 2014-04-01T02:28:53.547-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-19T15:13:45.320-04:00 + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=977538 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=967341 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=965982 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=963974 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=960145 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=958867 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=896268 + + + UBUNTU + USN-2151-1 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-15.html + + + DEBIAN + DSA-2881 + + + REDHAT + RHSA-2014:0316 + + + REDHAT + RHSA-2014:0310 + + + SUSE + openSUSE-SU-2014:0448 + + + SUSE + openSUSE-SU-2014:0419 + + + SUSE + SUSE-SU-2014:0418 + + Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:7.0 + cpe:/a:mozilla:firefox:1.5.6 + + CVE-2014-1494 + 2014-03-19T06:55:06.270-04:00 + 2014-04-01T02:28:53.703-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-19T15:18:09.403-04:00 + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=964462 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=949843 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=938626 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=938615 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=933219 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=932496 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=927579 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=909586 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=627295 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-15.html + + + SUSE + openSUSE-SU-2014:0448 + + + SUSE + openSUSE-SU-2014:0419 + + + SUSE + SUSE-SU-2014:0418 + + Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:thunderbird:6.0.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:thunderbird:1.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:thunderbird:16.0 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:thunderbird:1.5 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:thunderbird:11.0 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:thunderbird:6.0.2 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:thunderbird:0.7.1 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:thunderbird:0.7.2 + cpe:/a:mozilla:thunderbird:0.7.3 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:thunderbird:1.5.2 + cpe:/a:mozilla:thunderbird:1.0.3 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:thunderbird:1.0.4 + cpe:/a:mozilla:thunderbird:1.0.5 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:thunderbird:1.0.6 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:thunderbird:3.1.15 + cpe:/a:mozilla:thunderbird:3.1.16 + cpe:/a:mozilla:thunderbird:3.1.17 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:thunderbird:1.0.2 + cpe:/a:mozilla:thunderbird:1.0.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:thunderbird:3.1.10 + cpe:/a:mozilla:thunderbird:1.5.1 + cpe:/a:mozilla:thunderbird:1.0.8 + cpe:/a:mozilla:thunderbird:1.0.7 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:thunderbird:3.1.14 + cpe:/a:mozilla:thunderbird:3.1.13 + cpe:/a:mozilla:thunderbird:3.1.12 + cpe:/a:mozilla:thunderbird:3.1.11 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:thunderbird:17.0.4 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:thunderbird:12.0.1 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:thunderbird:1.5.0.3 + cpe:/a:mozilla:thunderbird:1.5.0.2 + cpe:/a:mozilla:thunderbird:1.5.0.1 + cpe:/a:mozilla:thunderbird:3.0.11 + cpe:/a:mozilla:thunderbird:3.0.10 + cpe:/a:mozilla:thunderbird:13.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:thunderbird:14.0 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:thunderbird:7.0 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:thunderbird:8.0 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:thunderbird:0.2 + cpe:/a:mozilla:thunderbird:0.3 + cpe:/a:mozilla:thunderbird:0.4 + cpe:/a:mozilla:thunderbird:0.5 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:thunderbird:0.1 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:thunderbird:1.7.1 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:thunderbird:1.7.3 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:thunderbird:0.9 + cpe:/a:mozilla:thunderbird:0.8 + cpe:/a:mozilla:thunderbird:0.7 + cpe:/a:mozilla:thunderbird:0.6 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:thunderbird:15.0.1 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:thunderbird:9.0 + cpe:/a:mozilla:thunderbird:6.0 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:thunderbird:12.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:thunderbird:15.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:thunderbird:24.0.1 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:thunderbird:2.0.0.5 + cpe:/a:mozilla:thunderbird:2.0.0.4 + cpe:/a:mozilla:thunderbird:2.0.0.7 + cpe:/a:mozilla:thunderbird:11.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.6 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:thunderbird:2.0.0.2 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:thunderbird:2.0.0.3 + cpe:/a:mozilla:thunderbird:2.0.0.0 + cpe:/a:mozilla:thunderbird:2.0.0.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:thunderbird:1.5.0.9 + cpe:/a:mozilla:thunderbird:1.5.0.8 + cpe:/a:mozilla:thunderbird:1.5.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.6 + cpe:/a:mozilla:thunderbird:2.0.0.8 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.9 + cpe:/a:mozilla:thunderbird:16.0.2 + cpe:/a:mozilla:thunderbird:16.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:thunderbird:24.3 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:thunderbird:24.2 + cpe:/a:mozilla:firefox_esr:24.3 + cpe:/a:mozilla:thunderbird:24.1 + cpe:/a:mozilla:thunderbird:3.0.9 + cpe:/a:mozilla:thunderbird:24.0 + cpe:/a:mozilla:thunderbird:24.1.1 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:thunderbird:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:thunderbird:5.0 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:thunderbird:3.0.4 + cpe:/a:mozilla:thunderbird:3.0.3 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:thunderbird:3.0.2 + cpe:/a:mozilla:thunderbird:3.0.1 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:thunderbird:3.1.3 + cpe:/a:mozilla:thunderbird:3.1.2 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:thunderbird:3.1.1 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:thunderbird:3.1.4 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:thunderbird:3.1.5 + cpe:/a:mozilla:thunderbird:3.1.6 + cpe:/a:mozilla:thunderbird:3.1.7 + cpe:/a:mozilla:thunderbird:2.0.0.18 + cpe:/a:mozilla:thunderbird:2.0.0.17 + cpe:/a:mozilla:thunderbird:2.0.0.16 + cpe:/a:mozilla:thunderbird:2.0.0.15 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:thunderbird:3.0.5 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:thunderbird:3.0.6 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:thunderbird:3.0.7 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:thunderbird:3.0.8 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:thunderbird:3.0 + cpe:/a:mozilla:thunderbird:3.1 + cpe:/a:mozilla:thunderbird:1.0.5:beta + cpe:/a:mozilla:thunderbird:2.0.0.21 + cpe:/a:mozilla:thunderbird:2.0.0.20 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:thunderbird:2.0.0.11 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:thunderbird:2.0.0.12 + cpe:/a:mozilla:thunderbird:2.0.0.13 + cpe:/a:mozilla:thunderbird:2.0.0.14 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:thunderbird:3.1.9 + cpe:/a:mozilla:thunderbird:3.1.8 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:thunderbird:2.0.0.19 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:thunderbird:2.0.0.22 + cpe:/a:mozilla:thunderbird:2.0.0.23 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:thunderbird:1.5.0.10 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:thunderbird:1.5.0.13 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:thunderbird:7.0.1 + cpe:/a:mozilla:thunderbird:1.5.0.14 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.11 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:thunderbird:1.5.0.12 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:thunderbird:13.0.1 + cpe:/a:mozilla:thunderbird:2.0 + cpe:/a:mozilla:thunderbird:9.0.1 + cpe:/a:mozilla:thunderbird:10.0 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:thunderbird:10.0.3 + cpe:/a:mozilla:thunderbird:10.0.4 + cpe:/a:mozilla:thunderbird:10.0.1 + cpe:/a:mozilla:thunderbird:10.0.2 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1496 + 2014-03-19T06:55:06.303-04:00 + 2014-04-01T02:28:53.890-04:00 + + + 6.9 + LOCAL + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-19T15:21:22.393-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=925747 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-16.html + + + SUSE + SUSE-SU-2014:0418 + + Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 might allow local users to gain privileges by modifying the extracted Mar contents during an update. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:thunderbird:6.0.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:thunderbird:1.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:thunderbird:16.0 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:thunderbird:1.5 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:thunderbird:11.0 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:thunderbird:6.0.2 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:thunderbird:0.7.1 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:thunderbird:0.7.2 + cpe:/a:mozilla:thunderbird:0.7.3 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:thunderbird:1.5.2 + cpe:/a:mozilla:thunderbird:1.0.3 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:thunderbird:1.0.4 + cpe:/a:mozilla:thunderbird:1.0.5 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:thunderbird:1.0.6 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:thunderbird:3.1.15 + cpe:/a:mozilla:thunderbird:3.1.16 + cpe:/a:mozilla:thunderbird:3.1.17 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:thunderbird:1.0.2 + cpe:/a:mozilla:thunderbird:1.0.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:thunderbird:3.1.10 + cpe:/a:mozilla:thunderbird:1.5.1 + cpe:/a:mozilla:thunderbird:1.0.8 + cpe:/a:mozilla:thunderbird:1.0.7 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:thunderbird:3.1.14 + cpe:/a:mozilla:thunderbird:3.1.13 + cpe:/a:mozilla:thunderbird:3.1.12 + cpe:/a:mozilla:thunderbird:3.1.11 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:thunderbird:17.0.4 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:thunderbird:12.0.1 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:thunderbird:1.5.0.3 + cpe:/a:mozilla:thunderbird:1.5.0.2 + cpe:/a:mozilla:thunderbird:1.5.0.1 + cpe:/a:mozilla:thunderbird:3.0.11 + cpe:/a:mozilla:thunderbird:3.0.10 + cpe:/a:mozilla:thunderbird:13.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:thunderbird:14.0 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:thunderbird:7.0 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:thunderbird:8.0 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:thunderbird:0.2 + cpe:/a:mozilla:thunderbird:0.3 + cpe:/a:mozilla:thunderbird:0.4 + cpe:/a:mozilla:thunderbird:0.5 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:thunderbird:0.1 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:thunderbird:1.7.1 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:thunderbird:1.7.3 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:thunderbird:0.9 + cpe:/a:mozilla:thunderbird:0.8 + cpe:/a:mozilla:thunderbird:0.7 + cpe:/a:mozilla:thunderbird:0.6 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:thunderbird:15.0.1 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:thunderbird:9.0 + cpe:/a:mozilla:thunderbird:6.0 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:thunderbird:12.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:thunderbird:15.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:thunderbird:24.0.1 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:thunderbird:2.0.0.5 + cpe:/a:mozilla:thunderbird:2.0.0.4 + cpe:/a:mozilla:thunderbird:2.0.0.7 + cpe:/a:mozilla:thunderbird:11.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.6 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:thunderbird:2.0.0.2 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:thunderbird:2.0.0.3 + cpe:/a:mozilla:thunderbird:2.0.0.0 + cpe:/a:mozilla:thunderbird:2.0.0.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:thunderbird:1.5.0.9 + cpe:/a:mozilla:thunderbird:1.5.0.8 + cpe:/a:mozilla:thunderbird:1.5.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.6 + cpe:/a:mozilla:thunderbird:2.0.0.8 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.9 + cpe:/a:mozilla:thunderbird:16.0.2 + cpe:/a:mozilla:thunderbird:16.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:thunderbird:24.3 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:thunderbird:24.2 + cpe:/a:mozilla:firefox_esr:24.3 + cpe:/a:mozilla:thunderbird:24.1 + cpe:/a:mozilla:thunderbird:3.0.9 + cpe:/a:mozilla:thunderbird:24.0 + cpe:/a:mozilla:thunderbird:24.1.1 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:thunderbird:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:thunderbird:5.0 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:thunderbird:3.0.4 + cpe:/a:mozilla:thunderbird:3.0.3 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:thunderbird:3.0.2 + cpe:/a:mozilla:thunderbird:3.0.1 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:thunderbird:3.1.3 + cpe:/a:mozilla:thunderbird:3.1.2 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:thunderbird:3.1.1 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:thunderbird:3.1.4 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:thunderbird:3.1.5 + cpe:/a:mozilla:thunderbird:3.1.6 + cpe:/a:mozilla:thunderbird:3.1.7 + cpe:/a:mozilla:thunderbird:2.0.0.18 + cpe:/a:mozilla:thunderbird:2.0.0.17 + cpe:/a:mozilla:thunderbird:2.0.0.16 + cpe:/a:mozilla:thunderbird:2.0.0.15 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:thunderbird:3.0.5 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:thunderbird:3.0.6 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:thunderbird:3.0.7 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:thunderbird:3.0.8 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:thunderbird:3.0 + cpe:/a:mozilla:thunderbird:3.1 + cpe:/a:mozilla:thunderbird:1.0.5:beta + cpe:/a:mozilla:thunderbird:2.0.0.21 + cpe:/a:mozilla:thunderbird:2.0.0.20 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:thunderbird:2.0.0.11 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:thunderbird:2.0.0.12 + cpe:/a:mozilla:thunderbird:2.0.0.13 + cpe:/a:mozilla:thunderbird:2.0.0.14 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:thunderbird:3.1.9 + cpe:/a:mozilla:thunderbird:3.1.8 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:thunderbird:2.0.0.19 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:thunderbird:2.0.0.22 + cpe:/a:mozilla:thunderbird:2.0.0.23 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:thunderbird:1.5.0.10 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:thunderbird:1.5.0.13 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:thunderbird:7.0.1 + cpe:/a:mozilla:thunderbird:1.5.0.14 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.11 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:thunderbird:1.5.0.12 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:thunderbird:13.0.1 + cpe:/a:mozilla:thunderbird:2.0 + cpe:/a:mozilla:thunderbird:9.0.1 + cpe:/a:mozilla:thunderbird:10.0 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:thunderbird:10.0.3 + cpe:/a:mozilla:thunderbird:10.0.4 + cpe:/a:mozilla:thunderbird:10.0.1 + cpe:/a:mozilla:thunderbird:10.0.2 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1497 + 2014-03-19T06:55:06.333-04:00 + 2014-04-01T02:28:54.063-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-19T15:25:43.993-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=966311 + + + UBUNTU + USN-2151-1 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-17.html + + + DEBIAN + DSA-2881 + + + REDHAT + RHSA-2014:0316 + + + REDHAT + RHSA-2014:0310 + + + SUSE + openSUSE-SU-2014:0448 + + + SUSE + openSUSE-SU-2014:0419 + + + SUSE + SUSE-SU-2014:0418 + + The mozilla::WaveReader::DecodeAudioData function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information from process heap memory, cause a denial of service (out-of-bounds read and application crash), or possibly have unspecified other impact via a crafted WAV file. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:7.0 + cpe:/a:mozilla:firefox:1.5.6 + + CVE-2014-1498 + 2014-03-19T06:55:06.350-04:00 + 2014-04-01T02:28:54.250-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-03-19T15:34:22.117-04:00 + + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=935618 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-18.html + + + SUSE + openSUSE-SU-2014:0448 + + + SUSE + openSUSE-SU-2014:0419 + + + SUSE + SUSE-SU-2014:0418 + + The crypto.generateCRMFRequest method in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does not properly validate a certain key type, which allows remote attackers to cause a denial of service (application crash) via vectors that trigger generation of a key that supports the Elliptic Curve ec-dual-use algorithm. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1499 + 2014-03-19T06:55:06.380-04:00 + 2014-04-01T02:28:54.437-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-19T15:42:42.033-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=961512 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-19.html + + + SUSE + openSUSE-SU-2014:0448 + + + SUSE + openSUSE-SU-2014:0419 + + + SUSE + SUSE-SU-2014:0418 + + Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to spoof the domain name in the WebRTC (1) camera or (2) microphone permission prompt by triggering navigation at a certain time during generation of this prompt. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:7.0 + cpe:/a:mozilla:firefox:1.5.6 + + CVE-2014-1500 + 2014-03-19T06:55:06.397-04:00 + 2014-04-01T02:28:54.623-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-03-19T15:48:40.887-04:00 + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=956524 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-20.html + + + SUSE + openSUSE-SU-2014:0448 + + + SUSE + openSUSE-SU-2014:0419 + + + SUSE + SUSE-SU-2014:0418 + + Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to cause a denial of service (resource consumption and application hang) via onbeforeunload events that trigger background JavaScript execution. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1501 + 2014-03-19T06:55:06.427-04:00 + 2014-04-01T02:28:54.797-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-19T15:51:48.907-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=960135 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-21.html + + + SUSE + SUSE-SU-2014:0418 + + Mozilla Firefox before 28.0 on Android allows remote attackers to bypass the Same Origin Policy and access arbitrary file: URLs via vectors involving the "Open Link in New Tab" menu selection. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:7.0 + cpe:/a:mozilla:firefox:1.5.6 + + CVE-2014-1502 + 2014-03-19T06:55:06.443-04:00 + 2014-04-01T02:28:54.983-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-19T15:55:27.927-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=972622 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-22.html + + + SUSE + openSUSE-SU-2014:0448 + + + SUSE + openSUSE-SU-2014:0419 + + + SUSE + SUSE-SU-2014:0418 + + The (1) WebGL.compressedTexImage2D and (2) WebGL.compressedTexSubImage2D functions in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to bypass the Same Origin Policy and render content in a different domain via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1504 + 2014-03-19T06:55:06.473-04:00 + 2014-04-01T02:28:55.157-04:00 + + + 2.6 + NETWORK + HIGH + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-19T15:58:53.653-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=911547 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-23.html + + + SUSE + openSUSE-SU-2014:0448 + + + SUSE + openSUSE-SU-2014:0419 + + + SUSE + SUSE-SU-2014:0418 + + The session-restore feature in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does not consider the Content Security Policy of a data: URL, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted document that is accessed after a browser restart. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:thunderbird:6.0.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:thunderbird:1.0 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:thunderbird:16.0 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:thunderbird:1.5 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:thunderbird:11.0 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:thunderbird:6.0.2 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:thunderbird:0.7.1 + cpe:/a:mozilla:thunderbird:0.7.2 + cpe:/a:mozilla:thunderbird:0.7.3 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:thunderbird:1.0.3 + cpe:/a:mozilla:thunderbird:1.5.2 + cpe:/a:mozilla:thunderbird:1.0.4 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:thunderbird:1.0.5 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:thunderbird:1.0.6 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:thunderbird:3.1.15 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:thunderbird:3.1.16 + cpe:/a:mozilla:thunderbird:3.1.17 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:thunderbird:1.0.2 + cpe:/a:mozilla:thunderbird:1.0.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:thunderbird:3.1.10 + cpe:/a:mozilla:thunderbird:1.5.1 + cpe:/a:mozilla:thunderbird:1.0.8 + cpe:/a:mozilla:thunderbird:1.0.7 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:thunderbird:3.1.14 + cpe:/a:mozilla:thunderbird:3.1.13 + cpe:/a:mozilla:thunderbird:3.1.12 + cpe:/a:mozilla:thunderbird:3.1.11 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:thunderbird:17.0.4 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:thunderbird:12.0.1 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:thunderbird:1.5.0.3 + cpe:/a:mozilla:thunderbird:1.5.0.2 + cpe:/a:mozilla:thunderbird:1.5.0.1 + cpe:/a:mozilla:thunderbird:3.0.11 + cpe:/a:mozilla:thunderbird:3.0.10 + cpe:/a:mozilla:thunderbird:13.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:thunderbird:14.0 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:thunderbird:7.0 + cpe:/a:mozilla:thunderbird:8.0 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:thunderbird:0.2 + cpe:/a:mozilla:thunderbird:0.3 + cpe:/a:mozilla:thunderbird:0.4 + cpe:/a:mozilla:thunderbird:0.5 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:thunderbird:0.1 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:thunderbird:1.7.1 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:thunderbird:1.7.3 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:thunderbird:0.9 + cpe:/a:mozilla:thunderbird:0.8 + cpe:/a:mozilla:thunderbird:0.7 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:thunderbird:0.6 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:thunderbird:15.0.1 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:thunderbird:9.0 + cpe:/a:mozilla:thunderbird:6.0 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:thunderbird:12.0 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:thunderbird:15.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:thunderbird:24.0.1 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:thunderbird:2.0.0.5 + cpe:/a:mozilla:thunderbird:2.0.0.4 + cpe:/a:mozilla:thunderbird:2.0.0.7 + cpe:/a:mozilla:thunderbird:2.0.0.6 + cpe:/a:mozilla:thunderbird:11.0.1 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:thunderbird:2.0.0.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:thunderbird:2.0.0.3 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:thunderbird:2.0.0.0 + cpe:/a:mozilla:thunderbird:2.0.0.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:thunderbird:1.5.0.9 + cpe:/a:mozilla:thunderbird:1.5.0.8 + cpe:/a:mozilla:thunderbird:1.5.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.6 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.8 + cpe:/a:mozilla:thunderbird:2.0.0.9 + cpe:/a:mozilla:thunderbird:16.0.2 + cpe:/a:mozilla:thunderbird:16.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:thunderbird:24.3 + cpe:/a:mozilla:thunderbird:24.2 + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:thunderbird:24.1 + cpe:/a:mozilla:thunderbird:3.0.9 + cpe:/a:mozilla:firefox_esr:24.3 + cpe:/a:mozilla:thunderbird:24.0 + cpe:/a:mozilla:thunderbird:24.1.1 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:thunderbird:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:thunderbird:5.0 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:thunderbird:3.0.4 + cpe:/a:mozilla:thunderbird:3.0.3 + cpe:/a:mozilla:thunderbird:3.0.2 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:thunderbird:3.0.1 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:thunderbird:3.1.3 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:thunderbird:3.1.2 + cpe:/a:mozilla:thunderbird:3.1.1 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:thunderbird:3.1.4 + cpe:/a:mozilla:thunderbird:3.1.5 + cpe:/a:mozilla:thunderbird:3.1.6 + cpe:/a:mozilla:thunderbird:3.1.7 + cpe:/a:mozilla:thunderbird:2.0.0.18 + cpe:/a:mozilla:thunderbird:2.0.0.17 + cpe:/a:mozilla:thunderbird:2.0.0.16 + cpe:/a:mozilla:thunderbird:2.0.0.15 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:thunderbird:3.0.5 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:thunderbird:3.0.6 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:thunderbird:3.0.7 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:thunderbird:3.0.8 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:thunderbird:3.0 + cpe:/a:mozilla:thunderbird:3.1 + cpe:/a:mozilla:thunderbird:1.0.5:beta + cpe:/a:mozilla:thunderbird:2.0.0.21 + cpe:/a:mozilla:thunderbird:2.0.0.20 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:thunderbird:2.0.0.11 + cpe:/a:mozilla:thunderbird:2.0.0.12 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:thunderbird:2.0.0.13 + cpe:/a:mozilla:thunderbird:2.0.0.14 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:thunderbird:3.1.9 + cpe:/a:mozilla:thunderbird:3.1.8 + cpe:/a:mozilla:thunderbird:2.0.0.19 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:thunderbird:2.0.0.22 + cpe:/a:mozilla:thunderbird:2.0.0.23 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:thunderbird:1.5.0.10 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:thunderbird:1.5.0.13 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:thunderbird:7.0.1 + cpe:/a:mozilla:thunderbird:1.5.0.14 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.11 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:thunderbird:1.5.0.12 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:thunderbird:13.0.1 + cpe:/a:mozilla:thunderbird:2.0 + cpe:/a:mozilla:thunderbird:9.0.1 + cpe:/a:mozilla:thunderbird:10.0 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:thunderbird:10.0.3 + cpe:/a:mozilla:thunderbird:10.0.4 + cpe:/a:mozilla:thunderbird:10.0.1 + cpe:/a:mozilla:thunderbird:10.0.2 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1505 + 2014-03-19T06:55:06.490-04:00 + 2014-04-01T02:28:55.343-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-19T16:03:47.800-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=941887 + + + UBUNTU + USN-2151-1 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-28.html + + + DEBIAN + DSA-2881 + + + REDHAT + RHSA-2014:0316 + + + REDHAT + RHSA-2014:0310 + + + SUSE + openSUSE-SU-2014:0448 + + + SUSE + openSUSE-SU-2014:0419 + + + SUSE + SUSE-SU-2014:0418 + + The SVG filter implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive displacement-correlation information, and possibly bypass the Same Origin Policy and read text from a different domain, via a timing attack involving feDisplacementMap elements, a related issue to CVE-2013-1693. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1506 + 2014-03-19T06:55:06.520-04:00 + 2014-04-01T02:28:55.530-04:00 + + + 6.4 + NETWORK + LOW + NONE + PARTIAL + NONE + PARTIAL + http://nvd.nist.gov + 2014-03-19T16:19:35.213-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=944374 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-24.html + + + BUGTRAQ + 20140326 Firefox for Android Profile Directory Derandomization and Data Exfiltration (CVE-2014-1484, CVE-2014-1506, CVE-2014-1515, CVE-2014-1516) + + Directory traversal vulnerability in Android Crash Reporter in Mozilla Firefox before 28.0 on Android allows attackers to trigger the transmission of local files to arbitrary servers, or cause a denial of service (application crash), via a crafted application that specifies Android Crash Reporter arguments. + + + + + + + + + cpe:/o:mozilla:firefoxos:1.2 + + CVE-2014-1507 + 2014-03-19T06:55:06.553-04:00 + 2014-03-19T16:55:28.143-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-19T16:55:28.097-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=940684 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-25.html + + Directory traversal vulnerability in the DeviceStorage API in Mozilla FirefoxOS before 1.2.2 allows attackers to bypass the media sandbox protection mechanism, and read or modify arbitrary files, via a crafted application that uses a relative pathname for a DeviceStorageFile object. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:thunderbird:6.0.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:thunderbird:1.0 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:thunderbird:16.0 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:thunderbird:1.5 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:thunderbird:11.0 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:thunderbird:6.0.2 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:thunderbird:0.7.1 + cpe:/a:mozilla:thunderbird:0.7.2 + cpe:/a:mozilla:thunderbird:0.7.3 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:thunderbird:1.0.3 + cpe:/a:mozilla:thunderbird:1.5.2 + cpe:/a:mozilla:thunderbird:1.0.4 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:thunderbird:1.0.5 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:thunderbird:1.0.6 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:thunderbird:3.1.15 + cpe:/a:mozilla:thunderbird:3.1.16 + cpe:/a:mozilla:thunderbird:3.1.17 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:thunderbird:1.0.2 + cpe:/a:mozilla:thunderbird:1.0.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:thunderbird:3.1.10 + cpe:/a:mozilla:thunderbird:1.5.1 + cpe:/a:mozilla:thunderbird:1.0.8 + cpe:/a:mozilla:thunderbird:1.0.7 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:thunderbird:3.1.14 + cpe:/a:mozilla:thunderbird:3.1.13 + cpe:/a:mozilla:thunderbird:3.1.12 + cpe:/a:mozilla:thunderbird:3.1.11 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:thunderbird:17.0.4 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:thunderbird:12.0.1 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:thunderbird:1.5.0.3 + cpe:/a:mozilla:thunderbird:1.5.0.2 + cpe:/a:mozilla:thunderbird:1.5.0.1 + cpe:/a:mozilla:thunderbird:3.0.11 + cpe:/a:mozilla:thunderbird:3.0.10 + cpe:/a:mozilla:thunderbird:13.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:thunderbird:14.0 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:thunderbird:7.0 + cpe:/a:mozilla:thunderbird:8.0 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:thunderbird:0.2 + cpe:/a:mozilla:thunderbird:0.3 + cpe:/a:mozilla:thunderbird:0.4 + cpe:/a:mozilla:thunderbird:0.5 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:thunderbird:0.1 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:thunderbird:1.7.1 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:thunderbird:1.7.3 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:thunderbird:0.9 + cpe:/a:mozilla:thunderbird:0.8 + cpe:/a:mozilla:thunderbird:0.7 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:thunderbird:0.6 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:thunderbird:15.0.1 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:thunderbird:9.0 + cpe:/a:mozilla:thunderbird:6.0 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:thunderbird:12.0 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:thunderbird:15.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:thunderbird:24.0.1 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:thunderbird:2.0.0.5 + cpe:/a:mozilla:thunderbird:2.0.0.4 + cpe:/a:mozilla:thunderbird:2.0.0.7 + cpe:/a:mozilla:thunderbird:11.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.6 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:thunderbird:2.0.0.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:thunderbird:2.0.0.3 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:thunderbird:2.0.0.0 + cpe:/a:mozilla:thunderbird:2.0.0.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:thunderbird:1.5.0.9 + cpe:/a:mozilla:thunderbird:1.5.0.8 + cpe:/a:mozilla:thunderbird:1.5.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.6 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.8 + cpe:/a:mozilla:thunderbird:2.0.0.9 + cpe:/a:mozilla:thunderbird:16.0.2 + cpe:/a:mozilla:thunderbird:16.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:thunderbird:24.3 + cpe:/a:mozilla:thunderbird:24.2 + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox_esr:24.3 + cpe:/a:mozilla:thunderbird:3.0.9 + cpe:/a:mozilla:thunderbird:24.1 + cpe:/a:mozilla:thunderbird:24.0 + cpe:/a:mozilla:thunderbird:24.1.1 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:thunderbird:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:thunderbird:5.0 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:thunderbird:3.0.4 + cpe:/a:mozilla:thunderbird:3.0.3 + cpe:/a:mozilla:thunderbird:3.0.2 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:thunderbird:3.0.1 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:thunderbird:3.1.3 + cpe:/a:mozilla:thunderbird:3.1.2 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:thunderbird:3.1.1 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:thunderbird:3.1.4 + cpe:/a:mozilla:thunderbird:3.1.5 + cpe:/a:mozilla:thunderbird:3.1.6 + cpe:/a:mozilla:thunderbird:3.1.7 + cpe:/a:mozilla:thunderbird:2.0.0.18 + cpe:/a:mozilla:thunderbird:2.0.0.17 + cpe:/a:mozilla:thunderbird:2.0.0.16 + cpe:/a:mozilla:thunderbird:2.0.0.15 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:thunderbird:3.0.5 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:thunderbird:3.0.6 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:thunderbird:3.0.7 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:thunderbird:3.0.8 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:thunderbird:3.0 + cpe:/a:mozilla:thunderbird:3.1 + cpe:/a:mozilla:thunderbird:1.0.5:beta + cpe:/a:mozilla:thunderbird:2.0.0.21 + cpe:/a:mozilla:thunderbird:2.0.0.20 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:thunderbird:2.0.0.11 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:thunderbird:2.0.0.12 + cpe:/a:mozilla:thunderbird:2.0.0.13 + cpe:/a:mozilla:thunderbird:2.0.0.14 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:thunderbird:3.1.9 + cpe:/a:mozilla:thunderbird:3.1.8 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:thunderbird:2.0.0.19 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:thunderbird:2.0.0.22 + cpe:/a:mozilla:thunderbird:2.0.0.23 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:thunderbird:1.5.0.10 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:thunderbird:1.5.0.13 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.14 + cpe:/a:mozilla:thunderbird:7.0.1 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.11 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:thunderbird:1.5.0.12 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:thunderbird:13.0.1 + cpe:/a:mozilla:thunderbird:2.0 + cpe:/a:mozilla:thunderbird:9.0.1 + cpe:/a:mozilla:thunderbird:10.0 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:thunderbird:10.0.3 + cpe:/a:mozilla:thunderbird:10.0.4 + cpe:/a:mozilla:thunderbird:10.0.1 + cpe:/a:mozilla:thunderbird:10.0.2 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1508 + 2014-03-19T06:55:06.567-04:00 + 2014-04-01T02:28:55.860-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-19T16:58:52.930-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=963198 + + + UBUNTU + USN-2151-1 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-26.html + + + DEBIAN + DSA-2881 + + + REDHAT + RHSA-2014:0316 + + + REDHAT + RHSA-2014:0310 + + + SUSE + openSUSE-SU-2014:0448 + + + SUSE + openSUSE-SU-2014:0419 + + + SUSE + SUSE-SU-2014:0418 + + The libxul.so!gfxContext::Polygon function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information from process memory, cause a denial of service (out-of-bounds read and application crash), or possibly bypass the Same Origin Policy via vectors involving MathML polygon rendering. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:thunderbird:6.0.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:thunderbird:1.0 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:thunderbird:16.0 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:thunderbird:1.5 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:thunderbird:11.0 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:thunderbird:6.0.2 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:thunderbird:0.7.1 + cpe:/a:mozilla:thunderbird:0.7.2 + cpe:/a:mozilla:thunderbird:0.7.3 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:thunderbird:1.5.2 + cpe:/a:mozilla:thunderbird:1.0.3 + cpe:/a:mozilla:thunderbird:1.0.4 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:thunderbird:1.0.5 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:thunderbird:1.0.6 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:thunderbird:3.1.15 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:thunderbird:3.1.16 + cpe:/a:mozilla:thunderbird:3.1.17 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:thunderbird:1.0.2 + cpe:/a:mozilla:thunderbird:1.0.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:thunderbird:3.1.10 + cpe:/a:mozilla:thunderbird:1.5.1 + cpe:/a:mozilla:thunderbird:1.0.8 + cpe:/a:mozilla:thunderbird:1.0.7 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:thunderbird:3.1.14 + cpe:/a:mozilla:thunderbird:3.1.13 + cpe:/a:mozilla:thunderbird:3.1.12 + cpe:/a:mozilla:thunderbird:3.1.11 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:thunderbird:17.0.4 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:thunderbird:12.0.1 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:thunderbird:1.5.0.3 + cpe:/a:mozilla:thunderbird:1.5.0.2 + cpe:/a:mozilla:thunderbird:1.5.0.1 + cpe:/a:mozilla:thunderbird:3.0.11 + cpe:/a:mozilla:thunderbird:3.0.10 + cpe:/a:mozilla:thunderbird:13.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:thunderbird:14.0 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:thunderbird:7.0 + cpe:/a:mozilla:thunderbird:8.0 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:thunderbird:0.2 + cpe:/a:mozilla:thunderbird:0.3 + cpe:/a:mozilla:thunderbird:0.4 + cpe:/a:mozilla:thunderbird:0.5 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:thunderbird:0.1 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:thunderbird:1.7.1 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:thunderbird:1.7.3 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:thunderbird:0.9 + cpe:/a:mozilla:thunderbird:0.8 + cpe:/a:mozilla:thunderbird:0.7 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:thunderbird:0.6 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:thunderbird:15.0.1 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:thunderbird:9.0 + cpe:/a:mozilla:thunderbird:6.0 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:thunderbird:12.0 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:thunderbird:15.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:thunderbird:24.0.1 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:thunderbird:2.0.0.5 + cpe:/a:mozilla:thunderbird:2.0.0.4 + cpe:/a:mozilla:thunderbird:2.0.0.7 + cpe:/a:mozilla:thunderbird:11.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.6 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:thunderbird:2.0.0.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:thunderbird:2.0.0.3 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:thunderbird:2.0.0.0 + cpe:/a:mozilla:thunderbird:2.0.0.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:thunderbird:1.5.0.9 + cpe:/a:mozilla:thunderbird:1.5.0.8 + cpe:/a:mozilla:thunderbird:1.5.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.6 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.8 + cpe:/a:mozilla:thunderbird:2.0.0.9 + cpe:/a:mozilla:thunderbird:16.0.2 + cpe:/a:mozilla:thunderbird:16.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:thunderbird:24.3 + cpe:/a:mozilla:thunderbird:24.2 + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:thunderbird:24.1 + cpe:/a:mozilla:thunderbird:3.0.9 + cpe:/a:mozilla:firefox_esr:24.3 + cpe:/a:mozilla:thunderbird:24.0 + cpe:/a:mozilla:thunderbird:24.1.1 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:thunderbird:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:thunderbird:5.0 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:thunderbird:3.0.4 + cpe:/a:mozilla:thunderbird:3.0.3 + cpe:/a:mozilla:thunderbird:3.0.2 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:thunderbird:3.0.1 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:thunderbird:3.1.3 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:thunderbird:3.1.2 + cpe:/a:mozilla:thunderbird:3.1.1 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:thunderbird:3.1.4 + cpe:/a:mozilla:thunderbird:3.1.5 + cpe:/a:mozilla:thunderbird:3.1.6 + cpe:/a:mozilla:thunderbird:3.1.7 + cpe:/a:mozilla:thunderbird:2.0.0.18 + cpe:/a:mozilla:thunderbird:2.0.0.17 + cpe:/a:mozilla:thunderbird:2.0.0.16 + cpe:/a:mozilla:thunderbird:2.0.0.15 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:thunderbird:3.0.5 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:thunderbird:3.0.6 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:thunderbird:3.0.7 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:thunderbird:3.0.8 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:thunderbird:3.0 + cpe:/a:mozilla:thunderbird:3.1 + cpe:/a:mozilla:thunderbird:1.0.5:beta + cpe:/a:mozilla:thunderbird:2.0.0.21 + cpe:/a:mozilla:thunderbird:2.0.0.20 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:thunderbird:2.0.0.11 + cpe:/a:mozilla:thunderbird:2.0.0.12 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:thunderbird:2.0.0.13 + cpe:/a:mozilla:thunderbird:2.0.0.14 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:thunderbird:3.1.9 + cpe:/a:mozilla:thunderbird:3.1.8 + cpe:/a:mozilla:thunderbird:2.0.0.19 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:thunderbird:2.0.0.22 + cpe:/a:mozilla:thunderbird:2.0.0.23 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:thunderbird:1.5.0.10 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:thunderbird:1.5.0.13 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:thunderbird:7.0.1 + cpe:/a:mozilla:thunderbird:1.5.0.14 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.11 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:thunderbird:1.5.0.12 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:thunderbird:13.0.1 + cpe:/a:mozilla:thunderbird:2.0 + cpe:/a:mozilla:thunderbird:9.0.1 + cpe:/a:mozilla:thunderbird:10.0 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:thunderbird:10.0.3 + cpe:/a:mozilla:thunderbird:10.0.4 + cpe:/a:mozilla:thunderbird:10.0.1 + cpe:/a:mozilla:thunderbird:10.0.2 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1509 + 2014-03-19T06:55:06.600-04:00 + 2014-04-01T02:28:56.030-04:00 + + + 7.6 + NETWORK + HIGH + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-19T17:02:08.260-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=966021 + + + UBUNTU + USN-2151-1 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-27.html + + + REDHAT + RHSA-2014:0316 + + + REDHAT + RHSA-2014:0310 + + + SUSE + openSUSE-SU-2014:0448 + + + SUSE + openSUSE-SU-2014:0419 + + + SUSE + SUSE-SU-2014:0418 + + Buffer overflow in the _cairo_truetype_index_to_ucs4 function in cairo, as used in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25, allows remote attackers to execute arbitrary code via a crafted extension that renders fonts in a PDF document. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:thunderbird:6.0.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:thunderbird:1.0 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:thunderbird:16.0 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:thunderbird:1.5 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:thunderbird:11.0 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:thunderbird:6.0.2 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:thunderbird:0.7.1 + cpe:/a:mozilla:thunderbird:0.7.2 + cpe:/a:mozilla:thunderbird:0.7.3 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:thunderbird:1.0.3 + cpe:/a:mozilla:thunderbird:1.5.2 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:thunderbird:1.0.4 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:thunderbird:1.0.5 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:thunderbird:1.0.6 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:thunderbird:3.1.15 + cpe:/a:mozilla:thunderbird:3.1.16 + cpe:/a:mozilla:thunderbird:3.1.17 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:thunderbird:1.0.2 + cpe:/a:mozilla:thunderbird:1.0.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:thunderbird:3.1.10 + cpe:/a:mozilla:thunderbird:1.5.1 + cpe:/a:mozilla:thunderbird:1.0.8 + cpe:/a:mozilla:thunderbird:1.0.7 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:thunderbird:3.1.14 + cpe:/a:mozilla:thunderbird:3.1.13 + cpe:/a:mozilla:thunderbird:3.1.12 + cpe:/a:mozilla:thunderbird:3.1.11 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:thunderbird:17.0.4 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:thunderbird:12.0.1 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:thunderbird:1.5.0.3 + cpe:/a:mozilla:thunderbird:1.5.0.2 + cpe:/a:mozilla:thunderbird:1.5.0.1 + cpe:/a:mozilla:thunderbird:3.0.11 + cpe:/a:mozilla:thunderbird:3.0.10 + cpe:/a:mozilla:thunderbird:13.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:thunderbird:14.0 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:thunderbird:7.0 + cpe:/a:mozilla:thunderbird:8.0 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:thunderbird:0.2 + cpe:/a:mozilla:thunderbird:0.3 + cpe:/a:mozilla:thunderbird:0.4 + cpe:/a:mozilla:thunderbird:0.5 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:thunderbird:0.1 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:thunderbird:1.7.1 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:thunderbird:1.7.3 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:thunderbird:0.9 + cpe:/a:mozilla:thunderbird:0.8 + cpe:/a:mozilla:thunderbird:0.7 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:thunderbird:0.6 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:thunderbird:15.0.1 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:thunderbird:9.0 + cpe:/a:mozilla:thunderbird:6.0 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:thunderbird:12.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:thunderbird:15.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:thunderbird:24.0.1 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:thunderbird:2.0.0.5 + cpe:/a:mozilla:thunderbird:2.0.0.4 + cpe:/a:mozilla:thunderbird:2.0.0.7 + cpe:/a:mozilla:thunderbird:11.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.6 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:thunderbird:2.0.0.2 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:thunderbird:2.0.0.3 + cpe:/a:mozilla:thunderbird:2.0.0.0 + cpe:/a:mozilla:thunderbird:2.0.0.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:thunderbird:1.5.0.9 + cpe:/a:mozilla:thunderbird:1.5.0.8 + cpe:/a:mozilla:thunderbird:1.5.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.6 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.8 + cpe:/a:mozilla:thunderbird:2.0.0.9 + cpe:/a:mozilla:thunderbird:16.0.2 + cpe:/a:mozilla:thunderbird:16.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:thunderbird:24.3 + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:thunderbird:24.2 + cpe:/a:mozilla:firefox_esr:24.3 + cpe:/a:mozilla:thunderbird:3.0.9 + cpe:/a:mozilla:thunderbird:24.1 + cpe:/a:mozilla:thunderbird:24.0 + cpe:/a:mozilla:thunderbird:24.1.1 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:thunderbird:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:thunderbird:5.0 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:thunderbird:3.0.4 + cpe:/a:mozilla:thunderbird:3.0.3 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:thunderbird:3.0.2 + cpe:/a:mozilla:thunderbird:3.0.1 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:thunderbird:3.1.3 + cpe:/a:mozilla:thunderbird:3.1.2 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:thunderbird:3.1.1 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:thunderbird:3.1.4 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:thunderbird:3.1.5 + cpe:/a:mozilla:thunderbird:3.1.6 + cpe:/a:mozilla:thunderbird:3.1.7 + cpe:/a:mozilla:thunderbird:2.0.0.18 + cpe:/a:mozilla:thunderbird:2.0.0.17 + cpe:/a:mozilla:thunderbird:2.0.0.16 + cpe:/a:mozilla:thunderbird:2.0.0.15 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:thunderbird:3.0.5 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:thunderbird:3.0.6 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:thunderbird:3.0.7 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:thunderbird:3.0.8 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:thunderbird:3.0 + cpe:/a:mozilla:thunderbird:3.1 + cpe:/a:mozilla:thunderbird:1.0.5:beta + cpe:/a:mozilla:thunderbird:2.0.0.21 + cpe:/a:mozilla:thunderbird:2.0.0.20 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:thunderbird:2.0.0.11 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:thunderbird:2.0.0.12 + cpe:/a:mozilla:thunderbird:2.0.0.13 + cpe:/a:mozilla:thunderbird:2.0.0.14 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:thunderbird:3.1.9 + cpe:/a:mozilla:thunderbird:3.1.8 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:thunderbird:2.0.0.19 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:thunderbird:2.0.0.22 + cpe:/a:mozilla:thunderbird:2.0.0.23 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:thunderbird:1.5.0.10 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.13 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.14 + cpe:/a:mozilla:thunderbird:7.0.1 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:thunderbird:1.5.0.11 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.12 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:thunderbird:13.0.1 + cpe:/a:mozilla:thunderbird:2.0 + cpe:/a:mozilla:thunderbird:9.0.1 + cpe:/a:mozilla:thunderbird:10.0 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:thunderbird:10.0.3 + cpe:/a:mozilla:thunderbird:10.0.4 + cpe:/a:mozilla:thunderbird:10.0.1 + cpe:/a:mozilla:thunderbird:10.0.2 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1510 + 2014-03-19T06:55:06.613-04:00 + 2014-04-01T02:28:56.123-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-19T17:07:25.287-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=982906 + + + UBUNTU + USN-2151-1 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-29.html + + + DEBIAN + DSA-2881 + + + REDHAT + RHSA-2014:0316 + + + REDHAT + RHSA-2014:0310 + + + SUSE + openSUSE-SU-2014:0448 + + + SUSE + openSUSE-SU-2014:0419 + + + SUSE + SUSE-SU-2014:0418 + + The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary JavaScript code with chrome privileges by using an IDL fragment to trigger a window.open call. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:thunderbird:6.0.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:thunderbird:1.0 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:thunderbird:16.0 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:thunderbird:1.5 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:thunderbird:11.0 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:thunderbird:6.0.2 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:thunderbird:0.7.1 + cpe:/a:mozilla:thunderbird:0.7.2 + cpe:/a:mozilla:thunderbird:0.7.3 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:thunderbird:1.5.2 + cpe:/a:mozilla:thunderbird:1.0.3 + cpe:/a:mozilla:thunderbird:1.0.4 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:thunderbird:1.0.5 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:thunderbird:1.0.6 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:thunderbird:3.1.15 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:thunderbird:3.1.16 + cpe:/a:mozilla:thunderbird:3.1.17 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:thunderbird:1.0.2 + cpe:/a:mozilla:thunderbird:1.0.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:thunderbird:3.1.10 + cpe:/a:mozilla:thunderbird:1.5.1 + cpe:/a:mozilla:thunderbird:1.0.8 + cpe:/a:mozilla:thunderbird:1.0.7 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:thunderbird:3.1.14 + cpe:/a:mozilla:thunderbird:3.1.13 + cpe:/a:mozilla:thunderbird:3.1.12 + cpe:/a:mozilla:thunderbird:3.1.11 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:thunderbird:17.0.4 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:thunderbird:12.0.1 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:thunderbird:1.5.0.3 + cpe:/a:mozilla:thunderbird:1.5.0.2 + cpe:/a:mozilla:thunderbird:1.5.0.1 + cpe:/a:mozilla:thunderbird:3.0.11 + cpe:/a:mozilla:thunderbird:3.0.10 + cpe:/a:mozilla:thunderbird:13.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:thunderbird:14.0 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:thunderbird:7.0 + cpe:/a:mozilla:thunderbird:8.0 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:thunderbird:0.2 + cpe:/a:mozilla:thunderbird:0.3 + cpe:/a:mozilla:thunderbird:0.4 + cpe:/a:mozilla:thunderbird:0.5 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:thunderbird:0.1 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:thunderbird:1.7.1 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:thunderbird:1.7.3 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:thunderbird:0.9 + cpe:/a:mozilla:thunderbird:0.8 + cpe:/a:mozilla:thunderbird:0.7 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:thunderbird:0.6 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:thunderbird:15.0.1 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:thunderbird:9.0 + cpe:/a:mozilla:thunderbird:6.0 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:thunderbird:12.0 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:thunderbird:15.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:thunderbird:24.0.1 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:thunderbird:2.0.0.5 + cpe:/a:mozilla:thunderbird:2.0.0.4 + cpe:/a:mozilla:thunderbird:2.0.0.7 + cpe:/a:mozilla:thunderbird:11.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.6 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:thunderbird:2.0.0.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:thunderbird:2.0.0.3 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:thunderbird:2.0.0.0 + cpe:/a:mozilla:thunderbird:2.0.0.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:thunderbird:1.5.0.9 + cpe:/a:mozilla:thunderbird:1.5.0.8 + cpe:/a:mozilla:thunderbird:1.5.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.6 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.8 + cpe:/a:mozilla:thunderbird:2.0.0.9 + cpe:/a:mozilla:thunderbird:16.0.2 + cpe:/a:mozilla:thunderbird:16.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:thunderbird:24.3 + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:thunderbird:24.2 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox_esr:24.3 + cpe:/a:mozilla:thunderbird:24.1 + cpe:/a:mozilla:thunderbird:3.0.9 + cpe:/a:mozilla:thunderbird:24.0 + cpe:/a:mozilla:thunderbird:24.1.1 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:thunderbird:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:thunderbird:5.0 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:thunderbird:3.0.4 + cpe:/a:mozilla:thunderbird:3.0.3 + cpe:/a:mozilla:thunderbird:3.0.2 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:thunderbird:3.0.1 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:thunderbird:3.1.3 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:thunderbird:3.1.2 + cpe:/a:mozilla:thunderbird:3.1.1 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:thunderbird:3.1.4 + cpe:/a:mozilla:thunderbird:3.1.5 + cpe:/a:mozilla:thunderbird:3.1.6 + cpe:/a:mozilla:thunderbird:3.1.7 + cpe:/a:mozilla:thunderbird:2.0.0.18 + cpe:/a:mozilla:thunderbird:2.0.0.17 + cpe:/a:mozilla:thunderbird:2.0.0.16 + cpe:/a:mozilla:thunderbird:2.0.0.15 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:thunderbird:3.0.5 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:thunderbird:3.0.6 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:thunderbird:3.0.7 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:thunderbird:3.0.8 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:thunderbird:3.0 + cpe:/a:mozilla:thunderbird:3.1 + cpe:/a:mozilla:thunderbird:1.0.5:beta + cpe:/a:mozilla:thunderbird:2.0.0.21 + cpe:/a:mozilla:thunderbird:2.0.0.20 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:thunderbird:2.0.0.11 + cpe:/a:mozilla:thunderbird:2.0.0.12 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:thunderbird:2.0.0.13 + cpe:/a:mozilla:thunderbird:2.0.0.14 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:thunderbird:3.1.9 + cpe:/a:mozilla:thunderbird:3.1.8 + cpe:/a:mozilla:thunderbird:2.0.0.19 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:thunderbird:2.0.0.22 + cpe:/a:mozilla:thunderbird:2.0.0.23 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:thunderbird:1.5.0.10 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:thunderbird:1.5.0.13 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:thunderbird:7.0.1 + cpe:/a:mozilla:thunderbird:1.5.0.14 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.11 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:thunderbird:1.5.0.12 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:thunderbird:13.0.1 + cpe:/a:mozilla:thunderbird:2.0 + cpe:/a:mozilla:thunderbird:9.0.1 + cpe:/a:mozilla:thunderbird:10.0 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:thunderbird:10.0.3 + cpe:/a:mozilla:thunderbird:10.0.4 + cpe:/a:mozilla:thunderbird:10.0.1 + cpe:/a:mozilla:thunderbird:10.0.2 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1511 + 2014-03-19T06:55:06.647-04:00 + 2014-04-01T02:28:56.217-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-19T17:10:03.947-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=982909 + + + UBUNTU + USN-2151-1 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-29.html + + + DEBIAN + DSA-2881 + + + REDHAT + RHSA-2014:0316 + + + REDHAT + RHSA-2014:0310 + + + SUSE + openSUSE-SU-2014:0448 + + + SUSE + openSUSE-SU-2014:0419 + + + SUSE + SUSE-SU-2014:0418 + + Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to bypass the popup blocker via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:thunderbird:6.0.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:thunderbird:1.0 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:thunderbird:16.0 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:thunderbird:1.5 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:thunderbird:11.0 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:thunderbird:6.0.2 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:thunderbird:0.7.1 + cpe:/a:mozilla:thunderbird:0.7.2 + cpe:/a:mozilla:thunderbird:0.7.3 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:thunderbird:1.0.3 + cpe:/a:mozilla:thunderbird:1.5.2 + cpe:/a:mozilla:thunderbird:1.0.4 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:thunderbird:1.0.5 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:thunderbird:1.0.6 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:thunderbird:3.1.15 + cpe:/a:mozilla:thunderbird:3.1.16 + cpe:/a:mozilla:thunderbird:3.1.17 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:thunderbird:1.0.2 + cpe:/a:mozilla:thunderbird:1.0.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:thunderbird:3.1.10 + cpe:/a:mozilla:thunderbird:1.5.1 + cpe:/a:mozilla:thunderbird:1.0.8 + cpe:/a:mozilla:thunderbird:1.0.7 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:thunderbird:3.1.14 + cpe:/a:mozilla:thunderbird:3.1.13 + cpe:/a:mozilla:thunderbird:3.1.12 + cpe:/a:mozilla:thunderbird:3.1.11 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:thunderbird:17.0.4 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:thunderbird:12.0.1 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:thunderbird:1.5.0.3 + cpe:/a:mozilla:thunderbird:1.5.0.2 + cpe:/a:mozilla:thunderbird:1.5.0.1 + cpe:/a:mozilla:thunderbird:3.0.11 + cpe:/a:mozilla:thunderbird:3.0.10 + cpe:/a:mozilla:thunderbird:13.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:thunderbird:14.0 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:thunderbird:7.0 + cpe:/a:mozilla:thunderbird:8.0 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:thunderbird:0.2 + cpe:/a:mozilla:thunderbird:0.3 + cpe:/a:mozilla:thunderbird:0.4 + cpe:/a:mozilla:thunderbird:0.5 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:thunderbird:0.1 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:thunderbird:1.7.1 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:thunderbird:1.7.3 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:thunderbird:0.9 + cpe:/a:mozilla:thunderbird:0.8 + cpe:/a:mozilla:thunderbird:0.7 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:thunderbird:0.6 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:thunderbird:15.0.1 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:thunderbird:9.0 + cpe:/a:mozilla:thunderbird:6.0 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:thunderbird:12.0 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:thunderbird:15.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:thunderbird:24.0.1 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:thunderbird:2.0.0.5 + cpe:/a:mozilla:thunderbird:2.0.0.4 + cpe:/a:mozilla:thunderbird:2.0.0.7 + cpe:/a:mozilla:thunderbird:11.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.6 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:thunderbird:2.0.0.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:thunderbird:2.0.0.3 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:thunderbird:2.0.0.0 + cpe:/a:mozilla:thunderbird:2.0.0.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:thunderbird:1.5.0.9 + cpe:/a:mozilla:thunderbird:1.5.0.8 + cpe:/a:mozilla:thunderbird:1.5.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.6 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.8 + cpe:/a:mozilla:thunderbird:2.0.0.9 + cpe:/a:mozilla:thunderbird:16.0.2 + cpe:/a:mozilla:thunderbird:16.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:thunderbird:24.3 + cpe:/a:mozilla:thunderbird:24.2 + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:thunderbird:3.0.9 + cpe:/a:mozilla:thunderbird:24.1 + cpe:/a:mozilla:firefox_esr:24.3 + cpe:/a:mozilla:thunderbird:24.0 + cpe:/a:mozilla:thunderbird:24.1.1 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:thunderbird:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:thunderbird:5.0 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:thunderbird:3.0.4 + cpe:/a:mozilla:thunderbird:3.0.3 + cpe:/a:mozilla:thunderbird:3.0.2 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:thunderbird:3.0.1 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:thunderbird:3.1.3 + cpe:/a:mozilla:thunderbird:3.1.2 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:thunderbird:3.1.1 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:thunderbird:3.1.4 + cpe:/a:mozilla:thunderbird:3.1.5 + cpe:/a:mozilla:thunderbird:3.1.6 + cpe:/a:mozilla:thunderbird:3.1.7 + cpe:/a:mozilla:thunderbird:2.0.0.18 + cpe:/a:mozilla:thunderbird:2.0.0.17 + cpe:/a:mozilla:thunderbird:2.0.0.16 + cpe:/a:mozilla:thunderbird:2.0.0.15 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:thunderbird:3.0.5 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:thunderbird:3.0.6 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:thunderbird:3.0.7 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:thunderbird:3.0.8 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:thunderbird:3.0 + cpe:/a:mozilla:thunderbird:3.1 + cpe:/a:mozilla:thunderbird:1.0.5:beta + cpe:/a:mozilla:thunderbird:2.0.0.21 + cpe:/a:mozilla:thunderbird:2.0.0.20 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:thunderbird:2.0.0.11 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:thunderbird:2.0.0.12 + cpe:/a:mozilla:thunderbird:2.0.0.13 + cpe:/a:mozilla:thunderbird:2.0.0.14 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:thunderbird:3.1.9 + cpe:/a:mozilla:thunderbird:3.1.8 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:thunderbird:2.0.0.19 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:thunderbird:2.0.0.22 + cpe:/a:mozilla:thunderbird:2.0.0.23 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:thunderbird:1.5.0.10 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:thunderbird:1.5.0.13 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.14 + cpe:/a:mozilla:thunderbird:7.0.1 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.11 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:thunderbird:1.5.0.12 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:thunderbird:13.0.1 + cpe:/a:mozilla:thunderbird:2.0 + cpe:/a:mozilla:thunderbird:9.0.1 + cpe:/a:mozilla:thunderbird:10.0 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:thunderbird:10.0.3 + cpe:/a:mozilla:thunderbird:10.0.4 + cpe:/a:mozilla:thunderbird:10.0.1 + cpe:/a:mozilla:thunderbird:10.0.2 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1512 + 2014-03-19T06:55:06.660-04:00 + 2014-04-01T02:28:56.297-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-19T17:12:03.293-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=982957 + + + UBUNTU + USN-2151-1 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-30.html + + + DEBIAN + DSA-2881 + + + REDHAT + RHSA-2014:0316 + + + REDHAT + RHSA-2014:0310 + + + SUSE + openSUSE-SU-2014:0448 + + + SUSE + openSUSE-SU-2014:0419 + + + SUSE + SUSE-SU-2014:0418 + + + BUGTRAQ + 20140326 VUPEN Security Research - Mozilla Firefox "BumpChunk" Object Processing Use-after-free (Pwn2Own) + + Use-after-free vulnerability in the TypeObject class in the JavaScript engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary code by triggering extensive memory consumption while garbage collection is occurring, as demonstrated by improper handling of BumpChunk objects. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:thunderbird:6.0.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:thunderbird:1.0 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:thunderbird:16.0 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:thunderbird:1.5 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:thunderbird:11.0 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:thunderbird:6.0.2 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:thunderbird:0.7.1 + cpe:/a:mozilla:thunderbird:0.7.2 + cpe:/a:mozilla:thunderbird:0.7.3 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:thunderbird:1.5.2 + cpe:/a:mozilla:thunderbird:1.0.3 + cpe:/a:mozilla:thunderbird:1.0.4 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:thunderbird:1.0.5 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:thunderbird:1.0.6 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:thunderbird:3.1.15 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:thunderbird:3.1.16 + cpe:/a:mozilla:thunderbird:3.1.17 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:thunderbird:1.0.2 + cpe:/a:mozilla:thunderbird:1.0.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:thunderbird:3.1.10 + cpe:/a:mozilla:thunderbird:1.5.1 + cpe:/a:mozilla:thunderbird:1.0.8 + cpe:/a:mozilla:thunderbird:1.0.7 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:thunderbird:3.1.14 + cpe:/a:mozilla:thunderbird:3.1.13 + cpe:/a:mozilla:thunderbird:3.1.12 + cpe:/a:mozilla:thunderbird:3.1.11 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:thunderbird:17.0.4 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:thunderbird:12.0.1 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:thunderbird:1.5.0.3 + cpe:/a:mozilla:thunderbird:1.5.0.2 + cpe:/a:mozilla:thunderbird:1.5.0.1 + cpe:/a:mozilla:thunderbird:3.0.11 + cpe:/a:mozilla:thunderbird:3.0.10 + cpe:/a:mozilla:thunderbird:13.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:thunderbird:14.0 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:thunderbird:7.0 + cpe:/a:mozilla:thunderbird:8.0 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:thunderbird:0.2 + cpe:/a:mozilla:thunderbird:0.3 + cpe:/a:mozilla:thunderbird:0.4 + cpe:/a:mozilla:thunderbird:0.5 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:thunderbird:0.1 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:thunderbird:1.7.1 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:thunderbird:1.7.3 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:thunderbird:0.9 + cpe:/a:mozilla:thunderbird:0.8 + cpe:/a:mozilla:thunderbird:0.7 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:thunderbird:0.6 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:thunderbird:15.0.1 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:thunderbird:9.0 + cpe:/a:mozilla:thunderbird:6.0 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:thunderbird:12.0 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:thunderbird:15.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:thunderbird:24.0.1 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:thunderbird:2.0.0.5 + cpe:/a:mozilla:thunderbird:2.0.0.4 + cpe:/a:mozilla:thunderbird:2.0.0.7 + cpe:/a:mozilla:thunderbird:11.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.6 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:thunderbird:2.0.0.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:thunderbird:2.0.0.3 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:thunderbird:2.0.0.0 + cpe:/a:mozilla:thunderbird:2.0.0.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:thunderbird:1.5.0.9 + cpe:/a:mozilla:thunderbird:1.5.0.8 + cpe:/a:mozilla:thunderbird:1.5.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.6 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.8 + cpe:/a:mozilla:thunderbird:2.0.0.9 + cpe:/a:mozilla:thunderbird:16.0.2 + cpe:/a:mozilla:thunderbird:16.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:thunderbird:24.3 + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:thunderbird:24.2 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox_esr:24.3 + cpe:/a:mozilla:thunderbird:24.1 + cpe:/a:mozilla:thunderbird:3.0.9 + cpe:/a:mozilla:thunderbird:24.0 + cpe:/a:mozilla:thunderbird:24.1.1 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:thunderbird:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:thunderbird:5.0 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:thunderbird:3.0.4 + cpe:/a:mozilla:thunderbird:3.0.3 + cpe:/a:mozilla:thunderbird:3.0.2 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:thunderbird:3.0.1 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:thunderbird:3.1.3 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:thunderbird:3.1.2 + cpe:/a:mozilla:thunderbird:3.1.1 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:thunderbird:3.1.4 + cpe:/a:mozilla:thunderbird:3.1.5 + cpe:/a:mozilla:thunderbird:3.1.6 + cpe:/a:mozilla:thunderbird:3.1.7 + cpe:/a:mozilla:thunderbird:2.0.0.18 + cpe:/a:mozilla:thunderbird:2.0.0.17 + cpe:/a:mozilla:thunderbird:2.0.0.16 + cpe:/a:mozilla:thunderbird:2.0.0.15 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:thunderbird:3.0.5 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:thunderbird:3.0.6 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:thunderbird:3.0.7 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:thunderbird:3.0.8 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:thunderbird:3.0 + cpe:/a:mozilla:thunderbird:3.1 + cpe:/a:mozilla:thunderbird:1.0.5:beta + cpe:/a:mozilla:thunderbird:2.0.0.21 + cpe:/a:mozilla:thunderbird:2.0.0.20 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:thunderbird:2.0.0.11 + cpe:/a:mozilla:thunderbird:2.0.0.12 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:thunderbird:2.0.0.13 + cpe:/a:mozilla:thunderbird:2.0.0.14 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:thunderbird:3.1.9 + cpe:/a:mozilla:thunderbird:3.1.8 + cpe:/a:mozilla:thunderbird:2.0.0.19 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:thunderbird:2.0.0.22 + cpe:/a:mozilla:thunderbird:2.0.0.23 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:thunderbird:1.5.0.10 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:thunderbird:1.5.0.13 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:thunderbird:7.0.1 + cpe:/a:mozilla:thunderbird:1.5.0.14 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.11 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:thunderbird:1.5.0.12 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:thunderbird:13.0.1 + cpe:/a:mozilla:thunderbird:2.0 + cpe:/a:mozilla:thunderbird:9.0.1 + cpe:/a:mozilla:thunderbird:10.0 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:thunderbird:10.0.3 + cpe:/a:mozilla:thunderbird:10.0.4 + cpe:/a:mozilla:thunderbird:10.0.1 + cpe:/a:mozilla:thunderbird:10.0.2 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1513 + 2014-03-19T06:55:06.693-04:00 + 2014-04-01T02:28:56.390-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-19T17:13:28.280-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=982974 + + + UBUNTU + USN-2151-1 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-31.html + + + DEBIAN + DSA-2881 + + + REDHAT + RHSA-2014:0316 + + + REDHAT + RHSA-2014:0310 + + + SUSE + openSUSE-SU-2014:0448 + + + SUSE + openSUSE-SU-2014:0419 + + + SUSE + SUSE-SU-2014:0418 + + TypedArrayObject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not prevent a zero-length transition during use of an ArrayBuffer object, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based out-of-bounds write or read) via a crafted web site. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:thunderbird:6.0.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:thunderbird:1.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:thunderbird:16.0 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:thunderbird:1.5 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:thunderbird:11.0 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:thunderbird:6.0.2 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:thunderbird:0.7.1 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:thunderbird:0.7.2 + cpe:/a:mozilla:thunderbird:0.7.3 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:thunderbird:1.5.2 + cpe:/a:mozilla:thunderbird:1.0.3 + cpe:/a:mozilla:thunderbird:1.0.4 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:thunderbird:1.0.5 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:thunderbird:1.0.6 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:thunderbird:3.1.15 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:thunderbird:3.1.16 + cpe:/a:mozilla:thunderbird:3.1.17 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:thunderbird:1.0.2 + cpe:/a:mozilla:thunderbird:1.0.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:thunderbird:3.1.10 + cpe:/a:mozilla:thunderbird:1.5.1 + cpe:/a:mozilla:thunderbird:1.0.8 + cpe:/a:mozilla:thunderbird:1.0.7 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:thunderbird:3.1.14 + cpe:/a:mozilla:thunderbird:3.1.13 + cpe:/a:mozilla:thunderbird:3.1.12 + cpe:/a:mozilla:thunderbird:3.1.11 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:thunderbird:17.0.4 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:thunderbird:12.0.1 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:thunderbird:1.5.0.3 + cpe:/a:mozilla:thunderbird:1.5.0.2 + cpe:/a:mozilla:thunderbird:1.5.0.1 + cpe:/a:mozilla:thunderbird:3.0.11 + cpe:/a:mozilla:thunderbird:3.0.10 + cpe:/a:mozilla:thunderbird:13.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:thunderbird:14.0 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:thunderbird:7.0 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:thunderbird:8.0 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:thunderbird:0.2 + cpe:/a:mozilla:thunderbird:0.3 + cpe:/a:mozilla:thunderbird:0.4 + cpe:/a:mozilla:thunderbird:0.5 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:thunderbird:0.1 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:thunderbird:1.7.1 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:thunderbird:1.7.3 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:thunderbird:0.9 + cpe:/a:mozilla:thunderbird:0.8 + cpe:/a:mozilla:thunderbird:0.7 + cpe:/a:mozilla:thunderbird:0.6 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:thunderbird:15.0.1 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:thunderbird:9.0 + cpe:/a:mozilla:thunderbird:6.0 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:thunderbird:12.0 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:thunderbird:15.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:thunderbird:24.0.1 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:thunderbird:2.0.0.5 + cpe:/a:mozilla:thunderbird:2.0.0.4 + cpe:/a:mozilla:thunderbird:2.0.0.7 + cpe:/a:mozilla:thunderbird:2.0.0.6 + cpe:/a:mozilla:thunderbird:11.0.1 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:thunderbird:2.0.0.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:thunderbird:2.0.0.3 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:thunderbird:2.0.0.0 + cpe:/a:mozilla:thunderbird:2.0.0.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:thunderbird:1.5.0.9 + cpe:/a:mozilla:thunderbird:1.5.0.8 + cpe:/a:mozilla:thunderbird:1.5.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.6 + cpe:/a:mozilla:thunderbird:2.0.0.8 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.9 + cpe:/a:mozilla:thunderbird:16.0.2 + cpe:/a:mozilla:thunderbird:16.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:thunderbird:24.3 + cpe:/a:mozilla:thunderbird:24.2 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:thunderbird:24.1 + cpe:/a:mozilla:thunderbird:3.0.9 + cpe:/a:mozilla:firefox_esr:24.3 + cpe:/a:mozilla:thunderbird:24.0 + cpe:/a:mozilla:thunderbird:24.1.1 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:thunderbird:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:thunderbird:5.0 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:thunderbird:3.0.4 + cpe:/a:mozilla:thunderbird:3.0.3 + cpe:/a:mozilla:thunderbird:3.0.2 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:thunderbird:3.0.1 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:thunderbird:3.1.3 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:thunderbird:3.1.2 + cpe:/a:mozilla:thunderbird:3.1.1 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:thunderbird:3.1.4 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:thunderbird:3.1.5 + cpe:/a:mozilla:thunderbird:3.1.6 + cpe:/a:mozilla:thunderbird:3.1.7 + cpe:/a:mozilla:thunderbird:2.0.0.18 + cpe:/a:mozilla:thunderbird:2.0.0.17 + cpe:/a:mozilla:thunderbird:2.0.0.16 + cpe:/a:mozilla:thunderbird:2.0.0.15 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:thunderbird:3.0.5 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:thunderbird:3.0.6 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:thunderbird:3.0.7 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:thunderbird:3.0.8 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:thunderbird:3.0 + cpe:/a:mozilla:thunderbird:3.1 + cpe:/a:mozilla:thunderbird:1.0.5:beta + cpe:/a:mozilla:thunderbird:2.0.0.21 + cpe:/a:mozilla:thunderbird:2.0.0.20 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:thunderbird:2.0.0.11 + cpe:/a:mozilla:thunderbird:2.0.0.12 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:thunderbird:2.0.0.13 + cpe:/a:mozilla:thunderbird:2.0.0.14 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:thunderbird:3.1.9 + cpe:/a:mozilla:thunderbird:3.1.8 + cpe:/a:mozilla:thunderbird:2.0.0.19 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:thunderbird:2.0.0.22 + cpe:/a:mozilla:thunderbird:2.0.0.23 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:thunderbird:1.5.0.10 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:thunderbird:1.5.0.13 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:thunderbird:7.0.1 + cpe:/a:mozilla:thunderbird:1.5.0.14 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.11 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:thunderbird:1.5.0.12 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:thunderbird:13.0.1 + cpe:/a:mozilla:thunderbird:2.0 + cpe:/a:mozilla:thunderbird:9.0.1 + cpe:/a:mozilla:thunderbird:10.0 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:thunderbird:10.0.3 + cpe:/a:mozilla:thunderbird:10.0.4 + cpe:/a:mozilla:thunderbird:10.0.1 + cpe:/a:mozilla:thunderbird:10.0.2 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1514 + 2014-03-19T06:55:06.723-04:00 + 2014-04-01T02:28:56.500-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-19T17:14:56.937-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=983344 + + + UBUNTU + USN-2151-1 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-32.html + + + DEBIAN + DSA-2881 + + + REDHAT + RHSA-2014:0316 + + + REDHAT + RHSA-2014:0310 + + + SUSE + openSUSE-SU-2014:0448 + + + SUSE + openSUSE-SU-2014:0419 + + + SUSE + SUSE-SU-2014:0418 + + vmtypedarrayobject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not validate the length of the destination array before a copy operation, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) by triggering incorrect use of the TypedArrayObject class. + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:28.0 + + CVE-2014-1515 + 2014-03-25T09:25:38.507-04:00 + 2014-04-01T02:28:56.640-04:00 + + + 1.9 + LOCAL + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-03-25T11:27:23.113-04:00 + + + + + CONFIRM + https://www.mozilla.org/security/announce/2014/mfsa2014-33.html + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=945429 + + + BUGTRAQ + 20140326 Firefox for Android Profile Directory Derandomization and Data Exfiltration (CVE-2014-1484, CVE-2014-1506, CVE-2014-1515, CVE-2014-1516) + + Mozilla Firefox before 28.0.1 on Android processes a file: URL by copying a local file onto the SD card, which allows attackers to obtain sensitive information from the Firefox profile directory via a crafted application. + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:28.0.1 + + CVE-2014-1516 + 2014-03-29T16:55:04.123-04:00 + 2014-03-31T13:33:14.993-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-03-31T13:33:14.947-04:00 + + + + + MISC + http://www.slideshare.net/ibmsecurity/overtaking-firefox-profiles-vulnerabilities-in-firefox-for-android + + + MISC + http://securityintelligence.com/vulnerabilities-firefox-android-overtaking-firefox-profiles/ + + + BUGTRAQ + 20140326 Firefox for Android Profile Directory Derandomization and Data Exfiltration (CVE-2014-1484, CVE-2014-1506, CVE-2014-1515, CVE-2014-1516) + + The saltProfileName function in base/GeckoProfileDirectories.java in Mozilla Firefox through 28.0.1 on Android relies on Android's weak approach to seeding the Math.random function, which makes it easier for attackers to bypass a profile-randomization protection mechanism via a crafted application. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:bugzilla:2.18 + cpe:/a:mozilla:bugzilla:2.19 + cpe:/a:mozilla:bugzilla:2.16 + cpe:/a:mozilla:bugzilla:2.17 + cpe:/a:mozilla:bugzilla:2.21 + cpe:/a:mozilla:bugzilla:2.22 + cpe:/a:mozilla:bugzilla:2.20 + cpe:/a:mozilla:bugzilla:4.0.10 + cpe:/a:mozilla:bugzilla:2.18.8 + cpe:/a:mozilla:bugzilla:2.18.9 + cpe:/a:mozilla:bugzilla:2.17.7 + cpe:/a:mozilla:bugzilla:2.18.2 + cpe:/a:mozilla:bugzilla:3.2.8 + cpe:/a:mozilla:bugzilla:2.10 + cpe:/a:mozilla:bugzilla:2.17.5 + cpe:/a:mozilla:bugzilla:3.2.9 + cpe:/a:mozilla:bugzilla:2.17.6 + cpe:/a:mozilla:bugzilla:2.18.1 + cpe:/a:mozilla:bugzilla:3.2.7 + cpe:/a:mozilla:bugzilla:2.17.4 + cpe:/a:mozilla:bugzilla:3.2.10 + cpe:/a:mozilla:bugzilla:2.23 + cpe:/a:mozilla:bugzilla:2.18.3 + cpe:/a:mozilla:bugzilla:2.18.7 + cpe:/a:mozilla:bugzilla:2.17.3 + cpe:/a:mozilla:bugzilla:2.18.6 + cpe:/a:mozilla:bugzilla:2.17.2 + cpe:/a:mozilla:bugzilla:2.18.5 + cpe:/a:mozilla:bugzilla:2.17.1 + cpe:/a:mozilla:bugzilla:2.18.4 + cpe:/a:mozilla:bugzilla:4.0:rc2 + cpe:/a:mozilla:bugzilla:3.2.1 + cpe:/a:mozilla:bugzilla:3.2.2 + cpe:/a:mozilla:bugzilla:3.2.3 + cpe:/a:mozilla:bugzilla:4.0:rc1 + cpe:/a:mozilla:bugzilla:4.2:rc1 + cpe:/a:mozilla:bugzilla:4.4:rc2 + cpe:/a:mozilla:bugzilla:4.4:rc1 + cpe:/a:mozilla:bugzilla:3.4.11 + cpe:/a:mozilla:bugzilla:3.4.12 + cpe:/a:mozilla:bugzilla:3.4.13 + cpe:/a:mozilla:bugzilla:4.2:rc2 + cpe:/a:mozilla:bugzilla:3.4.10 + cpe:/a:mozilla:bugzilla:2.21.1 + cpe:/a:mozilla:bugzilla:2.21.2 + cpe:/a:mozilla:bugzilla:3.2:rc1 + cpe:/a:mozilla:bugzilla:3.2:rc2 + cpe:/a:mozilla:bugzilla:4.0.13 + cpe:/a:mozilla:bugzilla:3.0:rc1 + cpe:/a:mozilla:bugzilla:4.0.12 + cpe:/a:mozilla:bugzilla:4.0.11 + cpe:/a:mozilla:bugzilla:3.6:rc1 + cpe:/a:mozilla:bugzilla:3.4:rc1 + cpe:/a:mozilla:bugzilla:3.2.6 + cpe:/a:mozilla:bugzilla:3.2.5 + cpe:/a:mozilla:bugzilla:3.2.4 + cpe:/a:mozilla:bugzilla:3.3.1 + cpe:/a:mozilla:bugzilla:3.3.2 + cpe:/a:mozilla:bugzilla:2.22:rc1 + cpe:/a:mozilla:bugzilla:2.20.3 + cpe:/a:mozilla:bugzilla:2.20.2 + cpe:/a:mozilla:bugzilla:2.20.1 + cpe:/a:mozilla:bugzilla:4.0.7 + cpe:/a:mozilla:bugzilla:4.0.6 + cpe:/a:mozilla:bugzilla:4.0.5 + cpe:/a:mozilla:bugzilla:2.16:rc1 + cpe:/a:mozilla:bugzilla:2.22.4 + cpe:/a:mozilla:bugzilla:2.16:rc2 + cpe:/a:mozilla:bugzilla:2.22.3 + cpe:/a:mozilla:bugzilla:2.18:rc1 + cpe:/a:mozilla:bugzilla:2.22.6 + cpe:/a:mozilla:bugzilla:2.18:rc2 + cpe:/a:mozilla:bugzilla:2.22.5 + cpe:/a:mozilla:bugzilla:2.22.2 + cpe:/a:mozilla:bugzilla:2.20:rc2 + cpe:/a:mozilla:bugzilla:2.20:rc1 + cpe:/a:mozilla:bugzilla:4.4.1 + cpe:/a:mozilla:bugzilla:2.18:rc3 + cpe:/a:mozilla:bugzilla:2.22.7 + cpe:/a:mozilla:bugzilla:4.4.2 + cpe:/a:mozilla:bugzilla:3.6.2 + cpe:/a:mozilla:bugzilla:3.6.0 + cpe:/a:mozilla:bugzilla:3.6.1 + cpe:/a:mozilla:bugzilla:4.0.1 + cpe:/a:mozilla:bugzilla:4.1.2 + cpe:/a:mozilla:bugzilla:4.0.2 + cpe:/a:mozilla:bugzilla:4.1.3 + cpe:/a:mozilla:bugzilla:4.0.3 + cpe:/a:mozilla:bugzilla:4.0.4 + cpe:/a:mozilla:bugzilla:4.1.1 + cpe:/a:mozilla:bugzilla:3.3.4 + cpe:/a:mozilla:bugzilla:3.3.3 + cpe:/a:mozilla:bugzilla:2.22.1 + cpe:/a:mozilla:bugzilla:2.16.11 + cpe:/a:mozilla:bugzilla:3.0.10 + cpe:/a:mozilla:bugzilla:3.0.11 + cpe:/a:mozilla:bugzilla:2.20.4 + cpe:/a:mozilla:bugzilla:2.20.7 + cpe:/a:mozilla:bugzilla:2.20.5 + cpe:/a:mozilla:bugzilla:2.20.6 + cpe:/a:mozilla:bugzilla:2.14 + cpe:/a:mozilla:bugzilla:2.16.10 + cpe:/a:mozilla:bugzilla:4.0.9 + cpe:/a:mozilla:bugzilla:2.12 + cpe:/a:mozilla:bugzilla:4.0.8 + cpe:/a:mozilla:bugzilla:2.14.5 + cpe:/a:mozilla:bugzilla:2.14.4 + cpe:/a:mozilla:bugzilla:2.14.1 + cpe:/a:mozilla:bugzilla:2.14.3 + cpe:/a:mozilla:bugzilla:2.14.2 + cpe:/a:mozilla:bugzilla:3.6.9 + cpe:/a:mozilla:bugzilla:3.6.8 + cpe:/a:mozilla:bugzilla:3.6.7 + cpe:/a:mozilla:bugzilla:3.6.6 + cpe:/a:mozilla:bugzilla:3.6.5 + cpe:/a:mozilla:bugzilla:3.6.4 + cpe:/a:mozilla:bugzilla:3.6.3 + cpe:/a:mozilla:bugzilla:2.16.5 + cpe:/a:mozilla:bugzilla:2.16.9 + cpe:/a:mozilla:bugzilla:2.16.8 + cpe:/a:mozilla:bugzilla:2.19.1 + cpe:/a:mozilla:bugzilla:2.16.7 + cpe:/a:mozilla:bugzilla:2.16.6 + cpe:/a:mozilla:bugzilla:4.5.2 + cpe:/a:mozilla:bugzilla:4.5.1 + cpe:/a:mozilla:bugzilla:2.16.4 + cpe:/a:mozilla:bugzilla:2.16.2 + cpe:/a:mozilla:bugzilla:2.19.3 + cpe:/a:mozilla:bugzilla:2.16.3 + cpe:/a:mozilla:bugzilla:2.19.2 + cpe:/a:mozilla:bugzilla:2.18.6%2b + cpe:/a:mozilla:bugzilla:2.16.1 + cpe:/a:mozilla:bugzilla:3.7.1 + cpe:/a:mozilla:bugzilla:3.7.2 + cpe:/a:mozilla:bugzilla:3.7.3 + cpe:/a:mozilla:bugzilla:4.5 + cpe:/a:mozilla:bugzilla:4.3 + cpe:/a:mozilla:bugzilla:4.2 + cpe:/a:mozilla:bugzilla:2.4 + cpe:/a:mozilla:bugzilla:2.6 + cpe:/a:mozilla:bugzilla:2.8 + cpe:/a:mozilla:bugzilla:2.9 + cpe:/a:mozilla:bugzilla:4.0 + cpe:/a:mozilla:bugzilla:2.0 + cpe:/a:mozilla:bugzilla:4.1 + cpe:/a:mozilla:bugzilla:2.2 + cpe:/a:mozilla:bugzilla:3.0.7 + cpe:/a:mozilla:bugzilla:3.0.6 + cpe:/a:mozilla:bugzilla:3.5.3 + cpe:/a:mozilla:bugzilla:3.5.2 + cpe:/a:mozilla:bugzilla:3.0.8 + cpe:/a:mozilla:bugzilla:3.5.1 + cpe:/a:mozilla:bugzilla:3.0.0 + cpe:/a:mozilla:bugzilla:3.4.4 + cpe:/a:mozilla:bugzilla:3.4.2 + cpe:/a:mozilla:bugzilla:3.4.3 + cpe:/a:mozilla:bugzilla:3.1.0 + cpe:/a:mozilla:bugzilla:3.1.4 + cpe:/a:mozilla:bugzilla:3.1.3 + cpe:/a:mozilla:bugzilla:3.4.1 + cpe:/a:mozilla:bugzilla:3.1.2 + cpe:/a:mozilla:bugzilla:3.1.1 + cpe:/a:mozilla:bugzilla:4.2.6 + cpe:/a:mozilla:bugzilla:4.2.9 + cpe:/a:mozilla:bugzilla:4.2.8 + cpe:/a:mozilla:bugzilla:4.2.7 + cpe:/a:mozilla:bugzilla:3.0.4 + cpe:/a:mozilla:bugzilla:3.0.5 + cpe:/a:mozilla:bugzilla:3.0.2 + cpe:/a:mozilla:bugzilla:2.21.2:rc1 + cpe:/a:mozilla:bugzilla:2.23.1 + cpe:/a:mozilla:bugzilla:3.0.3 + cpe:/a:mozilla:bugzilla:2.23.2 + cpe:/a:mozilla:bugzilla:2.23.3 + cpe:/a:mozilla:bugzilla:3.0.1 + cpe:/a:mozilla:bugzilla:2.23.4 + cpe:/a:mozilla:bugzilla:3.4.9 + cpe:/a:mozilla:bugzilla:3.4 + cpe:/a:mozilla:bugzilla:3.4.8 + cpe:/a:mozilla:bugzilla:3.5 + cpe:/a:mozilla:bugzilla:3.4.7 + cpe:/a:mozilla:bugzilla:3.6 + cpe:/a:mozilla:bugzilla:3.4.6 + cpe:/a:mozilla:bugzilla:3.7 + cpe:/a:mozilla:bugzilla:3.4.5 + cpe:/a:mozilla:bugzilla:3.3 + cpe:/a:mozilla:bugzilla:4.3.1 + cpe:/a:mozilla:bugzilla:3.0.9 + cpe:/a:mozilla:bugzilla:4.2.2 + cpe:/a:mozilla:bugzilla:4.2.1 + cpe:/a:mozilla:bugzilla:4.2.5 + cpe:/a:mozilla:bugzilla:4.2.3 + cpe:/a:mozilla:bugzilla:4.2.4 + cpe:/a:mozilla:bugzilla:4.4:- + cpe:/a:mozilla:bugzilla:3.6.13 + cpe:/a:mozilla:bugzilla:4.3.3 + cpe:/a:mozilla:bugzilla:4.3.2 + cpe:/a:mozilla:bugzilla:3.2 + cpe:/a:mozilla:bugzilla:3.0 + cpe:/a:mozilla:bugzilla:3.6.10 + cpe:/a:mozilla:bugzilla:3.6.11 + cpe:/a:mozilla:bugzilla:3.6.12 + + CVE-2014-1517 + 2014-04-19T21:55:06.723-04:00 + 2014-04-21T16:12:41.563-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-21T16:12:40.657-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=713926 + + + CONFIRM + http://git.mozilla.org/?p=bugzilla/bugzilla.git;a=commit;h=0e390970ba51b14a5dc780be7c6f0d6d7baa67e3 + + + CONFIRM + http://www.bugzilla.org/security/4.0.11/ + + The login form in Bugzilla 2.x, 3.x, 4.x before 4.4.3, and 4.5.x before 4.5.3 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account and then submit a vulnerability report, related to a "login CSRF" issue. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:thunderbird:6.0.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:thunderbird:1.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:thunderbird:16.0 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:thunderbird:1.5 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:thunderbird:11.0 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:thunderbird:6.0.2 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:thunderbird:0.7.1 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:thunderbird:0.7.2 + cpe:/a:mozilla:thunderbird:0.7.3 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:thunderbird:1.5.2 + cpe:/a:mozilla:thunderbird:1.0.3 + cpe:/a:mozilla:thunderbird:1.0.4 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:thunderbird:1.0.5 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:thunderbird:1.0.6 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:thunderbird:3.1.15 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:thunderbird:3.1.16 + cpe:/a:mozilla:thunderbird:3.1.17 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:thunderbird:1.0.2 + cpe:/a:mozilla:thunderbird:1.0.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:thunderbird:3.1.10 + cpe:/a:mozilla:thunderbird:1.5.1 + cpe:/a:mozilla:thunderbird:1.0.8 + cpe:/a:mozilla:thunderbird:1.0.7 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:thunderbird:3.1.14 + cpe:/a:mozilla:thunderbird:3.1.13 + cpe:/a:mozilla:thunderbird:3.1.12 + cpe:/a:mozilla:thunderbird:3.1.11 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:thunderbird:17.0.4 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:seamonkey:2.25:- + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:thunderbird:12.0.1 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:thunderbird:1.5.0.3 + cpe:/a:mozilla:thunderbird:1.5.0.2 + cpe:/a:mozilla:thunderbird:1.5.0.1 + cpe:/a:mozilla:thunderbird:3.0.11 + cpe:/a:mozilla:thunderbird:3.0.10 + cpe:/a:mozilla:thunderbird:13.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:thunderbird:14.0 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:thunderbird:7.0 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:thunderbird:8.0 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:thunderbird:0.2 + cpe:/a:mozilla:thunderbird:0.3 + cpe:/a:mozilla:thunderbird:0.4 + cpe:/a:mozilla:thunderbird:0.5 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:thunderbird:0.1 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:thunderbird:1.7.1 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:thunderbird:1.7.3 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:thunderbird:0.9 + cpe:/a:mozilla:thunderbird:0.8 + cpe:/a:mozilla:thunderbird:0.7 + cpe:/a:mozilla:thunderbird:0.6 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:thunderbird:15.0.1 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:thunderbird:9.0 + cpe:/a:mozilla:thunderbird:6.0 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:28.0 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:thunderbird:12.0 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:thunderbird:15.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:thunderbird:24.0.1 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:thunderbird:2.0.0.5 + cpe:/a:mozilla:thunderbird:2.0.0.4 + cpe:/a:mozilla:thunderbird:2.0.0.7 + cpe:/a:mozilla:thunderbird:2.0.0.6 + cpe:/a:mozilla:thunderbird:11.0.1 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:thunderbird:2.0.0.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:thunderbird:2.0.0.3 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:thunderbird:2.0.0.0 + cpe:/a:mozilla:thunderbird:2.0.0.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:thunderbird:1.5.0.9 + cpe:/a:mozilla:thunderbird:1.5.0.8 + cpe:/a:mozilla:thunderbird:1.5.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.6 + cpe:/a:mozilla:thunderbird:2.0.0.8 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.9 + cpe:/a:mozilla:thunderbird:16.0.2 + cpe:/a:mozilla:thunderbird:16.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:thunderbird:24.3 + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:thunderbird:24.2 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox_esr:24.3 + cpe:/a:mozilla:thunderbird:24.1 + cpe:/a:mozilla:thunderbird:3.0.9 + cpe:/a:mozilla:thunderbird:24.0 + cpe:/a:mozilla:thunderbird:24.1.1 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:thunderbird:24.4 + cpe:/a:mozilla:firefox_esr:24.4 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:thunderbird:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:thunderbird:5.0 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:thunderbird:3.0.4 + cpe:/a:mozilla:thunderbird:3.0.3 + cpe:/a:mozilla:thunderbird:3.0.2 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:thunderbird:3.0.1 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:thunderbird:3.1.3 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:thunderbird:3.1.2 + cpe:/a:mozilla:thunderbird:3.1.1 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:thunderbird:3.1.4 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:thunderbird:3.1.5 + cpe:/a:mozilla:seamonkey:2.25:beta3 + cpe:/a:mozilla:thunderbird:3.1.6 + cpe:/a:mozilla:thunderbird:3.1.7 + cpe:/a:mozilla:thunderbird:2.0.0.18 + cpe:/a:mozilla:thunderbird:2.0.0.17 + cpe:/a:mozilla:thunderbird:2.0.0.16 + cpe:/a:mozilla:thunderbird:2.0.0.15 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:thunderbird:3.0.5 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:thunderbird:3.0.6 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:thunderbird:3.0.7 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:thunderbird:3.0.8 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:thunderbird:3.0 + cpe:/a:mozilla:thunderbird:3.1 + cpe:/a:mozilla:thunderbird:1.0.5:beta + cpe:/a:mozilla:thunderbird:2.0.0.21 + cpe:/a:mozilla:thunderbird:2.0.0.20 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:thunderbird:2.0.0.11 + cpe:/a:mozilla:thunderbird:2.0.0.12 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:thunderbird:2.0.0.13 + cpe:/a:mozilla:thunderbird:2.0.0.14 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:thunderbird:3.1.9 + cpe:/a:mozilla:thunderbird:3.1.8 + cpe:/a:mozilla:thunderbird:2.0.0.19 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:thunderbird:2.0.0.22 + cpe:/a:mozilla:thunderbird:2.0.0.23 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:thunderbird:1.5.0.10 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:thunderbird:1.5.0.13 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:thunderbird:7.0.1 + cpe:/a:mozilla:thunderbird:1.5.0.14 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.11 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:thunderbird:1.5.0.12 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:thunderbird:13.0.1 + cpe:/a:mozilla:thunderbird:2.0 + cpe:/a:mozilla:thunderbird:9.0.1 + cpe:/a:mozilla:thunderbird:10.0 + cpe:/a:mozilla:seamonkey:2.26:rc1 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:thunderbird:10.0.3 + cpe:/a:mozilla:thunderbird:10.0.4 + cpe:/a:mozilla:thunderbird:10.0.1 + cpe:/a:mozilla:thunderbird:10.0.2 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1518 + 2014-04-30T06:49:04.677-04:00 + 2014-04-30T11:29:46.733-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-30T11:29:44.043-04:00 + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=993546 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=992968 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=991471 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=986843 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=986678 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=980537 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=966630 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=952022 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=944353 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-34.html + + Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:28.0 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.25:- + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:seamonkey:2.25:beta3 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:seamonkey:2.26:rc1 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1519 + 2014-04-30T06:49:04.707-04:00 + 2014-04-30T11:51:53.667-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-30T11:51:51.027-04:00 + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=996883 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=995607 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=990794 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=986864 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=977955 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=953104 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=946658 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=919592 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-34.html + + Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:28.0 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox_esr:24.3 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:firefox_esr:24.4 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1520 + 2014-04-30T06:49:04.753-04:00 + 2014-04-30T12:02:09.143-04:00 + + + 6.9 + LOCAL + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-30T12:02:07.173-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=961676 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-35.html + + maintenservice_installer.exe in the Maintenance Service Installer in Mozilla Firefox before 29.0 and Firefox ESR 24.x before 24.5 on Windows allows local users to gain privileges by placing a Trojan horse DLL file into a temporary directory at an unspecified point in the update process. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:28.0 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.25:- + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:seamonkey:2.25:beta3 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:seamonkey:2.26:rc1 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1522 + 2014-04-30T06:49:04.787-04:00 + 2014-04-30T12:11:38.583-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-30T12:11:36.177-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=995289 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-36.html + + The mozilla::dom::OscillatorNodeEngine::ComputeCustom function in the Web Audio subsystem in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read, memory corruption, and application crash) via crafted content. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:thunderbird:6.0.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:thunderbird:1.0 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:thunderbird:16.0 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:thunderbird:1.5 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:thunderbird:11.0 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:thunderbird:6.0.2 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:thunderbird:0.7.1 + cpe:/a:mozilla:thunderbird:0.7.2 + cpe:/a:mozilla:thunderbird:0.7.3 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:thunderbird:1.0.3 + cpe:/a:mozilla:thunderbird:1.5.2 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:thunderbird:1.0.4 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:thunderbird:1.0.5 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:thunderbird:1.0.6 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:thunderbird:3.1.15 + cpe:/a:mozilla:thunderbird:3.1.16 + cpe:/a:mozilla:thunderbird:3.1.17 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:thunderbird:1.0.2 + cpe:/a:mozilla:thunderbird:1.0.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:thunderbird:3.1.10 + cpe:/a:mozilla:thunderbird:1.5.1 + cpe:/a:mozilla:thunderbird:1.0.8 + cpe:/a:mozilla:thunderbird:1.0.7 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:thunderbird:3.1.14 + cpe:/a:mozilla:thunderbird:3.1.13 + cpe:/a:mozilla:thunderbird:3.1.12 + cpe:/a:mozilla:thunderbird:3.1.11 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:thunderbird:17.0.4 + cpe:/a:mozilla:seamonkey:2.25:- + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:thunderbird:12.0.1 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:thunderbird:1.5.0.3 + cpe:/a:mozilla:thunderbird:1.5.0.2 + cpe:/a:mozilla:thunderbird:1.5.0.1 + cpe:/a:mozilla:thunderbird:3.0.11 + cpe:/a:mozilla:thunderbird:3.0.10 + cpe:/a:mozilla:thunderbird:13.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:thunderbird:14.0 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:thunderbird:7.0 + cpe:/a:mozilla:thunderbird:8.0 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:thunderbird:0.2 + cpe:/a:mozilla:thunderbird:0.3 + cpe:/a:mozilla:thunderbird:0.4 + cpe:/a:mozilla:thunderbird:0.5 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:thunderbird:0.1 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:thunderbird:1.7.1 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:thunderbird:1.7.3 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:thunderbird:0.9 + cpe:/a:mozilla:thunderbird:0.8 + cpe:/a:mozilla:thunderbird:0.7 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:thunderbird:0.6 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:thunderbird:15.0.1 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:thunderbird:9.0 + cpe:/a:mozilla:thunderbird:6.0 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:28.0 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:thunderbird:12.0 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:thunderbird:15.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:thunderbird:24.0.1 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:thunderbird:2.0.0.5 + cpe:/a:mozilla:thunderbird:2.0.0.4 + cpe:/a:mozilla:thunderbird:2.0.0.7 + cpe:/a:mozilla:thunderbird:11.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.6 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:thunderbird:2.0.0.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:thunderbird:2.0.0.3 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:thunderbird:2.0.0.0 + cpe:/a:mozilla:thunderbird:2.0.0.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:thunderbird:1.5.0.9 + cpe:/a:mozilla:thunderbird:1.5.0.8 + cpe:/a:mozilla:thunderbird:1.5.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.6 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.8 + cpe:/a:mozilla:thunderbird:2.0.0.9 + cpe:/a:mozilla:thunderbird:16.0.2 + cpe:/a:mozilla:thunderbird:16.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:thunderbird:24.3 + cpe:/a:mozilla:thunderbird:24.2 + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox_esr:24.3 + cpe:/a:mozilla:thunderbird:3.0.9 + cpe:/a:mozilla:thunderbird:24.1 + cpe:/a:mozilla:thunderbird:24.0 + cpe:/a:mozilla:thunderbird:24.1.1 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:thunderbird:24.4 + cpe:/a:mozilla:firefox_esr:24.4 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:thunderbird:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:thunderbird:5.0 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:thunderbird:3.0.4 + cpe:/a:mozilla:thunderbird:3.0.3 + cpe:/a:mozilla:thunderbird:3.0.2 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:thunderbird:3.0.1 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:thunderbird:3.1.3 + cpe:/a:mozilla:thunderbird:3.1.2 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:thunderbird:3.1.1 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:thunderbird:3.1.4 + cpe:/a:mozilla:seamonkey:2.25:beta3 + cpe:/a:mozilla:thunderbird:3.1.5 + cpe:/a:mozilla:thunderbird:3.1.6 + cpe:/a:mozilla:thunderbird:3.1.7 + cpe:/a:mozilla:thunderbird:2.0.0.18 + cpe:/a:mozilla:thunderbird:2.0.0.17 + cpe:/a:mozilla:thunderbird:2.0.0.16 + cpe:/a:mozilla:thunderbird:2.0.0.15 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:thunderbird:3.0.5 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:thunderbird:3.0.6 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:thunderbird:3.0.7 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:thunderbird:3.0.8 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:thunderbird:3.0 + cpe:/a:mozilla:thunderbird:3.1 + cpe:/a:mozilla:thunderbird:1.0.5:beta + cpe:/a:mozilla:thunderbird:2.0.0.21 + cpe:/a:mozilla:thunderbird:2.0.0.20 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:thunderbird:2.0.0.11 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:thunderbird:2.0.0.12 + cpe:/a:mozilla:thunderbird:2.0.0.13 + cpe:/a:mozilla:thunderbird:2.0.0.14 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:thunderbird:3.1.9 + cpe:/a:mozilla:thunderbird:3.1.8 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:thunderbird:2.0.0.19 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:thunderbird:2.0.0.22 + cpe:/a:mozilla:thunderbird:2.0.0.23 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:thunderbird:1.5.0.10 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:thunderbird:1.5.0.13 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.14 + cpe:/a:mozilla:thunderbird:7.0.1 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.11 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:thunderbird:1.5.0.12 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:thunderbird:13.0.1 + cpe:/a:mozilla:thunderbird:2.0 + cpe:/a:mozilla:thunderbird:9.0.1 + cpe:/a:mozilla:thunderbird:10.0 + cpe:/a:mozilla:seamonkey:2.26:rc1 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:thunderbird:10.0.3 + cpe:/a:mozilla:thunderbird:10.0.4 + cpe:/a:mozilla:thunderbird:10.0.1 + cpe:/a:mozilla:thunderbird:10.0.2 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1523 + 2014-04-30T06:49:04.800-04:00 + 2014-04-30T12:24:23.030-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-30T12:24:19.860-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=969226 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-37.html + + Heap-based buffer overflow in the read_u32 function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG image. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:thunderbird:6.0.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:thunderbird:1.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:thunderbird:16.0 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:thunderbird:1.5 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:thunderbird:11.0 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:thunderbird:6.0.2 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:thunderbird:0.7.1 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:thunderbird:0.7.2 + cpe:/a:mozilla:thunderbird:0.7.3 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:thunderbird:1.5.2 + cpe:/a:mozilla:thunderbird:1.0.3 + cpe:/a:mozilla:thunderbird:1.0.4 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:thunderbird:1.0.5 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:thunderbird:1.0.6 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:thunderbird:3.1.15 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:thunderbird:3.1.16 + cpe:/a:mozilla:thunderbird:3.1.17 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:thunderbird:1.0.2 + cpe:/a:mozilla:thunderbird:1.0.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:thunderbird:3.1.10 + cpe:/a:mozilla:thunderbird:1.5.1 + cpe:/a:mozilla:thunderbird:1.0.8 + cpe:/a:mozilla:thunderbird:1.0.7 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:thunderbird:3.1.14 + cpe:/a:mozilla:thunderbird:3.1.13 + cpe:/a:mozilla:thunderbird:3.1.12 + cpe:/a:mozilla:thunderbird:3.1.11 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:thunderbird:17.0.4 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:seamonkey:2.25:- + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:thunderbird:12.0.1 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:thunderbird:1.5.0.3 + cpe:/a:mozilla:thunderbird:1.5.0.2 + cpe:/a:mozilla:thunderbird:1.5.0.1 + cpe:/a:mozilla:thunderbird:3.0.11 + cpe:/a:mozilla:thunderbird:3.0.10 + cpe:/a:mozilla:thunderbird:13.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:thunderbird:14.0 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:thunderbird:7.0 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:thunderbird:8.0 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:thunderbird:0.2 + cpe:/a:mozilla:thunderbird:0.3 + cpe:/a:mozilla:thunderbird:0.4 + cpe:/a:mozilla:thunderbird:0.5 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:thunderbird:0.1 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:thunderbird:1.7.1 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:thunderbird:1.7.3 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:thunderbird:0.9 + cpe:/a:mozilla:thunderbird:0.8 + cpe:/a:mozilla:thunderbird:0.7 + cpe:/a:mozilla:thunderbird:0.6 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:thunderbird:15.0.1 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:thunderbird:9.0 + cpe:/a:mozilla:thunderbird:6.0 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:28.0 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:thunderbird:12.0 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:thunderbird:15.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:thunderbird:24.0.1 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:thunderbird:2.0.0.5 + cpe:/a:mozilla:thunderbird:2.0.0.4 + cpe:/a:mozilla:thunderbird:2.0.0.7 + cpe:/a:mozilla:thunderbird:2.0.0.6 + cpe:/a:mozilla:thunderbird:11.0.1 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:thunderbird:2.0.0.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:thunderbird:2.0.0.3 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:thunderbird:2.0.0.0 + cpe:/a:mozilla:thunderbird:2.0.0.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:thunderbird:1.5.0.9 + cpe:/a:mozilla:thunderbird:1.5.0.8 + cpe:/a:mozilla:thunderbird:1.5.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.6 + cpe:/a:mozilla:thunderbird:2.0.0.8 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.9 + cpe:/a:mozilla:thunderbird:16.0.2 + cpe:/a:mozilla:thunderbird:16.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:thunderbird:24.3 + cpe:/a:mozilla:thunderbird:24.2 + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:thunderbird:24.1 + cpe:/a:mozilla:thunderbird:3.0.9 + cpe:/a:mozilla:firefox_esr:24.3 + cpe:/a:mozilla:thunderbird:24.0 + cpe:/a:mozilla:thunderbird:24.1.1 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:thunderbird:24.4 + cpe:/a:mozilla:firefox_esr:24.4 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:thunderbird:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:thunderbird:5.0 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:thunderbird:3.0.4 + cpe:/a:mozilla:thunderbird:3.0.3 + cpe:/a:mozilla:thunderbird:3.0.2 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:thunderbird:3.0.1 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:thunderbird:3.1.3 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:thunderbird:3.1.2 + cpe:/a:mozilla:thunderbird:3.1.1 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:thunderbird:3.1.4 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:thunderbird:3.1.5 + cpe:/a:mozilla:seamonkey:2.25:beta3 + cpe:/a:mozilla:thunderbird:3.1.6 + cpe:/a:mozilla:thunderbird:3.1.7 + cpe:/a:mozilla:thunderbird:2.0.0.18 + cpe:/a:mozilla:thunderbird:2.0.0.17 + cpe:/a:mozilla:thunderbird:2.0.0.16 + cpe:/a:mozilla:thunderbird:2.0.0.15 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:thunderbird:3.0.5 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:thunderbird:3.0.6 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:thunderbird:3.0.7 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:thunderbird:3.0.8 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:thunderbird:3.0 + cpe:/a:mozilla:thunderbird:3.1 + cpe:/a:mozilla:thunderbird:1.0.5:beta + cpe:/a:mozilla:thunderbird:2.0.0.21 + cpe:/a:mozilla:thunderbird:2.0.0.20 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:thunderbird:2.0.0.11 + cpe:/a:mozilla:thunderbird:2.0.0.12 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:thunderbird:2.0.0.13 + cpe:/a:mozilla:thunderbird:2.0.0.14 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:thunderbird:3.1.9 + cpe:/a:mozilla:thunderbird:3.1.8 + cpe:/a:mozilla:thunderbird:2.0.0.19 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:thunderbird:2.0.0.22 + cpe:/a:mozilla:thunderbird:2.0.0.23 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:thunderbird:1.5.0.10 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:thunderbird:1.5.0.13 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:thunderbird:7.0.1 + cpe:/a:mozilla:thunderbird:1.5.0.14 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.11 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:thunderbird:1.5.0.12 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:thunderbird:13.0.1 + cpe:/a:mozilla:thunderbird:2.0 + cpe:/a:mozilla:thunderbird:9.0.1 + cpe:/a:mozilla:thunderbird:10.0 + cpe:/a:mozilla:seamonkey:2.26:rc1 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:thunderbird:10.0.3 + cpe:/a:mozilla:thunderbird:10.0.4 + cpe:/a:mozilla:thunderbird:10.0.1 + cpe:/a:mozilla:thunderbird:10.0.2 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1524 + 2014-04-30T06:49:04.833-04:00 + 2014-04-30T12:33:27.033-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-30T12:33:24.253-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=989183 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-38.html + + The nsXBLProtoImpl::InstallImplementation function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 does not properly check whether objects are XBL objects, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted JavaScript code that accesses a non-XBL object as if it were an XBL object. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:28.0 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:seamonkey:2.25:- + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:seamonkey:2.25:beta3 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:seamonkey:2.26:rc1 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:7.0 + cpe:/a:mozilla:firefox:1.5.6 + + CVE-2014-1525 + 2014-04-30T06:49:04.863-04:00 + 2014-04-30T12:39:27.297-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-30T12:39:22.030-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=989210 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-39.html + + The mozilla::dom::TextTrack::AddCue function in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 does not properly perform garbage collection for Text Track Manager variables, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and heap memory corruption) via a crafted VIDEO element in an HTML document. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:28.0 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:seamonkey:2.25:- + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:seamonkey:2.25:beta3 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:seamonkey:2.26:rc1 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:7.0 + cpe:/a:mozilla:firefox:1.5.6 + + CVE-2014-1526 + 2014-04-30T06:49:04.880-04:00 + 2014-04-30T12:56:20.300-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-30T12:56:17.970-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=988106 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-47.html + + The XrayWrapper implementation in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allows user-assisted remote attackers to bypass intended access restrictions via a crafted web site that is visited in the debugger, leading to unwrapping operations and calls to DOM methods on the unwrapped objects. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:28.0 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1527 + 2014-04-30T06:49:04.910-04:00 + 2014-04-30T13:01:15.387-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-30T13:01:13.310-04:00 + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=960146 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-40.html + + Mozilla Firefox before 29.0 on Android allows remote attackers to spoof the address bar via crafted JavaScript code that uses DOM events to prevent the reemergence of the actual address bar after scrolling has taken it off of the screen. + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:28.0 + cpe:/a:mozilla:seamonkey:2.25:- + + CVE-2014-1528 + 2014-04-30T06:49:04.943-04:00 + 2014-04-30T13:07:51.433-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-30T13:07:51.277-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=963962 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-41.html + + The sse2_composite_src_x888_8888 function in Pixman, as used in Cairo in Mozilla Firefox 28.0 and SeaMonkey 2.25 on Windows, allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) by painting on a CANVAS element. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:thunderbird:6.0.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:thunderbird:1.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:thunderbird:16.0 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:thunderbird:1.5 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:thunderbird:11.0 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:thunderbird:6.0.2 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:thunderbird:0.7.1 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:thunderbird:0.7.2 + cpe:/a:mozilla:thunderbird:0.7.3 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:thunderbird:1.5.2 + cpe:/a:mozilla:thunderbird:1.0.3 + cpe:/a:mozilla:thunderbird:1.0.4 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:thunderbird:1.0.5 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:thunderbird:1.0.6 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:thunderbird:3.1.15 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:thunderbird:3.1.16 + cpe:/a:mozilla:thunderbird:3.1.17 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:thunderbird:1.0.2 + cpe:/a:mozilla:thunderbird:1.0.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:thunderbird:3.1.10 + cpe:/a:mozilla:thunderbird:1.5.1 + cpe:/a:mozilla:thunderbird:1.0.8 + cpe:/a:mozilla:thunderbird:1.0.7 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:thunderbird:3.1.14 + cpe:/a:mozilla:thunderbird:3.1.13 + cpe:/a:mozilla:thunderbird:3.1.12 + cpe:/a:mozilla:thunderbird:3.1.11 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:thunderbird:17.0.4 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:seamonkey:2.25:- + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:thunderbird:12.0.1 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:thunderbird:1.5.0.3 + cpe:/a:mozilla:thunderbird:1.5.0.2 + cpe:/a:mozilla:thunderbird:1.5.0.1 + cpe:/a:mozilla:thunderbird:3.0.11 + cpe:/a:mozilla:thunderbird:3.0.10 + cpe:/a:mozilla:thunderbird:13.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:thunderbird:14.0 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:thunderbird:7.0 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:thunderbird:8.0 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:thunderbird:0.2 + cpe:/a:mozilla:thunderbird:0.3 + cpe:/a:mozilla:thunderbird:0.4 + cpe:/a:mozilla:thunderbird:0.5 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:thunderbird:0.1 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:thunderbird:1.7.1 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:thunderbird:1.7.3 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:thunderbird:0.9 + cpe:/a:mozilla:thunderbird:0.8 + cpe:/a:mozilla:thunderbird:0.7 + cpe:/a:mozilla:thunderbird:0.6 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:thunderbird:15.0.1 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:thunderbird:9.0 + cpe:/a:mozilla:thunderbird:6.0 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:28.0 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:thunderbird:12.0 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:thunderbird:15.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:thunderbird:24.0.1 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:thunderbird:2.0.0.5 + cpe:/a:mozilla:thunderbird:2.0.0.4 + cpe:/a:mozilla:thunderbird:2.0.0.7 + cpe:/a:mozilla:thunderbird:2.0.0.6 + cpe:/a:mozilla:thunderbird:11.0.1 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:thunderbird:2.0.0.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:thunderbird:2.0.0.3 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:thunderbird:2.0.0.0 + cpe:/a:mozilla:thunderbird:2.0.0.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:thunderbird:1.5.0.9 + cpe:/a:mozilla:thunderbird:1.5.0.8 + cpe:/a:mozilla:thunderbird:1.5.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.6 + cpe:/a:mozilla:thunderbird:2.0.0.8 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.9 + cpe:/a:mozilla:thunderbird:16.0.2 + cpe:/a:mozilla:thunderbird:16.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:thunderbird:24.3 + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:thunderbird:24.2 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox_esr:24.3 + cpe:/a:mozilla:thunderbird:24.1 + cpe:/a:mozilla:thunderbird:3.0.9 + cpe:/a:mozilla:thunderbird:24.0 + cpe:/a:mozilla:thunderbird:24.1.1 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:thunderbird:24.4 + cpe:/a:mozilla:firefox_esr:24.4 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:thunderbird:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:thunderbird:5.0 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:thunderbird:3.0.4 + cpe:/a:mozilla:thunderbird:3.0.3 + cpe:/a:mozilla:thunderbird:3.0.2 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:thunderbird:3.0.1 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:thunderbird:3.1.3 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:thunderbird:3.1.2 + cpe:/a:mozilla:thunderbird:3.1.1 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:thunderbird:3.1.4 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:thunderbird:3.1.5 + cpe:/a:mozilla:seamonkey:2.25:beta3 + cpe:/a:mozilla:thunderbird:3.1.6 + cpe:/a:mozilla:thunderbird:3.1.7 + cpe:/a:mozilla:thunderbird:2.0.0.18 + cpe:/a:mozilla:thunderbird:2.0.0.17 + cpe:/a:mozilla:thunderbird:2.0.0.16 + cpe:/a:mozilla:thunderbird:2.0.0.15 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:thunderbird:3.0.5 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:thunderbird:3.0.6 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:thunderbird:3.0.7 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:thunderbird:3.0.8 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:thunderbird:3.0 + cpe:/a:mozilla:thunderbird:3.1 + cpe:/a:mozilla:thunderbird:1.0.5:beta + cpe:/a:mozilla:thunderbird:2.0.0.21 + cpe:/a:mozilla:thunderbird:2.0.0.20 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:thunderbird:2.0.0.11 + cpe:/a:mozilla:thunderbird:2.0.0.12 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:thunderbird:2.0.0.13 + cpe:/a:mozilla:thunderbird:2.0.0.14 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:thunderbird:3.1.9 + cpe:/a:mozilla:thunderbird:3.1.8 + cpe:/a:mozilla:thunderbird:2.0.0.19 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:thunderbird:2.0.0.22 + cpe:/a:mozilla:thunderbird:2.0.0.23 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:thunderbird:1.5.0.10 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:thunderbird:1.5.0.13 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:thunderbird:7.0.1 + cpe:/a:mozilla:thunderbird:1.5.0.14 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.11 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:thunderbird:1.5.0.12 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:thunderbird:13.0.1 + cpe:/a:mozilla:thunderbird:2.0 + cpe:/a:mozilla:thunderbird:9.0.1 + cpe:/a:mozilla:thunderbird:10.0 + cpe:/a:mozilla:seamonkey:2.26:rc1 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:thunderbird:10.0.3 + cpe:/a:mozilla:thunderbird:10.0.4 + cpe:/a:mozilla:thunderbird:10.0.1 + cpe:/a:mozilla:thunderbird:10.0.2 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1529 + 2014-04-30T06:49:04.973-04:00 + 2014-04-30T13:12:49.910-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-30T13:12:46.863-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=987003 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-42.html + + The Web Notification API in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to bypass intended source-component restrictions and execute arbitrary JavaScript code in a privileged context via a crafted web page for which Notification.permission is granted. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:thunderbird:6.0.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:thunderbird:1.0 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:thunderbird:16.0 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:thunderbird:1.5 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:thunderbird:11.0 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:thunderbird:6.0.2 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:thunderbird:0.7.1 + cpe:/a:mozilla:thunderbird:0.7.2 + cpe:/a:mozilla:thunderbird:0.7.3 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:thunderbird:1.0.3 + cpe:/a:mozilla:thunderbird:1.5.2 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:thunderbird:1.0.4 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:thunderbird:1.0.5 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:thunderbird:1.0.6 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:thunderbird:3.1.15 + cpe:/a:mozilla:thunderbird:3.1.16 + cpe:/a:mozilla:thunderbird:3.1.17 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:thunderbird:1.0.2 + cpe:/a:mozilla:thunderbird:1.0.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:thunderbird:3.1.10 + cpe:/a:mozilla:thunderbird:1.5.1 + cpe:/a:mozilla:thunderbird:1.0.8 + cpe:/a:mozilla:thunderbird:1.0.7 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:thunderbird:3.1.14 + cpe:/a:mozilla:thunderbird:3.1.13 + cpe:/a:mozilla:thunderbird:3.1.12 + cpe:/a:mozilla:thunderbird:3.1.11 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:thunderbird:17.0.4 + cpe:/a:mozilla:seamonkey:2.25:- + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:thunderbird:12.0.1 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:thunderbird:1.5.0.3 + cpe:/a:mozilla:thunderbird:1.5.0.2 + cpe:/a:mozilla:thunderbird:1.5.0.1 + cpe:/a:mozilla:thunderbird:3.0.11 + cpe:/a:mozilla:thunderbird:3.0.10 + cpe:/a:mozilla:thunderbird:13.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:thunderbird:14.0 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:thunderbird:7.0 + cpe:/a:mozilla:thunderbird:8.0 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:thunderbird:0.2 + cpe:/a:mozilla:thunderbird:0.3 + cpe:/a:mozilla:thunderbird:0.4 + cpe:/a:mozilla:thunderbird:0.5 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:thunderbird:0.1 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:thunderbird:1.7.1 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:thunderbird:1.7.3 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:thunderbird:0.9 + cpe:/a:mozilla:thunderbird:0.8 + cpe:/a:mozilla:thunderbird:0.7 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:thunderbird:0.6 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:thunderbird:15.0.1 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:thunderbird:9.0 + cpe:/a:mozilla:thunderbird:6.0 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:28.0 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:thunderbird:12.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:thunderbird:15.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:thunderbird:24.0.1 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:thunderbird:2.0.0.5 + cpe:/a:mozilla:thunderbird:2.0.0.4 + cpe:/a:mozilla:thunderbird:2.0.0.7 + cpe:/a:mozilla:thunderbird:11.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.6 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:thunderbird:2.0.0.2 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:thunderbird:2.0.0.3 + cpe:/a:mozilla:thunderbird:2.0.0.0 + cpe:/a:mozilla:thunderbird:2.0.0.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:thunderbird:1.5.0.9 + cpe:/a:mozilla:thunderbird:1.5.0.8 + cpe:/a:mozilla:thunderbird:1.5.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.6 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.8 + cpe:/a:mozilla:thunderbird:2.0.0.9 + cpe:/a:mozilla:thunderbird:16.0.2 + cpe:/a:mozilla:thunderbird:16.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:thunderbird:24.3 + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:thunderbird:24.2 + cpe:/a:mozilla:firefox_esr:24.3 + cpe:/a:mozilla:thunderbird:3.0.9 + cpe:/a:mozilla:thunderbird:24.1 + cpe:/a:mozilla:thunderbird:24.0 + cpe:/a:mozilla:thunderbird:24.1.1 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:thunderbird:24.4 + cpe:/a:mozilla:firefox_esr:24.4 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:thunderbird:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:thunderbird:5.0 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:thunderbird:3.0.4 + cpe:/a:mozilla:thunderbird:3.0.3 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:thunderbird:3.0.2 + cpe:/a:mozilla:thunderbird:3.0.1 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:thunderbird:3.1.3 + cpe:/a:mozilla:thunderbird:3.1.2 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:thunderbird:3.1.1 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:thunderbird:3.1.4 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:thunderbird:3.1.5 + cpe:/a:mozilla:seamonkey:2.25:beta3 + cpe:/a:mozilla:thunderbird:3.1.6 + cpe:/a:mozilla:thunderbird:3.1.7 + cpe:/a:mozilla:thunderbird:2.0.0.18 + cpe:/a:mozilla:thunderbird:2.0.0.17 + cpe:/a:mozilla:thunderbird:2.0.0.16 + cpe:/a:mozilla:thunderbird:2.0.0.15 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:thunderbird:3.0.5 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:thunderbird:3.0.6 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:thunderbird:3.0.7 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:thunderbird:3.0.8 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:thunderbird:3.0 + cpe:/a:mozilla:thunderbird:3.1 + cpe:/a:mozilla:thunderbird:1.0.5:beta + cpe:/a:mozilla:thunderbird:2.0.0.21 + cpe:/a:mozilla:thunderbird:2.0.0.20 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:thunderbird:2.0.0.11 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:thunderbird:2.0.0.12 + cpe:/a:mozilla:thunderbird:2.0.0.13 + cpe:/a:mozilla:thunderbird:2.0.0.14 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:thunderbird:3.1.9 + cpe:/a:mozilla:thunderbird:3.1.8 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:thunderbird:2.0.0.19 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:thunderbird:2.0.0.22 + cpe:/a:mozilla:thunderbird:2.0.0.23 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:thunderbird:1.5.0.10 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.13 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.14 + cpe:/a:mozilla:thunderbird:7.0.1 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:thunderbird:1.5.0.11 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.12 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:thunderbird:13.0.1 + cpe:/a:mozilla:thunderbird:2.0 + cpe:/a:mozilla:thunderbird:9.0.1 + cpe:/a:mozilla:thunderbird:10.0 + cpe:/a:mozilla:seamonkey:2.26:rc1 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:thunderbird:10.0.3 + cpe:/a:mozilla:thunderbird:10.0.4 + cpe:/a:mozilla:thunderbird:10.0.1 + cpe:/a:mozilla:thunderbird:10.0.2 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1530 + 2014-04-30T06:49:05.003-04:00 + 2014-04-30T13:19:08.407-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-30T13:19:05.297-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=895557 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-43.html + + The docshell implementation in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to trigger the loading of a URL with a spoofed baseURI property, and conduct cross-site scripting (XSS) attacks, via a crafted web site that performs history navigation. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:thunderbird:6.0.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:thunderbird:1.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:thunderbird:16.0 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:thunderbird:1.5 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:thunderbird:11.0 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:thunderbird:6.0.2 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:thunderbird:0.7.1 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:thunderbird:0.7.2 + cpe:/a:mozilla:thunderbird:0.7.3 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:thunderbird:1.0.3 + cpe:/a:mozilla:thunderbird:1.5.2 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:thunderbird:1.0.4 + cpe:/a:mozilla:thunderbird:1.0.5 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:thunderbird:1.0.6 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:thunderbird:3.1.15 + cpe:/a:mozilla:thunderbird:3.1.16 + cpe:/a:mozilla:thunderbird:3.1.17 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:thunderbird:1.0.2 + cpe:/a:mozilla:thunderbird:1.0.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:thunderbird:3.1.10 + cpe:/a:mozilla:thunderbird:1.5.1 + cpe:/a:mozilla:thunderbird:1.0.8 + cpe:/a:mozilla:thunderbird:1.0.7 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:thunderbird:3.1.14 + cpe:/a:mozilla:thunderbird:3.1.13 + cpe:/a:mozilla:thunderbird:3.1.12 + cpe:/a:mozilla:thunderbird:3.1.11 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:thunderbird:17.0.4 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:seamonkey:2.25:- + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:thunderbird:12.0.1 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:thunderbird:1.5.0.3 + cpe:/a:mozilla:thunderbird:1.5.0.2 + cpe:/a:mozilla:thunderbird:1.5.0.1 + cpe:/a:mozilla:thunderbird:3.0.11 + cpe:/a:mozilla:thunderbird:3.0.10 + cpe:/a:mozilla:thunderbird:13.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:thunderbird:14.0 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:thunderbird:7.0 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:thunderbird:8.0 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:thunderbird:0.2 + cpe:/a:mozilla:thunderbird:0.3 + cpe:/a:mozilla:thunderbird:0.4 + cpe:/a:mozilla:thunderbird:0.5 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:thunderbird:0.1 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:thunderbird:1.7.1 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:thunderbird:1.7.3 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:thunderbird:0.9 + cpe:/a:mozilla:thunderbird:0.8 + cpe:/a:mozilla:thunderbird:0.7 + cpe:/a:mozilla:thunderbird:0.6 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:thunderbird:15.0.1 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:thunderbird:9.0 + cpe:/a:mozilla:thunderbird:6.0 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:28.0 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:thunderbird:12.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:thunderbird:15.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:thunderbird:24.0.1 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:thunderbird:2.0.0.5 + cpe:/a:mozilla:thunderbird:2.0.0.4 + cpe:/a:mozilla:thunderbird:2.0.0.7 + cpe:/a:mozilla:thunderbird:2.0.0.6 + cpe:/a:mozilla:thunderbird:11.0.1 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:thunderbird:2.0.0.2 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:thunderbird:2.0.0.3 + cpe:/a:mozilla:thunderbird:2.0.0.0 + cpe:/a:mozilla:thunderbird:2.0.0.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:thunderbird:1.5.0.9 + cpe:/a:mozilla:thunderbird:1.5.0.8 + cpe:/a:mozilla:thunderbird:1.5.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.6 + cpe:/a:mozilla:thunderbird:2.0.0.8 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.9 + cpe:/a:mozilla:thunderbird:16.0.2 + cpe:/a:mozilla:thunderbird:16.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:thunderbird:24.3 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:thunderbird:24.2 + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:thunderbird:24.1 + cpe:/a:mozilla:thunderbird:3.0.9 + cpe:/a:mozilla:firefox_esr:24.3 + cpe:/a:mozilla:thunderbird:24.0 + cpe:/a:mozilla:thunderbird:24.1.1 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:thunderbird:24.4 + cpe:/a:mozilla:firefox_esr:24.4 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:thunderbird:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:thunderbird:5.0 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:thunderbird:3.0.4 + cpe:/a:mozilla:thunderbird:3.0.3 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:thunderbird:3.0.2 + cpe:/a:mozilla:thunderbird:3.0.1 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:thunderbird:3.1.3 + cpe:/a:mozilla:thunderbird:3.1.2 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:thunderbird:3.1.1 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:thunderbird:3.1.4 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:thunderbird:3.1.5 + cpe:/a:mozilla:seamonkey:2.25:beta3 + cpe:/a:mozilla:thunderbird:3.1.6 + cpe:/a:mozilla:thunderbird:3.1.7 + cpe:/a:mozilla:thunderbird:2.0.0.18 + cpe:/a:mozilla:thunderbird:2.0.0.17 + cpe:/a:mozilla:thunderbird:2.0.0.16 + cpe:/a:mozilla:thunderbird:2.0.0.15 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:thunderbird:3.0.5 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:thunderbird:3.0.6 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:thunderbird:3.0.7 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:thunderbird:3.0.8 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:thunderbird:3.0 + cpe:/a:mozilla:thunderbird:3.1 + cpe:/a:mozilla:thunderbird:1.0.5:beta + cpe:/a:mozilla:thunderbird:2.0.0.21 + cpe:/a:mozilla:thunderbird:2.0.0.20 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:thunderbird:2.0.0.11 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:thunderbird:2.0.0.12 + cpe:/a:mozilla:thunderbird:2.0.0.13 + cpe:/a:mozilla:thunderbird:2.0.0.14 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:thunderbird:3.1.9 + cpe:/a:mozilla:thunderbird:3.1.8 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:thunderbird:2.0.0.19 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:thunderbird:2.0.0.22 + cpe:/a:mozilla:thunderbird:2.0.0.23 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:thunderbird:1.5.0.10 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:thunderbird:1.5.0.13 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:thunderbird:7.0.1 + cpe:/a:mozilla:thunderbird:1.5.0.14 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.11 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:thunderbird:1.5.0.12 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:thunderbird:13.0.1 + cpe:/a:mozilla:thunderbird:2.0 + cpe:/a:mozilla:thunderbird:9.0.1 + cpe:/a:mozilla:thunderbird:10.0 + cpe:/a:mozilla:seamonkey:2.26:rc1 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:thunderbird:10.0.3 + cpe:/a:mozilla:thunderbird:10.0.4 + cpe:/a:mozilla:thunderbird:10.0.1 + cpe:/a:mozilla:thunderbird:10.0.2 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1531 + 2014-04-30T06:49:05.037-04:00 + 2014-04-30T13:44:36.193-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-30T13:44:32.600-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=987140 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-44.html + + Use-after-free vulnerability in the nsGenericHTMLElement::GetWidthHeightForImage function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving an imgLoader object that is not properly handled during an image-resize operation. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:thunderbird:6.0.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:thunderbird:1.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:thunderbird:16.0 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:thunderbird:1.5 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:thunderbird:11.0 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:thunderbird:6.0.2 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:thunderbird:0.7.1 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:thunderbird:0.7.2 + cpe:/a:mozilla:thunderbird:0.7.3 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:thunderbird:1.5.2 + cpe:/a:mozilla:thunderbird:1.0.3 + cpe:/a:mozilla:thunderbird:1.0.4 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:thunderbird:1.0.5 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:thunderbird:1.0.6 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:thunderbird:3.1.15 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:thunderbird:3.1.16 + cpe:/a:mozilla:thunderbird:3.1.17 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:thunderbird:1.0.2 + cpe:/a:mozilla:thunderbird:1.0.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:thunderbird:3.1.10 + cpe:/a:mozilla:thunderbird:1.5.1 + cpe:/a:mozilla:thunderbird:1.0.8 + cpe:/a:mozilla:thunderbird:1.0.7 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:thunderbird:3.1.14 + cpe:/a:mozilla:thunderbird:3.1.13 + cpe:/a:mozilla:thunderbird:3.1.12 + cpe:/a:mozilla:thunderbird:3.1.11 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:thunderbird:17.0.4 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:seamonkey:2.25:- + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:thunderbird:12.0.1 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:thunderbird:1.5.0.3 + cpe:/a:mozilla:thunderbird:1.5.0.2 + cpe:/a:mozilla:thunderbird:1.5.0.1 + cpe:/a:mozilla:thunderbird:3.0.11 + cpe:/a:mozilla:thunderbird:3.0.10 + cpe:/a:mozilla:thunderbird:13.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:thunderbird:14.0 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:thunderbird:7.0 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:thunderbird:8.0 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:thunderbird:0.2 + cpe:/a:mozilla:thunderbird:0.3 + cpe:/a:mozilla:thunderbird:0.4 + cpe:/a:mozilla:thunderbird:0.5 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:thunderbird:0.1 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:thunderbird:1.7.1 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:thunderbird:1.7.3 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:thunderbird:0.9 + cpe:/a:mozilla:thunderbird:0.8 + cpe:/a:mozilla:thunderbird:0.7 + cpe:/a:mozilla:thunderbird:0.6 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:thunderbird:15.0.1 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:thunderbird:9.0 + cpe:/a:mozilla:thunderbird:6.0 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:28.0 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:thunderbird:12.0 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:thunderbird:15.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:thunderbird:24.0.1 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:thunderbird:2.0.0.5 + cpe:/a:mozilla:thunderbird:2.0.0.4 + cpe:/a:mozilla:thunderbird:2.0.0.7 + cpe:/a:mozilla:thunderbird:2.0.0.6 + cpe:/a:mozilla:thunderbird:11.0.1 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:thunderbird:2.0.0.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:thunderbird:2.0.0.3 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:thunderbird:2.0.0.0 + cpe:/a:mozilla:thunderbird:2.0.0.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:thunderbird:1.5.0.9 + cpe:/a:mozilla:thunderbird:1.5.0.8 + cpe:/a:mozilla:thunderbird:1.5.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.6 + cpe:/a:mozilla:thunderbird:2.0.0.8 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.9 + cpe:/a:mozilla:thunderbird:16.0.2 + cpe:/a:mozilla:thunderbird:16.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:thunderbird:24.3 + cpe:/a:mozilla:thunderbird:24.2 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:thunderbird:24.1 + cpe:/a:mozilla:thunderbird:3.0.9 + cpe:/a:mozilla:firefox_esr:24.3 + cpe:/a:mozilla:thunderbird:24.0 + cpe:/a:mozilla:thunderbird:24.1.1 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:thunderbird:24.4 + cpe:/a:mozilla:firefox_esr:24.4 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:thunderbird:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:thunderbird:5.0 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:thunderbird:3.0.4 + cpe:/a:mozilla:thunderbird:3.0.3 + cpe:/a:mozilla:thunderbird:3.0.2 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:thunderbird:3.0.1 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:thunderbird:3.1.3 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:thunderbird:3.1.2 + cpe:/a:mozilla:thunderbird:3.1.1 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:thunderbird:3.1.4 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:thunderbird:3.1.5 + cpe:/a:mozilla:seamonkey:2.25:beta3 + cpe:/a:mozilla:thunderbird:3.1.6 + cpe:/a:mozilla:thunderbird:3.1.7 + cpe:/a:mozilla:thunderbird:2.0.0.18 + cpe:/a:mozilla:thunderbird:2.0.0.17 + cpe:/a:mozilla:thunderbird:2.0.0.16 + cpe:/a:mozilla:thunderbird:2.0.0.15 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:thunderbird:3.0.5 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:thunderbird:3.0.6 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:thunderbird:3.0.7 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:thunderbird:3.0.8 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:thunderbird:3.0 + cpe:/a:mozilla:thunderbird:3.1 + cpe:/a:mozilla:thunderbird:1.0.5:beta + cpe:/a:mozilla:thunderbird:2.0.0.21 + cpe:/a:mozilla:thunderbird:2.0.0.20 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:thunderbird:2.0.0.11 + cpe:/a:mozilla:thunderbird:2.0.0.12 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:thunderbird:2.0.0.13 + cpe:/a:mozilla:thunderbird:2.0.0.14 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:thunderbird:3.1.9 + cpe:/a:mozilla:thunderbird:3.1.8 + cpe:/a:mozilla:thunderbird:2.0.0.19 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:thunderbird:2.0.0.22 + cpe:/a:mozilla:thunderbird:2.0.0.23 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:thunderbird:1.5.0.10 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:thunderbird:1.5.0.13 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:thunderbird:7.0.1 + cpe:/a:mozilla:thunderbird:1.5.0.14 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.11 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:thunderbird:1.5.0.12 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:thunderbird:13.0.1 + cpe:/a:mozilla:thunderbird:2.0 + cpe:/a:mozilla:thunderbird:9.0.1 + cpe:/a:mozilla:thunderbird:10.0 + cpe:/a:mozilla:seamonkey:2.26:rc1 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:thunderbird:10.0.3 + cpe:/a:mozilla:thunderbird:10.0.4 + cpe:/a:mozilla:thunderbird:10.0.1 + cpe:/a:mozilla:thunderbird:10.0.2 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1532 + 2014-04-30T06:49:05.067-04:00 + 2014-04-30T13:51:29.847-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-30T13:51:26.927-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=966006 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-46.html + + Use-after-free vulnerability in the nsHostResolver::ConditionallyRefreshRecord function in libxul.so in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors related to host resolution. + + + + + + + + + + + + + + + + + cpe:/a:i-doit:i-doit:1.1.2::~~pro~~~ + cpe:/a:i-doit:i-doit:1.1.1::~~pro~~~ + cpe:/a:i-doit:i-doit:1.0::~~pro~~~ + cpe:/a:i-doit:i-doit:1.0.2::~~pro~~~ + cpe:/a:i-doit:i-doit:1.2.4::~~pro~~~ + cpe:/a:i-doit:i-doit:-::~~open~~~ + cpe:/a:i-doit:i-doit:1.2.1::~~pro~~~ + cpe:/a:i-doit:i-doit:1.2.2::~~pro~~~ + cpe:/a:i-doit:i-doit:1.2.3::~~pro~~~ + + CVE-2014-1597 + 2014-02-27T10:55:15.483-05:00 + 2014-02-28T10:25:42.487-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-28T10:25:42.427-05:00 + + + + + XF + idoit-cve20141597-sql-injection(91269) + + + BID + 65557 + + + CONFIRM + http://www.i-doit.com/en/company/news/single-news/?tx_ttnews%5Btt_news%5D=141 + + + MISC + http://www.csnc.ch/misc/files/advisories/CVE-2014-1597_i-doit_SQL_Injection.txt + + + SECUNIA + 56931 + + + FULLDISC + 20140217 SQL Injection i-doit Pro (CVE-2014-1597) + + SQL injection vulnerability in the CMDB web application in synetics i-doit pro before 1.2.5 and i-doit open allows remote attackers to execute arbitrary SQL commands via the objID parameter to the default URI. + + + + + + + + + + + + + + cpe:/o:sfr:sfr_box_router_firmware:nb6-main-r3.3.4 + cpe:/h:sfr:sfr_box_router:- + + CVE-2014-1599 + 2014-03-09T09:16:56.773-04:00 + 2014-03-10T12:07:40.987-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-10T12:07:40.863-04:00 + + + + + BUGTRAQ + 20140305 CVE-2014-1599 - 39 Type-1 XSS in SFR DSL/Fiber Box + + Multiple cross-site scripting (XSS) vulnerabilities in the SFR Box router with firmware NB6-MAIN-R3.3.4 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) dns, (2) dhcp, (3) nat, (4) route, or (5) lan in network/; or (6) wifi/config. + + + + + + + + + cpe:/a:python:rply:0.7.0 + + CVE-2014-1604 + 2014-01-27T19:55:04.037-05:00 + 2014-01-28T12:22:39.253-05:00 + + + 2.1 + LOCAL + LOW + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-28T12:22:39.207-05:00 + + + + CONFIRM + https://github.com/alex/rply/commit/fc9bbcd25b0b4f09bbd6339f710ad24c129d5d7c + + + XF + rply-cve20141604-insecure-permissions(90593) + + + OSVDB + 102202 + + + MLIST + [oss-security] 20140117 Re: Fwd: [Python-modules-team] Bug#735263: python-rply: insecure use of /tmp + + + MLIST + [oss-security] 20140114 Fwd: [Python-modules-team] Bug#735263: python-rply: insecure use of /tmp + + + SECUNIA + 56429 + + + CONFIRM + http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=735263 + + The parser cache functionality in parsergenerator.py in RPLY (aka python-rply) before 0.7.1 allows local users to spoof cache data by pre-creating a temporary rply-*.json file with a predictable name. + + + + + + + + + cpe:/a:drupal:drupal:7.14 + + CVE-2014-1607 + 2014-01-26T15:55:06.690-05:00 + 2014-01-31T01:08:28.423-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-27T13:44:35.717-05:00 + + + + + MISC + https://groups.drupal.org/node/402023 + + + BUGTRAQ + 20140123 [CVE-2014-1607.] Cross Site Scripting(XSS) in Drupal Event calendar module + + ** DISPUTED ** Cross-site scripting (XSS) vulnerability in the EventCalendar module for Drupal 7.14 allows remote attackers to inject arbitrary web script or HTML via the year parameter to eventcalander/. NOTE: this issue has been disputed by the Drupal Security Team; it may be site-specific. If so, then this CVE will be REJECTed in the future. + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mantisbt:mantisbt:1.2.0 + cpe:/a:mantisbt:mantisbt:1.2.0:a1 + cpe:/a:mantisbt:mantisbt:1.2.0:a2 + cpe:/a:mantisbt:mantisbt:1.2.0:a3 + cpe:/a:mantisbt:mantisbt:1.2.4 + cpe:/a:mantisbt:mantisbt:1.2.5 + cpe:/a:mantisbt:mantisbt:1.2.6 + cpe:/a:mantisbt:mantisbt:1.2.7 + cpe:/a:mantisbt:mantisbt:1.2.8 + cpe:/a:mantisbt:mantisbt:1.2.15 + cpe:/a:mantisbt:mantisbt:1.2.14 + cpe:/a:mantisbt:mantisbt:1.2.13 + cpe:/a:mantisbt:mantisbt:1.2.10 + cpe:/a:mantisbt:mantisbt:1.2.11 + cpe:/a:mantisbt:mantisbt:1.2.9 + cpe:/a:mantisbt:mantisbt:1.2.2 + cpe:/a:mantisbt:mantisbt:1.2.0:rc1 + cpe:/a:mantisbt:mantisbt:1.2.3 + cpe:/a:mantisbt:mantisbt:1.2.0:rc2 + cpe:/a:mantisbt:mantisbt:1.2.1 + + CVE-2014-1608 + 2014-03-18T13:03:00.467-04:00 + 2014-03-19T10:16:16.537-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-19T10:16:16.443-04:00 + + + + + MISC + http://www.ocert.org/advisories/ocert-2014-001.html + + + CONFIRM + https://github.com/mantisbt/mantisbt/commit/00b4c17088fa56594d85fe46b6c6057bb3421102 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1063111 + + + BID + 65445 + + + CONFIRM + http://www.mantisbt.org/bugs/view.php?id=16879 + + SQL injection vulnerability in the mci_file_get function in api/soap/mc_file_api.php in MantisBT before 1.2.16 allows remote attackers to execute arbitrary SQL commands via a crafted envelope tag in a mc_issue_attachment_get SOAP request. + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mantisbt:mantisbt:1.2.0 + cpe:/a:mantisbt:mantisbt:1.2.0:a1 + cpe:/a:mantisbt:mantisbt:1.2.0:a2 + cpe:/a:mantisbt:mantisbt:1.2.0:a3 + cpe:/a:mantisbt:mantisbt:1.2.4 + cpe:/a:mantisbt:mantisbt:1.2.5 + cpe:/a:mantisbt:mantisbt:1.2.6 + cpe:/a:mantisbt:mantisbt:1.2.7 + cpe:/a:mantisbt:mantisbt:1.2.8 + cpe:/a:mantisbt:mantisbt:1.2.15 + cpe:/a:mantisbt:mantisbt:1.2.14 + cpe:/a:mantisbt:mantisbt:1.2.13 + cpe:/a:mantisbt:mantisbt:1.2.10 + cpe:/a:mantisbt:mantisbt:1.2.11 + cpe:/a:mantisbt:mantisbt:1.2.9 + cpe:/a:mantisbt:mantisbt:1.2.2 + cpe:/a:mantisbt:mantisbt:1.2.0:rc1 + cpe:/a:mantisbt:mantisbt:1.2.3 + cpe:/a:mantisbt:mantisbt:1.2.0:rc2 + cpe:/a:mantisbt:mantisbt:1.2.1 + + CVE-2014-1609 + 2014-03-20T12:55:12.323-04:00 + 2014-03-20T14:51:46.340-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-20T14:50:02.900-04:00 + + + + + MISC + http://www.ocert.org/advisories/ocert-2014-001.html + + + CONFIRM + https://github.com/mantisbt/mantisbt/commit/7efe0175f0853e18ebfacedfd2374c4179028b3f + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1063111 + + + BID + 65461 + + + CONFIRM + http://www.mantisbt.org/bugs/view.php?id=16880 + + Multiple SQL injection vulnerabilities in MantisBT before 1.2.16 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to the (1) mc_project_get_attachments function in api/soap/mc_project_api.php; the (2) news_get_limited_rows function in core/news_api.php; the (3) summary_print_by_enum, (4) summary_print_by_age, (5) summary_print_by_developer, (6) summary_print_by_reporter, or (7) summary_print_by_category function in core/summary_api.php; the (8) create_bug_enum_summary or (9) enum_bug_group function in plugins/MantisGraph/core/graph_api.php; (10) bug_graph_bycategory.php or (11) bug_graph_bystatus.php in plugins/MantisGraph/pages/; or (12) proj_doc_page.php, related to use of the db_query function, a different vulnerability than CVE-2014-1608. + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mediawiki:mediawiki:1.19.0 + cpe:/a:mediawiki:mediawiki:1.21.1 + cpe:/a:mediawiki:mediawiki:1.19.9 + cpe:/a:mediawiki:mediawiki:1.19.5 + cpe:/a:mediawiki:mediawiki:1.19.4 + cpe:/a:mediawiki:mediawiki:1.19.7 + cpe:/a:mediawiki:mediawiki:1.19.6 + cpe:/a:mediawiki:mediawiki:1.19.1 + cpe:/a:mediawiki:mediawiki:1.22.0 + cpe:/a:mediawiki:mediawiki:1.19.3 + cpe:/a:mediawiki:mediawiki:1.19.2 + cpe:/a:mediawiki:mediawiki:1.19.10 + cpe:/a:mediawiki:mediawiki:1.21.3 + cpe:/a:mediawiki:mediawiki:1.22.1 + cpe:/a:mediawiki:mediawiki:1.19.8 + cpe:/a:mediawiki:mediawiki:1.21.4 + cpe:/a:mediawiki:mediawiki:1.21.2 + + CVE-2014-1610 + 2014-01-30T18:55:02.413-05:00 + 2014-04-19T00:47:46.783-04:00 + + + 6.0 + NETWORK + MEDIUM + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-31T13:46:03.910-05:00 + + + + + MISC + https://gerrit.wikimedia.org/r/#/c/110215/ + + + MISC + https://gerrit.wikimedia.org/r/#/c/110069/2/includes/media/Bitmap.php + + + MISC + https://gerrit.wikimedia.org/r/#/c/110069/ + + + CONFIRM + https://bugzilla.wikimedia.org/show_bug.cgi?id=60339 + + + MISC + https://bugzilla.wikimedia.org/attachment.cgi?id=14384&action=diff + + + MISC + https://bugzilla.wikimedia.org/attachment.cgi?id=14361&action=diff + + + SECTRACK + 1029707 + + + BID + 65223 + + + OSVDB + 102631 + + + EXPLOIT-DB + 31329 + + + DEBIAN + DSA-2891 + + + MISC + http://www.checkpoint.com/threatcloud-central/articles/2014-01-28-tc-researchers-discover.html + + + MISC + http://www.checkpoint.com/defense/advisories/public/2014/cpai-26-jan.html + + + SECUNIA + 57472 + + + SECUNIA + 56695 + + + OSVDB + 102630 + + + MLIST + [MediaWiki-announce] 20140128 MediaWiki Security Releases: 1.22.2, 1.21.5 and 1.19.11 + + + FEDORA + FEDORA-2014-1745 + + + FEDORA + FEDORA-2014-1802 + + MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5 and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php. + + + + + + + + + + + + + + + cpe:/a:anonymous_posting_project:anonymous_posting:7.x-1.3 + cpe:/a:anonymous_posting_project:anonymous_posting:7.x-1.2 + + CVE-2014-1611 + 2014-01-30T13:55:03.580-05:00 + 2014-02-21T13:37:16.577-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-30T20:57:36.000-05:00 + + + + + CONFIRM + https://drupal.org/node/2173437 + + + MISC + https://drupal.org/node/2173321 + + + XF + anonymousposting-contactname-xss(90526) + + + SECUNIA + 56476 + + + FULLDISC + 20140115 [Security-news] SA-CONTRIB-2014-002 - Anonymous Posting - Cross Site Scripting (XSS) + + + MISC + http://packetstormsecurity.com/files/124803/Drupal-Anonymous-Posting-7.x-Cross-Site-Scripting.html + + + OSVDB + 102126 + + Cross-site scripting (XSS) vulnerability in the Anonymous Posting module 7.x-1.2 and 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via the contact name field. + + + + + + + + + + + + + + cpe:/h:media5:mediatrix_voip_gateway:4402 + cpe:/a:media5:mediatrix_voip_gateway_4402_firmware:dgw_1.1.13.186 + + CVE-2014-1612 + 2014-01-30T13:55:03.627-05:00 + 2014-02-21T00:06:42.127-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-31T12:15:06.950-05:00 + + + + + CERT-VN + VU#252294 + + + XF + mediatrixwebmanagement-cve20141612-xss(90656) + + + BUGTRAQ + 20140123 Reflected cross-site scripting (XSS) vulnerability in Mediatrix Web Management Interface login page + + + SECUNIA + 56638 + + + MISC + http://packetstormsecurity.com/files/124931/Mediatrix-4402-Cross-Site-Scripting.html + + + OSVDB + 102415 + + Cross-site scripting (XSS) vulnerability in login.esp in the Web Management Interface in Media5 Mediatrix 4402 VoIP Gateway with firmware Dgw 1.1.13.186 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter. + + + + + + + + + + + cpe:/a:carbonblack:carbon_black:4.1.0:beta2 + cpe:/a:carbonblack:carbon_black:4.1.0:beta1 + cpe:/a:carbonblack:carbon_black:4.0.3 + + CVE-2014-1615 + 2014-04-22T10:23:35.283-04:00 + 2014-04-23T08:36:53.820-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-23T08:36:53.743-04:00 + + + + + MISC + http://www.secureworks.com/advisories/SWRX-2014-007/SWRX-2014-007.pdf + + + SECUNIA + 57645 + + Multiple cross-site request forgery (CSRF) vulnerabilities in Carbon Black before 4.1.0 allow remote attackers to hijack the authentication of administrators for requests that add new administrative users and have other unspecified action, as demonstrated by a request to api/user. + + + + + + + + + cpe:/a:uaepd:shopping_cart_script:- + + CVE-2014-1618 + 2014-01-21T10:17:12.477-05:00 + 2014-01-22T13:51:52.447-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-22T13:51:52.400-05:00 + + + + + XF + uaepd-multiple-sql-injection(90214) + + + BID + 64734 + + + MISC + http://www.iphobos.com/blog/2014/01/04/uaepd-script-multiple-sql-injection-vulnerabilty + + + SECUNIA + 56351 + + + MISC + http://packetstormsecurity.com/files/124723/uaepdshopping-sql.txt + + + OSVDB + 101900 + + + OSVDB + 101899 + + + OSVDB + 101859 + + Multiple SQL injection vulnerabilities in UAEPD Shopping Cart Script allow remote attackers to execute arbitrary SQL commands via the (1) cat_id or (2) p_id parameter to products.php or id parameter to (3) page.php or (4) news.php. + + + + + + + + + + + cpe:/a:cubicfactory:cubic_cms:5.2 + cpe:/a:cubicfactory:cubic_cms:5.1.1 + cpe:/a:cubicfactory:cubic_cms:5.1.2 + + CVE-2014-1619 + 2014-01-21T10:17:12.727-05:00 + 2014-01-22T14:01:14.883-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-22T14:01:14.853-05:00 + + + + + XF + cubiccms-agent-login-sql-injection(90153) + + + CONFIRM + http://www.cubicfactory.com/es/cubic-cms/changelog/id/260 + + + MISC + http://packetstormsecurity.com/files/124652 + + + OSVDB + 101721 + + + OSVDB + 101719 + + Multiple SQL injection vulnerabilities in Cubic CMS 5.1.1, 5.1.2, and 5.2 allow remote attackers to execute arbitrary SQL commands via the (1) resource_id or (2) version_id parameter to recursos/agent.php or (3) login or (4) pass parameter to login.usuario. + + + + + + + + + cpe:/a:hiox:hiox_guest_book:5.0 + + CVE-2014-1620 + 2014-01-21T10:17:12.760-05:00 + 2014-01-22T14:07:44.190-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-22T14:07:42.907-05:00 + + + + + XF + hiox-guestbook-add-xss(90156) + + + MISC + http://packetstormsecurity.com/files/124681/Hiox-Guest-Book-5.0-Cross-Site-Scripting.html + + + OSVDB + 101844 + + Multiple cross-site scripting (XSS) vulnerabilities in add.php in HIOX Guest Book (HGB) 5.0 allow remote attackers to inject arbitrary web script or HTML via the (1) name1, (2) email, or (3) cmt parameter. + + + + + + + + + cpe:/a:python:pyxdg:0.25 + + CVE-2014-1624 + 2014-01-27T19:55:04.083-05:00 + 2014-02-24T21:12:02.490-05:00 + + + 3.3 + LOCAL + MEDIUM + NONE + NONE + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-28T07:43:37.000-05:00 + + + + + XF + pythonxdg-cve20141624-symlink(90618) + + + BID + 65042 + + + MLIST + [oss-security] 20140121 Re: Fwd: [Python-modules-team] Bug#736247: python-xdg: get_runtime_dir(strict=False): insecure use of /tmp + + + MLIST + [oss-security] 20140121 Fwd: [Python-modules-team] Bug#736247: python-xdg: get_runtime_dir(strict=False): insecure use of /tmp + + + MISC + http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736247 + + Race condition in the xdg.BaseDirectory.get_runtime_dir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to an attacker-controlled location once the get_runtime_dir function is called. + + + + + + + + + + cpe:/a:galen_charlton:marc-xml:1.0.1 + cpe:/a:galen_charlton:marc-xml:1.0 + + CVE-2014-1626 + 2014-01-25T20:55:20.563-05:00 + 2014-01-27T11:56:12.227-05:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-27T11:56:12.163-05:00 + + + + + CONFIRM + https://metacpan.org/source/GMCHARLT/MARC-XML-1.0.2/Changes + + + XF + marcfile-xml-info-disc(90620) + + + BID + 65057 + + + CONFIRM + http://www.nntp.perl.org/group/perl.perl4lib/2014/01/msg3073.html + + + SECUNIA + 55404 + + + OSVDB + 102367 + + + MLIST + [Koha] 20140122 SECURITY release: MARC::File::XML 1.0.2 + + + MLIST + [OPEN-ILS-GENERAL] 20140121 SECURITY release: MARC::File::XML 1.0.2 + + XML External Entity (XXE) vulnerability in MARC::File::XML module before 1.0.2 for Perl, as used in Evergreen, Koha, perl4lib, and possibly other products, allows context-dependent attackers to read arbitrary files via a crafted XML file. + + + + + + + + + cpe:/a:doug_poulin:ommand_school_student_management_system:1.06.01 + + CVE-2014-1636 + 2014-01-22T14:55:06.677-05:00 + 2014-02-21T00:06:43.500-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-23T12:06:37.350-05:00 + + + + + XF + commandschool-id-sql-injection(90175) + + + BID + 64707 + + + MISC + http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html + + + OSVDB + 101885 + + + OSVDB + 101884 + + + OSVDB + 101883 + + + OSVDB + 101882 + + + OSVDB + 101881 + + + OSVDB + 101880 + + + OSVDB + 101879 + + + OSVDB + 101878 + + + OSVDB + 101877 + + + OSVDB + 101876 + + + OSVDB + 101875 + + + OSVDB + 101874 + + Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to (1) admin_school_names.php, (2) admin_subjects.php, (3) admin_grades.php, (4) admin_terms.php, (5) admin_school_years.php, (6) admin_sgrades.php, (7) admin_media_codes_1.php, (8) admin_infraction_codes.php, (9) admin_generations.php, (10) admin_relations.php, (11) admin_titles.php, or (12) health_allergies.php in sw/. + + + + + + + + + cpe:/a:doug_poulin:ommand_school_student_management_system:1.06.01 + + CVE-2014-1637 + 2014-01-22T14:55:06.787-05:00 + 2014-02-21T00:06:43.593-05:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-23T12:07:02.960-05:00 + + + + + BID + 64707 + + + MISC + http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html + + + OSVDB + 101888 + + Command School Student Management System 1.06.01 does not properly restrict access to sw/backup/backup_ray2.php, which allows remote attackers to download a database backup via a direct request. + + + + + + + + + cpe:/a:debian:localepurge:0.7.3.1 + + CVE-2014-1638 + 2014-01-27T19:55:04.130-05:00 + 2014-01-28T13:09:07.850-05:00 + + + 3.3 + LOCAL + MEDIUM + NONE + NONE + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-28T13:09:07.803-05:00 + + + + + XF + localepurge-cve20141638-symlink(90669) + + + BID + 65098 + + + OSVDB + 102381 + + + OSVDB + 102379 + + + MLIST + [oss-security] 20140122 Re: Getting tempfile/mktemp wrong + + + MLIST + [oss-security] 20140122 Getting tempfile/mktemp wrong + + + CONFIRM + http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736359 + + (1) debian/postrm and (2) debian/localepurge.config in localepurge before 0.7.3.2 use tempfile to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename. + + + + + + + + + cpe:/a:debian:syncevolution:1.3.99.6 + + CVE-2014-1639 + 2014-01-27T19:55:04.177-05:00 + 2014-02-24T17:02:44.467-05:00 + + + 3.3 + LOCAL + MEDIUM + NONE + NONE + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-28T13:31:12.343-05:00 + + + + + XF + syncevolution-cve20141639-symlink(90662) + + + BID + 65098 + + + OSVDB + 102380 + + + MLIST + [oss-security] 20140122 Re: Getting tempfile/mktemp wrong + + + MLIST + [oss-security] 20140122 Getting tempfile/mktemp wrong + + + CONFIRM + http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736357 + + syncevo/installcheck-local.sh in syncevolution before 1.3.99.7 uses mktemp to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename. + + + + + + + + + cpe:/a:debian:axiom:20100701-1.1 + + CVE-2014-1640 + 2014-01-27T19:55:04.223-05:00 + 2014-02-24T16:44:47.303-05:00 + + + 3.3 + LOCAL + MEDIUM + NONE + NONE + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-28T13:39:28.310-05:00 + + + + + XF + axiom-cve20141640-symlink(90663) + + + OSVDB + 102383 + + + MLIST + [oss-security] 20140122 Re: Getting tempfile/mktemp wrong + + + MLIST + [oss-security] 20140122 Getting tempfile/mktemp wrong + + + MISC + http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736358 + + axiom-test.sh in axiom 20100701-1.1 uses tempfile to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename. + + + + + + + + + + + + + + cpe:/o:xen:xen:4.3.0 + cpe:/o:xen:xen:4.3.1 + cpe:/o:xen:xen:4.2.3 + cpe:/o:xen:xen:4.2.1 + cpe:/o:xen:xen:4.2.2 + cpe:/o:xen:xen:4.2.0 + + CVE-2014-1642 + 2014-01-26T11:58:11.620-05:00 + 2014-04-19T00:47:49.143-04:00 + + + 4.4 + LOCAL + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-27T12:45:10.837-05:00 + + + + + XF + xen-irq-cve20141642-code-exec(90649) + + + CONFIRM + http://xenbits.xen.org/xsa/advisory-83.html + + + SECTRACK + 1029679 + + + BID + 65097 + + + MLIST + [oss-security] 20140123 Xen Security Advisory 83 (CVE-2014-1642) - Out-of-memory condition yielding memory corruption during IRQ setup + + + SECUNIA + 56557 + + + OSVDB + 102406 + + + SUSE + SUSE-SU-2014:0373 + + + FEDORA + FEDORA-2014-1552 + + The IRQ setup in Xen 4.2.x and 4.3.x, when using device passthrough and configured to support a large number of CPUs, frees certain memory that may still be intended for use, which allows local guest administrators to cause a denial of service (memory corruption and hypervisor crash) and possibly execute arbitrary code via vectors related to an out-of-memory error that triggers a (1) use-after-free or (2) double free. + + + + + + + + + + + + cpe:/a:symantec:encryption_management_server:3.3.0:mp2 + cpe:/a:symantec:encryption_management_server:3.3.0:mp1 + cpe:/a:symantec:encryption_management_server:3.3.1 + cpe:/a:symantec:encryption_management_server:3.3.0 + + CVE-2014-1643 + 2014-02-06T23:52:04.347-05:00 + 2014-02-07T13:52:13.613-05:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-02-07T13:52:10.800-05:00 + + + + + CONFIRM + http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140205_00 + + + BID + 65300 + + The Web Email Protection component in Symantec Encryption Management Server (aka PGP Universal Server) before 3.3.2 allows remote authenticated users to read the stored outbound e-mail messages of arbitrary users via a modified URL. + + + + + + + + + + + + + + + + + cpe:/a:symantec:liveupdate_administrator:2.1.0 + cpe:/a:symantec:liveupdate_administrator:2.2.2 + cpe:/a:symantec:liveupdate_administrator:2.2.2.9 + cpe:/a:symantec:liveupdate_administrator:2.1.2 + cpe:/a:symantec:liveupdate_administrator:2.1.3 + cpe:/a:symantec:liveupdate_administrator:2.2.1 + cpe:/a:symantec:liveupdate_administrator:2.3.2 + cpe:/a:symantec:liveupdate_administrator:2.3.1 + cpe:/a:symantec:liveupdate_administrator:2.3.0 + + CVE-2014-1644 + 2014-03-28T21:55:07.093-04:00 + 2014-03-31T12:40:14.277-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-31T12:40:08.403-04:00 + + + + + CONFIRM + http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140327_00 + + + MISC + https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140328-0_Symantec_LiveUpdate_Administrator_Multiple_vulnerabilities_wo_poc_v10.txt + + + BID + 66399 + + + BUGTRAQ + 20140328 SEC Consult SA-20140328-0 :: Multiple vulnerabilities in Symantec LiveUpdate Administrator + + The forgotten-password feature in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator (LUA) 2.x before 2.3.2.110 allows remote attackers to reset arbitrary passwords by providing the e-mail address associated with a user account. + + + + + + + + + + + + + + + + + cpe:/a:symantec:liveupdate_administrator:2.1.0 + cpe:/a:symantec:liveupdate_administrator:2.2.2 + cpe:/a:symantec:liveupdate_administrator:2.2.2.9 + cpe:/a:symantec:liveupdate_administrator:2.1.2 + cpe:/a:symantec:liveupdate_administrator:2.1.3 + cpe:/a:symantec:liveupdate_administrator:2.2.1 + cpe:/a:symantec:liveupdate_administrator:2.3.2 + cpe:/a:symantec:liveupdate_administrator:2.3.1 + cpe:/a:symantec:liveupdate_administrator:2.3.0 + + CVE-2014-1645 + 2014-03-28T21:55:07.123-04:00 + 2014-03-31T12:27:39.907-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-31T12:27:28.500-04:00 + + + + + CONFIRM + http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140327_00 + + + MISC + https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140328-0_Symantec_LiveUpdate_Administrator_Multiple_vulnerabilities_wo_poc_v10.txt + + + BID + 66400 + + + BUGTRAQ + 20140328 SEC Consult SA-20140328-0 :: Multiple vulnerabilities in Symantec LiveUpdate Administrator + + SQL injection vulnerability in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator (LUA) 2.x before 2.3.2.110 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:symantec:pgp_desktop:10.2.2 + cpe:/a:symantec:encryption_desktop:10.3.1::~~professional~~~ + cpe:/a:symantec:pgp_desktop:10.2.0 + cpe:/a:symantec:encryption_desktop:10.3.0::~~professional~~~ + cpe:/a:symantec:pgp_desktop:10.2.1 + cpe:/a:symantec:encryption_desktop:10.3.2:-:~~professional~~~ + cpe:/a:symantec:pgp_desktop:10.0.0 + cpe:/a:symantec:pgp_desktop:10.0.1 + cpe:/a:symantec:pgp_desktop:10.0.2 + cpe:/a:symantec:pgp_desktop:10.0.3 + cpe:/a:symantec:pgp_desktop:10.1.0 + cpe:/a:symantec:pgp_desktop:10.1.2 + cpe:/a:symantec:pgp_desktop:10.1.1 + + CVE-2014-1646 + 2014-04-23T15:55:05.237-04:00 + 2014-04-24T14:00:48.890-04:00 + + + 2.6 + NETWORK + HIGH + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-24T14:00:48.657-04:00 + + + + + CONFIRM + http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140423_00 + + + BID + 67016 + + Symantec PGP Desktop 10.0.x through 10.2.x and Encryption Desktop Professional 10.3.x before 10.3.2 MP1 do not properly perform memory copies, which allows remote attackers to cause a denial of service (read access violation and application crash) via a malformed certificate. + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:symantec:pgp_desktop:10.2.2 + cpe:/a:symantec:encryption_desktop:10.3.1::~~professional~~~ + cpe:/a:symantec:encryption_desktop:10.3.0::~~professional~~~ + cpe:/a:symantec:pgp_desktop:10.2.0 + cpe:/a:symantec:pgp_desktop:10.2.1 + cpe:/a:symantec:encryption_desktop:10.3.2:-:~~professional~~~ + cpe:/a:symantec:pgp_desktop:10.0.0 + cpe:/a:symantec:pgp_desktop:10.0.1 + cpe:/a:symantec:pgp_desktop:10.0.2 + cpe:/a:symantec:pgp_desktop:10.0.3 + cpe:/a:symantec:pgp_desktop:10.1.0 + cpe:/a:symantec:pgp_desktop:10.1.2 + cpe:/a:symantec:pgp_desktop:10.1.1 + + CVE-2014-1647 + 2014-04-23T15:55:05.267-04:00 + 2014-04-24T14:06:44.087-04:00 + + + 2.6 + NETWORK + HIGH + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-24T14:06:42.227-04:00 + + + + + CONFIRM + http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140423_00 + + + BID + 67020 + + Symantec PGP Desktop 10.0.x through 10.2.x and Encryption Desktop Professional 10.3.x before 10.3.2 MP1 do not properly perform block-data moves, which allows remote attackers to cause a denial of service (read access violation and application crash) via a malformed certificate. + + + + + + + + + + + + + + cpe:/a:symantec:messaging_gateway:10.0.3 + cpe:/a:symantec:messaging_gateway:10.0 + cpe:/a:symantec:messaging_gateway:10.5.0 + cpe:/a:symantec:messaging_gateway:10.5.1 + cpe:/a:symantec:messaging_gateway:10.0.1 + cpe:/a:symantec:messaging_gateway:10.0.2 + + CVE-2014-1648 + 2014-04-23T07:52:59.587-04:00 + 2014-04-24T10:07:09.613-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-24T10:07:04.537-04:00 + + + + + CONFIRM + http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140422_00 + + + BID + 66966 + + + FULLDISC + 20140422 (CVE-2014-1648) Symantec Messaging Gateway Management Console Cross Site Scripting Vulnerability + + Cross-site scripting (XSS) vulnerability in brightmail/setting/compliance/DlpConnectFlow$view.flo in the management console in Symantec Messaging Gateway 10.x before 10.5.2 allows remote attackers to inject arbitrary web script or HTML via the displayTab parameter. + + + + + + + + + + + cpe:/a:citrix:xenmobile_device_manager:8.6 + cpe:/a:citrix:xenmobile_device_manager:8.5 + cpe:/a:citrix:xenmobile_device_manager_mdm:8.0.1 + + CVE-2014-1663 + 2014-02-06T12:00:07.307-05:00 + 2014-02-07T12:11:40.450-05:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-02-07T12:11:36.010-05:00 + + + + BID + 65348 + + + CONFIRM + http://support.citrix.com/article/CTX140044 + + + SECUNIA + 56438 + + Unspecified vulnerability in Citrix XenMobile Device Manager server (formerly Zenprise Device Manager server) 8.5, 8.6, and MDM 8.0.1 allows remote attackers to obtain sensitive information via unknown vectors. + + + + + + + + + cpe:/a:citrix:gotomeeting:5.0.799.1238:-:~-~-~android~~ + + CVE-2014-1664 + 2014-01-26T15:55:06.720-05:00 + 2014-01-31T01:08:29.860-05:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-27T13:58:10.220-05:00 + + + + + XF + gotomeeting-cve20141664-info-disc(90695) + + + BID + 65123 + + + BUGTRAQ + 20140124 [CVE-2014-1664] GoToMeeting Information Disclosure via Logging Output (Android) + + + OSVDB + 102559 + + The Citrix GoToMeeting application 5.0.799.1238 for Android logs HTTP requests containing sensitive information, which allows attackers to obtain user IDs, meeting details, and authentication tokens via an application that reads the system log file. + + + + + + + + + + + + + + cpe:/o:xen:xen:4.1.5 + cpe:/o:xen:xen:4.3.0 + cpe:/o:xen:xen:4.3.1 + cpe:/o:xen:xen:4.2.3 + cpe:/o:xen:xen:4.2.2 + cpe:/o:xen:xen:4.1.6.1 + + CVE-2014-1666 + 2014-01-26T11:58:11.650-05:00 + 2014-04-19T00:47:49.770-04:00 + + + 8.3 + ADJACENT_NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-01-27T12:53:38.880-05:00 + + + + + MISC + http://xenbits.xen.org/xsa/xsa87-unstable-4.3.patch + + + XF + xen-cve20141666-priv-esc(90675) + + + CONFIRM + http://xenbits.xen.org/xsa/advisory-87.html + + + SECTRACK + 1029684 + + + BID + 65125 + + + MLIST + [oss-security] 20140123 Xen Security Advisory 87 (CVE-2014-1666) - PHYSDEVOP_{prepare,release}_msix exposed to unprivileged guests + + + SECUNIA + 56650 + + + OSVDB + 102536 + + + SUSE + SUSE-SU-2014:0373 + + + SUSE + SUSE-SU-2014:0372 + + + FEDORA + FEDORA-2014-1552 + + The do_physdev_op function in Xen 4.1.5, 4.1.6.1, 4.2.2 through 4.2.3, and 4.3.x does not properly restrict access to the (1) PHYSDEVOP_prepare_msix and (2) PHYSDEVOP_release_msix operations, which allows local PV guests to cause a denial of service (host or guest malfunction) or possibly gain privileges via unspecified vectors. + + + + + + + + + cpe:/a:microsoft:bing:4.2.0:-:~-~-~android~~ + + CVE-2014-1670 + 2014-01-25T11:55:03.237-05:00 + 2014-01-31T01:08:30.110-05:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-27T10:12:54.883-05:00 + + + + + MISC + https://play.google.com/store/apps/details?id=com.microsoft.bing + + + MISC + http://www.youtube.com/watch?v=_j1RKtTxZ3k + + + BID + 65128 + + + OSVDB + 102575 + + + MISC + http://blog.trustlook.com/2014/01/23/trustlook-reported-microsofts-first-ever-android-vulnerability/ + + The Microsoft Bing application before 4.2.1 for Android allows remote attackers to install arbitrary APK files via vectors involving a crafted DNS response. + + + + + + + + + + + + + cpe:/a:dell:kace_k1000_systems_management_appliance_software:5.4.76847 + cpe:/h:dell:kace_k1200s_systems_management_appliance:- + cpe:/a:dell:kace_k1000_systems_management_virtual_appliance:- + cpe:/h:dell:kace_k1100s_systems_management_appliance:- + cpe:/h:dell:kace_k1000_systems_management_appliance:- + + CVE-2014-1671 + 2014-01-25T20:55:20.657-05:00 + 2014-01-31T01:08:30.187-05:00 + + + 6.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-27T11:44:36.630-05:00 + + + + + XF + kace-multiple-sql-injection(90592) + + + BID + 65029 + + + MISC + http://www.baesystemsdetica.com.au/Research/Advisories/Dell-KACE-K1000-SQL-Injection-(DS-2014-001) + + + SECUNIA + 56396 + + Multiple SQL injection vulnerabilities in Dell KACE K1000 5.4.76847 and possibly earlier allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the macAddress element in a (1) getUploadPath or (2) getKBot SOAP request to service/kbot_service.php; the ID parameter to (3) userui/advisory_detail.php or (4) userui/ticket.php; and the (5) ORDER[] parameter to userui/ticket_list.php. + + + + + + + + + + cpe:/a:checkpoint:security_gateway:r75.47 + cpe:/a:checkpoint:management_server:r75.47 + + CVE-2014-1672 + 2014-01-25T20:55:26.780-05:00 + 2014-01-27T12:00:11.450-05:00 + + + 4.0 + NETWORK + HIGH + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-27T12:00:11.357-05:00 + + + + + CONFIRM + https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk98087 + + Check Point R75.47 Security Gateway and Management Server does not properly enforce Anti-Spoofing when the routing table is modified and the "Get - Interfaces with Topology" action is performed, which allows attackers to bypass intended access restrictions. + + + + + + + + + cpe:/a:checkpoint:session_authentication_agent:- + + CVE-2014-1673 + 2014-01-25T20:55:26.797-05:00 + 2014-01-31T01:08:30.347-05:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-01-27T12:09:55.930-05:00 + + + + CONFIRM + https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk98263 + + + XF + check-point-cve20141673-unauth-access(90746) + + + FULLDISC + 20140127 [CVE-2014-1673] Check Point Session Authentication Agent vulnerability + + + MISC + http://packetstormsecurity.com/files/124967 + + + OSVDB + 102418 + + Check Point Session Authentication Agent allows remote attackers to obtain sensitive information (user credentials) via unspecified vectors. + + + + + + + + + + + + + + + + + + cpe:/a:bandisoft:bandizip:3.00 + cpe:/a:bandisoft:bandizip:3.01 + cpe:/a:bandisoft:bandizip:3.06 + cpe:/a:bandisoft:bandizip:3.02 + cpe:/a:bandisoft:bandizip:3.05 + cpe:/a:bandisoft:bandizip:3.03 + cpe:/a:bandisoft:bandizip:3.04 + cpe:/a:bandisoft:bandizip:3.08 + cpe:/a:bandisoft:bandizip:3.07 + cpe:/a:bandisoft:bandizip:3.09 + + CVE-2014-1680 + 2014-02-14T08:10:30.950-05:00 + 2014-02-21T00:06:45.280-05:00 + + + 6.9 + LOCAL + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-14T12:06:22.087-05:00 + + + + XF + bandzip-dll-cve20141680-code-exec(90966) + + + MISC + http://www.bandisoft.com/bandizip/history + + + MISC + http://packetstormsecurity.com/files/125059 + + + OSVDB + 102979 + + Untrusted search path vulnerability in Bandisoft Bandizip before 3.10 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:google:chrome:32.0.1700.41 + cpe:/a:google:chrome:32.0.1700.95 + cpe:/a:google:chrome:32.0.1700.58 + cpe:/a:google:chrome:32.0.1700.94 + cpe:/a:google:chrome:32.0.1700.59 + cpe:/a:google:chrome:32.0.1700.38 + cpe:/a:google:chrome:32.0.1700.56 + cpe:/a:google:chrome:32.0.1700.39 + cpe:/a:google:chrome:32.0.1700.57 + cpe:/a:google:chrome:32.0.1700.54 + cpe:/a:google:chrome:32.0.1700.55 + cpe:/a:google:chrome:32.0.1700.52 + cpe:/a:google:chrome:32.0.1700.53 + cpe:/a:google:chrome:32.0.1700.50 + cpe:/a:google:chrome:32.0.1700.51 + cpe:/a:google:chrome:32.0.1700.99 + cpe:/a:google:chrome:32.0.1700.98 + cpe:/a:google:chrome:32.0.1700.97 + cpe:/a:google:chrome:32.0.1700.96 + cpe:/a:google:chrome:32.0.1700.0 + cpe:/a:google:chrome:32.0.1700.2 + cpe:/a:google:chrome:32.0.1700.4 + cpe:/a:google:chrome:32.0.1700.3 + cpe:/a:google:chrome:32.0.1700.11 + cpe:/a:google:chrome:32.0.1700.6 + cpe:/a:google:chrome:32.0.1700.10 + cpe:/a:google:chrome:32.0.1700.5 + cpe:/a:google:chrome:32.0.1700.8 + cpe:/a:google:chrome:32.0.1700.13 + cpe:/a:google:chrome:32.0.1700.7 + cpe:/a:google:chrome:32.0.1700.12 + cpe:/a:google:chrome:32.0.1700.15 + cpe:/a:google:chrome:32.0.1700.9 + cpe:/a:google:chrome:32.0.1700.14 + cpe:/a:google:chrome:32.0.1700.62 + cpe:/a:google:chrome:32.0.1700.26 + cpe:/a:google:chrome:32.0.1700.23 + cpe:/a:google:chrome:32.0.1700.24 + cpe:/a:google:chrome:32.0.1700.21 + cpe:/a:google:chrome:32.0.1700.22 + cpe:/a:google:chrome:32.0.1700.69 + cpe:/a:google:chrome:32.0.1700.68 + cpe:/a:google:chrome:32.0.1700.67 + cpe:/a:google:chrome:32.0.1700.101 + cpe:/a:google:chrome:32.0.1700.66 + cpe:/a:google:chrome:32.0.1700.100 + cpe:/a:google:chrome:32.0.1700.65 + cpe:/a:google:chrome:32.0.1700.64 + cpe:/a:google:chrome:32.0.1700.63 + cpe:/a:google:chrome:32.0.1700.76 + cpe:/a:google:chrome:32.0.1700.77 + cpe:/a:google:chrome:32.0.1700.74 + cpe:/a:google:chrome:32.0.1700.75 + cpe:/a:google:chrome:32.0.1700.72 + cpe:/a:google:chrome:32.0.1700.19 + cpe:/a:google:chrome:32.0.1700.18 + cpe:/a:google:chrome:32.0.1700.70 + cpe:/a:google:chrome:32.0.1700.17 + cpe:/a:google:chrome:32.0.1700.71 + cpe:/a:google:chrome:32.0.1700.16 + cpe:/a:google:chrome:32.0.1700.35 + cpe:/a:google:chrome:32.0.1700.34 + cpe:/a:google:chrome:32.0.1700.31 + cpe:/a:google:chrome:32.0.1700.30 + cpe:/a:google:chrome:32.0.1700.33 + cpe:/a:google:chrome:32.0.1700.32 + cpe:/a:google:chrome:32.0.1700.27 + cpe:/a:google:chrome:32.0.1700.28 + cpe:/a:google:chrome:32.0.1700.29 + + CVE-2014-1681 + 2014-01-28T09:30:39.527-05:00 + 2014-02-06T23:52:00.677-05:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-01-28T14:19:50.677-05:00 + + + + OSVDB + 102633 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/01/stable-channel-update_27.html + + Multiple unspecified vulnerabilities in Google Chrome before 32.0.1700.102 have unknown impact and attack vectors, related to 12 "security fixes [that were not] either contributed by external researchers or particularly interesting." + + + + + + + + + cpe:/a:skybluecanvas:skybluecanvas:1.1_r248-03 + + CVE-2014-1683 + 2014-01-29T13:55:27.027-05:00 + 2014-02-21T00:06:45.437-05:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-30T18:00:07.070-05:00 + + + + + XF + skybluecanvas-index-command-exec(90670) + + + BID + 65129 + + + EXPLOIT-DB + 31432 + + + EXPLOIT-DB + 31183 + + + SECUNIA + 56646 + + + FULLDISC + 20140123 Remote Command Injection Vulnerability in SkyBlueCanvas CMS + + + MISC + http://packetstormsecurity.com/files/124948/SkyBlueCanvas-CMS-1.1-r248-03-Command-Injection.html + + The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248-04, when the pid parameter is 4, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) name, (2) email, (3) subject, or (4) message parameter to index.php, when the pid parameter is 4. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:videolan:vlc_media_player:1.0.1 + cpe:/a:videolan:vlc_media_player:1.0.0 + cpe:/a:videolan:vlc_media_player:1.0.2 + cpe:/a:videolan:vlc_media_player:2.1.0 + cpe:/a:videolan:vlc_media_player:1.0.6 + cpe:/a:videolan:vlc_media_player:1.1.4.1 + cpe:/a:videolan:vlc_media_player:1.1.6.1 + cpe:/a:videolan:vlc_media_player:2.0.5 + cpe:/a:videolan:vlc_media_player:2.0.6 + cpe:/a:videolan:vlc_media_player:2.0.7 + cpe:/a:videolan:vlc_media_player:2.0.8 + cpe:/a:videolan:vlc_media_player:2.0.9 + cpe:/a:videolan:vlc_media_player:1.1.3 + cpe:/a:videolan:vlc_media_player:1.1.4 + cpe:/a:videolan:vlc_media_player:1.1.2 + cpe:/a:videolan:vlc_media_player:1.1.12 + cpe:/a:videolan:vlc_media_player:1.1.13 + cpe:/a:videolan:vlc_media_player:2.0.0 + cpe:/a:videolan:vlc_media_player:2.0.1 + cpe:/a:videolan:vlc_media_player:2.0.3 + cpe:/a:videolan:vlc_media_player:2.0.4 + cpe:/a:videolan:vlc_media_player:1.1.1 + cpe:/a:videolan:vlc_media_player:2.0.2 + cpe:/a:videolan:vlc_media_player:1.1.11 + cpe:/a:videolan:vlc_media_player:1.1.10 + cpe:/a:videolan:vlc_media_player:1.1.0 + cpe:/a:videolan:vlc_media_player:1.0.3 + cpe:/a:videolan:vlc_media_player:1.1.9 + cpe:/a:videolan:vlc_media_player:1.0.5 + cpe:/a:videolan:vlc_media_player:1.0.4 + cpe:/a:videolan:vlc_media_player:1.1.6 + cpe:/a:videolan:vlc_media_player:1.1.5 + cpe:/a:videolan:vlc_media_player:1.1.8 + cpe:/a:videolan:vlc_media_player:1.1.7 + cpe:/a:videolan:vlc_media_player:1.1.10.1 + cpe:/a:videolan:vlc_media_player:2.1.2 + cpe:/a:videolan:vlc_media_player:2.1.1 + + CVE-2014-1684 + 2014-03-03T11:55:04.287-05:00 + 2014-03-07T15:35:15.370-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-03-04T08:20:23.000-05:00 + + + + + CONFIRM + http://git.videolan.org/gitweb.cgi/vlc.git/?p=vlc.git;a=commitdiff;h=98787d0843612271e99d62bee0dfd8197f0cf404 + + + CONFIRM + https://trac.videolan.org/vlc/ticket/10482 + + + MISC + http://www.elsherei.com/?p=269 + + The ASF_ReadObject_file_properties function in modules/demux/asf/libasf.c in the ASF Demuxer in VideoLAN VLC Media Player before 2.1.3 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a zero minimum and maximum data packet size in an ASF file. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:linux:linux_kernel:3.0.48 + cpe:/o:linux:linux_kernel:3.0.49 + cpe:/o:linux:linux_kernel:3.0.46 + cpe:/o:linux:linux_kernel:3.0.47 + cpe:/o:linux:linux_kernel:3.0.44 + cpe:/o:linux:linux_kernel:3.0.45 + cpe:/o:linux:linux_kernel:3.0.42 + cpe:/o:linux:linux_kernel:3.4.70 + cpe:/o:linux:linux_kernel:3.4.71 + cpe:/o:linux:linux_kernel:3.0.40 + cpe:/o:linux:linux_kernel:3.0.41 + cpe:/o:linux:linux_kernel:3.4.45 + cpe:/o:linux:linux_kernel:3.4.44 + cpe:/o:linux:linux_kernel:3.4.46 + cpe:/o:linux:linux_kernel:3.4.41 + cpe:/o:linux:linux_kernel:3.4.40 + cpe:/o:linux:linux_kernel:3.4.43 + cpe:/o:linux:linux_kernel:3.4.42 + cpe:/o:linux:linux_kernel:3.4.49 + cpe:/o:linux:linux_kernel:3.4.48 + cpe:/o:linux:linux_kernel:3.0.59 + cpe:/o:linux:linux_kernel:3.4.47 + cpe:/o:linux:linux_kernel:3.0.55 + cpe:/o:linux:linux_kernel:3.0.56 + cpe:/o:linux:linux_kernel:3.0.57 + cpe:/o:linux:linux_kernel:3.0.58 + cpe:/o:linux:linux_kernel:3.0.51 + cpe:/o:linux:linux_kernel:3.0.52 + cpe:/o:linux:linux_kernel:3.0.53 + cpe:/o:linux:linux_kernel:3.11.10 + cpe:/o:linux:linux_kernel:3.0.50 + cpe:/o:linux:linux_kernel:3.4.57 + cpe:/o:linux:linux_kernel:3.4.56 + cpe:/o:linux:linux_kernel:3.4.55 + cpe:/o:linux:linux_kernel:3.4.54 + cpe:/o:linux:linux_kernel:3.4.53 + cpe:/o:linux:linux_kernel:3.4.52 + cpe:/o:linux:linux_kernel:3.4.51 + cpe:/o:linux:linux_kernel:3.4.50 + cpe:/o:linux:linux_kernel:3.0.43 + cpe:/o:linux:linux_kernel:3.10.26 + cpe:/o:linux:linux_kernel:3.4.59 + cpe:/o:linux:linux_kernel:3.0.24 + cpe:/o:linux:linux_kernel:3.0.25 + cpe:/o:linux:linux_kernel:3.0.22 + cpe:/o:linux:linux_kernel:3.1.9 + cpe:/o:linux:linux_kernel:3.0.23 + cpe:/o:linux:linux_kernel:3.10.28 + cpe:/o:linux:linux_kernel:3.0.28 + cpe:/o:linux:linux_kernel:3.10.27 + cpe:/o:linux:linux_kernel:3.0.26 + cpe:/o:linux:linux_kernel:3.10.29 + cpe:/o:linux:linux_kernel:3.4.58 + cpe:/o:linux:linux_kernel:3.0.27 + cpe:/o:linux:linux_kernel:3.10.24 + cpe:/o:linux:linux_kernel:3.10.23 + cpe:/o:linux:linux_kernel:3.10.25 + cpe:/o:linux:linux_kernel:3.10.20 + cpe:/o:linux:linux_kernel:3.1.8 + cpe:/o:linux:linux_kernel:3.0.20 + cpe:/o:linux:linux_kernel:3.10.22 + cpe:/o:linux:linux_kernel:3.10.21 + cpe:/o:linux:linux_kernel:3.4.21 + cpe:/o:linux:linux_kernel:3.4.20 + cpe:/o:linux:linux_kernel:3.4.23 + cpe:/o:linux:linux_kernel:3.4.22 + cpe:/o:linux:linux_kernel:3.4.24 + cpe:/o:linux:linux_kernel:3.4.27 + cpe:/o:linux:linux_kernel:3.4.26 + cpe:/o:linux:linux_kernel:3.4.29 + cpe:/o:linux:linux_kernel:3.10.15 + cpe:/o:linux:linux_kernel:3.4.28 + cpe:/o:linux:linux_kernel:3.0.54 + cpe:/o:linux:linux_kernel:3.0.33 + cpe:/o:linux:linux_kernel:3.0.34 + cpe:/o:linux:linux_kernel:3.0.35 + cpe:/o:linux:linux_kernel:3.0.36 + cpe:/o:linux:linux_kernel:3.10.19 + cpe:/o:linux:linux_kernel:3.0.37 + cpe:/o:linux:linux_kernel:3.10.18 + cpe:/o:linux:linux_kernel:3.0.38 + cpe:/o:linux:linux_kernel:3.4.25 + cpe:/o:linux:linux_kernel:3.10.17 + cpe:/o:linux:linux_kernel:3.0.39 + cpe:/o:linux:linux_kernel:3.10.16 + cpe:/o:linux:linux_kernel:3.10.14 + cpe:/o:linux:linux_kernel:3.10.13 + cpe:/o:linux:linux_kernel:3.10.12 + cpe:/o:linux:linux_kernel:3.10.11 + cpe:/o:linux:linux_kernel:3.10.10 + cpe:/o:linux:linux_kernel:3.0.30 + cpe:/o:linux:linux_kernel:3.0.31 + cpe:/o:linux:linux_kernel:3.9.8 + cpe:/o:linux:linux_kernel:3.5.5 + cpe:/o:linux:linux_kernel:3.4.32 + cpe:/o:linux:linux_kernel:3.9.9 + cpe:/o:linux:linux_kernel:3.5.6 + cpe:/o:linux:linux_kernel:3.4.31 + cpe:/o:linux:linux_kernel:3.5.7 + cpe:/o:linux:linux_kernel:3.4.30 + cpe:/o:linux:linux_kernel:3.7.1 + cpe:/o:linux:linux_kernel:3.4.35 + cpe:/o:linux:linux_kernel:3.9.0 + cpe:/o:linux:linux_kernel:3.0.18 + cpe:/o:linux:linux_kernel:3.4.34 + cpe:/o:linux:linux_kernel:3.4.33 + cpe:/o:linux:linux_kernel:3.9.2 + cpe:/o:linux:linux_kernel:3.9.1 + cpe:/o:linux:linux_kernel:3.0.19 + cpe:/o:linux:linux_kernel:3.4.39 + cpe:/o:linux:linux_kernel:3.9.4 + cpe:/o:linux:linux_kernel:3.4.38 + cpe:/o:linux:linux_kernel:3.9.3 + cpe:/o:linux:linux_kernel:3.4.37 + cpe:/o:linux:linux_kernel:3.9.6 + cpe:/o:linux:linux_kernel:3.9.5 + cpe:/o:linux:linux_kernel:3.0.21 + cpe:/o:linux:linux_kernel:3.9.7 + cpe:/o:linux:linux_kernel:3.5.4 + cpe:/o:linux:linux_kernel:3.0.4 + cpe:/o:linux:linux_kernel:3.0.5 + cpe:/o:linux:linux_kernel:3.0.2 + cpe:/o:linux:linux_kernel:3.0.3 + cpe:/o:linux:linux_kernel:3.0.8 + cpe:/o:linux:linux_kernel:3.0.6 + cpe:/o:linux:linux_kernel:3.0.7 + cpe:/o:linux:linux_kernel:3.4.36 + cpe:/o:linux:linux_kernel:3.6.10 + cpe:/o:linux:linux_kernel:3.6.11 + cpe:/o:linux:linux_kernel:3.4.1 + cpe:/o:linux:linux_kernel:3.4.19 + cpe:/o:linux:linux_kernel:3.4.17 + cpe:/o:linux:linux_kernel:3.4.3 + cpe:/o:linux:linux_kernel:3.4.18 + cpe:/o:linux:linux_kernel:3.4.2 + cpe:/o:linux:linux_kernel:3.2.9 + cpe:/o:linux:linux_kernel:3.4.15 + cpe:/o:linux:linux_kernel:3.2.8 + cpe:/o:linux:linux_kernel:3.4.16 + cpe:/o:linux:linux_kernel:3.4.4 + cpe:/o:linux:linux_kernel:3.2.7 + cpe:/o:linux:linux_kernel:3.4.13 + cpe:/o:linux:linux_kernel:3.12.10 + cpe:/o:linux:linux_kernel:3.4.11 + cpe:/o:linux:linux_kernel:3.4.12 + cpe:/o:linux:linux_kernel:3.4.10 + cpe:/o:linux:linux_kernel:3.0.61 + cpe:/o:linux:linux_kernel:3.3:rc2 + cpe:/o:linux:linux_kernel:3.4:rc7 + cpe:/o:linux:linux_kernel:3.0.60 + cpe:/o:linux:linux_kernel:3.3:rc7 + cpe:/o:linux:linux_kernel:3.4:rc5 + cpe:/o:linux:linux_kernel:3.3:rc5 + cpe:/o:linux:linux_kernel:3.4:rc6 + cpe:/o:linux:linux_kernel:3.3:rc6 + cpe:/o:linux:linux_kernel:3.0.64 + cpe:/o:linux:linux_kernel:3.0.63 + cpe:/o:linux:linux_kernel:3.0.62 + cpe:/o:linux:linux_kernel:3.12.1 + cpe:/o:linux:linux_kernel:3.0.68 + cpe:/o:linux:linux_kernel:3.0.67 + cpe:/o:linux:linux_kernel:3.0.66 + cpe:/o:linux:linux_kernel:3.4.14 + cpe:/o:linux:linux_kernel:3.12.7 + cpe:/o:linux:linux_kernel:3.2:rc2 + cpe:/o:linux:linux_kernel:3.1:rc1 + cpe:/o:linux:linux_kernel:3.0.9 + cpe:/o:linux:linux_kernel:3.0:rc4 + cpe:/o:linux:linux_kernel:3.1:rc4 + cpe:/o:linux:linux_kernel:3.0:rc3 + cpe:/o:linux:linux_kernel:3.0:rc2 + cpe:/o:linux:linux_kernel:3.1:rc2 + cpe:/o:linux:linux_kernel:3.0:rc1 + cpe:/o:linux:linux_kernel:3.2:rc7 + cpe:/o:linux:linux_kernel:3.12.3 + cpe:/o:linux:linux_kernel:3.2:rc6 + cpe:/o:linux:linux_kernel:3.1.10 + cpe:/o:linux:linux_kernel:3.12.4 + cpe:/o:linux:linux_kernel:3.2:rc5 + cpe:/o:linux:linux_kernel:3.0:rc7 + cpe:/o:linux:linux_kernel:3.12.5 + cpe:/o:linux:linux_kernel:3.9:rc3 + cpe:/o:linux:linux_kernel:3.0:rc6 + cpe:/o:linux:linux_kernel:3.12.6 + cpe:/o:linux:linux_kernel:3.0:rc5 + cpe:/o:linux:linux_kernel:3.9:rc1 + cpe:/o:linux:linux_kernel:3.9:rc4 + cpe:/o:linux:linux_kernel:3.9:rc7 + cpe:/o:linux:linux_kernel:3.12.2 + cpe:/o:linux:linux_kernel:3.9:rc2 + cpe:/o:linux:linux_kernel:3.9:rc5 + cpe:/o:linux:linux_kernel:3.3:rc3 + cpe:/o:linux:linux_kernel:3.4:rc4 + cpe:/o:linux:linux_kernel:3.4:rc3 + cpe:/o:linux:linux_kernel:3.3:rc1 + cpe:/o:linux:linux_kernel:3.4:rc2 + cpe:/o:linux:linux_kernel:3.9:rc6 + cpe:/o:linux:linux_kernel:3.3:rc4 + cpe:/o:linux:linux_kernel:3.4:rc1 + cpe:/o:linux:linux_kernel:3.4.5 + cpe:/o:linux:linux_kernel:3.2.2 + cpe:/o:linux:linux_kernel:3.2.3 + cpe:/o:linux:linux_kernel:3.2.1 + cpe:/o:linux:linux_kernel:3.4.6 + cpe:/o:linux:linux_kernel:3.2:rc3 + cpe:/o:linux:linux_kernel:3.2.6 + cpe:/o:linux:linux_kernel:3.4.7 + cpe:/o:linux:linux_kernel:3.2:rc4 + cpe:/o:linux:linux_kernel:3.1:rc3 + cpe:/o:linux:linux_kernel:3.4.8 + cpe:/o:linux:linux_kernel:3.2.4 + cpe:/o:linux:linux_kernel:3.4.9 + cpe:/o:linux:linux_kernel:3.2.5 + cpe:/o:linux:linux_kernel:3.0.65 + cpe:/o:linux:linux_kernel:3.2.12 + cpe:/o:linux:linux_kernel:3.8.10 + cpe:/o:linux:linux_kernel:3.8.12 + cpe:/o:linux:linux_kernel:3.8.11 + cpe:/o:linux:linux_kernel:3.8.13 + cpe:/o:linux:linux_kernel:3.7.9 + cpe:/o:linux:linux_kernel:3.7.8 + cpe:/o:linux:linux_kernel:3.7.7 + cpe:/o:linux:linux_kernel:3.7.6 + cpe:/o:linux:linux_kernel:3.6.3 + cpe:/o:linux:linux_kernel:3.7.5 + cpe:/o:linux:linux_kernel:3.7.4 + cpe:/o:linux:linux_kernel:3.7.3 + cpe:/o:linux:linux_kernel:3.7.2 + cpe:/o:linux:linux_kernel:3.6.7 + cpe:/o:linux:linux_kernel:3.6.6 + cpe:/o:linux:linux_kernel:3.6.5 + cpe:/o:linux:linux_kernel:3.6.4 + cpe:/o:linux:linux_kernel:3.6.9 + cpe:/o:linux:linux_kernel:3.6.8 + cpe:/o:linux:linux_kernel:3.10 + cpe:/o:linux:linux_kernel:3.11 + cpe:/o:linux:linux_kernel:3.12 + cpe:/o:linux:linux_kernel:3.10.1 + cpe:/o:linux:linux_kernel:3.10.2 + cpe:/o:linux:linux_kernel:3.10.3 + cpe:/o:linux:linux_kernel:3.6.2 + cpe:/o:linux:linux_kernel:3.6.1 + cpe:/o:linux:linux_kernel:3.3.6 + cpe:/o:linux:linux_kernel:3.3.7 + cpe:/o:linux:linux_kernel:3.3.8 + cpe:/o:linux:linux_kernel:3.0.1 + cpe:/o:linux:linux_kernel:3.2 + cpe:/o:linux:linux_kernel:3.1 + cpe:/o:linux:linux_kernel:3.7 + cpe:/o:linux:linux_kernel:3.6 + cpe:/o:linux:linux_kernel:3.4 + cpe:/o:linux:linux_kernel:3.1.6 + cpe:/o:linux:linux_kernel:3.1.5 + cpe:/o:linux:linux_kernel:3.1.7 + cpe:/o:linux:linux_kernel:3.0.32 + cpe:/o:linux:linux_kernel:3.8.9 + cpe:/o:linux:linux_kernel:3.1.2 + cpe:/o:linux:linux_kernel:3.1.1 + cpe:/o:linux:linux_kernel:3.1.4 + cpe:/o:linux:linux_kernel:3.1.3 + cpe:/o:linux:linux_kernel:3.9.10 + cpe:/o:linux:linux_kernel:3.0.29 + cpe:/o:linux:linux_kernel:3.3 + cpe:/o:linux:linux_kernel:3.8.4 + cpe:/o:linux:linux_kernel:3.2.26 + cpe:/o:linux:linux_kernel:3.8.5 + cpe:/o:linux:linux_kernel:3.2.27 + cpe:/o:linux:linux_kernel:3.8.2 + cpe:/o:linux:linux_kernel:3.2.24 + cpe:/o:linux:linux_kernel:3.8.3 + cpe:/o:linux:linux_kernel:3.2.25 + cpe:/o:linux:linux_kernel:3.8.8 + cpe:/o:linux:linux_kernel:3.8.6 + cpe:/o:linux:linux_kernel:3.2.28 + cpe:/o:linux:linux_kernel:3.8.7 + cpe:/o:linux:linux_kernel:3.2.29 + cpe:/o:linux:linux_kernel:3.3.3 + cpe:/o:linux:linux_kernel:3.3.4 + cpe:/o:linux:linux_kernel:3.3.5 + cpe:/o:linux:linux_kernel:3.2.22 + cpe:/o:linux:linux_kernel:3.8.1 + cpe:/o:linux:linux_kernel:3.2.20 + cpe:/o:linux:linux_kernel:3.3.1 + cpe:/o:linux:linux_kernel:3.2.21 + cpe:/o:linux:linux_kernel:3.3.2 + cpe:/o:linux:linux_kernel:3.11.1 + cpe:/o:linux:linux_kernel:3.11.2 + cpe:/o:linux:linux_kernel:3.2.23 + cpe:/o:linux:linux_kernel:3.0.17 + cpe:/o:linux:linux_kernel:3.9.11 + cpe:/o:linux:linux_kernel:3.0.16 + cpe:/o:linux:linux_kernel:3.0.15 + cpe:/o:linux:linux_kernel:3.2.30 + cpe:/o:linux:linux_kernel:3.0.14 + cpe:/o:linux:linux_kernel:3.0.13 + cpe:/o:linux:linux_kernel:3.0.12 + cpe:/o:linux:linux_kernel:3.0.11 + cpe:/o:linux:linux_kernel:3.4.61 + cpe:/o:linux:linux_kernel:3.0.10 + cpe:/o:linux:linux_kernel:3.4.64 + cpe:/o:linux:linux_kernel:3.8.0 + cpe:/o:linux:linux_kernel:3.4.65 + cpe:/o:linux:linux_kernel:3.4.62 + cpe:/o:linux:linux_kernel:3.4.63 + cpe:/o:linux:linux_kernel:3.4.68 + cpe:/o:linux:linux_kernel:3.4.66 + cpe:/o:linux:linux_kernel:3.4.67 + cpe:/o:linux:linux_kernel:3.5.3 + cpe:/o:linux:linux_kernel:3.5.1 + cpe:/o:linux:linux_kernel:3.5.2 + cpe:/o:linux:linux_kernel:3.10.4 + cpe:/o:linux:linux_kernel:3.4.72 + cpe:/o:linux:linux_kernel:3.10.9 + cpe:/o:linux:linux_kernel:3.4.73 + cpe:/o:linux:linux_kernel:3.4.74 + cpe:/o:linux:linux_kernel:3.4.75 + cpe:/o:linux:linux_kernel:3.4.76 + cpe:/o:linux:linux_kernel:3.10.5 + cpe:/o:linux:linux_kernel:3.4.77 + cpe:/o:linux:linux_kernel:3.10.6 + cpe:/o:linux:linux_kernel:3.4.78 + cpe:/o:linux:linux_kernel:3.10.7 + cpe:/o:linux:linux_kernel:3.4.79 + cpe:/o:linux:linux_kernel:3.10.8 + cpe:/o:linux:linux_kernel:3.7.10 + cpe:/o:linux:linux_kernel:3.2.17 + cpe:/o:linux:linux_kernel:3.2.18 + cpe:/o:linux:linux_kernel:3.2.19 + cpe:/o:linux:linux_kernel:3.2.13 + cpe:/o:linux:linux_kernel:3.2.14 + cpe:/o:linux:linux_kernel:3.11.3 + cpe:/o:linux:linux_kernel:3.2.15 + cpe:/o:linux:linux_kernel:3.4.60 + cpe:/o:linux:linux_kernel:3.2.16 + cpe:/o:linux:linux_kernel:3.11.5 + cpe:/o:linux:linux_kernel:3.11.4 + cpe:/o:linux:linux_kernel:3.2.10 + cpe:/o:linux:linux_kernel:3.11.7 + cpe:/o:linux:linux_kernel:3.2.11 + cpe:/o:linux:linux_kernel:3.11.6 + cpe:/o:linux:linux_kernel:3.11.9 + cpe:/o:linux:linux_kernel:3.11.8 + cpe:/o:linux:linux_kernel:3.4.69 + + CVE-2014-1690 + 2014-02-28T01:18:54.557-05:00 + 2014-04-19T00:47:51.410-04:00 + + + 2.6 + NETWORK + HIGH + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-02-28T13:17:54.650-05:00 + + + + + CONFIRM + https://github.com/torvalds/linux/commit/2690d97ade05c5325cbf7c72b94b90d265659886 + + + CONFIRM + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2690d97ade05c5325cbf7c72b94b90d265659886 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1058748 + + + UBUNTU + USN-2158-1 + + + UBUNTU + USN-2140-1 + + + UBUNTU + USN-2137-1 + + + MLIST + [oss-security] 20140128 Re: CVE request Linux kernel: netfilter: nf_nat: leakage of uninitialized buffer in IRC NAT helper + + + CONFIRM + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.8 + + The help function in net/netfilter/nf_nat_irc.c in the Linux kernel before 3.12.8 allows remote attackers to obtain sensitive information from kernel memory by establishing an IRC DCC session in which incorrect packet data is transmitted during use of the NAT mangle feature. + + + + + + + + + + + + + + cpe:/a:horde:horde_application_framework:5.1.0 + cpe:/a:horde:horde_application_framework:5.0.4 + cpe:/a:horde:horde_application_framework:5.0.2 + cpe:/a:horde:horde_application_framework:5.0.3 + cpe:/a:horde:horde_application_framework:5.0.0 + cpe:/a:horde:horde_application_framework:5.0.1 + + CVE-2014-1691 + 2014-04-01T11:55:06.363-04:00 + 2014-04-02T10:50:49.507-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-02T10:50:44.990-04:00 + + + + + CONFIRM + https://github.com/horde/horde/commit/da6afc7e9f4e290f782eca9dbca794f772caccb3 + + + MLIST + [oss-security] 20140128 Re: Remote code execution in horde < 5.1.1 + + + MLIST + [oss-security] 20140128 Remote code execution in horde < 5.1.1 + + + CONFIRM + https://github.com/horde/horde/blob/82c400788537cfc0106b68447789ff53793ac086/bundles/groupware/docs/CHANGES#L215 + + + DEBIAN + DSA-2853 + + + MLIST + [oss-security] 20140129 Re: Remote code execution in horde < 5.1.1 + + The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted serialized object in the _formvars form. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:openbsd:openssh:3.0.2p1 + cpe:/a:openbsd:openssh:1.5 + cpe:/a:openbsd:openssh:2.3.1 + cpe:/a:openbsd:openssh:3.6.1 + cpe:/a:openbsd:openssh:4.5 + cpe:/a:openbsd:openssh:4.4 + cpe:/a:openbsd:openssh:2.5.1 + cpe:/a:openbsd:openssh:3.0.1 + cpe:/a:openbsd:openssh:3.4p1 + cpe:/a:openbsd:openssh:4.3 + cpe:/a:openbsd:openssh:2.5.2 + cpe:/a:openbsd:openssh:3.0.2 + cpe:/a:openbsd:openssh:4.2 + cpe:/a:openbsd:openssh:4.9 + cpe:/a:openbsd:openssh:4.8 + cpe:/a:openbsd:openssh:4.7 + cpe:/a:openbsd:openssh:4.6 + cpe:/a:openbsd:openssh:4.0 + cpe:/a:openbsd:openssh:4.1 + cpe:/a:openbsd:openssh:1.2 + cpe:/a:openbsd:openssh:3.1p1 + cpe:/a:openbsd:openssh:1.3 + cpe:/a:openbsd:openssh:3.0.1p1 + cpe:/a:openbsd:openssh:2.1.1 + cpe:/a:openbsd:openssh:2.9 + cpe:/a:openbsd:openssh:3.0 + cpe:/a:openbsd:openssh:3.1 + cpe:/a:openbsd:openssh:3.2 + cpe:/a:openbsd:openssh:3.3p1 + cpe:/a:openbsd:openssh:2.5 + cpe:/a:openbsd:openssh:5.0 + cpe:/a:openbsd:openssh:3.4 + cpe:/a:openbsd:openssh:3.9.1 + cpe:/a:openbsd:openssh:2.9.9 + cpe:/a:openbsd:openssh:3.3 + cpe:/a:openbsd:openssh:3.7.1 + cpe:/a:openbsd:openssh:3.6 + cpe:/a:openbsd:openssh:4.2p1 + cpe:/a:openbsd:openssh:3.5p1 + cpe:/a:openbsd:openssh:3.5 + cpe:/a:openbsd:openssh:1.5.8 + cpe:/a:openbsd:openssh:5.7 + cpe:/a:openbsd:openssh:3.6.1p1 + cpe:/a:openbsd:openssh:5.8 + cpe:/a:openbsd:openssh:5.5 + cpe:/a:openbsd:openssh:1.5.7 + cpe:/a:openbsd:openssh:5.6 + cpe:/a:openbsd:openssh:5.3 + cpe:/a:openbsd:openssh:2.1 + cpe:/a:openbsd:openssh:5.4 + cpe:/a:openbsd:openssh:2.2 + cpe:/a:openbsd:openssh:5.1 + cpe:/a:openbsd:openssh:2.3 + cpe:/a:openbsd:openssh:5.2 + cpe:/a:openbsd:openssh:3.8 + cpe:/a:openbsd:openssh:3.7 + cpe:/a:openbsd:openssh:3.9 + cpe:/a:openbsd:openssh:3.7.1p1 + cpe:/a:openbsd:openssh:3.7.1p2 + cpe:/a:openbsd:openssh:4.3p1 + cpe:/a:openbsd:openssh:4.3p2 + cpe:/a:openbsd:openssh + cpe:/a:openbsd:openssh:3.9.1p1 + cpe:/a:openbsd:openssh:3.2.3p1 + cpe:/a:openbsd:openssh:4.0p1 + cpe:/a:openbsd:openssh:1.2.3 + cpe:/a:openbsd:openssh:1.2.1 + cpe:/a:openbsd:openssh:5.8p2 + cpe:/a:openbsd:openssh:1.2.2 + cpe:/a:openbsd:openssh:6.4 + cpe:/a:openbsd:openssh:6.0 + cpe:/a:openbsd:openssh:6.1 + cpe:/a:openbsd:openssh:1.2.27 + cpe:/a:openbsd:openssh:6.2 + cpe:/a:openbsd:openssh:6.3 + cpe:/a:openbsd:openssh:4.1p1 + cpe:/a:openbsd:openssh:3.8.1p1 + cpe:/a:openbsd:openssh:4.4p1 + cpe:/a:openbsd:openssh:3.0p1 + cpe:/a:openbsd:openssh:5.9 + cpe:/a:openbsd:openssh:2.9.9p2 + cpe:/a:openbsd:openssh:3.2.2p1 + cpe:/a:openbsd:openssh:3.8.1 + cpe:/a:openbsd:openssh:3.6.1p2 + cpe:/a:openbsd:openssh:2.9p1 + cpe:/a:openbsd:openssh:2.9p2 + cpe:/a:openbsd:openssh:3.2.2 + cpe:/a:openbsd:openssh:2 + + CVE-2014-1692 + 2014-01-29T11:02:05.443-05:00 + 2014-02-06T23:52:00.847-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-29T14:17:33.193-05:00 + + + + + XF + openssh-cve20141692-code-exec(90819) + + + BID + 65230 + + + MISC + http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/schnorr.c#rev1.10 + + + MISC + http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/Attic/schnorr.c.diff?r1=1.9;r2=1.10;f=h + + + OSVDB + 102611 + + + MLIST + [oss-security] 20140128 OpenSSH J-PAKE vulnerability (no cause for panic! remain calm!) + + + MLIST + [oss-security] 20140129 Re: OpenSSH J-PAKE vulnerability (no cause for panic! remain calm!) + + The hash_buffer function in schnorr.c in OpenSSH through 6.4, when Makefile.inc is modified to enable the J-PAKE protocol, does not initialize certain data structures, which might allow remote attackers to cause a denial of service (memory corruption) or have unspecified other impact via vectors that trigger an error condition. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:otrs:otrs:3.1.4 + cpe:/a:otrs:otrs:3.3.0 + cpe:/a:otrs:otrs:3.1.13 + cpe:/a:otrs:otrs:3.2.10 + cpe:/a:otrs:otrs:3.1.3 + cpe:/a:otrs:otrs:3.1.6 + cpe:/a:otrs:otrs:3.1.5 + cpe:/a:otrs:otrs:3.1.11 + cpe:/a:otrs:otrs:3.1.7 + cpe:/a:otrs:otrs:3.2.0:beta4 + cpe:/a:otrs:otrs:3.2.0:beta5 + cpe:/a:otrs:otrs:3.2.0 + cpe:/a:otrs:otrs:3.3.0:beta3 + cpe:/a:otrs:otrs:3.2.1 + cpe:/a:otrs:otrs:3.3.0:beta2 + cpe:/a:otrs:otrs:3.2.0:beta1 + cpe:/a:otrs:otrs:3.2.0:beta3 + cpe:/a:otrs:otrs:3.3.0:beta4 + cpe:/a:otrs:otrs:3.2.0:beta2 + cpe:/a:otrs:otrs:3.3.0:beta1 + cpe:/a:otrs:otrs:3.3.0:beta5 + cpe:/a:otrs:otrs:3.2.7 + cpe:/a:otrs:otrs:3.1.9 + cpe:/a:otrs:otrs:3.1.8 + cpe:/a:otrs:otrs:3.2.9 + cpe:/a:otrs:otrs:3.2.8 + cpe:/a:otrs:otrs:3.1.10 + cpe:/a:otrs:otrs:3.2.0:rc1 + cpe:/a:otrs:otrs:3.3.2 + cpe:/a:otrs:otrs:3.2.6 + cpe:/a:otrs:otrs:3.1.1 + cpe:/a:otrs:otrs:3.3.1 + cpe:/a:otrs:otrs:3.1.18 + cpe:/a:otrs:otrs:3.1.2 + cpe:/a:otrs:otrs:3.3.3 + cpe:/a:otrs:otrs:3.1.0 + cpe:/a:otrs:otrs:3.1.15 + cpe:/a:otrs:otrs:3.2.2 + cpe:/a:otrs:otrs:3.1.14 + cpe:/a:otrs:otrs:3.2.3 + cpe:/a:otrs:otrs:3.1.17 + cpe:/a:otrs:otrs:3.2.4 + cpe:/a:otrs:otrs:3.3.0:rc1 + cpe:/a:otrs:otrs:3.1.16 + cpe:/a:otrs:otrs:3.2.5 + + CVE-2014-1694 + 2014-02-04T16:55:05.640-05:00 + 2014-03-05T23:50:55.003-05:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-05T10:47:28.587-05:00 + + + + + CONFIRM + https://www.otrs.com/security-advisory-2014-01-csrf-issue-customer-web-interface + + + CONFIRM + https://github.com/OTRS/otrs/commit/ca2c3390fd60d9a3f810ed2c22cbc2c193457b77 + + + CONFIRM + https://github.com/OTRS/otrs/commit/92f417277f43832f1a0462f2485fe1fd3fd52312 + + + CONFIRM + https://github.com/OTRS/otrs/commit/6f324aaf8647729d509eebf063a0181f9f9196f7 + + + CONFIRM + https://www.otrs.com/release-notes-otrs-help-desk-3-3-4 + + + MLIST + [oss-security] 20140129 CVE Request: otrs: CSRF issue in customer web interface + + + MLIST + [oss-security] 20140129 Re: CVE Request: otrs: CSRF issue in customer web interface + + + DEBIAN + DSA-2867 + + + SECUNIA + 56655 + + + SECUNIA + 56644 + + + OSVDB + 102632 + + + CONFIRM + http://bugs.otrs.org/show_bug.cgi?id=10099 + + Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences.pm, (2) CustomerTicketMessage.pm, (3) CustomerTicketProcess.pm, and (4) CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow remote attackers to hijack the authentication of arbitrary users for requests that (5) create tickets or (6) send follow-ups to existing tickets. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:otrs:otrs:3.1.4 + cpe:/a:otrs:otrs:3.2.10 + cpe:/a:otrs:otrs:3.3.0 + cpe:/a:otrs:otrs:3.1.13 + cpe:/a:otrs:otrs:3.1.3 + cpe:/a:otrs:otrs:3.1.6 + cpe:/a:otrs:otrs:3.1.5 + cpe:/a:otrs:otrs:3.1.11 + cpe:/a:otrs:otrs:3.1.7 + cpe:/a:otrs:otrs:3.2.0:beta4 + cpe:/a:otrs:otrs:3.2.0:beta5 + cpe:/a:otrs:otrs:3.2.0 + cpe:/a:otrs:otrs:3.2.1 + cpe:/a:otrs:otrs:3.3.0:beta3 + cpe:/a:otrs:otrs:3.3.0:beta2 + cpe:/a:otrs:otrs:3.2.0:beta1 + cpe:/a:otrs:otrs:3.2.0:beta3 + cpe:/a:otrs:otrs:3.2.0:beta2 + cpe:/a:otrs:otrs:3.3.0:beta4 + cpe:/a:otrs:otrs:3.3.0:beta1 + cpe:/a:otrs:otrs:3.3.0:beta5 + cpe:/a:otrs:otrs:3.2.7 + cpe:/a:otrs:otrs:3.1.9 + cpe:/a:otrs:otrs:3.1.19 + cpe:/a:otrs:otrs:3.2.9 + cpe:/a:otrs:otrs:3.1.8 + cpe:/a:otrs:otrs:3.2.8 + cpe:/a:otrs:otrs:3.1.10 + cpe:/a:otrs:otrs:3.2.0:rc1 + cpe:/a:otrs:otrs:3.2.6 + cpe:/a:otrs:otrs:3.3.2 + cpe:/a:otrs:otrs:3.1.1 + cpe:/a:otrs:otrs:3.3.1 + cpe:/a:otrs:otrs:3.1.18 + cpe:/a:otrs:otrs:3.1.2 + cpe:/a:otrs:otrs:3.3.4 + cpe:/a:otrs:otrs:3.2.14 + cpe:/a:otrs:otrs:3.1.0 + cpe:/a:otrs:otrs:3.3.3 + cpe:/a:otrs:otrs:3.2.2 + cpe:/a:otrs:otrs:3.1.15 + cpe:/a:otrs:otrs:3.2.3 + cpe:/a:otrs:otrs:3.1.14 + cpe:/a:otrs:otrs:3.2.4 + cpe:/a:otrs:otrs:3.1.17 + cpe:/a:otrs:otrs:3.2.5 + cpe:/a:otrs:otrs:3.3.0:rc1 + cpe:/a:otrs:otrs:3.1.16 + + CVE-2014-1695 + 2014-02-28T19:01:08.200-05:00 + 2014-03-28T14:00:01.033-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-28T13:59:57.953-04:00 + + + + + CONFIRM + https://www.otrs.com/security-advisory-2014-03-xss-issue + + + BID + 65844 + + + SECUNIA + 57018 + + + SUSE + openSUSE-SU-2014:0360 + + Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.20, 3.2.x before 3.2.15, and 3.3.x before 3.3.5 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML email. + + + + + + + + + cpe:/a:siemens:simatic_wincc_open_architecture:3.12 + + CVE-2014-1696 + 2014-02-06T23:52:04.380-05:00 + 2014-02-21T00:06:45.767-05:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-02-07T16:06:39.200-05:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-035-01 + + + XF + simatic-wincc-cve20141696-priv-esc(90934) + + + CONFIRM + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-342587.pdf + + + OSVDB + 102809 + + Siemens SIMATIC WinCC OA before 3.12 P002 January uses a weak hash algorithm for passwords, which makes it easier for remote attackers to obtain access via a brute-force attack. + + + + + + + + + cpe:/a:siemens:simatic_wincc_open_architecture:3.12 + + CVE-2014-1697 + 2014-02-06T23:52:04.410-05:00 + 2014-02-21T00:06:45.843-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-07T16:07:52.500-05:00 + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-035-01 + + + XF + simatic-wincc-cve20141697-code-exec(90933) + + + CONFIRM + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-342587.pdf + + + BID + 65351 + + + SECUNIA + 56651 + + + OSVDB + 102810 + + The integrated web server in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to execute arbitrary code via crafted packets to TCP port 4999. + + + + + + + + + cpe:/a:siemens:simatic_wincc_open_architecture:3.12 + + CVE-2014-1698 + 2014-02-06T23:52:04.443-05:00 + 2014-02-21T00:06:45.920-05:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-02-07T16:08:38.643-05:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-035-01 + + + XF + simatic-wincc-cve20141698-dir-trav(90935) + + + CONFIRM + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-342587.pdf + + + BID + 65349 + + + SECUNIA + 56651 + + + OSVDB + 102811 + + Directory traversal vulnerability in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to read arbitrary files via crafted packets to TCP port 4999. + + + + + + + + + cpe:/a:siemens:simatic_wincc_open_architecture:3.12 + + CVE-2014-1699 + 2014-02-06T23:52:04.457-05:00 + 2014-02-21T00:06:46.017-05:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-02-07T16:09:44.067-05:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-035-01 + + + XF + simatic-wincc-cve20141699-dos(90936) + + + CONFIRM + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-342587.pdf + + + BID + 65347 + + + SECUNIA + 56651 + + + OSVDB + 102812 + + Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to cause a denial of service (monitoring-service outage) via malformed HTTP requests to port 4999. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:google:chrome:33.0.1750.53 + cpe:/a:google:chrome:33.0.1750.116 + cpe:/a:google:chrome:33.0.1750.35 + cpe:/a:google:chrome:33.0.1750.52 + cpe:/a:google:chrome:33.0.1750.115 + cpe:/a:google:chrome:33.0.1750.34 + cpe:/a:google:chrome:33.0.1750.51 + cpe:/a:google:chrome:33.0.1750.50 + cpe:/a:google:chrome:33.0.1750.117 + cpe:/a:google:chrome:33.0.1750.39 + cpe:/a:google:chrome:33.0.1750.112 + cpe:/a:google:chrome:33.0.1750.38 + cpe:/a:google:chrome:33.0.1750.111 + cpe:/a:google:chrome:33.0.1750.37 + cpe:/a:google:chrome:33.0.1750.36 + cpe:/a:google:chrome:33.0.1750.113 + cpe:/a:google:chrome:33.0.1750.92 + cpe:/a:google:chrome:33.0.1750.93 + cpe:/a:google:chrome:33.0.1750.90 + cpe:/a:google:chrome:33.0.1750.91 + cpe:/a:google:chrome:33.0.1750.89 + cpe:/a:google:chrome:33.0.1750.88 + cpe:/a:google:chrome:33.0.1750.49 + cpe:/a:google:chrome:33.0.1750.47 + cpe:/a:google:chrome:33.0.1750.124 + cpe:/a:google:chrome:33.0.1750.48 + cpe:/a:google:chrome:33.0.1750.125 + cpe:/a:google:chrome:33.0.1750.110 + cpe:/a:google:chrome:33.0.1750.45 + cpe:/a:google:chrome:33.0.1750.41 + cpe:/a:google:chrome:33.0.1750.126 + cpe:/a:google:chrome:33.0.1750.46 + cpe:/a:google:chrome:33.0.1750.42 + cpe:/a:google:chrome:33.0.1750.43 + cpe:/a:google:chrome:33.0.1750.44 + cpe:/a:google:chrome:33.0.1750.40 + cpe:/a:google:chrome:33.0.1750.83 + cpe:/a:google:chrome:33.0.1750.85 + cpe:/a:google:chrome:33.0.1750.80 + cpe:/a:google:chrome:33.0.1750.9 + cpe:/a:google:chrome:33.0.1750.82 + cpe:/a:google:chrome:33.0.1750.81 + cpe:/a:google:chrome:33.0.1750.6 + cpe:/a:google:chrome:33.0.1750.5 + cpe:/a:google:chrome:33.0.1750.8 + cpe:/a:google:chrome:33.0.1750.7 + cpe:/a:google:chrome:33.0.1750.2 + cpe:/a:google:chrome:33.0.1750.1 + cpe:/a:google:chrome:33.0.1750.4 + cpe:/a:google:chrome:33.0.1750.3 + cpe:/a:google:chrome:33.0.1750.0 + cpe:/a:google:chrome:33.0.1750.76 + cpe:/a:google:chrome:33.0.1750.77 + cpe:/a:google:chrome:33.0.1750.79 + cpe:/a:google:chrome:33.0.1750.133 + cpe:/a:google:chrome:33.0.1750.16 + cpe:/a:google:chrome:33.0.1750.136 + cpe:/a:google:chrome:33.0.1750.15 + cpe:/a:google:chrome:33.0.1750.135 + cpe:/a:google:chrome:33.0.1750.14 + cpe:/a:google:chrome:33.0.1750.13 + cpe:/a:google:chrome:33.0.1750.31 + cpe:/a:google:chrome:33.0.1750.12 + cpe:/a:google:chrome:33.0.1750.30 + cpe:/a:google:chrome:33.0.1750.11 + cpe:/a:google:chrome:33.0.1750.10 + cpe:/a:google:chrome:33.0.1750.70 + cpe:/a:google:chrome:33.0.1750.71 + cpe:/a:google:chrome:33.0.1750.74 + cpe:/a:google:chrome:33.0.1750.75 + cpe:/a:google:chrome:33.0.1750.19 + cpe:/a:google:chrome:33.0.1750.73 + cpe:/a:google:chrome:33.0.1750.18 + cpe:/a:google:chrome:33.0.1750.68 + cpe:/a:google:chrome:33.0.1750.67 + cpe:/a:google:chrome:33.0.1750.66 + cpe:/a:google:chrome:33.0.1750.29 + cpe:/a:google:chrome:33.0.1750.65 + cpe:/a:google:chrome:33.0.1750.69 + cpe:/a:google:chrome:33.0.1750.23 + cpe:/a:google:chrome:33.0.1750.20 + cpe:/a:google:chrome:33.0.1750.24 + cpe:/a:google:chrome:33.0.1750.21 + cpe:/a:google:chrome:33.0.1750.22 + cpe:/a:google:chrome:33.0.1750.144 + cpe:/a:google:chrome:33.0.1750.27 + cpe:/a:google:chrome:33.0.1750.28 + cpe:/a:google:chrome:33.0.1750.146 + cpe:/a:google:chrome:33.0.1750.25 + cpe:/a:google:chrome:33.0.1750.132 + cpe:/a:google:chrome:33.0.1750.26 + cpe:/a:google:chrome:33.0.1750.60 + cpe:/a:google:chrome:33.0.1750.62 + cpe:/a:google:chrome:33.0.1750.107 + cpe:/a:google:chrome:33.0.1750.61 + cpe:/a:google:chrome:33.0.1750.106 + cpe:/a:google:chrome:33.0.1750.64 + cpe:/a:google:chrome:33.0.1750.63 + cpe:/a:google:chrome:33.0.1750.104 + cpe:/a:google:chrome:33.0.1750.109 + cpe:/a:google:chrome:33.0.1750.108 + cpe:/a:google:chrome:33.0.1750.54 + cpe:/a:google:chrome:33.0.1750.55 + cpe:/a:google:chrome:33.0.1750.56 + cpe:/a:google:chrome:33.0.1750.57 + cpe:/a:google:chrome:33.0.1750.58 + cpe:/a:google:chrome:33.0.1750.59 + + CVE-2014-1700 + 2014-03-16T10:06:45.333-04:00 + 2014-04-01T02:29:03.407-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-17T14:27:29.083-04:00 + + + + + CONFIRM + https://src.chromium.org/viewvc/blink?revision=168171&view=revision + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=344881 + + + DEBIAN + DSA-2883 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html + + Use-after-free vulnerability in modules/speech/SpeechSynthesis.cpp in Blink, as used in Google Chrome before 33.0.1750.149, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of a certain utterance data structure. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:google:chrome:33.0.1750.53 + cpe:/a:google:chrome:33.0.1750.116 + cpe:/a:google:chrome:33.0.1750.35 + cpe:/a:google:chrome:33.0.1750.52 + cpe:/a:google:chrome:33.0.1750.115 + cpe:/a:google:chrome:33.0.1750.34 + cpe:/a:google:chrome:33.0.1750.51 + cpe:/a:google:chrome:33.0.1750.50 + cpe:/a:google:chrome:33.0.1750.117 + cpe:/a:google:chrome:33.0.1750.39 + cpe:/a:google:chrome:33.0.1750.112 + cpe:/a:google:chrome:33.0.1750.38 + cpe:/a:google:chrome:33.0.1750.111 + cpe:/a:google:chrome:33.0.1750.37 + cpe:/a:google:chrome:33.0.1750.36 + cpe:/a:google:chrome:33.0.1750.113 + cpe:/a:google:chrome:33.0.1750.92 + cpe:/a:google:chrome:33.0.1750.93 + cpe:/a:google:chrome:33.0.1750.90 + cpe:/a:google:chrome:33.0.1750.91 + cpe:/a:google:chrome:33.0.1750.89 + cpe:/a:google:chrome:33.0.1750.88 + cpe:/a:google:chrome:33.0.1750.49 + cpe:/a:google:chrome:33.0.1750.47 + cpe:/a:google:chrome:33.0.1750.124 + cpe:/a:google:chrome:33.0.1750.48 + cpe:/a:google:chrome:33.0.1750.125 + cpe:/a:google:chrome:33.0.1750.110 + cpe:/a:google:chrome:33.0.1750.45 + cpe:/a:google:chrome:33.0.1750.41 + cpe:/a:google:chrome:33.0.1750.126 + cpe:/a:google:chrome:33.0.1750.46 + cpe:/a:google:chrome:33.0.1750.42 + cpe:/a:google:chrome:33.0.1750.43 + cpe:/a:google:chrome:33.0.1750.44 + cpe:/a:google:chrome:33.0.1750.40 + cpe:/a:google:chrome:33.0.1750.83 + cpe:/a:google:chrome:33.0.1750.85 + cpe:/a:google:chrome:33.0.1750.80 + cpe:/a:google:chrome:33.0.1750.9 + cpe:/a:google:chrome:33.0.1750.82 + cpe:/a:google:chrome:33.0.1750.81 + cpe:/a:google:chrome:33.0.1750.6 + cpe:/a:google:chrome:33.0.1750.5 + cpe:/a:google:chrome:33.0.1750.8 + cpe:/a:google:chrome:33.0.1750.7 + cpe:/a:google:chrome:33.0.1750.2 + cpe:/a:google:chrome:33.0.1750.1 + cpe:/a:google:chrome:33.0.1750.4 + cpe:/a:google:chrome:33.0.1750.3 + cpe:/a:google:chrome:33.0.1750.0 + cpe:/a:google:chrome:33.0.1750.76 + cpe:/a:google:chrome:33.0.1750.77 + cpe:/a:google:chrome:33.0.1750.79 + cpe:/a:google:chrome:33.0.1750.133 + cpe:/a:google:chrome:33.0.1750.16 + cpe:/a:google:chrome:33.0.1750.136 + cpe:/a:google:chrome:33.0.1750.15 + cpe:/a:google:chrome:33.0.1750.135 + cpe:/a:google:chrome:33.0.1750.14 + cpe:/a:google:chrome:33.0.1750.13 + cpe:/a:google:chrome:33.0.1750.31 + cpe:/a:google:chrome:33.0.1750.12 + cpe:/a:google:chrome:33.0.1750.30 + cpe:/a:google:chrome:33.0.1750.11 + cpe:/a:google:chrome:33.0.1750.10 + cpe:/a:google:chrome:33.0.1750.70 + cpe:/a:google:chrome:33.0.1750.71 + cpe:/a:google:chrome:33.0.1750.74 + cpe:/a:google:chrome:33.0.1750.75 + cpe:/a:google:chrome:33.0.1750.19 + cpe:/a:google:chrome:33.0.1750.73 + cpe:/a:google:chrome:33.0.1750.18 + cpe:/a:google:chrome:33.0.1750.68 + cpe:/a:google:chrome:33.0.1750.67 + cpe:/a:google:chrome:33.0.1750.66 + cpe:/a:google:chrome:33.0.1750.29 + cpe:/a:google:chrome:33.0.1750.65 + cpe:/a:google:chrome:33.0.1750.69 + cpe:/a:google:chrome:33.0.1750.23 + cpe:/a:google:chrome:33.0.1750.20 + cpe:/a:google:chrome:33.0.1750.24 + cpe:/a:google:chrome:33.0.1750.21 + cpe:/a:google:chrome:33.0.1750.22 + cpe:/a:google:chrome:33.0.1750.144 + cpe:/a:google:chrome:33.0.1750.27 + cpe:/a:google:chrome:33.0.1750.28 + cpe:/a:google:chrome:33.0.1750.146 + cpe:/a:google:chrome:33.0.1750.25 + cpe:/a:google:chrome:33.0.1750.132 + cpe:/a:google:chrome:33.0.1750.26 + cpe:/a:google:chrome:33.0.1750.60 + cpe:/a:google:chrome:33.0.1750.62 + cpe:/a:google:chrome:33.0.1750.107 + cpe:/a:google:chrome:33.0.1750.61 + cpe:/a:google:chrome:33.0.1750.106 + cpe:/a:google:chrome:33.0.1750.64 + cpe:/a:google:chrome:33.0.1750.63 + cpe:/a:google:chrome:33.0.1750.104 + cpe:/a:google:chrome:33.0.1750.109 + cpe:/a:google:chrome:33.0.1750.108 + cpe:/a:google:chrome:33.0.1750.54 + cpe:/a:google:chrome:33.0.1750.55 + cpe:/a:google:chrome:33.0.1750.56 + cpe:/a:google:chrome:33.0.1750.57 + cpe:/a:google:chrome:33.0.1750.58 + cpe:/a:google:chrome:33.0.1750.59 + + CVE-2014-1701 + 2014-03-16T10:06:45.350-04:00 + 2014-04-01T02:29:03.577-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-17T14:28:42.647-04:00 + + + + + CONFIRM + https://src.chromium.org/viewvc/blink?revision=166999&view=revision + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=342618 + + + DEBIAN + DSA-2883 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html + + The GenerateFunction function in bindings/scripts/code_generator_v8.pm in Blink, as used in Google Chrome before 33.0.1750.149, does not implement a certain cross-origin restriction for the EventTarget::dispatchEvent function, which allows remote attackers to conduct Universal XSS (UXSS) attacks via vectors involving events. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:google:chrome:33.0.1750.53 + cpe:/a:google:chrome:33.0.1750.116 + cpe:/a:google:chrome:33.0.1750.35 + cpe:/a:google:chrome:33.0.1750.52 + cpe:/a:google:chrome:33.0.1750.115 + cpe:/a:google:chrome:33.0.1750.34 + cpe:/a:google:chrome:33.0.1750.51 + cpe:/a:google:chrome:33.0.1750.50 + cpe:/a:google:chrome:33.0.1750.117 + cpe:/a:google:chrome:33.0.1750.39 + cpe:/a:google:chrome:33.0.1750.112 + cpe:/a:google:chrome:33.0.1750.38 + cpe:/a:google:chrome:33.0.1750.111 + cpe:/a:google:chrome:33.0.1750.37 + cpe:/a:google:chrome:33.0.1750.36 + cpe:/a:google:chrome:33.0.1750.113 + cpe:/a:google:chrome:33.0.1750.92 + cpe:/a:google:chrome:33.0.1750.93 + cpe:/a:google:chrome:33.0.1750.90 + cpe:/a:google:chrome:33.0.1750.91 + cpe:/a:google:chrome:33.0.1750.89 + cpe:/a:google:chrome:33.0.1750.88 + cpe:/a:google:chrome:33.0.1750.49 + cpe:/a:google:chrome:33.0.1750.47 + cpe:/a:google:chrome:33.0.1750.124 + cpe:/a:google:chrome:33.0.1750.48 + cpe:/a:google:chrome:33.0.1750.125 + cpe:/a:google:chrome:33.0.1750.110 + cpe:/a:google:chrome:33.0.1750.45 + cpe:/a:google:chrome:33.0.1750.41 + cpe:/a:google:chrome:33.0.1750.126 + cpe:/a:google:chrome:33.0.1750.46 + cpe:/a:google:chrome:33.0.1750.42 + cpe:/a:google:chrome:33.0.1750.43 + cpe:/a:google:chrome:33.0.1750.44 + cpe:/a:google:chrome:33.0.1750.40 + cpe:/a:google:chrome:33.0.1750.83 + cpe:/a:google:chrome:33.0.1750.85 + cpe:/a:google:chrome:33.0.1750.80 + cpe:/a:google:chrome:33.0.1750.9 + cpe:/a:google:chrome:33.0.1750.82 + cpe:/a:google:chrome:33.0.1750.81 + cpe:/a:google:chrome:33.0.1750.6 + cpe:/a:google:chrome:33.0.1750.5 + cpe:/a:google:chrome:33.0.1750.8 + cpe:/a:google:chrome:33.0.1750.7 + cpe:/a:google:chrome:33.0.1750.2 + cpe:/a:google:chrome:33.0.1750.1 + cpe:/a:google:chrome:33.0.1750.4 + cpe:/a:google:chrome:33.0.1750.3 + cpe:/a:google:chrome:33.0.1750.0 + cpe:/a:google:chrome:33.0.1750.76 + cpe:/a:google:chrome:33.0.1750.77 + cpe:/a:google:chrome:33.0.1750.79 + cpe:/a:google:chrome:33.0.1750.133 + cpe:/a:google:chrome:33.0.1750.16 + cpe:/a:google:chrome:33.0.1750.136 + cpe:/a:google:chrome:33.0.1750.15 + cpe:/a:google:chrome:33.0.1750.135 + cpe:/a:google:chrome:33.0.1750.14 + cpe:/a:google:chrome:33.0.1750.13 + cpe:/a:google:chrome:33.0.1750.31 + cpe:/a:google:chrome:33.0.1750.12 + cpe:/a:google:chrome:33.0.1750.30 + cpe:/a:google:chrome:33.0.1750.11 + cpe:/a:google:chrome:33.0.1750.10 + cpe:/a:google:chrome:33.0.1750.70 + cpe:/a:google:chrome:33.0.1750.71 + cpe:/a:google:chrome:33.0.1750.74 + cpe:/a:google:chrome:33.0.1750.75 + cpe:/a:google:chrome:33.0.1750.19 + cpe:/a:google:chrome:33.0.1750.73 + cpe:/a:google:chrome:33.0.1750.18 + cpe:/a:google:chrome:33.0.1750.68 + cpe:/a:google:chrome:33.0.1750.67 + cpe:/a:google:chrome:33.0.1750.66 + cpe:/a:google:chrome:33.0.1750.29 + cpe:/a:google:chrome:33.0.1750.65 + cpe:/a:google:chrome:33.0.1750.69 + cpe:/a:google:chrome:33.0.1750.23 + cpe:/a:google:chrome:33.0.1750.20 + cpe:/a:google:chrome:33.0.1750.24 + cpe:/a:google:chrome:33.0.1750.21 + cpe:/a:google:chrome:33.0.1750.22 + cpe:/a:google:chrome:33.0.1750.144 + cpe:/a:google:chrome:33.0.1750.27 + cpe:/a:google:chrome:33.0.1750.28 + cpe:/a:google:chrome:33.0.1750.146 + cpe:/a:google:chrome:33.0.1750.25 + cpe:/a:google:chrome:33.0.1750.132 + cpe:/a:google:chrome:33.0.1750.26 + cpe:/a:google:chrome:33.0.1750.60 + cpe:/a:google:chrome:33.0.1750.62 + cpe:/a:google:chrome:33.0.1750.107 + cpe:/a:google:chrome:33.0.1750.61 + cpe:/a:google:chrome:33.0.1750.106 + cpe:/a:google:chrome:33.0.1750.64 + cpe:/a:google:chrome:33.0.1750.63 + cpe:/a:google:chrome:33.0.1750.104 + cpe:/a:google:chrome:33.0.1750.109 + cpe:/a:google:chrome:33.0.1750.108 + cpe:/a:google:chrome:33.0.1750.54 + cpe:/a:google:chrome:33.0.1750.55 + cpe:/a:google:chrome:33.0.1750.56 + cpe:/a:google:chrome:33.0.1750.57 + cpe:/a:google:chrome:33.0.1750.58 + cpe:/a:google:chrome:33.0.1750.59 + + CVE-2014-1702 + 2014-03-16T10:06:45.380-04:00 + 2014-04-01T02:29:03.670-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-17T14:40:43.883-04:00 + + + + + CONFIRM + https://src.chromium.org/viewvc/blink?revision=168059&view=revision + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=333058 + + + DEBIAN + DSA-2883 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html + + Use-after-free vulnerability in the DatabaseThread::cleanupDatabaseThread function in modules/webdatabase/DatabaseThread.cpp in the web database implementation in Blink, as used in Google Chrome before 33.0.1750.149, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of scheduled tasks during shutdown of a thread. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:google:chrome:33.0.1750.53 + cpe:/a:google:chrome:33.0.1750.116 + cpe:/a:google:chrome:33.0.1750.35 + cpe:/a:google:chrome:33.0.1750.52 + cpe:/a:google:chrome:33.0.1750.115 + cpe:/a:google:chrome:33.0.1750.34 + cpe:/a:google:chrome:33.0.1750.51 + cpe:/a:google:chrome:33.0.1750.50 + cpe:/a:google:chrome:33.0.1750.117 + cpe:/a:google:chrome:33.0.1750.39 + cpe:/a:google:chrome:33.0.1750.112 + cpe:/a:google:chrome:33.0.1750.38 + cpe:/a:google:chrome:33.0.1750.111 + cpe:/a:google:chrome:33.0.1750.37 + cpe:/a:google:chrome:33.0.1750.36 + cpe:/a:google:chrome:33.0.1750.113 + cpe:/a:google:chrome:33.0.1750.92 + cpe:/a:google:chrome:33.0.1750.93 + cpe:/a:google:chrome:33.0.1750.90 + cpe:/a:google:chrome:33.0.1750.91 + cpe:/a:google:chrome:33.0.1750.89 + cpe:/a:google:chrome:33.0.1750.88 + cpe:/a:google:chrome:33.0.1750.49 + cpe:/a:google:chrome:33.0.1750.47 + cpe:/a:google:chrome:33.0.1750.124 + cpe:/a:google:chrome:33.0.1750.48 + cpe:/a:google:chrome:33.0.1750.125 + cpe:/a:google:chrome:33.0.1750.110 + cpe:/a:google:chrome:33.0.1750.45 + cpe:/a:google:chrome:33.0.1750.41 + cpe:/a:google:chrome:33.0.1750.126 + cpe:/a:google:chrome:33.0.1750.46 + cpe:/a:google:chrome:33.0.1750.42 + cpe:/a:google:chrome:33.0.1750.43 + cpe:/a:google:chrome:33.0.1750.44 + cpe:/a:google:chrome:33.0.1750.40 + cpe:/a:google:chrome:33.0.1750.83 + cpe:/a:google:chrome:33.0.1750.85 + cpe:/a:google:chrome:33.0.1750.80 + cpe:/a:google:chrome:33.0.1750.9 + cpe:/a:google:chrome:33.0.1750.82 + cpe:/a:google:chrome:33.0.1750.81 + cpe:/a:google:chrome:33.0.1750.6 + cpe:/a:google:chrome:33.0.1750.5 + cpe:/a:google:chrome:33.0.1750.8 + cpe:/a:google:chrome:33.0.1750.7 + cpe:/a:google:chrome:33.0.1750.2 + cpe:/a:google:chrome:33.0.1750.1 + cpe:/a:google:chrome:33.0.1750.4 + cpe:/a:google:chrome:33.0.1750.3 + cpe:/a:google:chrome:33.0.1750.0 + cpe:/a:google:chrome:33.0.1750.76 + cpe:/a:google:chrome:33.0.1750.77 + cpe:/a:google:chrome:33.0.1750.79 + cpe:/a:google:chrome:33.0.1750.133 + cpe:/a:google:chrome:33.0.1750.16 + cpe:/a:google:chrome:33.0.1750.136 + cpe:/a:google:chrome:33.0.1750.15 + cpe:/a:google:chrome:33.0.1750.135 + cpe:/a:google:chrome:33.0.1750.14 + cpe:/a:google:chrome:33.0.1750.13 + cpe:/a:google:chrome:33.0.1750.31 + cpe:/a:google:chrome:33.0.1750.12 + cpe:/a:google:chrome:33.0.1750.30 + cpe:/a:google:chrome:33.0.1750.11 + cpe:/a:google:chrome:33.0.1750.10 + cpe:/a:google:chrome:33.0.1750.70 + cpe:/a:google:chrome:33.0.1750.71 + cpe:/a:google:chrome:33.0.1750.74 + cpe:/a:google:chrome:33.0.1750.75 + cpe:/a:google:chrome:33.0.1750.19 + cpe:/a:google:chrome:33.0.1750.73 + cpe:/a:google:chrome:33.0.1750.18 + cpe:/a:google:chrome:33.0.1750.68 + cpe:/a:google:chrome:33.0.1750.67 + cpe:/a:google:chrome:33.0.1750.66 + cpe:/a:google:chrome:33.0.1750.29 + cpe:/a:google:chrome:33.0.1750.65 + cpe:/a:google:chrome:33.0.1750.69 + cpe:/a:google:chrome:33.0.1750.23 + cpe:/a:google:chrome:33.0.1750.20 + cpe:/a:google:chrome:33.0.1750.24 + cpe:/a:google:chrome:33.0.1750.21 + cpe:/a:google:chrome:33.0.1750.22 + cpe:/a:google:chrome:33.0.1750.144 + cpe:/a:google:chrome:33.0.1750.27 + cpe:/a:google:chrome:33.0.1750.28 + cpe:/a:google:chrome:33.0.1750.146 + cpe:/a:google:chrome:33.0.1750.25 + cpe:/a:google:chrome:33.0.1750.132 + cpe:/a:google:chrome:33.0.1750.26 + cpe:/a:google:chrome:33.0.1750.60 + cpe:/a:google:chrome:33.0.1750.62 + cpe:/a:google:chrome:33.0.1750.107 + cpe:/a:google:chrome:33.0.1750.61 + cpe:/a:google:chrome:33.0.1750.106 + cpe:/a:google:chrome:33.0.1750.64 + cpe:/a:google:chrome:33.0.1750.63 + cpe:/a:google:chrome:33.0.1750.104 + cpe:/a:google:chrome:33.0.1750.109 + cpe:/a:google:chrome:33.0.1750.108 + cpe:/a:google:chrome:33.0.1750.54 + cpe:/a:google:chrome:33.0.1750.55 + cpe:/a:google:chrome:33.0.1750.56 + cpe:/a:google:chrome:33.0.1750.57 + cpe:/a:google:chrome:33.0.1750.58 + cpe:/a:google:chrome:33.0.1750.59 + + CVE-2014-1703 + 2014-03-16T10:06:45.413-04:00 + 2014-04-01T02:29:03.767-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-17T14:42:34.760-04:00 + + + + + CONFIRM + https://src.chromium.org/viewvc/chrome?revision=247627&view=revision + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=338354 + + + DEBIAN + DSA-2883 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html + + Use-after-free vulnerability in the WebSocketDispatcherHost::SendOrDrop function in content/browser/renderer_host/websocket_dispatcher_host.cc in the Web Sockets implementation in Google Chrome before 33.0.1750.149 might allow remote attackers to bypass the sandbox protection mechanism by leveraging an incorrect deletion in a certain failure case. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:google:chrome:33.0.1750.116 + cpe:/a:google:chrome:33.0.1750.35 + cpe:/a:google:chrome:33.0.1750.115 + cpe:/a:google:chrome:33.0.1750.34 + cpe:/a:google:chrome:33.0.1750.117 + cpe:/a:google:chrome:33.0.1750.112 + cpe:/a:google:chrome:33.0.1750.39 + cpe:/a:google:chrome:33.0.1750.111 + cpe:/a:google:chrome:33.0.1750.38 + cpe:/a:google:chrome:33.0.1750.37 + cpe:/a:google:chrome:33.0.1750.113 + cpe:/a:google:chrome:33.0.1750.36 + cpe:/a:google:chrome:33.0.1750.92 + cpe:/a:google:chrome:33.0.1750.93 + cpe:/a:google:chrome:33.0.1750.90 + cpe:/a:google:chrome:33.0.1750.91 + cpe:/a:google:chrome:33.0.1750.89 + cpe:/a:google:chrome:33.0.1750.88 + cpe:/a:google:chrome:33.0.1750.110 + cpe:/a:google:chrome:33.0.1750.41 + cpe:/a:google:chrome:33.0.1750.42 + cpe:/a:google:chrome:33.0.1750.40 + cpe:/a:google:chrome:33.0.1750.9 + cpe:/a:google:chrome:33.0.1750.6 + cpe:/a:google:chrome:33.0.1750.5 + cpe:/a:google:chrome:33.0.1750.8 + cpe:/a:google:chrome:33.0.1750.7 + cpe:/a:google:chrome:33.0.1750.2 + cpe:/a:google:chrome:33.0.1750.1 + cpe:/a:google:chrome:33.0.1750.4 + cpe:/a:google:chrome:33.0.1750.3 + cpe:/a:google:chrome:33.0.1750.0 + cpe:/a:google:chrome:33.0.1750.16 + cpe:/a:google:chrome:33.0.1750.133 + cpe:/a:google:chrome:33.0.1750.15 + cpe:/a:google:chrome:33.0.1750.136 + cpe:/a:google:chrome:33.0.1750.14 + cpe:/a:google:chrome:33.0.1750.135 + cpe:/a:google:chrome:33.0.1750.13 + cpe:/a:google:chrome:33.0.1750.12 + cpe:/a:google:chrome:33.0.1750.11 + cpe:/a:google:chrome:33.0.1750.10 + cpe:/a:google:chrome:33.0.1750.70 + cpe:/a:google:chrome:33.0.1750.71 + cpe:/a:google:chrome:33.0.1750.74 + cpe:/a:google:chrome:33.0.1750.75 + cpe:/a:google:chrome:33.0.1750.19 + cpe:/a:google:chrome:33.0.1750.73 + cpe:/a:google:chrome:33.0.1750.18 + cpe:/a:google:chrome:33.0.1750.68 + cpe:/a:google:chrome:33.0.1750.67 + cpe:/a:google:chrome:33.0.1750.66 + cpe:/a:google:chrome:33.0.1750.65 + cpe:/a:google:chrome:33.0.1750.69 + cpe:/a:google:chrome:33.0.1750.20 + cpe:/a:google:chrome:33.0.1750.132 + cpe:/a:google:chrome:33.0.1750.107 + cpe:/a:google:chrome:33.0.1750.106 + cpe:/a:google:chrome:33.0.1750.104 + cpe:/a:google:chrome:33.0.1750.109 + cpe:/a:google:chrome:33.0.1750.108 + cpe:/a:google:chrome:33.0.1750.53 + cpe:/a:google:chrome:33.0.1750.52 + cpe:/a:google:chrome:33.0.1750.51 + cpe:/a:google:chrome:33.0.1750.50 + cpe:/a:google:chrome:33.0.1750.49 + cpe:/a:google:chrome:33.0.1750.124 + cpe:/a:google:chrome:33.0.1750.47 + cpe:/a:google:chrome:33.0.1750.125 + cpe:/a:google:chrome:33.0.1750.48 + cpe:/a:google:chrome:33.0.1750.126 + cpe:/a:google:chrome:33.0.1750.45 + cpe:/a:google:chrome:33.0.1750.46 + cpe:/a:google:chrome:33.0.1750.43 + cpe:/a:google:chrome:33.0.1750.44 + cpe:/a:google:chrome:33.0.1750.83 + cpe:/a:google:chrome:33.0.1750.85 + cpe:/a:google:chrome:33.0.1750.80 + cpe:/a:google:chrome:33.0.1750.82 + cpe:/a:google:chrome:33.0.1750.81 + cpe:/a:google:v8:3.23.2 + cpe:/a:google:v8:3.23.3 + cpe:/a:google:v8:3.23.4 + cpe:/a:google:v8:3.23.5 + cpe:/a:google:v8:3.23.6 + cpe:/a:google:v8:3.23.7 + cpe:/a:google:v8:3.23.8 + cpe:/a:google:v8:3.23.9 + cpe:/a:google:chrome:33.0.1750.76 + cpe:/a:google:chrome:33.0.1750.77 + cpe:/a:google:chrome:33.0.1750.79 + cpe:/a:google:v8:3.23.0 + cpe:/a:google:v8:3.23.1 + cpe:/a:google:chrome:33.0.1750.31 + cpe:/a:google:chrome:33.0.1750.30 + cpe:/a:google:v8:3.23.17 + cpe:/a:google:v8:3.23.10 + cpe:/a:google:v8:3.23.11 + cpe:/a:google:chrome:33.0.1750.29 + cpe:/a:google:v8:3.23.12 + cpe:/a:google:v8:3.23.13 + cpe:/a:google:v8:3.23.14 + cpe:/a:google:v8:3.23.15 + cpe:/a:google:v8:3.23.16 + cpe:/a:google:chrome:33.0.1750.23 + cpe:/a:google:chrome:33.0.1750.24 + cpe:/a:google:chrome:33.0.1750.21 + cpe:/a:google:chrome:33.0.1750.22 + cpe:/a:google:chrome:33.0.1750.144 + cpe:/a:google:chrome:33.0.1750.27 + cpe:/a:google:chrome:33.0.1750.28 + cpe:/a:google:chrome:33.0.1750.146 + cpe:/a:google:chrome:33.0.1750.25 + cpe:/a:google:chrome:33.0.1750.26 + cpe:/a:google:chrome:33.0.1750.60 + cpe:/a:google:chrome:33.0.1750.62 + cpe:/a:google:chrome:33.0.1750.61 + cpe:/a:google:chrome:33.0.1750.64 + cpe:/a:google:chrome:33.0.1750.63 + cpe:/a:google:chrome:33.0.1750.54 + cpe:/a:google:chrome:33.0.1750.55 + cpe:/a:google:chrome:33.0.1750.56 + cpe:/a:google:chrome:33.0.1750.57 + cpe:/a:google:chrome:33.0.1750.58 + cpe:/a:google:chrome:33.0.1750.59 + + CVE-2014-1704 + 2014-03-16T10:06:45.427-04:00 + 2014-04-01T02:29:03.843-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-17T14:47:17.970-04:00 + + + + CONFIRM + https://code.google.com/p/v8/source/detail?r=19668 + + + CONFIRM + https://code.google.com/p/v8/source/detail?r=19614 + + + CONFIRM + https://code.google.com/p/v8/source/detail?r=18564 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=349079 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=345715 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=328202 + + + DEBIAN + DSA-2883 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html + + Multiple unspecified vulnerabilities in Google V8 before 3.23.17.18, as used in Google Chrome before 33.0.1750.149, allow attackers to cause a denial of service or possibly have other impact via unknown vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:google:chrome:33.0.1750.116 + cpe:/a:google:chrome:33.0.1750.35 + cpe:/a:google:chrome:33.0.1750.115 + cpe:/a:google:chrome:33.0.1750.34 + cpe:/a:google:chrome:33.0.1750.117 + cpe:/a:google:chrome:33.0.1750.112 + cpe:/a:google:chrome:33.0.1750.39 + cpe:/a:google:chrome:33.0.1750.111 + cpe:/a:google:chrome:33.0.1750.38 + cpe:/a:google:chrome:33.0.1750.37 + cpe:/a:google:chrome:33.0.1750.113 + cpe:/a:google:chrome:33.0.1750.36 + cpe:/a:google:chrome:33.0.1750.92 + cpe:/a:google:chrome:33.0.1750.93 + cpe:/a:google:chrome:33.0.1750.90 + cpe:/a:google:chrome:33.0.1750.91 + cpe:/a:google:chrome:33.0.1750.89 + cpe:/a:google:chrome:33.0.1750.88 + cpe:/a:google:chrome:33.0.1750.110 + cpe:/a:google:chrome:33.0.1750.41 + cpe:/a:google:chrome:33.0.1750.42 + cpe:/a:google:chrome:33.0.1750.40 + cpe:/a:google:chrome:33.0.1750.9 + cpe:/a:google:chrome:33.0.1750.6 + cpe:/a:google:chrome:33.0.1750.5 + cpe:/a:google:chrome:33.0.1750.8 + cpe:/a:google:chrome:33.0.1750.7 + cpe:/a:google:chrome:33.0.1750.2 + cpe:/a:google:chrome:33.0.1750.1 + cpe:/a:google:chrome:33.0.1750.4 + cpe:/a:google:chrome:33.0.1750.3 + cpe:/a:google:chrome:33.0.1750.0 + cpe:/a:google:chrome:33.0.1750.16 + cpe:/a:google:chrome:33.0.1750.133 + cpe:/a:google:chrome:33.0.1750.15 + cpe:/a:google:chrome:33.0.1750.136 + cpe:/a:google:chrome:33.0.1750.14 + cpe:/a:google:chrome:33.0.1750.135 + cpe:/a:google:chrome:33.0.1750.13 + cpe:/a:google:chrome:33.0.1750.12 + cpe:/a:google:chrome:33.0.1750.11 + cpe:/a:google:chrome:33.0.1750.10 + cpe:/a:google:chrome:33.0.1750.70 + cpe:/a:google:chrome:33.0.1750.71 + cpe:/a:google:chrome:33.0.1750.74 + cpe:/a:google:chrome:33.0.1750.75 + cpe:/a:google:chrome:33.0.1750.19 + cpe:/a:google:chrome:33.0.1750.18 + cpe:/a:google:chrome:33.0.1750.73 + cpe:/a:google:chrome:33.0.1750.68 + cpe:/a:google:chrome:33.0.1750.67 + cpe:/a:google:chrome:33.0.1750.66 + cpe:/a:google:chrome:33.0.1750.65 + cpe:/a:google:chrome:33.0.1750.69 + cpe:/a:google:chrome:33.0.1750.20 + cpe:/a:google:chrome:33.0.1750.132 + cpe:/a:google:chrome:33.0.1750.107 + cpe:/a:google:chrome:33.0.1750.106 + cpe:/a:google:chrome:33.0.1750.104 + cpe:/a:google:chrome:33.0.1750.109 + cpe:/a:google:chrome:33.0.1750.108 + cpe:/a:google:chrome:33.0.1750.53 + cpe:/a:google:chrome:33.0.1750.52 + cpe:/a:google:chrome:33.0.1750.51 + cpe:/a:google:chrome:33.0.1750.50 + cpe:/a:google:chrome:33.0.1750.49 + cpe:/a:google:chrome:33.0.1750.124 + cpe:/a:google:chrome:33.0.1750.47 + cpe:/a:google:chrome:33.0.1750.125 + cpe:/a:google:chrome:33.0.1750.48 + cpe:/a:google:chrome:33.0.1750.126 + cpe:/a:google:chrome:33.0.1750.45 + cpe:/a:google:chrome:33.0.1750.46 + cpe:/a:google:chrome:33.0.1750.43 + cpe:/a:google:chrome:33.0.1750.44 + cpe:/a:google:chrome:33.0.1750.83 + cpe:/a:google:chrome:33.0.1750.85 + cpe:/a:google:chrome:33.0.1750.80 + cpe:/a:google:chrome:33.0.1750.153 + cpe:/a:google:chrome:33.0.1750.152 + cpe:/a:google:chrome:33.0.1750.82 + cpe:/a:google:chrome:33.0.1750.81 + cpe:/a:google:chrome:33.0.1750.151 + cpe:/a:google:chrome:33.0.1750.76 + cpe:/a:google:chrome:33.0.1750.77 + cpe:/a:google:chrome:33.0.1750.79 + cpe:/a:google:chrome:33.0.1750.31 + cpe:/a:google:chrome:33.0.1750.30 + cpe:/a:google:chrome:33.0.1750.29 + cpe:/a:google:chrome:33.0.1750.23 + cpe:/a:google:chrome:33.0.1750.24 + cpe:/a:google:chrome:33.0.1750.149 + cpe:/a:google:chrome:33.0.1750.21 + cpe:/a:google:chrome:33.0.1750.22 + cpe:/a:google:chrome:33.0.1750.27 + cpe:/a:google:chrome:33.0.1750.144 + cpe:/a:google:chrome:33.0.1750.28 + cpe:/a:google:chrome:33.0.1750.25 + cpe:/a:google:chrome:33.0.1750.146 + cpe:/a:google:chrome:33.0.1750.26 + cpe:/a:google:chrome:33.0.1750.60 + cpe:/a:google:chrome:33.0.1750.62 + cpe:/a:google:chrome:33.0.1750.61 + cpe:/a:google:chrome:33.0.1750.64 + cpe:/a:google:chrome:33.0.1750.63 + cpe:/a:google:chrome:33.0.1750.54 + cpe:/a:google:chrome:33.0.1750.55 + cpe:/a:google:chrome:33.0.1750.56 + cpe:/a:google:chrome:33.0.1750.57 + cpe:/a:google:chrome:33.0.1750.58 + cpe:/a:google:chrome:33.0.1750.59 + + CVE-2014-1705 + 2014-03-16T10:06:45.460-04:00 + 2014-04-01T02:29:03.920-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-17T14:56:12.407-04:00 + + + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=351787 + + + DEBIAN + DSA-2883 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_14.html + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html + + Google V8, as used in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors. + + + + + + + + + + + + + + + + + + + cpe:/o:google:chrome_os:33.0.1750.149 + cpe:/o:google:chrome_os:33.0.1750.70 + cpe:/o:google:chrome_os:33.0.1750.29 + cpe:/o:google:chrome_os:33.0.1750.112 + cpe:/o:google:chrome_os:33.0.1750.93 + cpe:/o:google:chrome_os:33.0.1750.5 + cpe:/o:google:chrome_os:33.0.1750.2 + cpe:/o:google:chrome_os:33.0.1750.58 + cpe:/o:google:chrome_os:33.0.1750.16 + cpe:/o:google:chrome_os:33.0.1750.51 + cpe:/o:google:chrome_os:33.0.1750.124 + + CVE-2014-1706 + 2014-03-16T10:06:45.490-04:00 + 2014-03-25T21:59:12.457-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-17T11:22:16.000-04:00 + + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=351796 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html + + crosh in Google Chrome OS before 33.0.1750.152 allows attackers to inject commands via unspecified vectors. + + + + + + + + + + + + + + + + + + + cpe:/o:google:chrome_os:33.0.1750.149 + cpe:/o:google:chrome_os:33.0.1750.70 + cpe:/o:google:chrome_os:33.0.1750.29 + cpe:/o:google:chrome_os:33.0.1750.112 + cpe:/o:google:chrome_os:33.0.1750.93 + cpe:/o:google:chrome_os:33.0.1750.5 + cpe:/o:google:chrome_os:33.0.1750.2 + cpe:/o:google:chrome_os:33.0.1750.58 + cpe:/o:google:chrome_os:33.0.1750.16 + cpe:/o:google:chrome_os:33.0.1750.51 + cpe:/o:google:chrome_os:33.0.1750.124 + + CVE-2014-1707 + 2014-03-16T10:06:45.523-04:00 + 2014-03-25T21:53:53.240-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-17T07:23:51.000-04:00 + + + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=351811 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html + + Directory traversal vulnerability in CrosDisks in Google Chrome OS before 33.0.1750.152 has unspecified impact and attack vectors. + + + + + + + + + + + + + + + + + + + cpe:/o:google:chrome_os:33.0.1750.149 + cpe:/o:google:chrome_os:33.0.1750.70 + cpe:/o:google:chrome_os:33.0.1750.29 + cpe:/o:google:chrome_os:33.0.1750.112 + cpe:/o:google:chrome_os:33.0.1750.93 + cpe:/o:google:chrome_os:33.0.1750.5 + cpe:/o:google:chrome_os:33.0.1750.2 + cpe:/o:google:chrome_os:33.0.1750.58 + cpe:/o:google:chrome_os:33.0.1750.16 + cpe:/o:google:chrome_os:33.0.1750.51 + cpe:/o:google:chrome_os:33.0.1750.124 + + CVE-2014-1708 + 2014-03-16T10:06:45.537-04:00 + 2014-03-25T21:54:30.087-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-17T11:23:20.000-04:00 + + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=344051 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html + + The boot implementation in Google Chrome OS before 33.0.1750.152 does not properly consider file persistence, which allows remote attackers to execute arbitrary code via unspecified vectors. + + + + + + + + + + + + + + + + + + + cpe:/o:google:chrome_os:33.0.1750.149 + cpe:/o:google:chrome_os:33.0.1750.70 + cpe:/o:google:chrome_os:33.0.1750.29 + cpe:/o:google:chrome_os:33.0.1750.112 + cpe:/o:google:chrome_os:33.0.1750.93 + cpe:/o:google:chrome_os:33.0.1750.5 + cpe:/o:google:chrome_os:33.0.1750.2 + cpe:/o:google:chrome_os:33.0.1750.58 + cpe:/o:google:chrome_os:33.0.1750.16 + cpe:/o:google:chrome_os:33.0.1750.51 + cpe:/o:google:chrome_os:33.0.1750.124 + + CVE-2014-1710 + 2014-03-16T10:06:45.570-04:00 + 2014-03-25T22:04:31.700-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-17T15:50:44.767-04:00 + + + + + CONFIRM + https://src.chromium.org/viewvc/chrome?revision=256918&view=revision + + + CONFIRM + https://src.chromium.org/viewvc/chrome?revision=256723&view=revision + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=351852 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html + + The AsyncPixelTransfersCompletedQuery::End function in gpu/command_buffer/service/query_manager.cc in Google Chrome, as used in Google Chrome OS before 33.0.1750.152, does not check whether a certain position is within the bounds of a shared-memory segment, which allows remote attackers to cause a denial of service (GPU command-buffer memory corruption) or possibly have unspecified other impact via unknown vectors. + + + + + + + + + + + + + + + + + + + cpe:/o:google:chrome_os:33.0.1750.149 + cpe:/o:google:chrome_os:33.0.1750.70 + cpe:/o:google:chrome_os:33.0.1750.29 + cpe:/o:google:chrome_os:33.0.1750.112 + cpe:/o:google:chrome_os:33.0.1750.93 + cpe:/o:google:chrome_os:33.0.1750.5 + cpe:/o:google:chrome_os:33.0.1750.2 + cpe:/o:google:chrome_os:33.0.1750.58 + cpe:/o:google:chrome_os:33.0.1750.16 + cpe:/o:google:chrome_os:33.0.1750.51 + cpe:/o:google:chrome_os:33.0.1750.124 + + CVE-2014-1711 + 2014-03-16T10:06:45.583-04:00 + 2014-03-25T22:01:14.567-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-17T15:51:59.990-04:00 + + + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=351855 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html + + The GPU driver in the kernel in Google Chrome OS before 33.0.1750.152 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via unknown vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:google:chrome:33.0.1750.116 + cpe:/a:google:chrome:33.0.1750.35 + cpe:/a:google:chrome:33.0.1750.115 + cpe:/a:google:chrome:33.0.1750.34 + cpe:/a:google:chrome:33.0.1750.117 + cpe:/a:google:chrome:33.0.1750.112 + cpe:/a:google:chrome:33.0.1750.39 + cpe:/a:google:chrome:33.0.1750.111 + cpe:/a:google:chrome:33.0.1750.38 + cpe:/a:google:chrome:33.0.1750.37 + cpe:/a:google:chrome:33.0.1750.113 + cpe:/a:google:chrome:33.0.1750.36 + cpe:/a:google:chrome:33.0.1750.92 + cpe:/a:google:chrome:33.0.1750.93 + cpe:/a:google:chrome:33.0.1750.90 + cpe:/a:google:chrome:33.0.1750.91 + cpe:/a:google:chrome:33.0.1750.89 + cpe:/a:google:chrome:33.0.1750.88 + cpe:/a:google:chrome:33.0.1750.110 + cpe:/a:google:chrome:33.0.1750.41 + cpe:/a:google:chrome:33.0.1750.42 + cpe:/a:google:chrome:33.0.1750.40 + cpe:/a:google:chrome:33.0.1750.9 + cpe:/a:google:chrome:33.0.1750.6 + cpe:/a:google:chrome:33.0.1750.5 + cpe:/a:google:chrome:33.0.1750.8 + cpe:/a:google:chrome:33.0.1750.7 + cpe:/a:google:chrome:33.0.1750.2 + cpe:/a:google:chrome:33.0.1750.1 + cpe:/a:google:chrome:33.0.1750.4 + cpe:/a:google:chrome:33.0.1750.3 + cpe:/a:google:chrome:33.0.1750.0 + cpe:/a:google:chrome:33.0.1750.16 + cpe:/a:google:chrome:33.0.1750.133 + cpe:/a:google:chrome:33.0.1750.15 + cpe:/a:google:chrome:33.0.1750.136 + cpe:/a:google:chrome:33.0.1750.14 + cpe:/a:google:chrome:33.0.1750.135 + cpe:/a:google:chrome:33.0.1750.13 + cpe:/a:google:chrome:33.0.1750.12 + cpe:/a:google:chrome:33.0.1750.11 + cpe:/a:google:chrome:33.0.1750.10 + cpe:/a:google:chrome:33.0.1750.70 + cpe:/a:google:chrome:33.0.1750.71 + cpe:/a:google:chrome:33.0.1750.74 + cpe:/a:google:chrome:33.0.1750.75 + cpe:/a:google:chrome:33.0.1750.19 + cpe:/a:google:chrome:33.0.1750.18 + cpe:/a:google:chrome:33.0.1750.73 + cpe:/a:google:chrome:33.0.1750.68 + cpe:/a:google:chrome:33.0.1750.67 + cpe:/a:google:chrome:33.0.1750.66 + cpe:/a:google:chrome:33.0.1750.65 + cpe:/a:google:chrome:33.0.1750.69 + cpe:/a:google:chrome:33.0.1750.20 + cpe:/a:google:chrome:33.0.1750.132 + cpe:/a:google:chrome:33.0.1750.107 + cpe:/a:google:chrome:33.0.1750.106 + cpe:/a:google:chrome:33.0.1750.104 + cpe:/a:google:chrome:33.0.1750.109 + cpe:/a:google:chrome:33.0.1750.108 + cpe:/a:google:chrome:33.0.1750.53 + cpe:/a:google:chrome:33.0.1750.52 + cpe:/a:google:chrome:33.0.1750.51 + cpe:/a:google:chrome:33.0.1750.50 + cpe:/a:google:chrome:33.0.1750.49 + cpe:/a:google:chrome:33.0.1750.124 + cpe:/a:google:chrome:33.0.1750.47 + cpe:/a:google:chrome:33.0.1750.125 + cpe:/a:google:chrome:33.0.1750.48 + cpe:/a:google:chrome:33.0.1750.126 + cpe:/a:google:chrome:33.0.1750.45 + cpe:/a:google:chrome:33.0.1750.46 + cpe:/a:google:chrome:33.0.1750.43 + cpe:/a:google:chrome:33.0.1750.44 + cpe:/a:google:chrome:33.0.1750.83 + cpe:/a:google:chrome:33.0.1750.85 + cpe:/a:google:chrome:33.0.1750.80 + cpe:/a:google:chrome:33.0.1750.153 + cpe:/a:google:chrome:33.0.1750.82 + cpe:/a:google:chrome:33.0.1750.152 + cpe:/a:google:chrome:33.0.1750.81 + cpe:/a:google:chrome:33.0.1750.151 + cpe:/a:google:chrome:33.0.1750.76 + cpe:/a:google:chrome:33.0.1750.77 + cpe:/a:google:chrome:33.0.1750.79 + cpe:/a:google:chrome:33.0.1750.31 + cpe:/a:google:chrome:33.0.1750.30 + cpe:/a:google:chrome:33.0.1750.29 + cpe:/a:google:chrome:33.0.1750.23 + cpe:/a:google:chrome:33.0.1750.24 + cpe:/a:google:chrome:33.0.1750.149 + cpe:/a:google:chrome:33.0.1750.21 + cpe:/a:google:chrome:33.0.1750.22 + cpe:/a:google:chrome:33.0.1750.27 + cpe:/a:google:chrome:33.0.1750.144 + cpe:/a:google:chrome:33.0.1750.28 + cpe:/a:google:chrome:33.0.1750.25 + cpe:/a:google:chrome:33.0.1750.146 + cpe:/a:google:chrome:33.0.1750.26 + cpe:/a:google:chrome:33.0.1750.60 + cpe:/a:google:chrome:33.0.1750.62 + cpe:/a:google:chrome:33.0.1750.61 + cpe:/a:google:chrome:33.0.1750.64 + cpe:/a:google:chrome:33.0.1750.63 + cpe:/a:google:chrome:33.0.1750.54 + cpe:/a:google:chrome:33.0.1750.55 + cpe:/a:google:chrome:33.0.1750.56 + cpe:/a:google:chrome:33.0.1750.57 + cpe:/a:google:chrome:33.0.1750.58 + cpe:/a:google:chrome:33.0.1750.59 + + CVE-2014-1713 + 2014-03-16T10:06:45.617-04:00 + 2014-04-24T01:05:22.030-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-17T15:54:12.383-04:00 + + + + + CONFIRM + https://src.chromium.org/viewvc/blink?revision=169176&view=revision + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=352374 + + + DEBIAN + DSA-2883 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_14.html + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html + + + APPLE + APPLE-SA-2014-04-22-2 + + + APPLE + APPLE-SA-2014-04-22-3 + + + APPLE + APPLE-SA-2014-04-01-1 + + + BUGTRAQ + 20140326 VUPEN Security Research - Google Chrome Blink "locationAttributeSetter" Use-after-free (Pwn2Own) + + Use-after-free vulnerability in the AttributeSetter function in bindings/templates/attributes.cpp in the bindings in Blink, as used in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving the document.location value. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:google:chrome:33.0.1750.116 + cpe:/a:google:chrome:33.0.1750.35 + cpe:/a:google:chrome:33.0.1750.115 + cpe:/a:google:chrome:33.0.1750.34 + cpe:/a:google:chrome:33.0.1750.117 + cpe:/a:google:chrome:33.0.1750.112 + cpe:/a:google:chrome:33.0.1750.39 + cpe:/a:google:chrome:33.0.1750.111 + cpe:/a:google:chrome:33.0.1750.38 + cpe:/a:google:chrome:33.0.1750.37 + cpe:/a:google:chrome:33.0.1750.113 + cpe:/a:google:chrome:33.0.1750.36 + cpe:/a:google:chrome:33.0.1750.92 + cpe:/a:google:chrome:33.0.1750.93 + cpe:/a:google:chrome:33.0.1750.90 + cpe:/a:google:chrome:33.0.1750.91 + cpe:/a:google:chrome:33.0.1750.89 + cpe:/a:google:chrome:33.0.1750.88 + cpe:/a:google:chrome:33.0.1750.110 + cpe:/a:google:chrome:33.0.1750.41 + cpe:/a:google:chrome:33.0.1750.42 + cpe:/a:google:chrome:33.0.1750.40 + cpe:/a:google:chrome:33.0.1750.9 + cpe:/a:google:chrome:33.0.1750.6 + cpe:/a:google:chrome:33.0.1750.5 + cpe:/a:google:chrome:33.0.1750.8 + cpe:/a:google:chrome:33.0.1750.7 + cpe:/a:google:chrome:33.0.1750.2 + cpe:/a:google:chrome:33.0.1750.1 + cpe:/a:google:chrome:33.0.1750.4 + cpe:/a:google:chrome:33.0.1750.3 + cpe:/a:google:chrome:33.0.1750.0 + cpe:/a:google:chrome:33.0.1750.16 + cpe:/a:google:chrome:33.0.1750.133 + cpe:/a:google:chrome:33.0.1750.15 + cpe:/a:google:chrome:33.0.1750.136 + cpe:/a:google:chrome:33.0.1750.14 + cpe:/a:google:chrome:33.0.1750.135 + cpe:/a:google:chrome:33.0.1750.13 + cpe:/a:google:chrome:33.0.1750.12 + cpe:/a:google:chrome:33.0.1750.11 + cpe:/a:google:chrome:33.0.1750.10 + cpe:/a:google:chrome:33.0.1750.70 + cpe:/a:google:chrome:33.0.1750.71 + cpe:/a:google:chrome:33.0.1750.74 + cpe:/a:google:chrome:33.0.1750.75 + cpe:/a:google:chrome:33.0.1750.19 + cpe:/a:google:chrome:33.0.1750.18 + cpe:/a:google:chrome:33.0.1750.73 + cpe:/a:google:chrome:33.0.1750.68 + cpe:/a:google:chrome:33.0.1750.67 + cpe:/a:google:chrome:33.0.1750.66 + cpe:/a:google:chrome:33.0.1750.65 + cpe:/a:google:chrome:33.0.1750.69 + cpe:/a:google:chrome:33.0.1750.20 + cpe:/a:google:chrome:33.0.1750.132 + cpe:/a:google:chrome:33.0.1750.107 + cpe:/a:google:chrome:33.0.1750.106 + cpe:/a:google:chrome:33.0.1750.104 + cpe:/a:google:chrome:33.0.1750.109 + cpe:/a:google:chrome:33.0.1750.108 + cpe:/a:google:chrome:33.0.1750.53 + cpe:/a:google:chrome:33.0.1750.52 + cpe:/a:google:chrome:33.0.1750.51 + cpe:/a:google:chrome:33.0.1750.50 + cpe:/a:google:chrome:33.0.1750.49 + cpe:/a:google:chrome:33.0.1750.124 + cpe:/a:google:chrome:33.0.1750.47 + cpe:/a:google:chrome:33.0.1750.125 + cpe:/a:google:chrome:33.0.1750.48 + cpe:/a:google:chrome:33.0.1750.126 + cpe:/a:google:chrome:33.0.1750.45 + cpe:/a:google:chrome:33.0.1750.46 + cpe:/a:google:chrome:33.0.1750.43 + cpe:/a:google:chrome:33.0.1750.44 + cpe:/a:google:chrome:33.0.1750.83 + cpe:/a:google:chrome:33.0.1750.85 + cpe:/a:google:chrome:33.0.1750.80 + cpe:/a:google:chrome:33.0.1750.153 + cpe:/a:google:chrome:33.0.1750.82 + cpe:/a:google:chrome:33.0.1750.152 + cpe:/a:google:chrome:33.0.1750.81 + cpe:/a:google:chrome:33.0.1750.151 + cpe:/a:google:chrome:33.0.1750.76 + cpe:/a:google:chrome:33.0.1750.77 + cpe:/a:google:chrome:33.0.1750.79 + cpe:/a:google:chrome:33.0.1750.31 + cpe:/a:google:chrome:33.0.1750.30 + cpe:/a:google:chrome:33.0.1750.29 + cpe:/a:google:chrome:33.0.1750.23 + cpe:/a:google:chrome:33.0.1750.24 + cpe:/a:google:chrome:33.0.1750.149 + cpe:/a:google:chrome:33.0.1750.21 + cpe:/a:google:chrome:33.0.1750.22 + cpe:/a:google:chrome:33.0.1750.27 + cpe:/a:google:chrome:33.0.1750.144 + cpe:/a:google:chrome:33.0.1750.28 + cpe:/a:google:chrome:33.0.1750.25 + cpe:/a:google:chrome:33.0.1750.146 + cpe:/a:google:chrome:33.0.1750.26 + cpe:/a:google:chrome:33.0.1750.60 + cpe:/a:google:chrome:33.0.1750.62 + cpe:/a:google:chrome:33.0.1750.61 + cpe:/a:google:chrome:33.0.1750.64 + cpe:/a:google:chrome:33.0.1750.63 + cpe:/a:google:chrome:33.0.1750.54 + cpe:/a:google:chrome:33.0.1750.55 + cpe:/a:google:chrome:33.0.1750.56 + cpe:/a:google:chrome:33.0.1750.57 + cpe:/a:google:chrome:33.0.1750.58 + cpe:/a:google:chrome:33.0.1750.59 + + CVE-2014-1714 + 2014-03-16T10:06:45.647-04:00 + 2014-04-01T02:29:04.670-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-17T15:06:32.907-04:00 + + + + + CONFIRM + https://src.chromium.org/viewvc/chrome?revision=256974&view=revision + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=352395 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_14.html + + + BUGTRAQ + 20140326 VUPEN Security Research - Google Chrome "Clipboard::WriteData()" Function Sandbox Escape (Pwn2Own) + + The ScopedClipboardWriter::WritePickledData function in ui/base/clipboard/scoped_clipboard_writer.cc in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows does not verify a certain format value, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the clipboard. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:google:chrome:33.0.1750.116 + cpe:/a:google:chrome:33.0.1750.35 + cpe:/a:google:chrome:33.0.1750.115 + cpe:/a:google:chrome:33.0.1750.34 + cpe:/a:google:chrome:33.0.1750.117 + cpe:/a:google:chrome:33.0.1750.112 + cpe:/a:google:chrome:33.0.1750.39 + cpe:/a:google:chrome:33.0.1750.111 + cpe:/a:google:chrome:33.0.1750.38 + cpe:/a:google:chrome:33.0.1750.37 + cpe:/a:google:chrome:33.0.1750.113 + cpe:/a:google:chrome:33.0.1750.36 + cpe:/a:google:chrome:33.0.1750.92 + cpe:/a:google:chrome:33.0.1750.93 + cpe:/a:google:chrome:33.0.1750.90 + cpe:/a:google:chrome:33.0.1750.91 + cpe:/a:google:chrome:33.0.1750.89 + cpe:/a:google:chrome:33.0.1750.88 + cpe:/a:google:chrome:33.0.1750.110 + cpe:/a:google:chrome:33.0.1750.41 + cpe:/a:google:chrome:33.0.1750.42 + cpe:/a:google:chrome:33.0.1750.40 + cpe:/a:google:chrome:33.0.1750.9 + cpe:/a:google:chrome:33.0.1750.6 + cpe:/a:google:chrome:33.0.1750.5 + cpe:/a:google:chrome:33.0.1750.8 + cpe:/a:google:chrome:33.0.1750.7 + cpe:/a:google:chrome:33.0.1750.2 + cpe:/a:google:chrome:33.0.1750.1 + cpe:/a:google:chrome:33.0.1750.4 + cpe:/a:google:chrome:33.0.1750.3 + cpe:/a:google:chrome:33.0.1750.0 + cpe:/a:google:chrome:33.0.1750.16 + cpe:/a:google:chrome:33.0.1750.133 + cpe:/a:google:chrome:33.0.1750.15 + cpe:/a:google:chrome:33.0.1750.136 + cpe:/a:google:chrome:33.0.1750.14 + cpe:/a:google:chrome:33.0.1750.135 + cpe:/a:google:chrome:33.0.1750.13 + cpe:/a:google:chrome:33.0.1750.12 + cpe:/a:google:chrome:33.0.1750.11 + cpe:/a:google:chrome:33.0.1750.10 + cpe:/a:google:chrome:33.0.1750.70 + cpe:/a:google:chrome:33.0.1750.71 + cpe:/a:google:chrome:33.0.1750.74 + cpe:/a:google:chrome:33.0.1750.75 + cpe:/a:google:chrome:33.0.1750.19 + cpe:/a:google:chrome:33.0.1750.18 + cpe:/a:google:chrome:33.0.1750.73 + cpe:/a:google:chrome:33.0.1750.68 + cpe:/a:google:chrome:33.0.1750.67 + cpe:/a:google:chrome:33.0.1750.66 + cpe:/a:google:chrome:33.0.1750.65 + cpe:/a:google:chrome:33.0.1750.69 + cpe:/a:google:chrome:33.0.1750.20 + cpe:/a:google:chrome:33.0.1750.132 + cpe:/a:google:chrome:33.0.1750.107 + cpe:/a:google:chrome:33.0.1750.106 + cpe:/a:google:chrome:33.0.1750.104 + cpe:/a:google:chrome:33.0.1750.109 + cpe:/a:google:chrome:33.0.1750.108 + cpe:/a:google:chrome:33.0.1750.53 + cpe:/a:google:chrome:33.0.1750.52 + cpe:/a:google:chrome:33.0.1750.51 + cpe:/a:google:chrome:33.0.1750.50 + cpe:/a:google:chrome:33.0.1750.49 + cpe:/a:google:chrome:33.0.1750.124 + cpe:/a:google:chrome:33.0.1750.47 + cpe:/a:google:chrome:33.0.1750.125 + cpe:/a:google:chrome:33.0.1750.48 + cpe:/a:google:chrome:33.0.1750.126 + cpe:/a:google:chrome:33.0.1750.45 + cpe:/a:google:chrome:33.0.1750.46 + cpe:/a:google:chrome:33.0.1750.43 + cpe:/a:google:chrome:33.0.1750.44 + cpe:/a:google:chrome:33.0.1750.83 + cpe:/a:google:chrome:33.0.1750.85 + cpe:/a:google:chrome:33.0.1750.80 + cpe:/a:google:chrome:33.0.1750.153 + cpe:/a:google:chrome:33.0.1750.152 + cpe:/a:google:chrome:33.0.1750.82 + cpe:/a:google:chrome:33.0.1750.81 + cpe:/a:google:chrome:33.0.1750.151 + cpe:/a:google:chrome:33.0.1750.76 + cpe:/a:google:chrome:33.0.1750.77 + cpe:/a:google:chrome:33.0.1750.79 + cpe:/a:google:chrome:33.0.1750.31 + cpe:/a:google:chrome:33.0.1750.30 + cpe:/a:google:chrome:33.0.1750.29 + cpe:/a:google:chrome:33.0.1750.23 + cpe:/a:google:chrome:33.0.1750.24 + cpe:/a:google:chrome:33.0.1750.149 + cpe:/a:google:chrome:33.0.1750.21 + cpe:/a:google:chrome:33.0.1750.22 + cpe:/a:google:chrome:33.0.1750.27 + cpe:/a:google:chrome:33.0.1750.144 + cpe:/a:google:chrome:33.0.1750.28 + cpe:/a:google:chrome:33.0.1750.25 + cpe:/a:google:chrome:33.0.1750.146 + cpe:/a:google:chrome:33.0.1750.26 + cpe:/a:google:chrome:33.0.1750.60 + cpe:/a:google:chrome:33.0.1750.62 + cpe:/a:google:chrome:33.0.1750.61 + cpe:/a:google:chrome:33.0.1750.64 + cpe:/a:google:chrome:33.0.1750.63 + cpe:/a:google:chrome:33.0.1750.54 + cpe:/a:google:chrome:33.0.1750.55 + cpe:/a:google:chrome:33.0.1750.56 + cpe:/a:google:chrome:33.0.1750.57 + cpe:/a:google:chrome:33.0.1750.58 + cpe:/a:google:chrome:33.0.1750.59 + + CVE-2014-1715 + 2014-03-16T10:06:45.677-04:00 + 2014-04-01T02:29:04.843-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-17T15:05:00.043-04:00 + + + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=352429 + + + DEBIAN + DSA-2883 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_14.html + + Directory traversal vulnerability in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows has unspecified impact and attack vectors. + + + + + + + + + cpe:/a:google:chrome:34.0.1847.115 + + CVE-2014-1716 + 2014-04-09T06:56:51.303-04:00 + 2014-04-09T21:08:54.310-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-09T21:08:41.717-04:00 + + + + + CONFIRM + https://code.google.com/p/v8/source/detail?r=20138 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=354123 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html + + Cross-site scripting (XSS) vulnerability in the Runtime_SetPrototype function in runtime.cc in Google V8, as used in Google Chrome before 34.0.1847.116, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)." + + + + + + + + + cpe:/a:google:chrome:34.0.1847.115 + + CVE-2014-1717 + 2014-04-09T06:57:15.617-04:00 + 2014-04-09T21:10:47.127-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-09T21:10:47.063-04:00 + + + + + CONFIRM + https://code.google.com/p/v8/source/detail?r=20020 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=353004 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html + + Google V8, as used in Google Chrome before 34.0.1847.116, does not properly use numeric casts during handling of typed arrays, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JavaScript code. + + + + + + + + + cpe:/a:google:chrome:34.0.1847.115 + + CVE-2014-1718 + 2014-04-09T06:57:15.773-04:00 + 2014-04-09T21:12:12.440-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-09T21:12:12.393-04:00 + + + + + CONFIRM + https://src.chromium.org/viewvc/chrome?revision=261817&view=revision + + + CONFIRM + https://src.chromium.org/viewvc/chrome?revision=260969&view=revision + + + CONFIRM + https://src.chromium.org/viewvc/chrome?revision=258418&view=revision + + + CONFIRM + https://src.chromium.org/viewvc/chrome?revision=257417&view=revision + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=348332 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html + + Integer overflow in the SoftwareFrameManager::SwapToNewFrame function in content/browser/renderer_host/software_frame_manager.cc in the software compositor in Google Chrome before 34.0.1847.116 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted mapping of a large amount of renderer memory. + + + + + + + + + cpe:/a:google:chrome:34.0.1847.115 + + CVE-2014-1719 + 2014-04-09T06:57:15.977-04:00 + 2014-04-09T21:14:57.150-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-09T21:14:57.103-04:00 + + + + + CONFIRM + https://src.chromium.org/viewvc/chrome?revision=252010&view=revision + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=343661 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html + + Use-after-free vulnerability in the WebSharedWorkerStub::OnTerminateWorkerContext function in content/worker/websharedworker_stub.cc in the Web Workers implementation in Google Chrome before 34.0.1847.116 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via vectors that trigger a SharedWorker termination during script loading. + + + + + + + + + cpe:/a:google:chrome:34.0.1847.115 + + CVE-2014-1720 + 2014-04-09T06:57:51.180-04:00 + 2014-04-09T21:17:26.593-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-09T21:17:26.560-04:00 + + + + + CONFIRM + https://src.chromium.org/viewvc/blink?revision=170216&view=revision + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=356095 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html + + Use-after-free vulnerability in the HTMLBodyElement::insertedInto function in core/html/HTMLBodyElement.cpp in Blink, as used in Google Chrome before 34.0.1847.116, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving attributes. + + + + + + + + + cpe:/a:google:chrome:34.0.1847.115 + + CVE-2014-1721 + 2014-04-09T06:57:51.213-04:00 + 2014-04-09T21:19:17.423-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-09T21:19:14.627-04:00 + + + + + CONFIRM + https://code.google.com/p/v8/source/detail?r=19834 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=350434 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html + + Google V8, as used in Google Chrome before 34.0.1847.116, does not properly implement lazy deoptimization, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted JavaScript code, as demonstrated by improper handling of a heap allocation of a number outside the Small Integer (aka smi) range. + + + + + + + + + cpe:/a:google:chrome:34.0.1847.115 + + CVE-2014-1722 + 2014-04-09T06:57:51.243-04:00 + 2014-04-09T21:24:53.780-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-09T21:24:31.577-04:00 + + + + + CONFIRM + https://src.chromium.org/viewvc/blink?revision=164405&view=revision + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=330626 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html + + Use-after-free vulnerability in the RenderBlock::addChildIgnoringAnonymousColumnBlocks function in core/rendering/RenderBlock.cpp in Blink, as used in Google Chrome before 34.0.1847.116, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving addition of a child node. + + + + + + + + + cpe:/a:google:chrome:34.0.1847.115 + + CVE-2014-1723 + 2014-04-09T06:57:51.277-04:00 + 2014-04-09T21:28:16.690-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-09T21:28:16.613-04:00 + + + + + CONFIRM + https://src.chromium.org/viewvc/chrome?revision=254091&view=revision + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=337746 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html + + The UnescapeURLWithOffsetsImpl function in net/base/escape.cc in Google Chrome before 34.0.1847.116 does not properly handle bidirectional Internationalized Resource Identifiers (IRIs), which makes it easier for remote attackers to spoof URLs via crafted use of right-to-left (RTL) Unicode text. + + + + + + + + + cpe:/a:google:chrome:34.0.1847.115 + + CVE-2014-1724 + 2014-04-09T06:57:56.867-04:00 + 2014-04-09T21:29:38.633-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-09T21:29:38.507-04:00 + + + + + CONFIRM + https://src.chromium.org/viewvc/chrome?revision=259109&view=revision + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=327295 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html + + Use-after-free vulnerability in Free(b)soft Laboratory Speech Dispatcher 0.7.1, as used in Google Chrome before 34.0.1847.116, allows remote attackers to cause a denial of service (application hang) or possibly have unspecified other impact via a text-to-speech request. + + + + + + + + + cpe:/a:google:chrome:34.0.1847.115 + + CVE-2014-1725 + 2014-04-09T06:57:56.900-04:00 + 2014-04-09T21:31:28.620-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-09T21:31:07.963-04:00 + + + + + CONFIRM + https://src.chromium.org/viewvc/blink?revision=170264&view=revision + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=357332 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html + + The base64DecodeInternal function in wtf/text/Base64.cpp in Blink, as used in Google Chrome before 34.0.1847.116, does not properly handle string data composed exclusively of whitespace characters, which allows remote attackers to cause a denial of service (out-of-bounds read) via a window.atob method call. + + + + + + + + + cpe:/a:google:chrome:34.0.1847.115 + + CVE-2014-1726 + 2014-04-09T06:57:56.963-04:00 + 2014-04-09T21:49:17.423-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-09T21:49:17.390-04:00 + + + + CONFIRM + https://src.chromium.org/viewvc/chrome?revision=259353&view=revision + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=346135 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html + + The drag implementation in Google Chrome before 34.0.1847.116 allows user-assisted remote attackers to bypass the Same Origin Policy and forge local pathnames by leveraging renderer access. + + + + + + + + + cpe:/a:google:chrome:34.0.1847.115 + + CVE-2014-1727 + 2014-04-09T06:57:57.010-04:00 + 2014-04-09T21:51:16.863-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-09T21:51:16.817-04:00 + + + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html + + + CONFIRM + https://src.chromium.org/viewvc/chrome?revision=255276&view=revision + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=342735 + + Use-after-free vulnerability in content/renderer/renderer_webcolorchooser_impl.h in Google Chrome before 34.0.1847.116 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to forms. + + + + + + + + + cpe:/a:google:chrome:34.0.1847.115 + + CVE-2014-1728 + 2014-04-09T06:57:57.073-04:00 + 2014-04-09T21:56:30.563-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-09T21:56:30.517-04:00 + + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=360298 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=358059 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=356517 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=356235 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=355586 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=354297 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=353013 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=352982 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=351815 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=350863 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=350537 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=350533 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=348319 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=347262 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=345820 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html + + Multiple unspecified vulnerabilities in Google Chrome before 34.0.1847.116 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. + + + + + + + + + cpe:/a:google:chrome:34.0.1847.115 + + CVE-2014-1729 + 2014-04-09T06:57:57.197-04:00 + 2014-04-09T21:58:38.737-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-09T21:58:37.050-04:00 + + + + CONFIRM + https://code.google.com/p/v8/source/detail?r=20409 + + + CONFIRM + https://code.google.com/p/v8/source/detail?r=20345 + + + CONFIRM + https://code.google.com/p/v8/source/detail?r=20033 + + + CONFIRM + https://code.google.com/p/v8/source/detail?r=19923 + + + CONFIRM + https://code.google.com/p/v8/source/detail?r=19584 + + + CONFIRM + https://code.google.com/p/v8/source/detail?r=19572 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=358059 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=355586 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=352982 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=350863 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=348319 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=347262 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=345820 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html + + Multiple unspecified vulnerabilities in Google V8 before 3.24.35.22, as used in Google Chrome before 34.0.1847.116, allow attackers to cause a denial of service or possibly have other impact via unknown vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:google:chrome:34.0.1847.131 + cpe:/a:google:chrome:34.0.1847.130 + + CVE-2014-1730 + 2014-04-26T06:55:05.433-04:00 + 2014-04-28T10:29:20.927-04:00 + + + 7.8 + NETWORK + LOW + NONE + COMPLETE + NONE + NONE + http://nvd.nist.gov + 2014-04-28T10:29:19.757-04:00 + + + + + CONFIRM + https://code.google.com/p/v8/source/detail?r=20595 + + + CONFIRM + https://code.google.com/p/v8/source/detail?r=20593 + + + CONFIRM + https://code.google.com/p/v8/source/detail?r=20388 + + + CONFIRM + https://code.google.com/p/v8/source/detail?r=20377 + + + CONFIRM + https://code.google.com/p/v8/source/detail?r=20375 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=354967 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html + + Google V8, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly store internationalization metadata, which allows remote attackers to bypass intended access restrictions by leveraging "type confusion" and reading property values, related to i18n.js and runtime.cc. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:google:chrome:34.0.1847.131 + cpe:/a:google:chrome:34.0.1847.130 + + CVE-2014-1731 + 2014-04-26T06:55:05.480-04:00 + 2014-04-28T10:31:52.497-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-28T10:31:51.403-04:00 + + + + + CONFIRM + https://src.chromium.org/viewvc/blink?revision=171216&view=revision + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=349903 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html + + core/html/HTMLSelectElement.cpp in the DOM implementation in Blink, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly check renderer state upon a focus event, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion" for SELECT elements. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:google:chrome:34.0.1847.131 + cpe:/a:google:chrome:34.0.1847.130 + + CVE-2014-1732 + 2014-04-26T06:55:05.513-04:00 + 2014-04-28T10:38:32.990-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-28T10:38:30.227-04:00 + + + + + CONFIRM + https://src.chromium.org/viewvc/chrome?revision=261737&view=revision + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=352851 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html + + Use-after-free vulnerability in browser/ui/views/speech_recognition_bubble_views.cc in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact via an INPUT element that triggers the presence of a Speech Recognition Bubble window for an incorrect duration. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:google:chrome:34.0.1847.131 + cpe:/a:google:chrome:34.0.1847.130 + + CVE-2014-1733 + 2014-04-26T06:55:05.543-04:00 + 2014-04-28T10:43:50.860-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-28T10:43:49.673-04:00 + + + + + CONFIRM + https://src.chromium.org/viewvc/chrome?revision=260157&view=revision + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=351103 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html + + The PointerCompare function in codegen.cc in Seccomp-BPF, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly merge blocks, which might allow remote attackers to bypass intended sandbox restrictions by leveraging renderer access. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:google:chrome:34.0.1847.131 + cpe:/a:google:chrome:34.0.1847.130 + + CVE-2014-1734 + 2014-04-26T06:55:05.560-04:00 + 2014-04-28T11:15:37.607-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-28T11:15:36.073-04:00 + + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=367314 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=357382 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=356181 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html + + Multiple unspecified vulnerabilities in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux allow attackers to cause a denial of service or possibly have other impact via unknown vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:google:chrome:34.0.1847.131 + cpe:/a:google:chrome:34.0.1847.130 + + CVE-2014-1735 + 2014-04-26T06:55:05.590-04:00 + 2014-04-28T11:21:36.240-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-28T11:21:35.007-04:00 + + + + CONFIRM + https://src.chromium.org/viewvc/blink?revision=171127&view=revision + + + CONFIRM + https://src.chromium.org/viewvc/blink?revision=171077&view=revision + + + CONFIRM + https://code.google.com/p/v8/source/detail?r=20624 + + + CONFIRM + https://code.google.com/p/v8/source/detail?r=20622 + + + CONFIRM + https://code.google.com/p/v8/source/detail?r=20501 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=360429 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=359525 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=359130 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html + + Multiple unspecified vulnerabilities in Google V8 before 3.24.35.33, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, allow attackers to cause a denial of service or possibly have other impact via unknown vectors. + + + + + + + + + cpe:/a:microsoft:internet_explorer:9 + + CVE-2014-1751 + 2014-04-08T19:55:06.430-04:00 + 2014-04-09T20:36:29.023-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-09T20:36:25.353-04:00 + + + + + MS + MS14-018 + + Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0235 and CVE-2014-1755. + + + + + + + + + + cpe:/a:microsoft:internet_explorer:7 + cpe:/a:microsoft:internet_explorer:6 + + CVE-2014-1752 + 2014-04-08T19:55:06.463-04:00 + 2014-04-09T20:39:33.077-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-09T20:39:32.703-04:00 + + + + + MS + MS14-018 + + Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." + + + + + + + + + + + + + cpe:/a:microsoft:internet_explorer:7 + cpe:/a:microsoft:internet_explorer:8 + cpe:/a:microsoft:internet_explorer:6 + cpe:/a:microsoft:internet_explorer:9 + cpe:/a:microsoft:internet_explorer:6:sp1 + + CVE-2014-1753 + 2014-04-08T19:55:06.477-04:00 + 2014-04-09T20:43:23.757-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-09T20:43:23.693-04:00 + + + + + MS + MS14-018 + + Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." + + + + + + + + + cpe:/a:microsoft:internet_explorer:9 + + CVE-2014-1755 + 2014-04-08T19:55:06.510-04:00 + 2014-04-09T20:37:38.200-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-09T20:37:38.137-04:00 + + + + + MS + MS14-018 + + Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0235 and CVE-2014-1751. + + + + + + + + + + + + cpe:/a:microsoft:word:2007:sp3 + cpe:/a:microsoft:office_compatibility_pack::sp3 + cpe:/a:microsoft:word:2010:sp2 + cpe:/a:microsoft:word:2010:sp1 + + CVE-2014-1757 + 2014-04-08T19:55:06.540-04:00 + 2014-04-09T20:49:25.723-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-09T20:49:25.677-04:00 + + + + + MS + MS14-017 + + Microsoft Word 2007 SP3 and 2010 SP1 and SP2, and Office Compatibility Pack SP3, allocates memory incorrectly for file conversions from a binary (aka .doc) format to a newer format, which allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office File Format Converter Vulnerability." + + + + + + + + + cpe:/a:microsoft:word:2003:sp3 + + CVE-2014-1758 + 2014-04-08T19:55:06.573-04:00 + 2014-04-09T20:51:18.523-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-09T20:51:18.493-04:00 + + + + + MS + MS14-017 + + Stack-based buffer overflow in Microsoft Word 2003 SP3 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Word Stack Overflow Vulnerability." + + + + + + + + + + cpe:/a:microsoft:publisher:2003:sp3 + cpe:/a:microsoft:publisher:2007:sp3 + + CVE-2014-1759 + 2014-04-08T19:55:06.587-04:00 + 2014-04-09T20:55:09.500-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-09T20:55:04.717-04:00 + + + + MS + MS14-020 + + pubconv.dll in Microsoft Publisher 2003 SP3 and 2007 SP3 allows remote attackers to execute arbitrary code or cause a denial of service (incorrect pointer dereference and application crash) via a crafted .pub file, aka "Arbitrary Pointer Dereference Vulnerability." + + + + + + + + + cpe:/a:microsoft:internet_explorer:11:- + + CVE-2014-1760 + 2014-04-08T19:55:06.620-04:00 + 2014-04-09T20:41:39.113-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-09T20:41:36.253-04:00 + + + + + MS + MS14-018 + + Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:microsoft:word:2007:sp3 + cpe:/a:microsoft:word:2003:sp3 + cpe:/a:microsoft:sharepoint_server:2013 + cpe:/a:microsoft:word:2013:-:~-~-~rt~~ + cpe:/a:microsoft:sharepoint_server:2010:sp1 + cpe:/a:microsoft:sharepoint_server:2010:sp2 + cpe:/a:microsoft:word_viewer + cpe:/a:microsoft:word:2010:sp1:~~~x64~~ + cpe:/a:microsoft:word:2010:sp2:~~~x64~~ + cpe:/a:microsoft:office_web_apps:2010:sp1 + cpe:/a:microsoft:office_web_apps:2010:sp2 + cpe:/a:microsoft:word:2010:sp1:~~~x86~~ + cpe:/a:microsoft:word:2010:sp2:~~~x86~~ + cpe:/a:microsoft:office:2011::mac + cpe:/a:microsoft:word:2013 + cpe:/a:microsoft:office_compatibility_pack::sp3 + cpe:/a:microsoft:office_web_apps_server:2013 + + CVE-2014-1761 + 2014-03-25T09:24:01.067-04:00 + 2014-04-19T00:47:56.067-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-25T10:08:06.717-04:00 + + + + + MS + MS14-017 + + + CONFIRM + http://technet.microsoft.com/security/advisory/2953095 + + Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Word Automation Services on SharePoint Server 2010 SP1 and SP2 and 2013; Office Web Apps 2010 SP1 and SP2; and Office Web Apps Server 2013 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, as exploited in the wild in March 2014. + + + + + + + + + cpe:/a:microsoft:internet_explorer:11:- + + CVE-2014-1762 + 2014-04-27T06:55:03.153-04:00 + 2014-04-28T12:15:10.007-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-28T12:15:09.977-04:00 + + + + MISC + http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/ + + + MISC + http://twitter.com/thezdi/statuses/443810610958958592 + + Unspecified vulnerability in Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code with medium-integrity privileges and bypass a sandbox protection mechanism via unknown vectors, as demonstrated by ZDI during a Pwn4Fun competition at CanSecWest 2014. + + + + + + + + + cpe:/a:microsoft:internet_explorer:11:- + + CVE-2014-1763 + 2014-04-27T06:55:03.200-04:00 + 2014-04-28T12:17:29.263-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-28T12:17:29.247-04:00 + + + + + MISC + http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/ + + + MISC + http://twitter.com/thezdi/statuses/443855973673754624 + + Use-after-free vulnerability in Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014. + + + + + + + + + cpe:/a:microsoft:internet_explorer:11:- + + CVE-2014-1764 + 2014-04-27T06:55:03.233-04:00 + 2014-04-28T12:26:37.700-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-28T12:26:37.670-04:00 + + + + + MISC + http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/ + + + MISC + http://twitter.com/thezdi/statuses/443855973673754624 + + Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism by leveraging "object confusion" in a broker process, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014. + + + + + + + + + cpe:/a:microsoft:internet_explorer:11:- + + CVE-2014-1765 + 2014-04-27T06:55:03.247-04:00 + 2014-04-28T12:34:52.230-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-28T12:34:52.183-04:00 + + + + + MISC + http://www.pwn2own.com/2014/03/pwn2own-results-thursday-day-two/ + + + MISC + http://twitter.com/thezdi/statuses/444216845734666240 + + Multiple use-after-free vulnerabilities in Microsoft Internet Explorer 11 allow remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by Sebastian Apelt and Andreas Schmidt during a Pwn2Own competition at CanSecWest 2014. + + + + + + + + + cpe:/o:microsoft:windows_8.1:- + + CVE-2014-1766 + 2014-04-27T06:55:03.280-04:00 + 2014-04-28T12:40:57.350-04:00 + + + 7.2 + LOCAL + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-28T12:40:57.303-04:00 + + + + MISC + http://www.pwn2own.com/2014/03/pwn2own-results-thursday-day-two/ + + + MISC + http://twitter.com/thezdi/statuses/444216845734666240 + + Unspecified vulnerability in the kernel in Microsoft Windows 8.1 allows local users to gain privileges via unknown vectors, as demonstrated by Sebastian Apelt and Andreas Schmidt during a Pwn2Own competition at CanSecWest 2014. + + + + + + + + + + + + + + cpe:/a:microsoft:internet_explorer:8 + cpe:/a:microsoft:internet_explorer:7 + cpe:/a:microsoft:internet_explorer:9 + cpe:/a:microsoft:internet_explorer:11:- + cpe:/a:microsoft:internet_explorer:6 + cpe:/a:microsoft:internet_explorer:10 + + CVE-2014-1776 + 2014-04-27T06:55:03.340-04:00 + 2014-04-28T12:53:15.060-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-28T12:53:15.013-04:00 + + + + + CONFIRM + https://technet.microsoft.com/library/security/2963983 + + + MISC + http://www.fireeye.com/blog/uncategorized/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html + + Use-after-free vulnerability in VGX.DLL in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as exploited in the wild in April 2014. + + + + + + + + + cpe:/a:ithoughts:ithoughtshd:4.19::~~~iphone_os~ipad~ + + CVE-2014-1826 + 2014-03-26T06:55:05.240-04:00 + 2014-03-26T14:11:18.247-04:00 + + + 2.6 + NETWORK + HIGH + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-26T14:11:14.513-04:00 + + + + + MISC + http://www.madirish.net/559 + + Cross-site scripting (XSS) vulnerability in the iThoughtsHD app 4.19 for iOS on iPad devices, when the WiFi Transfer feature is used, allows remote attackers to inject arbitrary web script or HTML via a crafted map name. + + + + + + + + + cpe:/a:ithoughts:ithoughtshd:4.19::~~~iphone_os~ipad~ + + CVE-2014-1827 + 2014-03-26T06:55:05.257-04:00 + 2014-03-26T14:14:10.253-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-26T14:14:10.207-04:00 + + + + + MISC + http://www.madirish.net/559 + + The iThoughtsHD app 4.19 for iOS on iPad devices, when the WiFi Transfer feature is used, allows remote attackers to upload arbitrary files by placing a %00 sequence after a dangerous extension, as demonstrated by a .html%00.txt file. + + + + + + + + + cpe:/a:ithoughts:ithoughtshd:4.19::~~~iphone_os~ipad~ + + CVE-2014-1828 + 2014-03-26T06:55:05.270-04:00 + 2014-03-26T14:18:46.123-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-03-26T14:18:43.937-04:00 + + + + + MISC + http://www.madirish.net/559 + + The iThoughts web server in the iThoughtsHD app 4.19 for iOS on iPad devices allows remote attackers to cause a denial of service (disk consumption) by uploading a large file. + + + + + + + + + cpe:/a:devscripts_devel_team:devscripts:2.14.1 + + CVE-2014-1833 + 2014-02-05T13:55:06.363-05:00 + 2014-02-21T00:06:46.140-05:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-06T11:28:27.337-05:00 + + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1059947 + + + BID + 65260 + + + MLIST + [oss-security] 20140131 CVE request: uupdate (devscripts) directory traversal + + + MLIST + [oss-security] 20140131 Re: CVE request: uupdate (devscripts) directory traversal + + + OSVDB + 102748 + + + MISC + http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737160 + + Directory traversal vulnerability in uupdate in devscripts 2.14.1 allows remote attackers to modify arbitrary files via a crafted .orig.tar file, related to a symlink. + + + + + + + + + + + + cpe:/a:stackideas:komento:1.7.3 + cpe:/a:stackideas:komento:1.7.2 + cpe:/a:stackideas:komento:1.7.1 + cpe:/a:stackideas:komento:1.7.0 + + CVE-2014-1837 + 2014-01-30T14:55:03.333-05:00 + 2014-02-21T00:06:46.217-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-01-31T12:01:37.787-05:00 + + + + + XF + komento-joomla-cve20141837-xss(90974) + + + BID + 65173 + + + CONFIRM + http://stackideas.com/downloads/changelog/komento + + + SECUNIA + 56577 + + + OSVDB + 102563 + + Cross-site scripting (XSS) vulnerability in the StackIdeas Komento (com_komento) component before 1.7.4 for Joomla! allows remote attackers to inject arbitrary web script or HTML via vectors related to "checking new comments." + + + + + + + + + + + + + + + cpe:/o:novell:opensuse:12.3 + cpe:/o:novell:opensuse:13.1 + cpe:/a:logilab:logilab-common:0.60.0 + + CVE-2014-1838 + 2014-03-11T15:37:04.833-04:00 + 2014-03-12T14:38:15.277-04:00 + + + 4.4 + LOCAL + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-12T14:38:13.200-04:00 + + + + + CONFIRM + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737051 + + + CONFIRM + http://www.logilab.org/ticket/207561 + + + SECUNIA + 57209 + + + SUSE + openSUSE-SU-2014:0306 + + + MLIST + [oss-security] 20140131 CVE request: temp file issues in python's logilab-common module + + The (1) extract_keys_from_pdf and (2) fill_pdf functions in pdf_ext.py in logilab-commons before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf. + + + + + + + + + + + + + + + cpe:/o:novell:opensuse:12.3 + cpe:/o:novell:opensuse:13.1 + cpe:/a:logilab:logilab-common:0.60.0 + + CVE-2014-1839 + 2014-03-11T15:37:04.850-04:00 + 2014-03-12T14:43:00.410-04:00 + + + 4.4 + LOCAL + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-12T14:43:00.253-04:00 + + + + CONFIRM + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737051 + + + CONFIRM + http://www.logilab.org/ticket/207562 + + + SECUNIA + 57209 + + + SUSE + openSUSE-SU-2014:0306 + + + MLIST + [oss-security] 20140131 CVE request: temp file issues in python's logilab-common module + + The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file. + + + + + + + + + + + + + + + + + + + + + cpe:/a:mybb:mybb:1.6.6 + cpe:/a:mybb:mybb:1.6.7 + cpe:/a:mybb:mybb:1.6.5 + cpe:/a:mybb:mybb:1.6.8 + cpe:/a:mybb:mybb:1.6.9 + cpe:/a:mybb:mybb:1.6.11 + cpe:/a:mybb:mybb:1.6.12 + cpe:/a:mybb:mybb:1.6.10 + cpe:/a:mybb:mybb:1.6.0 + cpe:/a:mybb:mybb:1.6.1 + cpe:/a:mybb:mybb:1.6.2 + cpe:/a:mybb:mybb:1.6.3 + cpe:/a:mybb:mybb:1.6.4 + + CVE-2014-1840 + 2014-03-03T11:55:04.320-05:00 + 2014-03-04T12:36:10.193-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-04T12:36:10.007-05:00 + + + + + MISC + http://packetstormsecurity.com/files/125038/MyBB-1.6.12-POST-Cross-Site-Scripting.html + + + MISC + http://osandamalith.wordpress.com/2014/02/02/mybb-1-6-12-post-xss-0day/ + + Cross-site scripting (XSS) vulnerability in Upload/search.php in MyBB 1.6.12 and earlier allows remote attackers to inject arbitrary web script or HTML via the keywords parameter in a do_search action, which is not properly handled in a forced SQL error message. + + + + + + + + + + + + cpe:/a:southrivertech:titan_ftp_server:10.01.1740 + cpe:/a:southrivertech:titan_ftp_server:10.0.1733 + cpe:/a:southrivertech:titan_ftp_server:10.40 + cpe:/a:southrivertech:titan_ftp_server:10.30 + + CVE-2014-1841 + 2014-04-29T06:37:03.763-04:00 + 2014-04-29T11:23:07.387-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-29T11:23:07.323-04:00 + + + + + FULLDISC + 20140210 Titan FTP Server Directory Traversal Vulnerabilities - [CVE-2014-1841 / CVE-2014-1842 / CVE-2014-1843] + + Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to copy an arbitrary user's home folder via a Move action with a .. (dot dot) in the src parameter. + + + + + + + + + + + + cpe:/a:southrivertech:titan_ftp_server:10.01.1740 + cpe:/a:southrivertech:titan_ftp_server:10.0.1733 + cpe:/a:southrivertech:titan_ftp_server:10.40 + cpe:/a:southrivertech:titan_ftp_server:10.30 + + CVE-2014-1842 + 2014-04-29T06:37:03.780-04:00 + 2014-04-29T11:24:52.327-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-29T11:24:52.280-04:00 + + + + + FULLDISC + 20140210 Titan FTP Server Directory Traversal Vulnerabilities - [CVE-2014-1841 / CVE-2014-1842 / CVE-2014-1843] + + Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to list all usernames via a Go action with a .. (dot dot) in the search-bar value. + + + + + + + + + + + + cpe:/a:southrivertech:titan_ftp_server:10.01.1740 + cpe:/a:southrivertech:titan_ftp_server:10.0.1733 + cpe:/a:southrivertech:titan_ftp_server:10.40 + cpe:/a:southrivertech:titan_ftp_server:10.30 + + CVE-2014-1843 + 2014-04-29T06:37:03.810-04:00 + 2014-04-29T11:34:23.800-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-29T11:34:23.737-04:00 + + + + + FULLDISC + 20140210 Titan FTP Server Directory Traversal Vulnerabilities - [CVE-2014-1841 / CVE-2014-1842 / CVE-2014-1843] + + Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to obtain the property information of an arbitrary home folder via a Properties action with a .. (dot dot) in the src parameter. + + + + + + + + + + + + + + + + + + + cpe:/a:adrotateplugin:adrotate:3.9.4::~free~wordpress~~~ + cpe:/a:adrotateplugin:adrotate:3.9.4::~pro~wordpress~~~ + cpe:/a:adrotateplugin:adrotate:3.9.3::~free~wordpress~~~ + cpe:/a:adrotateplugin:adrotate:3.9.5::~pro~wordpress~~~ + cpe:/a:adrotateplugin:adrotate:3.9.2::~free~wordpress~~~ + cpe:/a:adrotateplugin:adrotate:3.9.1::~free~wordpress~~~ + cpe:/a:adrotateplugin:adrotate:3.9.1::~pro~wordpress~~~ + cpe:/a:adrotateplugin:adrotate:3.9.::~free~wordpress~~~ + cpe:/a:adrotateplugin:adrotate:3.9.2::~pro~wordpress~~~ + cpe:/a:adrotateplugin:adrotate:3.9.3::~pro~wordpress~~~ + cpe:/a:adrotateplugin:adrotate:3.9.::~pro~wordpress~~~ + + CVE-2014-1854 + 2014-02-27T10:55:15.623-05:00 + 2014-03-07T15:42:45.240-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-28T06:47:43.000-05:00 + + + + + MISC + https://www.htbridge.com/advisory/HTB23201 + + + XF + adrotate-track-sql-injection(91253) + + + BID + 65709 + + + BUGTRAQ + 20140220 SQL Injection in AdRotate + + + EXPLOIT-DB + 31834 + + + CONFIRM + http://www.adrotateplugin.com/2014/01/adrotate-pro-3-9-6-and-adrotate-free-3-9-5 + + + SECUNIA + 57079 + + SQL injection vulnerability in library/clicktracker.php in the AdRotate Pro plugin 3.9 through 3.9.5 and AdRotate Free plugin 3.9 through 3.9.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the track parameter. + + + + + + + + + + cpe:/a:jetroplatforms:jetro_cockpit_secure_browsing:4.3.1 + cpe:/a:jetroplatforms:jetro_cockpit_secure_browsing:4.3.3 + + CVE-2014-1861 + 2014-02-18T06:55:16.603-05:00 + 2014-02-20T21:04:47.563-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-18T14:48:08.000-05:00 + + + + + MISC + http://blog.quaji.com/2014/02/remote-code-execution-on-all-enterprise.html + + + BUGTRAQ + 20140217 Jetro Cockpit Secure Browsing vulnerability - Client missing input validation allowing RCE + + The client in Jetro COCKPIT Secure Browsing (JCSB) 4.3.1 and 4.3.3 does not validate the FileName element in an RDP_FILE_TRANSFER document, which allows remote JCSB servers to execute arbitrary programs by providing a .EXE extension. + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:zeroclipboard_project:zeroclipboard:1.0.5 + cpe:/a:zeroclipboard_project:zeroclipboard:1.3.0 + cpe:/a:zeroclipboard_project:zeroclipboard:1.0.7 + cpe:/a:zeroclipboard_project:zeroclipboard:1.3.1 + cpe:/a:zeroclipboard_project:zeroclipboard:1.1.1 + cpe:/a:zeroclipboard_project:zeroclipboard:1.1.0 + cpe:/a:zeroclipboard_project:zeroclipboard:1.0.8 + cpe:/a:zeroclipboard_project:zeroclipboard:1.2.0 + cpe:/a:zeroclipboard_project:zeroclipboard:1.1.7 + cpe:/a:zeroclipboard_project:zeroclipboard:1.2.2 + cpe:/a:zeroclipboard_project:zeroclipboard:1.2.3 + cpe:/a:zeroclipboard_project:zeroclipboard:1.1.2 + cpe:/a:zeroclipboard_project:zeroclipboard:1.1.3 + cpe:/a:zeroclipboard_project:zeroclipboard:1.1.4 + cpe:/a:zeroclipboard_project:zeroclipboard:1.1.5 + cpe:/a:zeroclipboard_project:zeroclipboard:1.2.1 + cpe:/a:zeroclipboard_project:zeroclipboard:1.1.6 + + CVE-2014-1869 + 2014-02-07T19:55:06.207-05:00 + 2014-02-21T00:06:46.390-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-10T12:33:51.373-05:00 + + + + + CONFIRM + https://github.com/zeroclipboard/zeroclipboard/releases/tag/v1.3.2 + + + CONFIRM + https://github.com/zeroclipboard/zeroclipboard/pull/335 + + + MISC + https://github.com/zeroclipboard/zeroclipboard/commit/2f9eb9750a433965572d047e24b0fc78fd1415ca + + + XF + zeroclipboard-cve20141869-xss(91085) + + + BID + 65484 + + + SECUNIA + 56821 + + Multiple cross-site scripting (XSS) vulnerabilities in ZeroClipboard.swf in ZeroClipboard before 1.3.2, as maintained by Jon Rohan and James M. Greene, allow remote attackers to inject arbitrary web script or HTML via vectors related to certain SWF query parameters (aka loaderInfo.parameters). + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:opera:opera_browser:11.64 + cpe:/a:opera:opera_browser:11.65 + cpe:/a:opera:opera_browser:11.66 + cpe:/a:opera:opera_browser:11.67 + cpe:/a:opera:opera_browser:12.00 + cpe:/a:opera:opera_browser:12.02 + cpe:/a:opera:opera_browser:12.01 + cpe:/a:opera:opera_browser:10.60:beta1 + cpe:/a:opera:opera_browser:16.00 + cpe:/a:opera:opera_browser:11.10 + cpe:/a:opera:opera_browser:10.00 + cpe:/a:opera:opera_browser:11.11 + cpe:/a:opera:opera_browser:11.61 + cpe:/a:opera:opera_browser:11.60 + cpe:/a:opera:opera_browser:11.62 + cpe:/a:opera:opera_browser:12.11 + cpe:/a:opera:opera_browser:10.01 + cpe:/a:opera:opera_browser:12.10 + cpe:/a:opera:opera_browser:12.13 + cpe:/a:opera:opera_browser:12.12 + cpe:/a:opera:opera_browser:10.00:beta2 + cpe:/a:opera:opera_browser:11.00:beta + cpe:/a:opera:opera_browser:10.00:beta3 + cpe:/a:opera:opera_browser:10.00:beta1 + cpe:/a:opera:opera_browser:18.00 + cpe:/a:opera:opera_browser:11.01 + cpe:/a:opera:opera_browser:11.00 + cpe:/a:opera:opera_browser:10.00:alpha + cpe:/a:opera:opera_browser:1.00 + cpe:/a:opera:opera_browser:10.61 + cpe:/a:opera:opera_browser:15.00 + cpe:/a:opera:opera_browser:10.62 + cpe:/a:opera:opera_browser:10.60:alpha + cpe:/a:opera:opera_browser:10.60 + cpe:/a:opera:opera_browser:15.00:next + cpe:/a:opera:opera_browser:11.10:beta + cpe:/a:opera:opera_browser:10.10:beta1 + cpe:/a:opera:opera_browser:10.52:beta2 + cpe:/a:opera:opera_browser:17.00 + cpe:/a:opera:opera_browser:10.52:beta1 + cpe:/a:opera:opera_browser:11.50:beta + cpe:/a:opera:opera_browser:10.53:beta1 + cpe:/a:opera:opera_browser:10.50:beta2 + cpe:/a:opera:opera_browser:12.14 + cpe:/a:opera:opera_browser:12.15 + cpe:/a:opera:opera_browser:11.52.1100 + cpe:/a:opera:opera_browser:12.00:beta + cpe:/a:opera:opera_browser:10.53:b + cpe:/a:opera:opera_browser:10.63 + cpe:/a:opera:opera_browser:12.10:beta + cpe:/a:opera:opera_browser:10.50 + cpe:/a:opera:opera_browser:10.51 + cpe:/a:opera:opera_browser:11.60:beta + cpe:/a:opera:opera_browser:10.50:beta1 + cpe:/a:opera:opera_browser:10.20:alpha + cpe:/a:opera:opera_browser:10.10 + cpe:/a:opera:opera_browser:10.11 + cpe:/a:opera:opera_browser:11.52 + cpe:/a:opera:opera_browser:11.51 + cpe:/a:opera:opera_browser:11.50 + cpe:/a:opera:opera_browser:10.53 + cpe:/a:opera:opera_browser:10.52 + cpe:/a:opera:opera_browser:10.54 + + CVE-2014-1870 + 2014-02-06T18:55:04.057-05:00 + 2014-02-07T13:14:02.387-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-07T13:14:01.573-05:00 + + + + CONFIRM + http://blogs.opera.com/security/2014/01/security-changes-features-opera-19/ + + Opera before 19 on Mac OS X allows user-assisted remote attackers to spoof the address bar via vectors involving a drag-and-drop operation. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:linux:linux_kernel:3.0.48 + cpe:/o:linux:linux_kernel:3.0.49 + cpe:/o:linux:linux_kernel:3.0.46 + cpe:/o:linux:linux_kernel:3.0.47 + cpe:/o:linux:linux_kernel:3.0.44 + cpe:/o:linux:linux_kernel:3.0.45 + cpe:/o:linux:linux_kernel:3.0.42 + cpe:/o:linux:linux_kernel:3.4.70 + cpe:/o:linux:linux_kernel:3.4.71 + cpe:/o:linux:linux_kernel:3.0.40 + cpe:/o:linux:linux_kernel:3.0.41 + cpe:/o:linux:linux_kernel:3.4.45 + cpe:/o:linux:linux_kernel:3.4.44 + cpe:/o:linux:linux_kernel:3.4.46 + cpe:/o:linux:linux_kernel:3.4.41 + cpe:/o:linux:linux_kernel:3.4.40 + cpe:/o:linux:linux_kernel:3.4.43 + cpe:/o:linux:linux_kernel:3.4.42 + cpe:/o:linux:linux_kernel:3.4.49 + cpe:/o:linux:linux_kernel:3.4.48 + cpe:/o:linux:linux_kernel:3.0.59 + cpe:/o:linux:linux_kernel:3.4.47 + cpe:/o:linux:linux_kernel:3.0.55 + cpe:/o:linux:linux_kernel:3.0.56 + cpe:/o:linux:linux_kernel:3.0.57 + cpe:/o:linux:linux_kernel:3.0.58 + cpe:/o:linux:linux_kernel:3.0.51 + cpe:/o:linux:linux_kernel:3.0.52 + cpe:/o:linux:linux_kernel:3.0.53 + cpe:/o:linux:linux_kernel:3.11.10 + cpe:/o:linux:linux_kernel:3.0.50 + cpe:/o:linux:linux_kernel:3.4.57 + cpe:/o:linux:linux_kernel:3.4.56 + cpe:/o:linux:linux_kernel:3.4.55 + cpe:/o:linux:linux_kernel:3.4.54 + cpe:/o:linux:linux_kernel:3.4.53 + cpe:/o:linux:linux_kernel:3.4.52 + cpe:/o:linux:linux_kernel:3.4.51 + cpe:/o:linux:linux_kernel:3.4.50 + cpe:/o:linux:linux_kernel:3.0.43 + cpe:/o:linux:linux_kernel:3.10.26 + cpe:/o:linux:linux_kernel:3.4.59 + cpe:/o:linux:linux_kernel:3.0.24 + cpe:/o:linux:linux_kernel:3.0.25 + cpe:/o:linux:linux_kernel:3.0.22 + cpe:/o:linux:linux_kernel:3.1.9 + cpe:/o:linux:linux_kernel:3.0.23 + cpe:/o:linux:linux_kernel:3.10.28 + cpe:/o:linux:linux_kernel:3.0.28 + cpe:/o:linux:linux_kernel:3.10.27 + cpe:/o:linux:linux_kernel:3.0.26 + cpe:/o:linux:linux_kernel:3.10.29 + cpe:/o:linux:linux_kernel:3.4.58 + cpe:/o:linux:linux_kernel:3.0.27 + cpe:/o:linux:linux_kernel:3.10.24 + cpe:/o:linux:linux_kernel:3.10.23 + cpe:/o:linux:linux_kernel:3.10.25 + cpe:/o:linux:linux_kernel:3.10.20 + cpe:/o:linux:linux_kernel:3.1.8 + cpe:/o:linux:linux_kernel:3.0.20 + cpe:/o:linux:linux_kernel:3.10.22 + cpe:/o:linux:linux_kernel:3.10.21 + cpe:/o:linux:linux_kernel:3.4.21 + cpe:/o:linux:linux_kernel:3.4.20 + cpe:/o:linux:linux_kernel:3.4.23 + cpe:/o:linux:linux_kernel:3.4.22 + cpe:/o:linux:linux_kernel:3.4.24 + cpe:/o:linux:linux_kernel:3.4.27 + cpe:/o:linux:linux_kernel:3.4.26 + cpe:/o:linux:linux_kernel:3.4.29 + cpe:/o:linux:linux_kernel:3.10.15 + cpe:/o:linux:linux_kernel:3.4.28 + cpe:/o:linux:linux_kernel:3.0.54 + cpe:/o:linux:linux_kernel:3.0.33 + cpe:/o:linux:linux_kernel:3.0.34 + cpe:/o:linux:linux_kernel:3.0.35 + cpe:/o:linux:linux_kernel:3.0.36 + cpe:/o:linux:linux_kernel:3.10.19 + cpe:/o:linux:linux_kernel:3.0.37 + cpe:/o:linux:linux_kernel:3.10.18 + cpe:/o:linux:linux_kernel:3.0.38 + cpe:/o:linux:linux_kernel:3.4.25 + cpe:/o:linux:linux_kernel:3.10.17 + cpe:/o:linux:linux_kernel:3.0.39 + cpe:/o:linux:linux_kernel:3.10.16 + cpe:/o:linux:linux_kernel:3.10.14 + cpe:/o:linux:linux_kernel:3.10.13 + cpe:/o:linux:linux_kernel:3.10.12 + cpe:/o:linux:linux_kernel:3.10.11 + cpe:/o:linux:linux_kernel:3.10.10 + cpe:/o:linux:linux_kernel:3.0.30 + cpe:/o:linux:linux_kernel:3.0.31 + cpe:/o:linux:linux_kernel:3.9.8 + cpe:/o:linux:linux_kernel:3.5.5 + cpe:/o:linux:linux_kernel:3.4.32 + cpe:/o:linux:linux_kernel:3.9.9 + cpe:/o:linux:linux_kernel:3.5.6 + cpe:/o:linux:linux_kernel:3.4.31 + cpe:/o:linux:linux_kernel:3.5.7 + cpe:/o:linux:linux_kernel:3.4.30 + cpe:/o:linux:linux_kernel:3.7.1 + cpe:/o:linux:linux_kernel:3.4.35 + cpe:/o:linux:linux_kernel:3.9.0 + cpe:/o:linux:linux_kernel:3.0.18 + cpe:/o:linux:linux_kernel:3.4.34 + cpe:/o:linux:linux_kernel:3.4.33 + cpe:/o:linux:linux_kernel:3.9.2 + cpe:/o:linux:linux_kernel:3.9.1 + cpe:/o:linux:linux_kernel:3.0.19 + cpe:/o:linux:linux_kernel:3.4.39 + cpe:/o:linux:linux_kernel:3.9.4 + cpe:/o:linux:linux_kernel:3.4.38 + cpe:/o:linux:linux_kernel:3.9.3 + cpe:/o:linux:linux_kernel:3.4.37 + cpe:/o:linux:linux_kernel:3.9.6 + cpe:/o:linux:linux_kernel:3.9.5 + cpe:/o:linux:linux_kernel:3.0.21 + cpe:/o:linux:linux_kernel:3.9.7 + cpe:/o:linux:linux_kernel:3.5.4 + cpe:/o:linux:linux_kernel:3.0.4 + cpe:/o:linux:linux_kernel:3.0.5 + cpe:/o:linux:linux_kernel:3.0.2 + cpe:/o:linux:linux_kernel:3.0.3 + cpe:/o:linux:linux_kernel:3.0.8 + cpe:/o:linux:linux_kernel:3.0.6 + cpe:/o:linux:linux_kernel:3.0.7 + cpe:/o:linux:linux_kernel:3.4.36 + cpe:/o:linux:linux_kernel:3.13.1 + cpe:/o:linux:linux_kernel:3.6.10 + cpe:/o:linux:linux_kernel:3.6.11 + cpe:/o:linux:linux_kernel:3.13.2 + cpe:/o:linux:linux_kernel:3.13.3 + cpe:/o:linux:linux_kernel:3.4.1 + cpe:/o:linux:linux_kernel:3.4.19 + cpe:/o:linux:linux_kernel:3.4.17 + cpe:/o:linux:linux_kernel:3.4.3 + cpe:/o:linux:linux_kernel:3.4.18 + cpe:/o:linux:linux_kernel:3.4.2 + cpe:/o:linux:linux_kernel:3.2.9 + cpe:/o:linux:linux_kernel:3.4.15 + cpe:/o:linux:linux_kernel:3.2.8 + cpe:/o:linux:linux_kernel:3.4.16 + cpe:/o:linux:linux_kernel:3.4.4 + cpe:/o:linux:linux_kernel:3.12.12 + cpe:/o:linux:linux_kernel:3.2.7 + cpe:/o:linux:linux_kernel:3.4.13 + cpe:/o:linux:linux_kernel:3.12.13 + cpe:/o:linux:linux_kernel:3.12.10 + cpe:/o:linux:linux_kernel:3.4.11 + cpe:/o:linux:linux_kernel:3.12.11 + cpe:/o:linux:linux_kernel:3.4.12 + cpe:/o:linux:linux_kernel:3.4.10 + cpe:/o:linux:linux_kernel:3.0.61 + cpe:/o:linux:linux_kernel:3.3:rc2 + cpe:/o:linux:linux_kernel:3.4:rc7 + cpe:/o:linux:linux_kernel:3.0.60 + cpe:/o:linux:linux_kernel:3.3:rc7 + cpe:/o:linux:linux_kernel:3.4:rc5 + cpe:/o:linux:linux_kernel:3.3:rc5 + cpe:/o:linux:linux_kernel:3.4:rc6 + cpe:/o:linux:linux_kernel:3.3:rc6 + cpe:/o:linux:linux_kernel:3.0.64 + cpe:/o:linux:linux_kernel:3.0.63 + cpe:/o:linux:linux_kernel:3.0.62 + cpe:/o:linux:linux_kernel:3.12.1 + cpe:/o:linux:linux_kernel:3.0.68 + cpe:/o:linux:linux_kernel:3.0.67 + cpe:/o:linux:linux_kernel:3.0.66 + cpe:/o:linux:linux_kernel:3.4.14 + cpe:/o:linux:linux_kernel:3.12.7 + cpe:/o:linux:linux_kernel:3.2:rc2 + cpe:/o:linux:linux_kernel:3.1:rc1 + cpe:/o:linux:linux_kernel:3.0.9 + cpe:/o:linux:linux_kernel:3.0:rc4 + cpe:/o:linux:linux_kernel:3.12.8 + cpe:/o:linux:linux_kernel:3.1:rc4 + cpe:/o:linux:linux_kernel:3.0:rc3 + cpe:/o:linux:linux_kernel:3.12.9 + cpe:/o:linux:linux_kernel:3.0:rc2 + cpe:/o:linux:linux_kernel:3.1:rc2 + cpe:/o:linux:linux_kernel:3.0:rc1 + cpe:/o:linux:linux_kernel:3.2:rc7 + cpe:/o:linux:linux_kernel:3.12.3 + cpe:/o:linux:linux_kernel:3.2:rc6 + cpe:/o:linux:linux_kernel:3.1.10 + cpe:/o:linux:linux_kernel:3.12.4 + cpe:/o:linux:linux_kernel:3.2:rc5 + cpe:/o:linux:linux_kernel:3.0:rc7 + cpe:/o:linux:linux_kernel:3.12.5 + cpe:/o:linux:linux_kernel:3.9:rc3 + cpe:/o:linux:linux_kernel:3.0:rc6 + cpe:/o:linux:linux_kernel:3.12.6 + cpe:/o:linux:linux_kernel:3.0:rc5 + cpe:/o:linux:linux_kernel:3.9:rc1 + cpe:/o:linux:linux_kernel:3.9:rc4 + cpe:/o:linux:linux_kernel:3.9:rc7 + cpe:/o:linux:linux_kernel:3.12.2 + cpe:/o:linux:linux_kernel:3.9:rc2 + cpe:/o:linux:linux_kernel:3.9:rc5 + cpe:/o:linux:linux_kernel:3.3:rc3 + cpe:/o:linux:linux_kernel:3.4:rc4 + cpe:/o:linux:linux_kernel:3.4:rc3 + cpe:/o:linux:linux_kernel:3.3:rc1 + cpe:/o:linux:linux_kernel:3.4:rc2 + cpe:/o:linux:linux_kernel:3.9:rc6 + cpe:/o:linux:linux_kernel:3.3:rc4 + cpe:/o:linux:linux_kernel:3.4:rc1 + cpe:/o:linux:linux_kernel:3.4.5 + cpe:/o:linux:linux_kernel:3.2.2 + cpe:/o:linux:linux_kernel:3.2.3 + cpe:/o:linux:linux_kernel:3.2.1 + cpe:/o:linux:linux_kernel:3.4.6 + cpe:/o:linux:linux_kernel:3.2:rc3 + cpe:/o:linux:linux_kernel:3.2.6 + cpe:/o:linux:linux_kernel:3.4.7 + cpe:/o:linux:linux_kernel:3.2:rc4 + cpe:/o:linux:linux_kernel:3.1:rc3 + cpe:/o:linux:linux_kernel:3.4.8 + cpe:/o:linux:linux_kernel:3.2.4 + cpe:/o:linux:linux_kernel:3.4.9 + cpe:/o:linux:linux_kernel:3.2.5 + cpe:/o:linux:linux_kernel:3.0.65 + cpe:/o:linux:linux_kernel:3.2.12 + cpe:/o:linux:linux_kernel:3.8.10 + cpe:/o:linux:linux_kernel:3.8.12 + cpe:/o:linux:linux_kernel:3.8.11 + cpe:/o:linux:linux_kernel:3.8.13 + cpe:/o:linux:linux_kernel:3.7.9 + cpe:/o:linux:linux_kernel:3.7.8 + cpe:/o:linux:linux_kernel:3.7.7 + cpe:/o:linux:linux_kernel:3.7.6 + cpe:/o:linux:linux_kernel:3.6.3 + cpe:/o:linux:linux_kernel:3.7.5 + cpe:/o:linux:linux_kernel:3.7.4 + cpe:/o:linux:linux_kernel:3.7.3 + cpe:/o:linux:linux_kernel:3.7.2 + cpe:/o:linux:linux_kernel:3.6.7 + cpe:/o:linux:linux_kernel:3.6.6 + cpe:/o:linux:linux_kernel:3.6.5 + cpe:/o:linux:linux_kernel:3.6.4 + cpe:/o:linux:linux_kernel:3.6.9 + cpe:/o:linux:linux_kernel:3.6.8 + cpe:/o:linux:linux_kernel:3.10 + cpe:/o:linux:linux_kernel:3.11 + cpe:/o:linux:linux_kernel:3.12 + cpe:/o:linux:linux_kernel:3.13 + cpe:/o:linux:linux_kernel:3.10.1 + cpe:/o:linux:linux_kernel:3.10.2 + cpe:/o:linux:linux_kernel:3.10.3 + cpe:/o:linux:linux_kernel:3.6.2 + cpe:/o:linux:linux_kernel:3.6.1 + cpe:/o:linux:linux_kernel:3.3.6 + cpe:/o:linux:linux_kernel:3.3.7 + cpe:/o:linux:linux_kernel:3.3.8 + cpe:/o:linux:linux_kernel:3.0.1 + cpe:/o:linux:linux_kernel:3.2 + cpe:/o:linux:linux_kernel:3.1 + cpe:/o:linux:linux_kernel:3.7 + cpe:/o:linux:linux_kernel:3.6 + cpe:/o:linux:linux_kernel:3.4 + cpe:/o:linux:linux_kernel:3.1.6 + cpe:/o:linux:linux_kernel:3.1.5 + cpe:/o:linux:linux_kernel:3.1.7 + cpe:/o:linux:linux_kernel:3.0.32 + cpe:/o:linux:linux_kernel:3.8.9 + cpe:/o:linux:linux_kernel:3.1.2 + cpe:/o:linux:linux_kernel:3.1.1 + cpe:/o:linux:linux_kernel:3.1.4 + cpe:/o:linux:linux_kernel:3.1.3 + cpe:/o:linux:linux_kernel:3.9.10 + cpe:/o:linux:linux_kernel:3.0.29 + cpe:/o:linux:linux_kernel:3.3 + cpe:/o:linux:linux_kernel:3.8.4 + cpe:/o:linux:linux_kernel:3.2.26 + cpe:/o:linux:linux_kernel:3.8.5 + cpe:/o:linux:linux_kernel:3.2.27 + cpe:/o:linux:linux_kernel:3.8.2 + cpe:/o:linux:linux_kernel:3.2.24 + cpe:/o:linux:linux_kernel:3.8.3 + cpe:/o:linux:linux_kernel:3.2.25 + cpe:/o:linux:linux_kernel:3.8.8 + cpe:/o:linux:linux_kernel:3.8.6 + cpe:/o:linux:linux_kernel:3.2.28 + cpe:/o:linux:linux_kernel:3.8.7 + cpe:/o:linux:linux_kernel:3.2.29 + cpe:/o:linux:linux_kernel:3.3.3 + cpe:/o:linux:linux_kernel:3.3.4 + cpe:/o:linux:linux_kernel:3.3.5 + cpe:/o:linux:linux_kernel:3.2.22 + cpe:/o:linux:linux_kernel:3.8.1 + cpe:/o:linux:linux_kernel:3.2.20 + cpe:/o:linux:linux_kernel:3.3.1 + cpe:/o:linux:linux_kernel:3.2.21 + cpe:/o:linux:linux_kernel:3.3.2 + cpe:/o:linux:linux_kernel:3.11.1 + cpe:/o:linux:linux_kernel:3.11.2 + cpe:/o:linux:linux_kernel:3.2.23 + cpe:/o:linux:linux_kernel:3.0.17 + cpe:/o:linux:linux_kernel:3.9.11 + cpe:/o:linux:linux_kernel:3.0.16 + cpe:/o:linux:linux_kernel:3.0.15 + cpe:/o:linux:linux_kernel:3.2.30 + cpe:/o:linux:linux_kernel:3.0.14 + cpe:/o:linux:linux_kernel:3.0.13 + cpe:/o:linux:linux_kernel:3.0.12 + cpe:/o:linux:linux_kernel:3.0.11 + cpe:/o:linux:linux_kernel:3.4.61 + cpe:/o:linux:linux_kernel:3.0.10 + cpe:/o:linux:linux_kernel:3.4.64 + cpe:/o:linux:linux_kernel:3.8.0 + cpe:/o:linux:linux_kernel:3.4.65 + cpe:/o:linux:linux_kernel:3.4.62 + cpe:/o:linux:linux_kernel:3.4.63 + cpe:/o:linux:linux_kernel:3.4.68 + cpe:/o:linux:linux_kernel:3.4.66 + cpe:/o:linux:linux_kernel:3.4.67 + cpe:/o:linux:linux_kernel:3.5.3 + cpe:/o:linux:linux_kernel:3.5.1 + cpe:/o:linux:linux_kernel:3.5.2 + cpe:/o:linux:linux_kernel:3.10.4 + cpe:/o:linux:linux_kernel:3.4.72 + cpe:/o:linux:linux_kernel:3.10.9 + cpe:/o:linux:linux_kernel:3.4.73 + cpe:/o:linux:linux_kernel:3.4.74 + cpe:/o:linux:linux_kernel:3.4.75 + cpe:/o:linux:linux_kernel:3.4.76 + cpe:/o:linux:linux_kernel:3.10.5 + cpe:/o:linux:linux_kernel:3.4.77 + cpe:/o:linux:linux_kernel:3.10.6 + cpe:/o:linux:linux_kernel:3.4.78 + cpe:/o:linux:linux_kernel:3.10.7 + cpe:/o:linux:linux_kernel:3.4.79 + cpe:/o:linux:linux_kernel:3.10.8 + cpe:/o:linux:linux_kernel:3.7.10 + cpe:/o:linux:linux_kernel:3.2.17 + cpe:/o:linux:linux_kernel:3.2.18 + cpe:/o:linux:linux_kernel:3.2.19 + cpe:/o:linux:linux_kernel:3.2.13 + cpe:/o:linux:linux_kernel:3.2.14 + cpe:/o:linux:linux_kernel:3.11.3 + cpe:/o:linux:linux_kernel:3.2.15 + cpe:/o:linux:linux_kernel:3.4.60 + cpe:/o:linux:linux_kernel:3.2.16 + cpe:/o:linux:linux_kernel:3.11.5 + cpe:/o:linux:linux_kernel:3.11.4 + cpe:/o:linux:linux_kernel:3.2.10 + cpe:/o:linux:linux_kernel:3.11.7 + cpe:/o:linux:linux_kernel:3.2.11 + cpe:/o:linux:linux_kernel:3.11.6 + cpe:/o:linux:linux_kernel:3.11.9 + cpe:/o:linux:linux_kernel:3.11.8 + cpe:/o:linux:linux_kernel:3.4.69 + + CVE-2014-1874 + 2014-02-28T01:18:54.587-05:00 + 2014-03-16T00:45:30.847-04:00 + + + 4.4 + LOCAL + MEDIUM + SINGLE_INSTANCE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-02-28T13:04:35.693-05:00 + + + + + CONFIRM + https://github.com/torvalds/linux/commit/2172fa709ab32ca60e86179dc67d0857be8e2c98 + + + CONFIRM + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2172fa709ab32ca60e86179dc67d0857be8e2c98 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1062356 + + + UBUNTU + USN-2141-1 + + + UBUNTU + USN-2140-1 + + + UBUNTU + USN-2139-1 + + + UBUNTU + USN-2138-1 + + + UBUNTU + USN-2137-1 + + + UBUNTU + USN-2136-1 + + + UBUNTU + USN-2135-1 + + + UBUNTU + USN-2134-1 + + + UBUNTU + USN-2133-1 + + + UBUNTU + USN-2129-1 + + + UBUNTU + USN-2128-1 + + + MLIST + [oss-security] 20140206 Re: CVE Request: Linux kernel: SELinux local DoS + + + CONFIRM + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.4 + + The security_context_to_sid_core function in security/selinux/ss/services.c in the Linux kernel before 3.13.4 allows local users to cause a denial of service (system crash) by leveraging the CAP_MAC_ADMIN capability to set a zero-length security context. + + + + + + + + + + + cpe:/a:oracle:openjdk:1.6.0 + cpe:/a:oracle:openjdk:1.8.0 + cpe:/a:oracle:openjdk:1.7.0 + + CVE-2014-1876 + 2014-02-10T18:55:05.103-05:00 + 2014-04-19T00:48:00.503-04:00 + + + 4.4 + LOCAL + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-11T10:30:52.000-05:00 + + + + + MISC + https://bugzilla.redhat.com/show_bug.cgi?id=1060907 + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + MLIST + [oss-security] 20140207 Re: CVE request and heads-up on insecure temp file handling in unpack200 (OpenJDK, Oracle Java) + + + MLIST + [oss-security] 20140203 CVE request and heads-up on insecure temp file handling in unpack200 (OpenJDK, Oracle Java) + + + OSVDB + 102808 + + + MISC + http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737562 + + The unpacker::redirect_stdio function in unpack.cpp in unpack200 in OpenJDK 6, 7, and 8; Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 does not securely create temporary files when a log file cannot be opened, which allows local users to overwrite arbitrary files via a symlink attack on /tmp/unpack.log. + + + + + + + + + cpe:/a:dokeos_project:dokeos:2.1.1 + + CVE-2014-1877 + 2014-03-13T10:55:05.173-04:00 + 2014-03-13T14:07:20.860-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-13T14:07:20.813-04:00 + + + + + XF + dokeos-cve20141877-xss(91295) + + + MISC + http://www.xchg.info/?p=381 + + + MLIST + [oss-security] 20140207 Re: Dokeos 2.1.1 Multiple Stored XSS Vulnerabilities + + + MLIST + [oss-security] 20140206 Dokeos 2.1.1 Multiple Stored XSS Vulnerabilities + + Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 2.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Phone, (2) Street, (3) Address line, (4) Zip code, or (5) City field to main/auth/profile.php; (6) Subject field to main/social/groups.php; or (7) Message body field to main/messages/view_message.php. + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:nagios:nagios:4.0.0:beta3 + cpe:/a:nagios:nagios:4.0.0:beta1 + cpe:/a:nagios:nagios:4.0.0:beta2 + cpe:/a:icinga:icinga:1.8.2 + cpe:/a:nagios:nagios:4.0.2 + cpe:/a:icinga:icinga:1.9.0 + cpe:/a:icinga:icinga:1.9.2 + cpe:/a:icinga:icinga:1.9.3 + cpe:/a:icinga:icinga:1.10.0 + cpe:/a:icinga:icinga:1.9.4 + cpe:/a:icinga:icinga:1.10.1 + cpe:/a:icinga:icinga:1.8.3 + cpe:/a:icinga:icinga:1.8.4 + cpe:/a:icinga:icinga:1.8.5 + cpe:/a:icinga:icinga:1.9.1 + cpe:/a:nagios:nagios:4.0.3:rc1 + cpe:/a:icinga:icinga:1.10.2 + cpe:/a:nagios:nagios:4.0.0:beta4 + cpe:/a:icinga:icinga:1.8.0 + cpe:/a:icinga:icinga:1.8.1 + + CVE-2014-1878 + 2014-02-28T10:13:04.063-05:00 + 2014-02-28T13:27:24.133-05:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-02-28T13:27:24.007-05:00 + + + + + CONFIRM + https://dev.icinga.org/issues/5434 + + + CONFIRM + https://www.icinga.org/2014/02/11/bugfix-releases-1-10-3-1-9-5-1-8-6 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1066578 + + + BID + 65605 + + + SECUNIA + 57024 + + Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a denial of service (segmentation fault) via a long message to cmd.cgi. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:phpmyadmin:phpmyadmin:1.0.3 + cpe:/a:phpmyadmin:phpmyadmin:1.0.4 + cpe:/a:phpmyadmin:phpmyadmin:1.0.5 + cpe:/a:phpmyadmin:phpmyadmin:3.5.7 + cpe:/a:phpmyadmin:phpmyadmin:3.5.8 + cpe:/a:phpmyadmin:phpmyadmin:3.5.4 + cpe:/a:phpmyadmin:phpmyadmin:3.5.5 + cpe:/a:phpmyadmin:phpmyadmin:3.5.6 + cpe:/a:phpmyadmin:phpmyadmin:1.2.9.3 + cpe:/a:phpmyadmin:phpmyadmin:1.0.2 + cpe:/a:phpmyadmin:phpmyadmin:3.5.3.0 + cpe:/a:phpmyadmin:phpmyadmin:1.2.9.1 + cpe:/a:phpmyadmin:phpmyadmin:1.2.9.2 + cpe:/a:phpmyadmin:phpmyadmin:2.11.7.1 + cpe:/a:phpmyadmin:phpmyadmin:3.4.7.1 + cpe:/a:phpmyadmin:phpmyadmin:3.4.7.0 + cpe:/a:phpmyadmin:phpmyadmin:2.11.1.0 + cpe:/a:phpmyadmin:phpmyadmin:1.2.9.5 + cpe:/a:phpmyadmin:phpmyadmin:1.0.1 + cpe:/a:phpmyadmin:phpmyadmin:2.11.3.0 + cpe:/a:phpmyadmin:phpmyadmin:2.11.1.1 + cpe:/a:phpmyadmin:phpmyadmin:1.0.0 + cpe:/a:phpmyadmin:phpmyadmin:2.11.1.2 + cpe:/a:phpmyadmin:phpmyadmin:3.4.6.0 + cpe:/a:phpmyadmin:phpmyadmin:1.0.7 + cpe:/a:phpmyadmin:phpmyadmin:3.5.2.0 + cpe:/a:phpmyadmin:phpmyadmin:1.0.6 + cpe:/a:phpmyadmin:phpmyadmin:3.5.2.1 + cpe:/a:phpmyadmin:phpmyadmin:3.5.2.2 + cpe:/a:phpmyadmin:phpmyadmin:1.0.8 + cpe:/a:phpmyadmin:phpmyadmin:1.2.8 + cpe:/a:phpmyadmin:phpmyadmin:2.11.7.0 + cpe:/a:phpmyadmin:phpmyadmin:1.2.5 + cpe:/a:phpmyadmin:phpmyadmin:1.2.4 + cpe:/a:phpmyadmin:phpmyadmin:2.11.10.0 + cpe:/a:phpmyadmin:phpmyadmin:1.2.7 + cpe:/a:phpmyadmin:phpmyadmin:3.1.1:rc1 + cpe:/a:phpmyadmin:phpmyadmin:2.11.10.1 + cpe:/a:phpmyadmin:phpmyadmin:1.2.6 + cpe:/a:phpmyadmin:phpmyadmin:3.5.8.1 + cpe:/a:phpmyadmin:phpmyadmin:3.4.3.0 + cpe:/a:phpmyadmin:phpmyadmin:3.4.3.1 + cpe:/a:phpmyadmin:phpmyadmin:3.4.3.2 + cpe:/a:phpmyadmin:phpmyadmin:1.3:alpha + cpe:/a:phpmyadmin:phpmyadmin:1.2.1 + cpe:/a:phpmyadmin:phpmyadmin:1.2.2 + cpe:/a:phpmyadmin:phpmyadmin:1.2.3 + cpe:/a:phpmyadmin:phpmyadmin:3.3.10.0 + cpe:/a:phpmyadmin:phpmyadmin:3.3.9.1 + cpe:/a:phpmyadmin:phpmyadmin:3.3.1.0 + cpe:/a:phpmyadmin:phpmyadmin:3.3.9.0 + cpe:/a:phpmyadmin:phpmyadmin:3.2.0:rc1 + cpe:/a:phpmyadmin:phpmyadmin:3.3.9.2 + cpe:/a:phpmyadmin:phpmyadmin:3.3.8.1 + cpe:/a:phpmyadmin:phpmyadmin:3.3.0.0 + cpe:/a:phpmyadmin:phpmyadmin:2.11.8.0 + cpe:/a:phpmyadmin:phpmyadmin:2.11.4.0 + cpe:/a:phpmyadmin:phpmyadmin:3.4.9.0 + cpe:/a:phpmyadmin:phpmyadmin:3.4.8.0 + cpe:/a:phpmyadmin:phpmyadmin:3.0.1:rc1 + cpe:/a:phpmyadmin:phpmyadmin:3.1.5:rc1 + cpe:/a:phpmyadmin:phpmyadmin:3.1.2:rc1 + cpe:/a:phpmyadmin:phpmyadmin:3.5.8.2 + cpe:/a:phpmyadmin:phpmyadmin:3.1.3:rc1 + cpe:/a:phpmyadmin:phpmyadmin:3.1.4:rc2 + cpe:/a:phpmyadmin:phpmyadmin:4.1.3 + cpe:/a:phpmyadmin:phpmyadmin:4.1.2 + cpe:/a:phpmyadmin:phpmyadmin:4.1.5 + cpe:/a:phpmyadmin:phpmyadmin:4.0.0:rc3 + cpe:/a:phpmyadmin:phpmyadmin:4.1.4 + cpe:/a:phpmyadmin:phpmyadmin:4.1.6 + cpe:/a:phpmyadmin:phpmyadmin:3.2.2 + cpe:/a:phpmyadmin:phpmyadmin:4.0.7 + cpe:/a:phpmyadmin:phpmyadmin:3.1.3.1 + cpe:/a:phpmyadmin:phpmyadmin:4.0.4.1 + cpe:/a:phpmyadmin:phpmyadmin:4.0.4 + cpe:/a:phpmyadmin:phpmyadmin:3.1.3.2 + cpe:/a:phpmyadmin:phpmyadmin:4.0.3 + cpe:/a:phpmyadmin:phpmyadmin:4.0.6 + cpe:/a:phpmyadmin:phpmyadmin:4.0.5 + cpe:/a:phpmyadmin:phpmyadmin:3.4.5.0 + cpe:/a:phpmyadmin:phpmyadmin:4.0.0 + cpe:/a:phpmyadmin:phpmyadmin:4.0.1 + cpe:/a:phpmyadmin:phpmyadmin:4.0.2 + cpe:/a:phpmyadmin:phpmyadmin:1.0.6:a + cpe:/a:phpmyadmin:phpmyadmin:1.1 + cpe:/a:phpmyadmin:phpmyadmin:1.2 + cpe:/a:phpmyadmin:phpmyadmin:1.3 + cpe:/a:phpmyadmin:phpmyadmin:3.2.0 + cpe:/a:phpmyadmin:phpmyadmin:3.2.1 + cpe:/a:phpmyadmin:phpmyadmin:3.4.4.0 + cpe:/a:phpmyadmin:phpmyadmin:4.1.0 + cpe:/a:phpmyadmin:phpmyadmin:4.1.1 + cpe:/a:phpmyadmin:phpmyadmin:3.1.0:beta1 + cpe:/a:phpmyadmin:phpmyadmin:3.0.1 + cpe:/a:phpmyadmin:phpmyadmin:3.1.1 + cpe:/a:phpmyadmin:phpmyadmin:3.1.2 + cpe:/a:phpmyadmin:phpmyadmin:3.1.0 + cpe:/a:phpmyadmin:phpmyadmin:3.0.1.1 + cpe:/a:phpmyadmin:phpmyadmin:4.0.0:rc2 + cpe:/a:phpmyadmin:phpmyadmin:3.1.5 + cpe:/a:phpmyadmin:phpmyadmin:3.1.4 + cpe:/a:phpmyadmin:phpmyadmin:3.0.0 + cpe:/a:phpmyadmin:phpmyadmin:3.1.3 + cpe:/a:phpmyadmin:phpmyadmin:4.0.4.2 + cpe:/a:phpmyadmin:phpmyadmin:1.2.9 + cpe:/a:phpmyadmin:phpmyadmin:3.4.2.0 + cpe:/a:phpmyadmin:phpmyadmin:3.4.0.0 + cpe:/a:phpmyadmin:phpmyadmin:3.3.5.1 + cpe:/a:phpmyadmin:phpmyadmin:2.11.0 + cpe:/a:phpmyadmin:phpmyadmin:3.3.5.0 + cpe:/a:phpmyadmin:phpmyadmin:2.11.2.2 + cpe:/a:phpmyadmin:phpmyadmin:2.11.2.1 + cpe:/a:phpmyadmin:phpmyadmin:3.5.8:rc1 + cpe:/a:phpmyadmin:phpmyadmin:3.5.7:rc1 + cpe:/a:phpmyadmin:phpmyadmin:2.11.2.0 + cpe:/a:phpmyadmin:phpmyadmin:3.4.1.0 + cpe:/a:phpmyadmin:phpmyadmin:3.3.4.0 + cpe:/a:phpmyadmin:phpmyadmin:3.4.10.2 + cpe:/a:phpmyadmin:phpmyadmin:2.11.6.0 + cpe:/a:phpmyadmin:phpmyadmin:3.0.0:rc1 + cpe:/a:phpmyadmin:phpmyadmin:3.2.2:rc1 + cpe:/a:phpmyadmin:phpmyadmin:3.2.1:rc1 + cpe:/a:phpmyadmin:phpmyadmin:3.4.10.0 + cpe:/a:phpmyadmin:phpmyadmin:3.4.10.1 + cpe:/a:phpmyadmin:phpmyadmin:3.0.0:alpha + cpe:/a:phpmyadmin:phpmyadmin:3.2.0:beta1 + cpe:/a:phpmyadmin:phpmyadmin:1.2.9.4:c + cpe:/a:phpmyadmin:phpmyadmin:4.0.9 + cpe:/a:phpmyadmin:phpmyadmin:1.2.9.4:b + cpe:/a:phpmyadmin:phpmyadmin:4.0.8 + cpe:/a:phpmyadmin:phpmyadmin:2.11.5.0 + cpe:/a:phpmyadmin:phpmyadmin:2.11.5.1 + cpe:/a:phpmyadmin:phpmyadmin:3.3.8 + cpe:/a:phpmyadmin:phpmyadmin:2.11.5.2 + cpe:/a:phpmyadmin:phpmyadmin:3.3.7 + cpe:/a:phpmyadmin:phpmyadmin:3.3.6 + cpe:/a:phpmyadmin:phpmyadmin:2.11.9.0 + cpe:/a:phpmyadmin:phpmyadmin:2.11.9.1 + cpe:/a:phpmyadmin:phpmyadmin:3.4.11 + cpe:/a:phpmyadmin:phpmyadmin:3.5.0.0 + cpe:/a:phpmyadmin:phpmyadmin:3.0.0:beta + cpe:/a:phpmyadmin:phpmyadmin:3.5.1.0 + cpe:/a:phpmyadmin:phpmyadmin:2.11.9.5 + cpe:/a:phpmyadmin:phpmyadmin:2.11.9.4 + cpe:/a:phpmyadmin:phpmyadmin:2.11.9.3 + cpe:/a:phpmyadmin:phpmyadmin:2.11.9.2 + cpe:/a:phpmyadmin:phpmyadmin:2.11.9.6 + cpe:/a:phpmyadmin:phpmyadmin:3.3.2.0 + cpe:/a:phpmyadmin:phpmyadmin:3.3.3.0 + + CVE-2014-1879 + 2014-02-20T10:27:09.547-05:00 + 2014-03-16T00:45:31.223-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-20T13:55:15.627-05:00 + + + + + CONFIRM + https://github.com/phpmyadmin/phpmyadmin/commit/968d5d5f486820bfa30af046f063b9f23304e14a + + + CONFIRM + http://www.phpmyadmin.net/home_page/security/PMASA-2014-1.php + + + SUSE + openSUSE-SU-2014:0344 + + Cross-site scripting (XSS) vulnerability in import.php in phpMyAdmin before 4.1.7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename in an import action. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:adobe:phonegap:2.4.0:rc1 + cpe:/a:apache:cordova:3.1.0 + cpe:/a:apache:cordova:3.0.0 + cpe:/a:adobe:phonegap:2.7.0 + cpe:/a:adobe:phonegap:2.6.0:rc1 + cpe:/a:apache:cordova:3.2.0:rc1 + cpe:/a:adobe:phonegap:2.5.0 + cpe:/a:adobe:phonegap:2.1.0 + cpe:/a:adobe:phonegap:2.3.0 + cpe:/a:adobe:phonegap:2.2.0:rc1 + cpe:/a:adobe:phonegap:2.2.0:rc2 + cpe:/a:adobe:phonegap:2.3.0:rc1 + cpe:/a:adobe:phonegap:2.7.0:rc1 + cpe:/a:adobe:phonegap:2.0.0 + cpe:/a:adobe:phonegap:2.3.0:rc2 + cpe:/a:apache:cordova:3.3.0 + cpe:/a:apache:cordova:3.1.0:rc1 + cpe:/a:adobe:phonegap:2.6.0 + cpe:/a:apache:cordova:3.3.0:rc1 + cpe:/a:adobe:phonegap:2.9.0 + cpe:/a:adobe:phonegap:2.2.0 + cpe:/a:apache:cordova:3.2.0 + cpe:/a:apache:cordova:3.0.0:rc1 + cpe:/a:adobe:phonegap:2.9.0:rc1 + cpe:/a:adobe:phonegap:2.5.0:rc1 + cpe:/a:adobe:phonegap:2.4.0 + cpe:/a:adobe:phonegap:2.0.0:rc1 + cpe:/a:adobe:phonegap:2.8.1 + cpe:/a:adobe:phonegap:2.8.0 + + CVE-2014-1881 + 2014-03-02T23:50:46.267-05:00 + 2014-03-03T15:39:37.103-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-03T10:11:20.000-05:00 + + + + + BUGTRAQ + 20140124 Security Vulnerabilities in Apache Cordova / PhoneGap + + + MISC + http://www.internetsociety.org/ndss2014/programme#session3 + + + MISC + http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf + + + MISC + http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt + + + MLIST + [oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap + + Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted library clone that leverages IFRAME script execution and waits a certain amount of time for an OnJsPrompt handler return value as an alternative to correct synchronization. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apache:cordova:3.3.0 + cpe:/a:adobe:phonegap:2.4.0:rc1 + cpe:/a:apache:cordova:3.1.0:rc1 + cpe:/a:adobe:phonegap:2.6.0 + cpe:/a:apache:cordova:3.1.0 + cpe:/a:apache:cordova:3.3.0:rc1 + cpe:/a:adobe:phonegap:2.9.0 + cpe:/a:apache:cordova:3.0.0 + cpe:/a:adobe:phonegap:2.2.0 + cpe:/a:apache:cordova:3.2.0 + cpe:/a:apache:cordova:3.0.0:rc1 + cpe:/a:adobe:phonegap:2.7.0 + cpe:/a:adobe:phonegap:2.6.0:rc1 + cpe:/a:adobe:phonegap:2.9.0:rc1 + cpe:/a:apache:cordova:3.2.0:rc1 + cpe:/a:adobe:phonegap:2.5.0:rc1 + cpe:/a:adobe:phonegap:2.5.0 + cpe:/a:adobe:phonegap:2.4.0 + cpe:/a:adobe:phonegap:2.1.0 + cpe:/a:adobe:phonegap:2.3.0 + cpe:/a:adobe:phonegap:2.0.0:rc1 + cpe:/a:adobe:phonegap:2.2.0:rc1 + cpe:/a:adobe:phonegap:2.2.0:rc2 + cpe:/a:adobe:phonegap:2.8.1 + cpe:/a:adobe:phonegap:2.3.0:rc1 + cpe:/a:adobe:phonegap:2.8.0 + cpe:/a:adobe:phonegap:2.7.0:rc1 + cpe:/a:adobe:phonegap:2.0.0 + cpe:/a:adobe:phonegap:2.3.0:rc2 + + CVE-2014-1882 + 2014-03-02T23:50:46.283-05:00 + 2014-03-03T15:26:49.287-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-03T10:15:05.000-05:00 + + + + + MISC + http://www.internetsociety.org/ndss2014/programme#session3 + + + MISC + http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf + + + BUGTRAQ + 20140124 Security Vulnerabilities in Apache Cordova / PhoneGap + + + MISC + http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt + + + MLIST + [oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap + + Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted library clone that leverages IFRAME script execution and directly accesses bridge JavaScript objects, as demonstrated by certain cordova.require calls. + + + + + + + + + + + + + + + + + + + + + cpe:/a:adobe:phonegap:2.4.0:rc1 + cpe:/a:adobe:phonegap:2.2.0 + cpe:/a:adobe:phonegap:2.5.0:rc1 + cpe:/a:adobe:phonegap:2.5.0 + cpe:/a:adobe:phonegap:2.4.0 + cpe:/a:adobe:phonegap:2.1.0 + cpe:/a:adobe:phonegap:2.3.0 + cpe:/a:adobe:phonegap:2.0.0:rc1 + cpe:/a:adobe:phonegap:2.2.0:rc1 + cpe:/a:adobe:phonegap:2.2.0:rc2 + cpe:/a:adobe:phonegap:2.3.0:rc1 + cpe:/a:adobe:phonegap:2.0.0 + cpe:/a:adobe:phonegap:2.3.0:rc2 + + CVE-2014-1883 + 2014-03-02T23:50:46.313-05:00 + 2014-03-03T15:32:03.437-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-03T10:28:00.000-05:00 + + + + + BUGTRAQ + 20140124 Security Vulnerabilities in Apache Cordova / PhoneGap + + + MISC + https://github.com/phonegap/phonegap/blob/2.6.0/changelog + + + MISC + http://www.internetsociety.org/ndss2014/programme#session3 + + + MISC + http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf + + + MISC + http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt + + + MLIST + [oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap + + Adobe PhoneGap before 2.6.0 on Android uses the shouldOverrideUrlLoading callback instead of the proper shouldInterceptRequest callback, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:adobe:phonegap:2.4.0:rc1 + cpe:/a:apache:cordova:3.1.0 + cpe:/a:apache:cordova:3.0.0 + cpe:/a:adobe:phonegap:2.7.0 + cpe:/a:adobe:phonegap:2.6.0:rc1 + cpe:/a:apache:cordova:3.2.0:rc1 + cpe:/a:adobe:phonegap:2.5.0 + cpe:/a:adobe:phonegap:2.1.0 + cpe:/a:adobe:phonegap:2.3.0 + cpe:/a:adobe:phonegap:2.2.0:rc1 + cpe:/a:adobe:phonegap:2.2.0:rc2 + cpe:/a:adobe:phonegap:2.3.0:rc1 + cpe:/a:adobe:phonegap:2.7.0:rc1 + cpe:/a:adobe:phonegap:2.0.0 + cpe:/a:adobe:phonegap:2.3.0:rc2 + cpe:/a:apache:cordova:3.3.0 + cpe:/a:apache:cordova:3.1.0:rc1 + cpe:/a:adobe:phonegap:2.6.0 + cpe:/a:apache:cordova:3.3.0:rc1 + cpe:/a:adobe:phonegap:2.9.0 + cpe:/a:adobe:phonegap:2.2.0 + cpe:/a:apache:cordova:3.2.0 + cpe:/a:apache:cordova:3.0.0:rc1 + cpe:/a:adobe:phonegap:2.9.0:rc1 + cpe:/a:adobe:phonegap:2.5.0:rc1 + cpe:/a:adobe:phonegap:2.4.0 + cpe:/a:adobe:phonegap:2.0.0:rc1 + cpe:/a:adobe:phonegap:2.8.1 + cpe:/a:adobe:phonegap:2.8.0 + + CVE-2014-1884 + 2014-03-02T23:50:46.343-05:00 + 2014-03-03T15:37:54.633-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-03T10:26:41.000-05:00 + + + + + MISC + http://www.internetsociety.org/ndss2014/programme#session3 + + + MISC + http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf + + + BUGTRAQ + 20140124 Security Vulnerabilities in Apache Cordova / PhoneGap + + + MISC + http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt + + + MLIST + [oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap + + Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7 and 8 do not properly restrict navigation events, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:hsgroup:forzearmate:-::~~~android~~ + + CVE-2014-1885 + 2014-03-02T23:50:46.360-05:00 + 2014-03-07T15:01:54.897-05:00 + + + 6.4 + NETWORK + LOW + NONE + NONE + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-05T13:04:14.440-05:00 + + + + + MISC + http://www.internetsociety.org/ndss2014/programme#session3 + + + MISC + http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf + + + MLIST + [oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap + + The ForzeArmate application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently obtain write access to external-storage resources, by leveraging control over any Google syndication advertising domain. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:edinburghtour:edinburgh_by_bus:-::~~~android~~ + + CVE-2014-1886 + 2014-03-02T23:50:46.390-05:00 + 2014-03-07T15:02:59.853-05:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-05T08:00:13.000-05:00 + + + + + MISC + http://www.internetsociety.org/ndss2014/programme#session3 + + + MISC + http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf + + + MLIST + [oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap + + The Edinburgh by Bus application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently access external-storage resources, by leveraging control over one of a number of "obscure Eastern European dating sites." + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:drinkedin:drinkedin_barfinder:-::~~~android~~ + + CVE-2014-1887 + 2014-03-02T23:50:46.423-05:00 + 2014-03-07T15:04:02.697-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-03-05T07:52:41.000-05:00 + + + + + MISC + http://www.internetsociety.org/ndss2014/programme#session3 + + + MISC + http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf + + + MLIST + [oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap + + The DrinkedIn BarFinder application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently obtain sensitive fine-geolocation information, by leveraging control over one of a number of adult sites, as demonstrated by (1) freelifetimecheating.com and (2) www.babesroulette.com. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:buddypress:buddypress_plugin:1.5.5 + cpe:/a:buddypress:buddypress_plugin:1.9 + cpe:/a:buddypress:buddypress_plugin:1.8 + cpe:/a:buddypress:buddypress_plugin:1.7 + cpe:/a:buddypress:buddypress_plugin:1.6 + cpe:/a:buddypress:buddypress_plugin:1.5.3.1 + cpe:/a:buddypress:buddypress_plugin:1.6.5 + cpe:/a:buddypress:buddypress_plugin:1.5 + cpe:/a:buddypress:buddypress_plugin:1.7.2 + cpe:/a:buddypress:buddypress_plugin:1.7.1 + cpe:/a:buddypress:buddypress_plugin:1.5.1 + cpe:/a:buddypress:buddypress_plugin:1.6.2 + cpe:/a:buddypress:buddypress_plugin:1.5.2 + cpe:/a:buddypress:buddypress_plugin:1.6.3 + cpe:/a:buddypress:buddypress_plugin:1.5.3 + cpe:/a:buddypress:buddypress_plugin:1.6.1 + cpe:/a:buddypress:buddypress_plugin:1.5.4 + cpe:/a:buddypress:buddypress_plugin:1.8.1 + cpe:/a:buddypress:buddypress_plugin:1.5.6 + cpe:/a:buddypress:buddypress_plugin:1.6.4 + cpe:/a:buddypress:buddypress_plugin:1.5.7 + cpe:/a:buddypress:buddypress_plugin:1.7.3 + + CVE-2014-1888 + 2014-02-28T19:01:09.183-05:00 + 2014-03-03T10:10:58.790-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-03T10:10:58.650-05:00 + + + + + XF + buddypress-cve20141888-xss(91175) + + + BID + 65555 + + + BUGTRAQ + 20140213 Wordpress plugin Buddypress <= 1.9.1 stored xss vulnerability + + + SECUNIA + 56950 + + + MISC + http://packetstormsecurity.com/files/125212/WordPress-Buddypress-1.9.1-Cross-Site-Scripting.html + + + OSVDB + 103307 + + + CONFIRM + http://buddypress.org/2014/02/buddypress-1-9-2 + + Cross-site scripting (XSS) vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the name field to groups/create/step/group-details. NOTE: this can be exploited without authentication by leveraging CVE-2014-1889. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:xen:xen:4.1.5 + cpe:/o:xen:xen:3.4.4 + cpe:/o:xen:xen:4.1.4 + cpe:/o:xen:xen:3.4.2 + cpe:/o:xen:xen:3.4.3 + cpe:/o:xen:xen:3.4.0 + cpe:/o:xen:xen:3.4.1 + cpe:/o:xen:xen:3.2.3 + cpe:/o:xen:xen:3.2.2 + cpe:/o:xen:xen:4.2.3 + cpe:/o:xen:xen:3.2.1 + cpe:/o:xen:xen:3.2.0 + cpe:/o:xen:xen:4.2.1 + cpe:/o:xen:xen:4.2.2 + cpe:/o:xen:xen:4.2.0 + cpe:/o:xen:xen:4.1.6.1 + cpe:/o:xen:xen:4.3.0 + cpe:/o:xen:xen:4.3.1 + cpe:/o:xen:xen:3.3.0 + cpe:/o:xen:xen:3.3.1 + cpe:/o:xen:xen:3.3.2 + cpe:/o:xen:xen:4.1.2 + cpe:/o:xen:xen:4.1.3 + cpe:/o:xen:xen:4.1.0 + cpe:/o:xen:xen:4.1.1 + + CVE-2014-1891 + 2014-04-01T02:35:53.467-04:00 + 2014-04-19T00:48:02.893-04:00 + + + 5.2 + ADJACENT_NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-01T15:11:50.293-04:00 + + + + + CONFIRM + http://xenbits.xen.org/xsa/advisory-84.html + + + MLIST + [oss-security] 20140210 Xen Security Advisory 84 (CVE-2014-1891,CVE-2014-1892,CVE-2014-1893,CVE-2014-1894) - integer overflow in several XSM/Flask hypercalls + + + MLIST + [oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls + + + MLIST + [oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls + + + SUSE + SUSE-SU-2014:0446 + + + SUSE + SUSE-SU-2014:0373 + + + SUSE + SUSE-SU-2014:0372 + + Multiple integer overflows in the (1) FLASK_GETBOOL, (2) FLASK_SETBOOL, (3) FLASK_USER, and (4) FLASK_CONTEXT_TO_SID suboperations in the flask hypercall in Xen 4.3.x, 4.2.x, 4.1.x, 3.2.x, and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1892, CVE-2014-1893, and CVE-2014-1894. + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:xen:xen:4.1.5 + cpe:/o:xen:xen:3.4.4 + cpe:/o:xen:xen:4.0.0 + cpe:/o:xen:xen:4.1.4 + cpe:/o:xen:xen:3.4.2 + cpe:/o:xen:xen:3.4.3 + cpe:/o:xen:xen:4.0.4 + cpe:/o:xen:xen:3.4.0 + cpe:/o:xen:xen:3.4.1 + cpe:/o:xen:xen:4.0.3 + cpe:/o:xen:xen:4.0.2 + cpe:/o:xen:xen:4.0.1 + cpe:/o:xen:xen:4.1.6.1 + cpe:/o:xen:xen:3.3.0 + cpe:/o:xen:xen:3.3.1 + cpe:/o:xen:xen:3.3.2 + cpe:/o:xen:xen:4.1.2 + cpe:/o:xen:xen:4.1.3 + cpe:/o:xen:xen:4.1.0 + cpe:/o:xen:xen:4.1.1 + + CVE-2014-1892 + 2014-04-01T02:35:53.497-04:00 + 2014-04-19T00:48:03.003-04:00 + + + 5.2 + ADJACENT_NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-01T14:54:21.977-04:00 + + + + + CONFIRM + http://xenbits.xen.org/xsa/advisory-84.html + + + MLIST + [oss-security] 20140210 Xen Security Advisory 84 (CVE-2014-1891,CVE-2014-1892,CVE-2014-1893,CVE-2014-1894) - integer overflow in several XSM/Flask hypercalls + + + MLIST + [oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls + + + MLIST + [oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls + + + SUSE + SUSE-SU-2014:0446 + + + SUSE + SUSE-SU-2014:0373 + + + SUSE + SUSE-SU-2014:0372 + + Xen 3.3 through 4.1, when XSM is enabled, allows local users to cause a denial of service via vectors related to a "large memory allocation," a different vulnerability than CVE-2014-1891, CVE-2014-1893, and CVE-2014-1894. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:xen:xen:4.1.5 + cpe:/o:xen:xen:4.0.0 + cpe:/o:xen:xen:3.4.4 + cpe:/o:xen:xen:4.1.4 + cpe:/o:xen:xen:3.4.2 + cpe:/o:xen:xen:3.4.3 + cpe:/o:xen:xen:4.0.4 + cpe:/o:xen:xen:3.4.0 + cpe:/o:xen:xen:4.0.3 + cpe:/o:xen:xen:3.4.1 + cpe:/o:xen:xen:4.0.2 + cpe:/o:xen:xen:4.0.1 + cpe:/o:xen:xen:3.2.3 + cpe:/o:xen:xen:3.2.2 + cpe:/o:xen:xen:3.2.1 + cpe:/o:xen:xen:3.2.0 + cpe:/o:xen:xen:4.1.6.1 + cpe:/o:xen:xen:3.3.0 + cpe:/o:xen:xen:3.3.1 + cpe:/o:xen:xen:3.3.2 + cpe:/o:xen:xen:4.1.2 + cpe:/o:xen:xen:4.1.3 + cpe:/o:xen:xen:4.1.0 + cpe:/o:xen:xen:4.1.1 + + CVE-2014-1893 + 2014-04-01T02:35:53.513-04:00 + 2014-04-19T00:48:03.113-04:00 + + + 5.2 + ADJACENT_NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-01T14:57:11.590-04:00 + + + + + CONFIRM + http://xenbits.xen.org/xsa/advisory-84.html + + + MLIST + [oss-security] 20140210 Xen Security Advisory 84 (CVE-2014-1891,CVE-2014-1892,CVE-2014-1893,CVE-2014-1894) - integer overflow in several XSM/Flask hypercalls + + + MLIST + [oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls + + + MLIST + [oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls + + + SUSE + SUSE-SU-2014:0446 + + + SUSE + SUSE-SU-2014:0373 + + + SUSE + SUSE-SU-2014:0372 + + Multiple integer overflows in the (1) FLASK_GETBOOL and (2) FLASK_SETBOOL suboperations in the flask hypercall in Xen 4.1.x, 3.3.x, 3.2.x, and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1891, CVE-2014-1892, and CVE-2014-1894. + + + + + + + + + + + + + + + + + cpe:/o:xen:xen:3.0.3 + cpe:/o:xen:xen:3.0.2 + cpe:/o:xen:xen:3.0.4 + cpe:/o:xen:xen:3.2.3 + cpe:/o:xen:xen:3.2.2 + cpe:/o:xen:xen:3.2.1 + cpe:/o:xen:xen:3.2.0 + cpe:/o:xen:xen:3.1.4 + cpe:/o:xen:xen:3.1.3 + + CVE-2014-1894 + 2014-04-01T02:35:53.547-04:00 + 2014-04-19T00:48:03.223-04:00 + + + 5.2 + ADJACENT_NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-01T14:59:36.487-04:00 + + + + + CONFIRM + http://xenbits.xen.org/xsa/advisory-84.html + + + MLIST + [oss-security] 20140210 Xen Security Advisory 84 (CVE-2014-1891,CVE-2014-1892,CVE-2014-1893,CVE-2014-1894) - integer overflow in several XSM/Flask hypercalls + + + MLIST + [oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls + + + MLIST + [oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls + + + SUSE + SUSE-SU-2014:0446 + + + SUSE + SUSE-SU-2014:0373 + + + SUSE + SUSE-SU-2014:0372 + + Multiple integer overflows in unspecified suboperations in the flask hypercall in Xen 3.2.x and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1891, CVE-2014-1892, and CVE-2014-1893. + + + + + + + + + + + + + + cpe:/o:xen:xen:4.3.0 + cpe:/o:xen:xen:4.3.1 + cpe:/o:xen:xen:4.2.3 + cpe:/o:xen:xen:4.2.1 + cpe:/o:xen:xen:4.2.2 + cpe:/o:xen:xen:4.2.0 + + CVE-2014-1895 + 2014-04-01T02:35:53.577-04:00 + 2014-04-19T00:48:03.333-04:00 + + + 5.8 + ADJACENT_NETWORK + MEDIUM + SINGLE_INSTANCE + PARTIAL + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-01T15:03:43.527-04:00 + + + + + CONFIRM + http://xenbits.xen.org/xsa/advisory-85.html + + + MLIST + [oss-security] 20140210 Xen Security Advisory 85 (CVE-2014-1895) - Off-by-one error in FLASK_AVC_CACHESTAT hypercall + + + MLIST + [oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls + + + SUSE + SUSE-SU-2014:0373 + + Off-by-one error in the flask_security_avc_cachestats function in xsm/flask/flask_op.c in Xen 4.2.x and 4.3.x, when the maximum number of physical CPUs are in use, allows local users to cause a denial of service (host crash) or obtain sensitive information from hypervisor memory by leveraging a FLASK_AVC_CACHESTAT hypercall, which triggers a buffer over-read. + + + + + + + + + + + + + + + cpe:/o:xen:xen:4.3.0 + cpe:/o:xen:xen:4.3.1 + cpe:/o:xen:xen:4.4.0:rc1 + cpe:/o:xen:xen:4.2.3 + cpe:/o:xen:xen:4.2.1 + cpe:/o:xen:xen:4.2.2 + cpe:/o:xen:xen:4.2.0 + + CVE-2014-1896 + 2014-04-01T02:35:53.607-04:00 + 2014-04-19T00:48:03.427-04:00 + + + 4.9 + ADJACENT_NETWORK + MEDIUM + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-01T15:10:54.370-04:00 + + + + + CONFIRM + http://xenbits.xen.org/xsa/xsa86.patch + + + CONFIRM + http://xenbits.xen.org/xsa/advisory-86.html + + + MLIST + [oss-security] 20140210 Xen Security Advisory 86 (CVE-2014-1896) - libvchan failure handling malicious ring indexes + + + MLIST + [oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls + + + SUSE + SUSE-SU-2014:0373 + + The (1) do_send and (2) do_recv functions in io.c in libvchan in Xen 4.2.x, 4.3.x, and 4.4-RC series allows local guests to cause a denial of service or possibly gain privileges via crafted xenstore ring indexes, which triggers a "read or write past the end of the ring." + + + CVE-2014-1899 + 2014-05-02T10:55:05.933-04:00 + 2014-05-02T10:55:05.933-04:00 + + CONFIRM + https://support.citrix.com/article/CTX140291 + + Cross-site scripting (XSS) vulnerability in Citrix NetScaler Gateway (formerly Citrix Access Gateway Enterprise Edition) 9.x before 9.3.66.5 and 10.x before 10.1.123.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + + + cpe:/a:freepbx:freepbx:2.10 + cpe:/a:freepbx:freepbx:2.11 + cpe:/a:freepbx:freepbx:2.9 + cpe:/a:freepbx:freepbx:2.12 + + CVE-2014-1903 + 2014-02-18T06:55:16.977-05:00 + 2014-02-21T00:06:46.907-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-18T20:07:11.023-05:00 + + + + + BUGTRAQ + 20140211 [CVE-2014-1903] FreePBX 2.9 through 12 RCE + + + CONFIRM + http://www.freepbx.org/news/2014-02-06/security-vulnerability-notice + + + MISC + http://packetstormsecurity.com/files/125215/FreePBX-2.9-Remote-Code-Execution.html + + + MISC + http://packetstormsecurity.com/files/125166/FreePBX-2.x-Code-Execution.html + + + OSVDB + 103240 + + + CONFIRM + http://issues.freepbx.org/browse/FREEPBX-7123 + + + CONFIRM + http://issues.freepbx.org/browse/FREEPBX-7117 + + + CONFIRM + http://code.freepbx.org/changelog/FreePBX_SVN?cs=16429 + + + CONFIRM + http://code.freepbx.org/changelog/FreePBX_Framework?cs=a29382efeb293ef4f42aa9b841dfc8eabb2d1e03 + + + FULLDISC + 20140211 Re: Freepbx , php code execution exploit + + + FULLDISC + 20140211 Freepbx , php code execution exploit + + admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not restrict the set of functions accessible to the API handler, which allows remote attackers to execute arbitrary PHP code via the function and args parameters to admin/config.php. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:springsource:spring_framework:3.0.0 + cpe:/a:springsource:spring_framework:4.0.1 + cpe:/a:springsource:spring_framework:3.2.4 + cpe:/a:springsource:spring_framework:3.2.5 + cpe:/a:springsource:spring_framework:3.2.2 + cpe:/a:springsource:spring_framework:3.2.3 + cpe:/a:springsource:spring_framework:3.0.0:rc3 + cpe:/a:springsource:spring_framework:3.0.0:rc1 + cpe:/a:springsource:spring_framework:3.2.6 + cpe:/a:springsource:spring_framework:3.0.0:rc2 + cpe:/a:springsource:spring_framework:3.2.0 + cpe:/a:springsource:spring_framework:3.2.1 + cpe:/a:springsource:spring_framework:3.2.7 + cpe:/a:springsource:spring_framework:3.1.2 + cpe:/a:springsource:spring_framework:3.1.1 + cpe:/a:springsource:spring_framework:3.1.0 + cpe:/a:springsource:spring_framework:4.0.0:rc1 + cpe:/a:springsource:spring_framework:3.1.4 + cpe:/a:springsource:spring_framework:3.1.3 + cpe:/a:springsource:spring_framework:3.0.1 + cpe:/a:springsource:spring_framework:3.0.2 + cpe:/a:springsource:spring_framework:3.0.3 + cpe:/a:springsource:spring_framework:4.0.0:m2 + cpe:/a:springsource:spring_framework:3.0.4 + cpe:/a:springsource:spring_framework:3.0.5 + cpe:/a:springsource:spring_framework:3.0.6 + cpe:/a:springsource:spring_framework:4.0.0:m1 + cpe:/a:springsource:spring_framework:3.0.7 + cpe:/a:springsource:spring_framework:3.0.0:m1 + cpe:/a:springsource:spring_framework:3.0.0:m2 + cpe:/a:springsource:spring_framework:3.0.0:m3 + cpe:/a:springsource:spring_framework:3.0.0:m4 + + CVE-2014-1904 + 2014-03-20T12:55:12.683-04:00 + 2014-04-24T01:05:30.200-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-21T08:50:14.987-04:00 + + + + + CONFIRM + https://jira.springsource.org/browse/SPR-11426 + + + CONFIRM + https://github.com/spring-projects/spring-framework/commit/741b4b229ae032bd17175b46f98673ce0bd2d485 + + + BUGTRAQ + 20140311 CVE-2014-1904 XSS when using Spring MVC + + + CONFIRM + http://www.gopivotal.com/security/cve-2014-1904 + + + SECUNIA + 57915 + + + REDHAT + RHSA-2014:0400 + + + CONFIRM + http://docs.spring.io/spring/docs/3.2.8.RELEASE/changelog.txt + + Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action. + + + + + + + + + + + + + + + + + + + cpe:/a:videowhisper:live_streaming_integration_plugin:2.0 + cpe:/a:videowhisper:live_streaming_integration_plugin:4.27.3 + cpe:/a:videowhisper:live_streaming_integration_plugin:2.1 + cpe:/a:videowhisper:live_streaming_integration_plugin:4.25 + cpe:/a:videowhisper:live_streaming_integration_plugin:4.27.4 + cpe:/a:videowhisper:live_streaming_integration_plugin:4.07 + cpe:/a:videowhisper:live_streaming_integration_plugin:2.2 + cpe:/a:videowhisper:live_streaming_integration_plugin:4.27 + cpe:/a:videowhisper:live_streaming_integration_plugin:4.05 + cpe:/a:videowhisper:live_streaming_integration_plugin:1.0.2 + cpe:/a:videowhisper:live_streaming_integration_plugin:4.25.3 + + CVE-2014-1906 + 2014-03-06T10:55:28.797-05:00 + 2014-03-07T10:07:59.883-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-06T09:29:32.000-05:00 + + + + + MISC + https://www.htbridge.com/advisory/HTB23199 + + + XF + videowhisper-cve20141906-xss(91477) + + + MISC + http://packetstormsecurity.com/files/125454 + + Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) m parameter to lb_status.php; (2) msg parameter to vc_chatlog.php; n parameter to (3) channel.php, (4) htmlchat.php, (5) video.php, or (6) videotext.php; (7) message parameter to lb_logout.php; or ct parameter to (8) lb_status.php or (9) v_status.php in ls/. + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:videowhisper:live_streaming_integration_plugin:2.0 + cpe:/a:videowhisper:live_streaming_integration_plugin:4.27.3 + cpe:/a:videowhisper:live_streaming_integration_plugin:2.1 + cpe:/a:videowhisper:live_streaming_integration_plugin:4.25 + cpe:/a:videowhisper:live_streaming_integration_plugin:4.27.4 + cpe:/a:videowhisper:live_streaming_integration_plugin:4.07 + cpe:/a:videowhisper:live_streaming_integration_plugin:2.2 + cpe:/a:videowhisper:live_streaming_integration_plugin:4.27 + cpe:/a:videowhisper:live_streaming_integration_plugin:4.05 + cpe:/a:videowhisper:live_streaming_integration_plugin:1.0.2 + cpe:/a:videowhisper:live_streaming_integration_plugin:4.25.3 + + CVE-2014-1907 + 2014-03-06T10:55:28.830-05:00 + 2014-03-07T09:39:23.667-05:00 + + + 6.4 + NETWORK + LOW + NONE + PARTIAL + NONE + PARTIAL + http://nvd.nist.gov + 2014-03-06T04:30:37.000-05:00 + + + + + MISC + https://www.htbridge.com/advisory/HTB23199 + + + XF + videowhisper-cve20141907-dir-trav(91478) + + + MISC + http://packetstormsecurity.com/files/125454 + + Multiple directory traversal vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_login.php or (2) delete arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_logout.php. + + + + + + + + + + cpe:/a:citrix:sharefile_mobile:2.4::~~~android~~ + cpe:/a:citrix:sharefile_mobile_for_tablets:2.4::~~~android~~ + + CVE-2014-1910 + 2014-02-21T10:30:16.267-05:00 + 2014-02-21T12:34:57.030-05:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-21T12:34:56.953-05:00 + + + + + CONFIRM + http://support.citrix.com/article/CTX140303 + + + SECTRACK + 1029791 + + + SECUNIA + 57020 + + Citrix ShareFile Mobile and ShareFile Mobile for Tablets before 2.4.4 for Android do not verify X.509 certificates from SSL servers, which allow man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. + + + + + + + + + + + + + + cpe:/h:foscam:fi8919w:- + cpe:/o:foscam:fi8919w_firmware:11.37.2.54 + + CVE-2014-1911 + 2014-03-06T06:55:05.473-05:00 + 2014-03-07T13:54:48.300-05:00 + + + 7.8 + NETWORK + LOW + NONE + COMPLETE + NONE + NONE + http://nvd.nist.gov + 2014-03-06T09:12:01.000-05:00 + + + + + CERT-VN + VU#525132 + + + CONFIRM + http://foscam.us/forum/mjpeg-54-firmware-bug-user-logon-bypass-t8442.html + + The Foscam FI8910W camera with firmware before 11.37.2.55 allows remote attackers to obtain sensitive video and image data via a blank username and password. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:python:python:2.7.1 + cpe:/a:python:python:2.6.3 + cpe:/a:python:python:2.6.2 + cpe:/a:python:python:2.6.1 + cpe:/a:python:python:2.7.1:rc1 + cpe:/a:python:python:2.7.2:rc1 + cpe:/a:python:python:3.0 + cpe:/a:python:python:3.1 + cpe:/a:python:python:3.4:alpha1 + cpe:/a:python:python:2.6 + cpe:/a:python:python:2.5 + cpe:/a:python:python:3.3 + cpe:/a:python:python:2.7 + cpe:/a:python:python:2.7.6 + cpe:/a:python:python:2.7.5 + cpe:/a:python:python:2.7.4 + cpe:/a:python:python:2.7.3 + cpe:/a:python:python:2.6.6 + cpe:/a:python:python:2.6.5 + cpe:/a:python:python:2.6.4 + cpe:/a:python:python:2.6.8 + cpe:/a:python:python:2.6.7 + cpe:/a:python:python:2.7.2150 + cpe:/a:python:python:3.2.2150 + cpe:/a:python:python:3.3.0 + cpe:/a:python:python:2.5.2 + cpe:/a:python:python:3.3.3 + cpe:/a:python:python:2.5.3 + cpe:/a:python:python:3.3.1 + cpe:/a:python:python:3.2:alpha + cpe:/a:python:python:3.3.2 + cpe:/a:python:python:2.5.1 + cpe:/a:python:python:3.2.4 + cpe:/a:python:python:3.2.5 + cpe:/a:python:python:2.5.4 + cpe:/a:python:python:3.2.2 + cpe:/a:python:python:3.3:beta2 + cpe:/a:python:python:3.1.2150::~~~~x64~ + cpe:/a:python:python:3.2.3 + cpe:/a:python:python:3.2.0 + cpe:/a:python:python:3.2.1 + cpe:/a:python:python:3.2 + cpe:/a:python:python:2.6.6150 + cpe:/a:python:python:2.7.1150::~~~~x64~ + cpe:/a:python:python:2.5.150 + cpe:/a:python:python:2.7.1150 + cpe:/a:python:python:2.5.6 + cpe:/a:python:python:3.0.1 + cpe:/a:python:python:3.1.1 + cpe:/a:python:python:2.6.2150 + cpe:/a:python:python:3.1.2 + cpe:/a:python:python:3.1.5 + cpe:/a:python:python:3.1.3 + cpe:/a:python:python:3.1.4 + + CVE-2014-1912 + 2014-02-28T19:55:05.093-05:00 + 2014-03-26T00:57:37.083-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-03T10:54:46.887-05:00 + + + + + CONFIRM + http://bugs.python.org/issue20246 + + + MISC + https://www.trustedsec.com/february-2014/python-remote-code-execution-socket-recvfrom_into/ + + + UBUNTU + USN-2125-1 + + + SECTRACK + 1029831 + + + MLIST + [oss-security] 20140212 Re: CVE request? buffer overflow in socket.recvfrom_into + + + EXPLOIT-DB + 31875 + + + DEBIAN + DSA-2880 + + + MISC + http://pastebin.com/raw.php?i=GHXSmNEg + + + CONFIRM + http://hg.python.org/cpython/rev/87673659d8f7 + + Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3.3.4, and 3.4.x before 3.4rc1 allows remote attackers to execute arbitrary code via a crafted string. + + + + + + + + + cpe:/a:doug_poulin:command_school_student_management_system:1.06.01 + + CVE-2014-1914 + 2014-02-07T10:48:57.157-05:00 + 2014-02-21T00:06:47.000-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-07T13:18:32.813-05:00 + + + + + XF + commandschool-message-xss(90179) + + + XF + commandschool-addtopic-xss(90178) + + + BID + 64707 + + + MISC + http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html + + + OSVDB + 101892 + + + OSVDB + 101891 + + Multiple cross-site scripting (XSS) vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to inject arbitrary web script or HTML via the (1) topic parameter to sw/add_topic.php or (2) nick parameter to sw/chat/message.php. + + + + + + + + + cpe:/a:doug_poulin:command_school_student_management_system:1.06.01 + + CVE-2014-1915 + 2014-02-07T10:48:57.517-05:00 + 2014-02-21T00:06:47.077-05:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-07T13:19:17.157-05:00 + + + + + BID + 64707 + + + MISC + http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html + + + OSVDB + 101890 + + + OSVDB + 101889 + + Multiple cross-site request forgery (CSRF) vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to hijack the authentication of (1) administrators for requests that change the administrator password via an update action to sw/admin_change_password.php or (2) unspecified victims for requests that add a topic or blog entry to sw/add_topic.php. NOTE: vector 2 can be leveraged to bypass the authentication requirements for exploiting vector 1 in CVE-2014-1914. + + + + + + + + + + + + + + + cpe:/a:light_speed_gaming:mumblekit:- + cpe:/a:light_speed_gaming:mumble:1.2.1::~~~iphone_os~~ + cpe:/a:light_speed_gaming:mumble:1.1:rc1:~~~iphone_os~~ + cpe:/a:light_speed_gaming:mumble:1.2.2::~~~iphone_os~~ + cpe:/a:light_speed_gaming:mumble:1.1.1::~~~iphone_os~~ + cpe:/a:light_speed_gaming:mumble:1.1::~~~iphone_os~~ + cpe:/a:light_speed_gaming:mumble:1.2::~~~iphone_os~~ + + CVE-2014-1916 + 2014-02-07T19:55:06.237-05:00 + 2014-02-10T12:26:33.363-05:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-02-10T12:26:33.300-05:00 + + + + + OSVDB + 102957 + + + CONFIRM + http://mumble.info/security/Mumble-SA-2014-003.txt + + The (1) opus_packet_get_nb_frames and (2) opus_packet_get_samples_per_frame functions in the client in MumbleKit before commit fd190328a9b24d37382b269a5674b0c0c7a7e36d and Mumble for iOS 1.1 through 1.2.2 do not properly check the return value of the copyDataBlock method, which allow remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted length prefix value in an Opus voice packet. + + + + + + + + + + + + cpe:/a:parcimonie_project:parcimonie:0.6-1 + cpe:/a:parcimonie_project:parcimonie:0.6-3 + cpe:/a:parcimonie_project:parcimonie:0.7-1 + cpe:/a:parcimonie_project:parcimonie:0.7.1-1 + + CVE-2014-1921 + 2014-02-14T10:55:06.203-05:00 + 2014-02-21T00:06:47.483-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-18T11:03:57.443-05:00 + + + + + CONFIRM + https://gaffer.ptitcanardnoir.org/intrigeri/files/parcimonie/App-Parcimonie-0.8.1.tar.gz + + + CONFIRM + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=738134 + + + XF + parcimonie-cve20141921-info-disc(91118) + + + BID + 65505 + + + DEBIAN + DSA-2860 + + + MLIST + [oss-security] 20140210 Re: CVE request: parcimonie (0.6 to 0.8, included) possible correlation between key fetches + + + MLIST + [oss-security] 20140210 CVE request: parcimonie (0.6 to 0.8, included) possible correlation between key fetches + + parcimonie before 0.8.1, when using a large keyring, sleeps for the same amount of time between fetches, which allows attackers to correlate key fetches via unspecified vectors. + + + + + + + + + + + + + + + cpe:/a:visibility_software:cyber_recruiter:6.6 + cpe:/a:visibility_software:cyber_recruiter:6.4 + cpe:/a:visibility_software:cyber_recruiter:6.2 + cpe:/a:visibility_software:cyber_recruiter:7.2 + cpe:/a:visibility_software:cyber_recruiter:7.0 + cpe:/a:visibility_software:cyber_recruiter:6.8 + cpe:/a:visibility_software:cyber_recruiter:8.0 + + CVE-2014-1930 + 2014-02-10T17:55:03.887-05:00 + 2014-02-21T00:06:47.657-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-02-11T13:37:57.347-05:00 + + + + + CERT-VN + VU#566894 + + + CONFIRM + http://www.vspublic.com/help/Cyber%20Recruiter/default.aspx?pageid=release_details + + + BID + 65305 + + + OSVDB + 102815 + + + OSVDB + 102814 + + + MISC + http://jvn.jp/vu/JVNVU97441356/index.html + + Visibility Software Cyber Recruiter before 8.1.00 does not use the appropriate combination of HTTPS transport and response headers to prevent access to (1) AppSelfService.aspx and (2) AgencyPortal.aspx in the browser history, which allows remote attackers to obtain sensitive information by leveraging an unattended workstation. + + + + + + + + + + + + + + + cpe:/a:visibility_software:cyber_recruiter:6.6 + cpe:/a:visibility_software:cyber_recruiter:6.4 + cpe:/a:visibility_software:cyber_recruiter:6.2 + cpe:/a:visibility_software:cyber_recruiter:7.2 + cpe:/a:visibility_software:cyber_recruiter:7.0 + cpe:/a:visibility_software:cyber_recruiter:6.8 + cpe:/a:visibility_software:cyber_recruiter:8.0 + + CVE-2014-1931 + 2014-02-10T17:55:03.933-05:00 + 2014-02-21T00:06:47.750-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-02-11T13:38:41.583-05:00 + + + + + CONFIRM + http://www.vspublic.com/help/Cyber%20Recruiter/default.aspx?pageid=release_details + + + BID + 65564 + + The user login page in Visibility Software Cyber Recruiter before 8.1.00 generates different responses for invalid password-retrieval attempts depending on which data elements are incorrect, which might allow remote attackers to obtain account-related information via a series of requests. + + + + + + + + + + cpe:/a:python:pillow:2.3.0 + cpe:/a:pythonware:python_imaging_library:1.1.7 + + CVE-2014-1932 + 2014-04-17T10:55:11.090-04:00 + 2014-04-18T11:51:05.090-04:00 + + + 4.4 + LOCAL + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-18T11:51:05.060-04:00 + + + + + CONFIRM + https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7 + + + CONFIRM + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059 + + + UBUNTU + USN-2168-1 + + + MLIST + [oss-security] 20140210 Re: CVE requests: Pacemaker, Python Imaging Library, eyeD3, 9base, rc, Gamera, RPLY - insecure use of /tmp + + The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file. + + + + + + + + + + cpe:/a:python:pillow:2.3.0 + cpe:/a:pythonware:python_imaging_library:1.1.7 + + CVE-2014-1933 + 2014-04-17T10:55:11.120-04:00 + 2014-04-18T11:51:10.293-04:00 + + + 2.1 + LOCAL + LOW + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-18T11:51:10.263-04:00 + + + + + CONFIRM + https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7 + + + UBUNTU + USN-2168-1 + + + MLIST + [oss-security] 20140210 Re: CVE requests: Pacemaker, Python Imaging Library, eyeD3, 9base, rc, Gamera, RPLY - insecure use of /tmp + + + MLIST + [oss-security] 20140210 CVE requests: Pacemaker, Python Imaging Library, eyeD3, 9base, rc, Gamera, RPLY - insecure use of /tmp + + The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes. + + + + + + + + + + + + + + + + + + + + cpe:/o:google:android:4.1 + cpe:/o:google:android:4.1.2 + cpe:/o:google:android:4.2.2 + cpe:/o:google:android:4.2.1 + cpe:/o:google:android:4.0.1 + cpe:/o:google:android:4.0.2 + cpe:/o:google:android:4.0 + cpe:/o:google:android:4.0.4 + cpe:/o:google:android:4.0.3 + cpe:/o:google:android:4.3 + cpe:/o:google:android:4.2 + cpe:/o:google:android:4.3.1 + + CVE-2014-1939 + 2014-03-02T23:50:46.453-05:00 + 2014-03-04T11:02:59.460-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-04T10:35:24.060-05:00 + + + + + MLIST + [oss-security] 20140210 CVE-2014-1939 searchBoxJavaBridge_ in Android Jelly Bean + + + CONFIRM + http://blog.chromium.org/2013/11/introducing-chromium-powered-android.html + + java/android/webkit/BrowserFrame.java in Android before 4.4 uses the addJavascriptInterface API in conjunction with creating an object of the SearchBoxImpl class, which allows attackers to execute arbitrary Java code by leveraging access to the searchBoxJavaBridge_ interface at certain Android API levels. + + + + + + + + + cpe:/a:pearson:esis_enterprise_student_information_system:- + + CVE-2014-1942 + 2014-04-01T23:58:17.077-04:00 + 2014-04-02T12:05:40.047-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-02T12:05:35.907-04:00 + + + + + CERT-VN + VU#163188 + + Cross-site scripting (XSS) vulnerability in aal/loginverification.aspx in Pearson eSIS Enterprise Student Information System allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:fine_free_file_project:fine_free_file:5.4 + cpe:/a:fine_free_file_project:fine_free_file:5.3 + cpe:/a:fine_free_file_project:fine_free_file:5.2 + cpe:/a:fine_free_file_project:fine_free_file:5.1 + cpe:/a:fine_free_file_project:fine_free_file:5.9 + cpe:/a:fine_free_file_project:fine_free_file:5.8 + cpe:/a:fine_free_file_project:fine_free_file:5.7 + cpe:/a:fine_free_file_project:fine_free_file:5.10 + cpe:/a:fine_free_file_project:fine_free_file:5.11 + cpe:/a:fine_free_file_project:fine_free_file:5.12 + cpe:/a:fine_free_file_project:fine_free_file:5.0 + cpe:/a:fine_free_file_project:fine_free_file:5.13 + cpe:/a:fine_free_file_project:fine_free_file:5.14 + cpe:/a:fine_free_file_project:fine_free_file:5.15 + cpe:/a:fine_free_file_project:fine_free_file:5.16 + + CVE-2014-1943 + 2014-02-18T14:55:04.377-05:00 + 2014-03-26T00:57:38.880-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-02-19T10:46:59.307-05:00 + + + + + CONFIRM + https://github.com/glensc/file/blob/FILE5_17/ChangeLog + + + UBUNTU + USN-2126-1 + + + UBUNTU + USN-2123-1 + + + CONFIRM + http://www.php.net/ChangeLog-5.php + + + DEBIAN + DSA-2868 + + + DEBIAN + DSA-2861 + + + MLIST + [file] 20140213 segfault in magic_buffer + + + MLIST + [file] 20140211 segfault in magic_buffer + + + MLIST + [file] 20140211 segfault in magic_buffer + + + MLIST + [file] 20142010 segfault in magic_buffer + + + SUSE + openSUSE-SU-2014:0367 + + + SUSE + openSUSE-SU-2014:0364 + + Fine Free file before 5.17 allows context-dependent attackers to cause a denial of service (infinite recursion, CPU consumption, and crash) via a crafted indirect offset value in the magic of a file. + + + + + + + + + cpe:/a:ilch:ilch_cms:2.0 + + CVE-2014-1944 + 2014-03-09T09:16:56.850-04:00 + 2014-03-10T12:14:25.637-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-10T12:14:25.590-04:00 + + + + + CONFIRM + https://github.com/IlchCMS/Ilch-2.0/commit/381e15f39d07d3cdf6aaaa25c0f2321f817935f7 + + + MISC + https://www.htbridge.com/advisory/HTB23203 + + + XF + ilchcms-cve20141944-xss(91538) + + + BUGTRAQ + 20140305 Cross-Site Scripting (XSS) in Ilch CMS + + + EXPLOIT-DB + 32076 + + Cross-site scripting (XSS) vulnerability in Ilch CMS 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the text parameter to index.php/guestbook/index/newentry. + + + + + + + + + + + + + + + + + + + + cpe:/a:opendocman:opendocman:1.2.6.5 + cpe:/a:opendocman:opendocman:1.2.7 + cpe:/a:opendocman:opendocman:1.2.6.6 + cpe:/a:opendocman:opendocman:1.2.6.7:- + cpe:/a:opendocman:opendocman:1.2.6.2:- + cpe:/a:opendocman:opendocman:1.2.6.3:a + cpe:/a:opendocman:opendocman:1.2.6.2:a + cpe:/a:opendocman:opendocman:1.2.6.7:beta + cpe:/a:opendocman:opendocman:1.2.6.3:- + cpe:/a:opendocman:opendocman:1.2.6.8 + cpe:/a:opendocman:opendocman:1.2.7.1 + cpe:/a:opendocman:opendocman:1.2.6.2:b + + CVE-2014-1945 + 2014-03-09T09:16:57.083-04:00 + 2014-03-10T12:24:22.857-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-10T12:24:22.793-04:00 + + + + + MISC + http://www.opendocman.com/opendocman-v1-2-7-2-released + + + MISC + http://www.opendocman.com/opendocman-v1-2-7-1-release + + + MISC + https://www.htbridge.com/advisory/HTB23202 + + + BID + 65775 + + + SECUNIA + 56189 + + SQL injection vulnerability in ajax_udf.php in OpenDocMan before 1.2.7.2 allows remote attackers to execute arbitrary SQL commands via the add_value parameter. + + + + + + + + + + cpe:/a:openstack:image_registry_and_delivery_service_%28glance%29:2013.2.1 + cpe:/a:openstack:image_registry_and_delivery_service_%28glance%29:2013.2 + + CVE-2014-1948 + 2014-02-14T10:55:06.407-05:00 + 2014-03-08T00:13:14.480-05:00 + + + 2.6 + LOCAL + HIGH + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-18T11:10:03.767-05:00 + + + + + CONFIRM + https://bugs.launchpad.net/glance/+bug/1275062 + + + BID + 65507 + + + MLIST + [oss-security] 20140212 [OSSA 2014-004] Glance Swift store backend password leak (CVE-2014-1948) + + + SECUNIA + 56419 + + + REDHAT + RHSA-2014:0229 + + OpenStack Image Registry and Delivery Service (Glance) 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the Swift store backend password when authentication fails and WARNING level logging is enabled, which allows local users to obtain sensitive information by reading the log. + + + + + + + + + + + + + + + + + + + + cpe:/o:xen:xen:4.3.0 + cpe:/o:xen:xen:4.1.5 + cpe:/o:xen:xen:4.3.1 + cpe:/o:xen:xen:4.1.4 + cpe:/o:xen:xen:4.1.2 + cpe:/o:xen:xen:4.1.3 + cpe:/o:xen:xen:4.2.3 + cpe:/o:xen:xen:4.1.1 + cpe:/o:xen:xen:4.2.1 + cpe:/o:xen:xen:4.2.2 + cpe:/o:xen:xen:4.2.0 + cpe:/o:xen:xen:4.1.6.1 + + CVE-2014-1950 + 2014-02-14T10:55:06.563-05:00 + 2014-04-19T00:48:06.723-04:00 + + + 4.6 + LOCAL + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-18T11:13:17.050-05:00 + + + + + CONFIRM + http://xenbits.xen.org/xsa/advisory-88.html + + + MLIST + [oss-security] 20140212 Xen Security Advisory 88 (CVE-2014-1950) - use-after-free in xc_cpupool_getinfo() under memory pressure + + + SUSE + SUSE-SU-2014:0373 + + + SUSE + SUSE-SU-2014:0372 + + Use-after-free vulnerability in the xc_cpupool_getinfo function in Xen 4.1.x through 4.3.x, when using a multithreaded toolstack, does not properly handle a failure by the xc_cpumap_alloc function, which allows local users with access to management functions to cause a denial of service (heap corruption) and possibly gain privileges via unspecified vectors. + + + + + + + + + cpe:/a:fortinet:fortiweb:5.0.2 + + CVE-2014-1955 + 2014-04-30T10:22:06.173-04:00 + 2014-05-01T08:14:40.323-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-05-01T08:14:40.247-04:00 + + + + + CONFIRM + http://www.fortiguard.com/advisory/FG-IR-13-009/ + + Cross-site scripting (XSS) vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + cpe:/a:fortinet:fortiweb:5.0.2 + + CVE-2014-1956 + 2014-04-30T10:22:06.203-04:00 + 2014-05-01T08:20:06.820-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-05-01T08:20:06.787-04:00 + + + + CONFIRM + http://www.fortiguard.com/advisory/FG-IR-13-009/ + + CRLF injection vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors. + + + + + + + + + cpe:/a:fortinet:fortiweb:5.0.2 + + CVE-2014-1957 + 2014-04-30T10:22:06.237-04:00 + 2014-05-01T08:54:07.450-04:00 + + + 6.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-05-01T08:54:06.467-04:00 + + + ALLOWS_USER_ACCESS + + + CONFIRM + http://www.fortiguard.com/advisory/FG-IR-13-009/ + + FortiGuard FortiWeb before 5.0.3 allows remote authenticated users to gain privileges via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:gnu:gnutls:3.1.20 + cpe:/a:gnu:gnutls:3.1.1 + cpe:/a:gnu:gnutls:3.1.0 + cpe:/a:gnu:gnutls:3.2.7 + cpe:/a:gnu:gnutls:3.2.8 + cpe:/a:gnu:gnutls:3.1.6 + cpe:/a:gnu:gnutls:3.1.7 + cpe:/a:gnu:gnutls:3.1.19 + cpe:/a:gnu:gnutls:3.1.2 + cpe:/a:gnu:gnutls:3.1.3 + cpe:/a:gnu:gnutls:3.2.9 + cpe:/a:gnu:gnutls:3.1.4 + cpe:/a:gnu:gnutls:3.1.5 + cpe:/a:gnu:gnutls:3.2.8.1 + cpe:/a:gnu:gnutls:3.2.2 + cpe:/a:gnu:gnutls:3.2.1 + cpe:/a:gnu:gnutls:3.2.4 + cpe:/a:gnu:gnutls:3.2.3 + cpe:/a:gnu:gnutls:3.1.10 + cpe:/a:gnu:gnutls:3.2.6 + cpe:/a:gnu:gnutls:3.1.8 + cpe:/a:gnu:gnutls:3.2.5 + cpe:/a:gnu:gnutls:3.1.9 + cpe:/a:gnu:gnutls:3.1.17 + cpe:/a:gnu:gnutls:3.1.18 + cpe:/a:gnu:gnutls:3.1.15 + cpe:/a:gnu:gnutls:3.1.16 + cpe:/a:gnu:gnutls:3.1.13 + cpe:/a:gnu:gnutls:3.1.14 + cpe:/a:gnu:gnutls:3.1.12 + cpe:/a:gnu:gnutls:3.1.11 + cpe:/a:gnu:gnutls:3.2.10 + cpe:/a:gnu:gnutls:3.2.0 + + CVE-2014-1959 + 2014-03-06T19:10:57.620-05:00 + 2014-03-16T00:45:38.007-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-07T07:12:21.670-05:00 + + + + + CONFIRM + https://www.gitorious.org/gnutls/gnutls/commit/b1abfe3d182d68539900092eb42fc62cf1bb7e7c + + + UBUNTU + USN-2121-1 + + + CONFIRM + http://www.gnutls.org/security.html + + + DEBIAN + DSA-2866 + + + MLIST + [oss-security] 20140213 Re: CVE Request - GnuTLS corrects flaw in certificate verification (3.1.x/3.2.x) + + + MLIST + [oss-security] 20140213 CVE Request - GnuTLS corrects flaw in certificate verification (3.1.x/3.2.x) + + lib/x509/verify.c in GnuTLS before 3.1.21 and 3.2.x before 3.2.11 treats version 1 X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates. + + + + + + + + + + + cpe:/a:sap:netweaver_solution_manager:7.0 + cpe:/a:sap:netweaver_solution_manager:7.1 + cpe:/a:sap:netweaver:- + + CVE-2014-1960 + 2014-02-14T10:55:07.437-05:00 + 2014-02-21T00:06:48.327-05:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-02-18T11:15:42.057-05:00 + + + + + CONFIRM + https://service.sap.com/sap/support/notes/1828885 + + + XF + netweaver-solution-info-disc(91093) + + + SECUNIA + 56942 + + + CONFIRM + http://scn.sap.com/docs/DOC-8218 + + + MISC + http://erpscan.com/advisories/erpscan-14-004-sap-netweaver-solution-manager-missing-authorization-check-information-disclosure/ + + The Solution Manager in SAP NetWeaver does not properly restrict access, which allows remote attackers to obtain sensitive information via unspecified vectors. + + + + + + + + + cpe:/a:sap:netweaver:- + + CVE-2014-1961 + 2014-02-14T10:55:07.470-05:00 + 2014-02-21T00:06:48.420-05:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-02-18T11:28:06.900-05:00 + + + + CONFIRM + https://service.sap.com/sap/support/notes/1852146 + + + XF + netweaver-webdyn-path-disclosure(91096) + + + SECUNIA + 56947 + + + CONFIRM + http://scn.sap.com/docs/DOC-8218 + + + MISC + http://erpscan.com/advisories/erpscan-14-002-sap-portal-webdynpro-path-disclosure/ + + Unspecified vulnerability in the Portal WebDynPro in SAP NetWeaver allows remote attackers to obtain sensitive path information via unknown attack vectors. + + + + + + + + + cpe:/a:sap:customer_relationship_management:7.02:ehp2 + + CVE-2014-1962 + 2014-02-14T10:55:07.500-05:00 + 2014-02-21T00:06:48.500-05:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-02-18T11:18:07.403-05:00 + + + + + CONFIRM + https://service.sap.com/sap/support/notes/1917054 + + + XF + sap-crm-info-disc(91098) + + + SECUNIA + 56944 + + + CONFIRM + http://scn.sap.com/docs/DOC-8218 + + + MISC + http://erpscan.com/advisories/erpscan-14-003-sap-crm-gwsync-xxe/ + + Gwsync in SAP CRM 7.02 EHP 2 allows remote attackers to obtain sensitive information via unspecified vectors, related to an XML External Entity (XXE) issue. + + + + + + + + + cpe:/a:sap:netweaver:7.20 + + CVE-2014-1963 + 2014-02-14T10:55:07.533-05:00 + 2014-02-21T00:06:48.577-05:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-02-18T11:21:29.953-05:00 + + + + CONFIRM + https://service.sap.com/sap/support/notes/1773912 + + + XF + netweaver-message-server-dos(91097) + + + SECUNIA + 56947 + + + CONFIRM + http://scn.sap.com/docs/DOC-8218 + + + MISC + http://erpscan.com/advisories/erpscan-14-001-sap-netweaver-message-server-dos/ + + Unspecified vulnerability in Message Server in SAP NetWeaver 7.20 allows remote attackers to cause a denial of service via unknown attack vectors. + + + + + + + + + + cpe:/a:sap:netweaver_exchange_infrastructure_%28bc-xi%29:- + cpe:/a:sap:netweaver:- + + CVE-2014-1964 + 2014-02-14T10:55:07.563-05:00 + 2014-02-21T00:06:48.657-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-18T11:26:44.963-05:00 + + + + + CONFIRM + https://service.sap.com/sap/support/notes/1788080 + + + XF + netweaver-dir-xss(91095) + + + SECUNIA + 56947 + + + CONFIRM + http://scn.sap.com/docs/DOC-8218 + + + MISC + http://erpscan.com/advisories/erpscan-14-005-sap-netweaver-dir-error-xss/ + + Cross-site scripting (XSS) vulnerability in the Integration Repository in the SAP Exchange Infrastructure (BC-XI) component in SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via vectors related to the ESR application and a DIR error. + + + + + + + + + + + + + + cpe:/a:sap:netweaver:7.11 + cpe:/a:sap:netweaver:7.10 + cpe:/a:sap:netweaver:7.01 + cpe:/a:sap:netweaver:7.02 + cpe:/a:sap:netweaver:7.0 + cpe:/a:sap:netweaver:3.0 + + CVE-2014-1965 + 2014-02-14T10:55:07.830-05:00 + 2014-02-21T00:06:48.750-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-18T11:50:22.387-05:00 + + + + + CONFIRM + https://service.sap.com/sap/support/notes/1442517 + + + XF + netweaver-ispeakadapter-xss(91094) + + + MISC + http://www.stechno.net/sap-notes.html?view=sapnote&id=1442517 + + + SECUNIA + 56947 + + + MISC + http://erpscan.com/advisories/erpscan-14-006-sap-netweaver-pip-xss/ + + Cross-site scripting (XSS) vulnerability in ISpeakAdapter in the Integration Repository in the SAP Exchange Infrastructure (BC-XI) component 3.0, 7.00 through 7.02, and 7.10 through 7.11 for SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via vectors related to PIP. + + + + + + + + + + + + + + + + + + + + cpe:/o:siemens:ruggedcom_rugged_operating_system:3.3.6 + cpe:/o:siemens:ruggedcom_rugged_operating_system:3.4.9 + cpe:/o:siemens:ruggedcom_rugged_operating_system:3.5.4 + cpe:/o:siemens:ruggedcom_rugged_operating_system:3.7.9 + cpe:/o:siemens:ruggedcom_rugged_operating_system:3.12.2 + cpe:/o:siemens:ruggedcom_rugged_operating_system:3.8.5 + cpe:/o:siemens:ruggedcom_rugged_operating_system:3.9.3 + cpe:/o:siemens:ruggedcom_rugged_operating_system:3.12.1 + cpe:/o:siemens:ruggedcom_rugged_operating_system:3.12 + cpe:/o:siemens:ruggedcom_rugged_operating_system:3.6.6 + cpe:/o:siemens:ruggedcom_rugged_operating_system:3.2.5 + + CVE-2014-1966 + 2014-02-23T23:48:10.210-05:00 + 2014-02-24T14:53:51.657-05:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-02-24T14:53:49.750-05:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-051-03 + + + CONFIRM + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-892342.pdf + + The SNMP implementation in Siemens RuggedCom ROS before 3.11, ROS 3.11 for RS950G, ROS 3.12 before 3.12.4, and ROS 4.0 for RSG2488 allows remote attackers to cause a denial of service (device outage) via crafted packets. + + + + + + + + + + + cpe:/a:7andi-fs.co:denny%27s:1.0.1::~~~android~~ + cpe:/a:7andi-fs.co:denny%27s:1.0.2::~~~android~~ + cpe:/a:7andi-fs.co:denny%27s:2.0.0::~~~android~~ + + CVE-2014-1967 + 2014-02-26T20:55:04.243-05:00 + 2014-02-27T13:58:12.380-05:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-27T13:58:12.303-05:00 + + + + + CONFIRM + https://play.google.com/store/apps/details?id=jp.denimoba + + + JVNDB + JVNDB-2014-000022 + + + JVN + JVN#48810179 + + The Denny's application before 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. + + + + + + + + + + + + + + + + cpe:/a:riken:xoonips:3.47::~~~xoops~~ + cpe:/a:riken:xoonips:3.40::~~~xoops~~ + cpe:/a:riken:xoonips:3.42::~~~xoops~~ + cpe:/a:riken:xoonips:3.41::~~~xoops~~ + cpe:/a:riken:xoonips:3.44::~~~xoops~~ + cpe:/a:riken:xoonips:3.43::~~~xoops~~ + cpe:/a:riken:xoonips:3.46::~~~xoops~~ + cpe:/a:riken:xoonips:3.45::~~~xoops~~ + + CVE-2014-1968 + 2014-02-26T20:55:04.273-05:00 + 2014-02-27T14:06:21.190-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-27T14:06:21.127-05:00 + + + + + CONFIRM + http://xoonips.sourceforge.jp + + + JVNDB + JVNDB-2014-000025 + + + JVN + JVN#87797318 + + Cross-site scripting (XSS) vulnerability in the XooNIps module 3.47 and earlier for XOOPS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + cpe:/a:apps4u%40android:sd_card_manager:20140223::~~~android~~ + + CVE-2014-1969 + 2014-04-11T12:55:08.817-04:00 + 2014-04-14T12:26:20.383-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-14T12:26:20.320-04:00 + + + + + JVNDB + JVNDB-2014-000035 + + + JVN + JVN#47386847 + + Directory traversal vulnerability in the apps4u@android SD Card Manager application before 20140224 for Android allows attackers to overwrite or create arbitrary files via a crafted filename. + + + + + + + + + + + + + + + + cpe:/a:estrongs:es_file_explorer:1.6.1.1::~~~android~~ + cpe:/a:estrongs:es_file_explorer:3.0.0::~~~android~~ + cpe:/a:estrongs:es_file_explorer:1.6.0.2::~~~android~~ + + CVE-2014-1970 + 2014-03-20T11:55:05.493-04:00 + 2014-03-20T13:12:59.220-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-20T13:12:56.843-04:00 + + + + + JVNDB + JVNDB-2014-000033 + + + JVN + JVN#70029459 + + Directory traversal vulnerability in the ES File Explorer File Manager application before 3.0.4 for Android allows remote attackers to overwrite or create arbitrary files via unspecified vectors. + + + + + + + + + cpe:/a:silexlabs:silex:2.0.0:alpha5 + + CVE-2014-1971 + 2014-03-20T11:55:06.823-04:00 + 2014-03-20T13:23:41.287-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-20T13:23:38.710-04:00 + + + + + MISC + https://github.com/silexlabs/Silex/blob/master/docs/change-log.md + + + JVNDB + JVNDB-2014-000032 + + + JVN + JVN#14282890 + + Cross-site scripting (XSS) vulnerability in Silex before 2.0.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:lyesoft:andexplorer:1.3::~~professional~android~~ + cpe:/a:lyesoft:andexplorer:1.2::~~professional~android~~ + cpe:/a:lyesoft:andexplorer:1.1::~~professional~android~~ + cpe:/a:lyesoft:andexplorer:1.0::~~professional~android~~ + cpe:/a:lyesoft:andexplorer:2.5::~~~android~~ + cpe:/a:lyesoft:andexplorer:1.9::~~professional~android~~ + cpe:/a:lyesoft:andexplorer:1.8::~~professional~android~~ + cpe:/a:lyesoft:andexplorer:1.7::~~professional~android~~ + cpe:/a:lyesoft:andexplorer:2.4::~~~android~~ + cpe:/a:lyesoft:andexplorer:1.6::~~professional~android~~ + cpe:/a:lyesoft:andexplorer:1.5::~~professional~android~~ + cpe:/a:lyesoft:andexplorer:3.0::~~~android~~ + cpe:/a:lyesoft:andexplorer:2.3::~~~android~~ + cpe:/a:lyesoft:andexplorer:2.3::~~professional~android~~ + cpe:/a:lyesoft:andexplorer:2.1::~~~android~~ + cpe:/a:lyesoft:andexplorer:2.2::~~~android~~ + cpe:/a:lyesoft:andexplorer:1.5::~~~android~~ + cpe:/a:lyesoft:andexplorer:3.0::~~professional~android~~ + cpe:/a:lyesoft:andexplorer:2.4::~~professional~android~~ + cpe:/a:lyesoft:andexplorer:1.9::~~~android~~ + cpe:/a:lyesoft:andexplorer:2.2::~~professional~android~~ + cpe:/a:lyesoft:andexplorer:1.8::~~~android~~ + cpe:/a:lyesoft:andexplorer:2.1::~~professional~android~~ + cpe:/a:lyesoft:andexplorer:1.7::~~~android~~ + cpe:/a:lyesoft:andexplorer:2.0::~~professional~android~~ + cpe:/a:lyesoft:andexplorer:1.6::~~~android~~ + cpe:/a:lyesoft:andexplorer:1.4::~~~android~~ + cpe:/a:lyesoft:andexplorer:1.2::~~~android~~ + cpe:/a:lyesoft:andexplorer:1.3::~~~android~~ + cpe:/a:lyesoft:andexplorer:1.0::~~~android~~ + cpe:/a:lyesoft:andexplorer:1.1::~~~android~~ + cpe:/a:lyesoft:andexplorer:1.4::~~professional~android~~ + + CVE-2014-1974 + 2014-04-19T15:55:07.640-04:00 + 2014-04-24T01:05:34.687-04:00 + + + 6.4 + NETWORK + LOW + NONE + NONE + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-21T15:03:48.263-04:00 + + + + + CONFIRM + https://play.google.com/store/apps/details?id=lysesoft.andexplorerpro + + + CONFIRM + https://play.google.com/store/apps/details?id=lysesoft.andexplorer + + + JVNDB + JVNDB-2014-000037 + + + JVN + JVN#22670349 + + Directory traversal vulnerability in the LYSESOFT AndExplorer application before 20140403 and AndExplorerPro application before 20140405 for Android allows attackers to overwrite or create arbitrary files via unspecified vectors. + + + + + + + + + + cpe:/a:r-company:unzipper:1.0.1::~~~android~~ + cpe:/a:r-company:unzipper:1.0.0::~~~android~~ + + CVE-2014-1975 + 2014-03-18T01:18:18.830-04:00 + 2014-03-18T11:59:37.623-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-18T11:58:53.513-04:00 + + + + + CONFIRM + https://play.google.com/store/apps/details?id=org.rhorita777.unzipper + + + JVNDB + JVNDB-2014-000031 + + + JVN + JVN#38227002 + + + CONFIRM + http://jvn.jp/en/jp/JVN38227002/995495/index.html + + Directory traversal vulnerability in the R-Company Unzipper application 1.0.1 and earlier for Android allows remote attackers to overwrite or create arbitrary files via a crafted filename. + + + + + + + + + + cpe:/a:yumenomachi:demaecan:2.1.0::~~~android~~ + cpe:/a:yumenomachi:demaecan:2.0.0::~~~android~~ + + CVE-2014-1976 + 2014-03-18T01:18:18.907-04:00 + 2014-03-18T12:05:27.273-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-18T12:05:20.710-04:00 + + + + + MISC + https://play.google.com/store/apps/details?id=com.demaecan.androidapp + + + JVNDB + JVNDB-2014-000030 + + + JVN + JVN#16263849 + + The Demaecan application 2.1.0 and earlier for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:nttdocomo:spmode_mail_android:5200 + cpe:/a:nttdocomo:spmode_mail_android:2546 + cpe:/a:nttdocomo:spmode_mail_android:3100 + cpe:/a:nttdocomo:spmode_mail_android:4000 + cpe:/a:nttdocomo:spmode_mail_android:4400 + cpe:/a:nttdocomo:spmode_mail_android:5550 + cpe:/a:nttdocomo:spmode_mail_android:4600 + cpe:/a:nttdocomo:spmode_mail_android:3000 + cpe:/a:nttdocomo:spmode_mail_android:4700 + cpe:/a:nttdocomo:spmode_mail_android:3400 + cpe:/a:nttdocomo:spmode_mail_android:4200 + cpe:/a:nttdocomo:spmode_mail_android:4800 + cpe:/a:nttdocomo:spmode_mail_android:5400 + cpe:/a:nttdocomo:spmode_mail_android:4900 + cpe:/a:nttdocomo:spmode_mail_android:5300 + cpe:/a:nttdocomo:spmode_mail_android:2631 + cpe:/a:nttdocomo:spmode_mail_android:3300 + cpe:/a:nttdocomo:spmode_mail_android:3200 + cpe:/a:nttdocomo:spmode_mail_android:4300 + cpe:/a:nttdocomo:spmode_mail_android:6300::~~~android~~ + cpe:/a:nttdocomo:spmode_mail_android:5000 + cpe:/a:nttdocomo:spmode_mail_android:6700::~~~android~~ + cpe:/a:nttdocomo:spmode_mail_android:5500 + cpe:/a:nttdocomo:spmode_mail_android:5100 + cpe:/a:nttdocomo:spmode_mail_android:4500 + + CVE-2014-1977 + 2014-03-19T10:17:45.070-04:00 + 2014-03-20T12:03:45.070-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-03-20T12:03:14.663-04:00 + + + + + JVNDB + JVNDB-2014-000027 + + + JVN + JVN#81739241 + + The NTT DOCOMO sp mode mail application 6300 and earlier for Android 4.0.x and 6700 and earlier for Android 4.1 through 4.4 uses weak permissions for attachments during processing of incoming e-mail messages, which allows attackers to obtain sensitive information via a crafted application. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:nttdocomo:spmode_mail_android:6130::~~~android~~ + cpe:/a:nttdocomo:spmode_mail_android:6300::~~~android~~ + cpe:/a:nttdocomo:spmode_mail_android:6700::~~~android~~ + cpe:/a:nttdocomo:spmode_mail_android:6100::~~~android~~ + + CVE-2014-1978 + 2014-03-19T10:17:45.103-04:00 + 2014-03-20T12:02:34.990-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-03-20T12:02:34.363-04:00 + + + + + JVNDB + JVNDB-2014-000028 + + + JVN + JVN#05951929 + + The application link interface in the NTT DOCOMO sp mode mail application 6100 through 6300 for Android 4.0.x and 6130 through 6700 for Android 4.1 through 4.4 writes message content to the SD card during e-mail composition, which allows attackers to obtain sensitive information via a crafted application. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:nttdocomo:spmode_mail_android:5900::~~~android~~ + cpe:/a:nttdocomo:spmode_mail_android:6620::~~~android~~ + cpe:/a:nttdocomo:spmode_mail_android:6300::~~~android~~ + cpe:/a:nttdocomo:spmode_mail_android:6000::~~~android~~ + cpe:/a:nttdocomo:spmode_mail_android:6200::~~~android~~ + + CVE-2014-1979 + 2014-03-19T10:17:45.117-04:00 + 2014-03-20T12:36:50.880-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-20T12:36:50.693-04:00 + + + + + JVNDB + JVNDB-2014-000029 + + + JVN + JVN#89260331 + + The NTT DOCOMO sp mode mail application 5900 through 6300 for Android 4.0.x and 6000 through 6620 for Android 4.1 through 4.4 allows remote attackers to execute arbitrary Java methods via Deco-mail emoticon POP data in an e-mail message. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:alliedtelesis:at-rg634a_firmware:3.3%2b + cpe:/h:alliedtelesis:img646bd:- + cpe:/h:alliedtelesis:img616lh:- + cpe:/o:alliedtelesis:img624a_firmware:3.5 + cpe:/h:alliedtelesis:at-rg634a:- + cpe:/o:alliedtelesis:img616lh_firmware:%2b2.4 + cpe:/h:alliedtelesis:img624a:- + cpe:/o:alliedtelesis:img646bd_firmware:3.5 + + CVE-2014-1982 + 2014-03-31T10:58:35.803-04:00 + 2014-03-31T13:57:38.137-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-31T13:57:38.057-04:00 + + + + + + EXPLOIT-DB + 32545 + + + FULLDISC + 20140326 [GTA-2014-01] - Allied Telesis AT-RG634A ADSL Broadband router hidden administrative unauthenticated webshell. + + The administrative interface in Allied Telesis AT-RG634A ADSL Broadband router 3.3+, iMG624A firmware 3.5, iMG616LH firmware 2.4, and iMG646BD firmware 3.5 allows remote attackers to gain privileges and execute arbitrary commands via a direct request to cli.html. + + + + + + + + + + cpe:/a:cybozu:remote_service_manager:2.3.0 + cpe:/a:cybozu:remote_service_manager:3.1.0 + + CVE-2014-1983 + 2014-04-19T15:55:07.670-04:00 + 2014-04-21T15:12:44.837-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-21T15:12:44.790-04:00 + + + + CONFIRM + http://cs.cybozu.co.jp/information/20130317notice01.php + + + JVNDB + JVNDB-2014-000039 + + + JVN + JVN#10319260 + + Unspecified vulnerability in Cybozu Remote Service Manager through 2.3.0 and 3.x before 3.1.1 allows remote attackers to cause a denial of service (CPU consumption) via unknown vectors. + + + + + + + + + + cpe:/a:cybozu:remote_service_manager:2.3.0 + cpe:/a:cybozu:remote_service_manager:3.1.0 + + CVE-2014-1984 + 2014-04-19T15:55:07.687-04:00 + 2014-04-21T15:16:56.590-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-21T15:16:56.527-04:00 + + + + + CONFIRM + http://cs.cybozu.co.jp/information/20130317notice02.php + + + JVNDB + JVNDB-2014-000040 + + + JVN + JVN#00058727 + + Session fixation vulnerability in the management screen in Cybozu Remote Service Manager through 2.3.0 and 3.x before 3.1.1 allows remote attackers to hijack web sessions via unspecified vectors. + + + + + + + + + + + + + + cpe:/a:redmine:redmine:2.4.4 + cpe:/a:redmine:redmine:2.4.3 + cpe:/a:redmine:redmine:2.4.2 + cpe:/a:redmine:redmine:2.4.1 + cpe:/a:redmine:redmine:2.4.0 + cpe:/a:redmine:redmine:2.5.0 + + CVE-2014-1985 + 2014-04-11T10:55:05.663-04:00 + 2014-04-14T09:19:18.173-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-14T09:19:18.017-04:00 + + + + + CONFIRM + http://www.redmine.org/projects/redmine/wiki/Security_Advisories + + + CONFIRM + https://github.com/redmine/redmine/commit/7567c3d8b21fe67e5f04e6839c1fce061600f2f3 + + + CONFIRM + http://www.redmine.org/projects/redmine/wiki/Changelog_2_4 + + + CONFIRM + http://www.redmine.org/projects/redmine/wiki/Changelog + + + SECUNIA + 57524 + + + MLIST + [oss-security] 20140410 Re: CVE request: redmine open redirector + + Open redirect vulnerability in the redirect_back_or_default function in app/controllers/application_controller.rb in Redmine before 2.4.5 and 2.5.x before 2.5.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the back url (back_url parameter). + + + + + + + + + cpe:/a:kokuyo:camiapp:1.21.1::~~~android~~ + + CVE-2014-1986 + 2014-04-15T19:13:15.383-04:00 + 2014-04-19T00:48:09.707-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-16T09:59:05.567-04:00 + + + + + CONFIRM + https://play.google.com/store/apps/details?id=jp.co.kokuyost.CamiApp + + + JVNDB + JVNDB-2014-000036 + + + JVN + JVN#55438786 + + The Content Provider in the KOKUYO CamiApp application 1.21.1 and earlier for Android allows attackers to bypass intended access restrictions and read database information via a crafted application. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cybozu:garoon:2.1.3 + cpe:/a:cybozu:garoon:2.1.2 + cpe:/a:cybozu:garoon:2.1.1 + cpe:/a:cybozu:garoon:2.5.4 + cpe:/a:cybozu:garoon:2.5.2 + cpe:/a:cybozu:garoon:2.5.3 + cpe:/a:cybozu:garoon:2.5.0 + cpe:/a:cybozu:garoon:2.5.1 + cpe:/a:cybozu:garoon:3.0.1 + cpe:/a:cybozu:garoon:3.0.3 + cpe:/a:cybozu:garoon:3.0.2 + cpe:/a:cybozu:garoon:3.7.1 + cpe:/a:cybozu:garoon:3.7.0 + cpe:/a:cybozu:garoon:3.7:sp2 + cpe:/a:cybozu:garoon:3.7:sp1 + cpe:/a:cybozu:garoon:3.1.3 + cpe:/a:cybozu:garoon:2.0.0 + cpe:/a:cybozu:garoon:3.1.0 + cpe:/a:cybozu:garoon:3.1.1 + cpe:/a:cybozu:garoon:3.1.2 + cpe:/a:cybozu:garoon:2.1.0 + cpe:/a:cybozu:garoon:3.7.2 + cpe:/a:cybozu:garoon:3.5.3 + cpe:/a:cybozu:garoon:3.5.0 + cpe:/a:cybozu:garoon:3.5.4 + cpe:/a:cybozu:garoon:3.0.0 + cpe:/a:cybozu:garoon:3.5.2 + cpe:/a:cybozu:garoon:3.5.1 + cpe:/a:cybozu:garoon:3.5.5 + + CVE-2014-1988 + 2014-05-02T06:55:07.430-04:00 + 2014-05-02T11:32:37.667-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-05-02T11:32:37.167-04:00 + + + + CONFIRM + https://support.cybozu.com/ja-jp/article/8105 + + + JVNDB + JVNDB-2014-000042 + + + JVN + JVN#90519014 + + The Phone Messages feature in Cybozu Garoon 2.0.0 through 3.7 SP2 allows remote authenticated users to cause a denial of service (resource consumption) via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cybozu:garoon:3.1.3 + cpe:/a:cybozu:garoon:3.1.0 + cpe:/a:cybozu:garoon:3.1.1 + cpe:/a:cybozu:garoon:3.1.2 + cpe:/a:cybozu:garoon:3.7:sp3 + cpe:/a:cybozu:garoon:3.0.1 + cpe:/a:cybozu:garoon:3.0.3 + cpe:/a:cybozu:garoon:3.7.1 + cpe:/a:cybozu:garoon:3.0.2 + cpe:/a:cybozu:garoon:3.7.0 + cpe:/a:cybozu:garoon:3.7.2 + cpe:/a:cybozu:garoon:3.5.3 + cpe:/a:cybozu:garoon:3.5.4 + cpe:/a:cybozu:garoon:3.5.0 + cpe:/a:cybozu:garoon:3.7:sp2 + cpe:/a:cybozu:garoon:3.0.0 + cpe:/a:cybozu:garoon:3.7:sp1 + cpe:/a:cybozu:garoon:3.5.2 + cpe:/a:cybozu:garoon:3.5.5 + cpe:/a:cybozu:garoon:3.5.1 + + CVE-2014-1989 + 2014-05-02T06:55:07.787-04:00 + 2014-05-02T11:35:28.657-04:00 + + + 6.0 + NETWORK + MEDIUM + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-05-02T11:35:28.530-04:00 + + + + + CONFIRM + https://support.cybozu.com/ja/article/5264 + + + JVNDB + JVNDB-2014-000043 + + + JVN + JVN#31230946 + + Cybozu Garoon 3.0 through 3.7 SP3 allows remote authenticated users to bypass intended access restrictions and delete schedule information via unspecified API calls. + + + + + + + + + + + + cpe:/h:toshibatec:e-studio-233:- + cpe:/h:toshibatec:e-studio-232:- + cpe:/h:toshibatec:e-studio-283:- + cpe:/h:toshibatec:e-studio-282:- + + CVE-2014-1990 + 2014-04-19T15:55:07.717-04:00 + 2014-04-21T15:23:39.973-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-21T15:23:39.910-04:00 + + + + + CONFIRM + http://www.toshibatec.co.jp/page.jsp?id=4224 + + + JVNDB + JVNDB-2014-000038 + + + JVN + JVN#13313061 + + Cross-site request forgery (CSRF) vulnerability in TopAccess (aka the web-based management utility) on TOSHIBA TEC e-Studio 232, 233, 282, and 283 devices allows remote attackers to hijack the authentication of administrators for requests that change passwords. + + + + + + + + + + + + cpe:/a:artifex:mupdf:1.3 + cpe:/a:artifex:mupdf:1.2 + cpe:/a:artifex:mupdf:1.1 + cpe:/a:artifex:mupdf:1.0 + + CVE-2014-2013 + 2014-03-03T11:55:04.350-05:00 + 2014-03-07T15:33:39.493-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-04T13:35:17.420-05:00 + + + + + MISC + http://www.hdwsec.fr/blog/mupdf.html + + + MLIST + [oss-security] 20140218 Re: CVE request: MuPDF Stack-based Buffer Overflow in xps_parse_color() + + + FULLDISC + 20140120 0day - MuPDF Stack-based Buffer Overflow in xps_parse_color() + + + SUSE + openSUSE-SU-2014:0309 + + + CONFIRM + http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=60dabde18d7fe12b19da8b509bdfee9cc886aafc + + + CONFIRM + http://bugs.ghostscript.com/show_bug.cgi?id=694957 + + Stack-based buffer overflow in the xps_parse_color function in xps/xps-common.c in MuPDF 1.3 and earlier allows remote attackers to execute arbitrary code via a large number of entries in the ContextColor value of the Fill attribute in a Path element. + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:gilles_lamiral:imapsync:1.567 + cpe:/a:gilles_lamiral:imapsync:1.558 + cpe:/a:gilles_lamiral:imapsync:1.53 + cpe:/a:gilles_lamiral:imapsync:1.569 + cpe:/a:gilles_lamiral:imapsync:1.547 + cpe:/a:gilles_lamiral:imapsync:1.504 + cpe:/a:gilles_lamiral:imapsync:1.542 + cpe:/a:gilles_lamiral:imapsync:1.525 + cpe:/a:gilles_lamiral:imapsync:1.518 + cpe:/a:gilles_lamiral:imapsync:1.500 + cpe:/a:gilles_lamiral:imapsync:1.554 + cpe:/a:gilles_lamiral:imapsync:1.564 + cpe:/a:gilles_lamiral:imapsync:1.516 + cpe:/a:gilles_lamiral:imapsync:1.508 + cpe:/a:gilles_lamiral:imapsync:1.580 + + CVE-2014-2014 + 2014-04-18T18:14:35.980-04:00 + 2014-04-21T12:19:29.213-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-21T12:19:23.870-04:00 + + + + + MLIST + [oss-security] 20140218 Re: CVE request: "imapsync ignores the --tls switch and sends my authentication plaintext." + + + FEDORA + FEDORA-2014-2505 + + + CONFIRM + https://github.com/imapsync/imapsync/issues/15 + + + CONFIRM + https://bugs.mageia.org/show_bug.cgi?id=12770 + + + MANDRIVA + MDVSA-2014:060 + + + MLIST + [imapsync_list] 20140122 Re: [imapsync] Upon certificate issues STARTTLS is ignored and the password sent in plaintext (#15) + + + MLIST + [imapsync_list] 20140120 Re: [imapsync] STARTTLS support (#15) + + + MLIST + [oss-security] 20140217 CVE request: "imapsync ignores the --tls switch and sends my authentication plaintext." + + imapsync before 1.584, when running with the --tls option, attempts a cleartext login when a certificate verification failure occurs, which allows remote attackers to obtain credentials by sniffing the network. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oxid-esales:eshop:4.7.0:-:professional + cpe:/a:oxid-esales:eshop:4.6.1::professional + cpe:/a:oxid-esales:eshop:4.6.0::professional + cpe:/a:oxid-esales:eshop:4.6.4::community + cpe:/a:oxid-esales:eshop:4.6.5::community + cpe:/a:oxid-esales:eshop:4.6.6::community + cpe:/a:oxid-esales:eshop:4.6.7::community + cpe:/a:oxid-esales:eshop:4.7.10::professional + cpe:/a:oxid-esales:eshop:4.6.2::community + cpe:/a:oxid-esales:eshop:4.6.3::community + cpe:/a:oxid-esales:eshop:5.0.6::enterprise + cpe:/a:oxid-esales:eshop:5.0.5::enterprise + cpe:/a:oxid-esales:eshop:5.0.4::enterprise + cpe:/a:oxid-esales:eshop:5.0.3::enterprise + cpe:/a:oxid-esales:eshop:5.0.2::enterprise + cpe:/a:oxid-esales:eshop:5.0.1::enterprise + cpe:/a:oxid-esales:eshop:5.0.0::enterprise + cpe:/a:oxid-esales:eshop:4.7.0:-:community + cpe:/a:oxid-esales:eshop:4.6.2::enterprise + cpe:/a:oxid-esales:eshop:4.6.3::enterprise + cpe:/a:oxid-esales:eshop:5.0.9::enterprise + cpe:/a:oxid-esales:eshop:5.1.0::enterprise + cpe:/a:oxid-esales:eshop:5.1.1::enterprise + cpe:/a:oxid-esales:eshop:5.1.2::enterprise + cpe:/a:oxid-esales:eshop:5.1.3::enterprise + cpe:/a:oxid-esales:eshop:4.7.1:-:professional + cpe:/a:oxid-esales:eshop:4.8.3::community + cpe:/a:oxid-esales:eshop:4.8.2::community + cpe:/a:oxid-esales:eshop:4.7.5:-:professional + cpe:/a:oxid-esales:eshop:4.7.4:-:professional + cpe:/a:oxid-esales:eshop:4.7.3:-:professional + cpe:/a:oxid-esales:eshop:4.8.1::community + cpe:/a:oxid-esales:eshop:4.7.2:-:professional + cpe:/a:oxid-esales:eshop:4.8.0::community + cpe:/a:oxid-esales:eshop:4.6.4::professional + cpe:/a:oxid-esales:eshop:4.7.8::community + cpe:/a:oxid-esales:eshop:4.7.8:-:professional + cpe:/a:oxid-esales:eshop:4.6.5::professional + cpe:/a:oxid-esales:eshop:4.7.7:-:professional + cpe:/a:oxid-esales:eshop:4.6.2::professional + cpe:/a:oxid-esales:eshop:4.7.6:-:professional + cpe:/a:oxid-esales:eshop:4.6.3::professional + cpe:/a:oxid-esales:eshop:4.6.7::professional + cpe:/a:oxid-esales:eshop:4.7.8:-:community + cpe:/a:oxid-esales:eshop:4.6.6::professional + cpe:/a:oxid-esales:eshop:4.6.0::community + cpe:/a:oxid-esales:eshop:4.7.9::professional + cpe:/a:oxid-esales:eshop:4.6.8::professional + cpe:/a:oxid-esales:eshop:4.6.1::community + cpe:/a:oxid-esales:eshop:4.7.9::community + cpe:/a:oxid-esales:eshop:4.6.0::enterprise + cpe:/a:oxid-esales:eshop:4.6.1::enterprise + cpe:/a:oxid-esales:eshop:5.0.10::enterprise + cpe:/a:oxid-esales:eshop:4.7.1:-:community + cpe:/a:oxid-esales:eshop:4.6.8::enterprise + cpe:/a:oxid-esales:eshop:4.7.3:-:community + cpe:/a:oxid-esales:eshop:4.7.10::community + cpe:/a:oxid-esales:eshop:4.7.2:-:community + cpe:/a:oxid-esales:eshop:4.8.0::professional + cpe:/a:oxid-esales:eshop:4.7.5:-:community + cpe:/a:oxid-esales:eshop:4.6.5::enterprise + cpe:/a:oxid-esales:eshop:4.8.1::professional + cpe:/a:oxid-esales:eshop:4.7.4:-:community + cpe:/a:oxid-esales:eshop:4.6.4::enterprise + cpe:/a:oxid-esales:eshop:4.8.2::professional + cpe:/a:oxid-esales:eshop:4.7.7:-:community + cpe:/a:oxid-esales:eshop:5.0.8::enterprise + cpe:/a:oxid-esales:eshop:4.6.7::enterprise + cpe:/a:oxid-esales:eshop:4.8.3::professional + cpe:/a:oxid-esales:eshop:4.7.6:-:community + cpe:/a:oxid-esales:eshop:5.0.7::enterprise + cpe:/a:oxid-esales:eshop:4.6.6::enterprise + + CVE-2014-2016 + 2014-03-25T14:21:48.233-04:00 + 2014-03-26T10:36:14.110-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-26T10:36:13.547-04:00 + + + + + CONFIRM + http://wiki.oxidforge.org/Security_bulletins/2014-001 + + + SECUNIA + 57438 + + Multiple cross-site scripting (XSS) vulnerabilities in OXID eShop Professional and Community Edition 4.6.8 and earlier, 4.7.x before 4.7.11, and 4.8.x before 4.8.4, and Enterprise Edition 4.6.8 and earlier, 5.0.x before 5.0.11 and 5.1.x before 5.1.4 allow remote attackers to inject arbitrary web script or HTML via the searchtag parameter to the getTag function in (1) application/controllers/details.php or (2) application/controllers/tag.php. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:1.1.1 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:1.1.5 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:1.1.6 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:1.1.3 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:1.1.4 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:1.1.9 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:1.1.7 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:1.1.8 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:seamonkey:1.1.2 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:seamonkey:1.5.0.10 + cpe:/a:mozilla:seamonkey:1.0 + cpe:/a:mozilla:seamonkey:1.1 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:seamonkey:1.1:alpha + cpe:/a:mozilla:seamonkey:1.0:alpha + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:seamonkey:1.0.3 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:1.1:beta + cpe:/a:mozilla:seamonkey:1.1.11 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:seamonkey:1.1.10 + cpe:/a:mozilla:thunderbird_esr:17.0.2 + cpe:/a:mozilla:seamonkey:1.1.13 + cpe:/a:mozilla:thunderbird_esr:17.0.1 + cpe:/a:mozilla:seamonkey:1.1.12 + cpe:/a:mozilla:thunderbird_esr:17.0.4 + cpe:/a:mozilla:seamonkey:1.1.15 + cpe:/a:mozilla:thunderbird_esr:17.0.3 + cpe:/a:mozilla:thunderbird_esr:17.0 + cpe:/a:mozilla:seamonkey:1.1.14 + cpe:/a:mozilla:thunderbird_esr:17.0.5 + cpe:/a:mozilla:seamonkey:1.0:beta + cpe:/a:mozilla:seamonkey:1.1.16 + cpe:/a:mozilla:thunderbird_esr:17.0.7 + cpe:/a:mozilla:seamonkey:1.0.1 + cpe:/a:mozilla:thunderbird_esr:17.0.8 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:seamonkey:1.0.2 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:seamonkey:1.0.9 + cpe:/a:mozilla:seamonkey:1.0.8 + cpe:/a:mozilla:seamonkey:1.0.5 + cpe:/a:mozilla:seamonkey:1.0.4 + cpe:/a:mozilla:seamonkey:1.0.7 + cpe:/a:mozilla:thunderbird_esr:17.0.6 + cpe:/a:mozilla:seamonkey:1.0.6 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:seamonkey + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:seamonkey:1.1.18 + cpe:/a:mozilla:seamonkey:1.1.19 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:seamonkey:1.1.17 + cpe:/a:mozilla:seamonkey:1.5.0.9 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:seamonkey:1.5.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:thunderbird_esr:17.0.10 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:thunderbird:17.0.4 + + CVE-2014-2018 + 2014-02-17T17:55:05.273-05:00 + 2014-02-18T14:44:52.987-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-18T14:44:49.000-05:00 + + + + + CERT-VN + VU#863369 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=875818 + + + MISC + http://www.vulnerability-lab.com/get_content.php?id=953 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-14.html + + Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8, Thunderbird ESR 17.x through 17.0.10, and SeaMonkey before 2.20 allows user-assisted remote attackers to inject arbitrary web script or HTML via an e-mail message containing a data: URL in a (1) OBJECT or (2) EMBED element, a related issue to CVE-2013-6674. + + + + + + + + + + + + + cpe:/o:apple:iphone_os:7.0.1 + cpe:/o:apple:iphone_os:7.0.4 + cpe:/o:apple:iphone_os:7.0.3 + cpe:/o:apple:iphone_os:7.0.2 + cpe:/o:apple:iphone_os:7.0 + + CVE-2014-2019 + 2014-02-18T06:55:17.027-05:00 + 2014-03-16T00:45:41.410-04:00 + + + 4.9 + LOCAL + LOW + NONE + NONE + COMPLETE + NONE + http://nvd.nist.gov + 2014-02-18T19:53:18.393-05:00 + + + + + MISC + http://www.youtube.com/watch?v=QnPk4RRWjic + + + CONFIRM + http://support.apple.com/kb/HT6162 + + + MISC + http://news.softpedia.com/news/Major-iOS-7-Security-Flaw-Discovered-Video-425011.shtml + + The iCloud subsystem in Apple iOS before 7.1 allows physically proximate attackers to bypass an intended password requirement, and turn off the Find My iPhone service or complete a Delete Account action and then associate this service with a different Apple ID account, by entering an arbitrary iCloud Account Password value and a blank iCloud Account Description value. + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:php:php:5.5.1 + cpe:/a:php:php:5.5.0:rc1 + cpe:/a:php:php:5.5.0:alpha1 + cpe:/a:php:php:5.5.3 + cpe:/a:php:php:5.5.0:alpha3 + cpe:/a:php:php:5.5.4 + cpe:/a:php:php:5.5.0:alpha6 + cpe:/a:php:php:5.5.2 + cpe:/a:php:php:5.5.0:alpha4 + cpe:/a:php:php:5.5.7 + cpe:/a:php:php:5.5.8 + cpe:/a:php:php:5.5.0:rc2 + cpe:/a:php:php:5.5.0:alpha2 + cpe:/a:php:php:5.5.5 + cpe:/a:php:php:5.5.0:alpha5 + cpe:/a:php:php:5.5.6 + cpe:/a:php:php:5.5.0:beta1 + cpe:/a:php:php:5.5.0:beta4 + cpe:/a:php:php:5.5.0:beta2 + cpe:/a:php:php:5.5.0:beta3 + + CVE-2014-2020 + 2014-02-18T06:55:17.057-05:00 + 2014-03-08T00:13:16.573-05:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-02-18T14:51:45.293-05:00 + + + + + CONFIRM + https://github.com/php/php-src/commit/2938329ce19cb8c4197dec146c3ec887c6f61d01 + + + CONFIRM + https://bugs.php.net/bug.php?id=66356 + + + UBUNTU + USN-2126-1 + + ext/gd/gd.c in PHP 5.5.x before 5.5.9 does not check data types, which might allow remote attackers to obtain sensitive information by using a (1) string or (2) array data type in place of a numeric data type, as demonstrated by an imagecrop function call with a string for the x dimension value, a different vulnerability than CVE-2013-7226. + + + + + + + + + + + + + + + + + + + + cpe:/a:openclassifieds:open_classifieds_2:2.1.1 + cpe:/a:openclassifieds:open_classifieds_2:2.0.5 + cpe:/a:openclassifieds:open_classifieds_2:2.0.6 + cpe:/a:openclassifieds:open_classifieds_2:2.0.7 + cpe:/a:openclassifieds:open_classifieds_2:2.0.1 + cpe:/a:openclassifieds:open_classifieds_2:2.1.2 + cpe:/a:openclassifieds:open_classifieds_2:2.0.8 + cpe:/a:openclassifieds:open_classifieds_2:2.0.2 + cpe:/a:openclassifieds:open_classifieds_2:2.0.3 + cpe:/a:openclassifieds:open_classifieds_2:2.0.4 + cpe:/a:openclassifieds:open_classifieds_2:2.1 + cpe:/a:openclassifieds:open_classifieds_2:2.0 + + CVE-2014-2024 + 2014-03-14T10:55:04.377-04:00 + 2014-03-25T20:43:57.100-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-17T04:19:34.000-04:00 + + + + + CONFIRM + https://github.com/open-classifieds/openclassifieds2/commit/45ee8fb601a91b8a4238229580a32a4fd8d96ef9 + + + MISC + https://www.htbridge.com/advisory/HTB23204 + + + CONFIRM + https://github.com/open-classifieds/openclassifieds2/issues/556 + + + BUGTRAQ + 20140312 Cross-Site Scripting (XSS) in Open Classifieds + + Cross-site scripting (XSS) vulnerability in classes/controller/error.php in Open Classifieds 2 before 2.1.3 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to shared-apartments-rooms/. + + + + + + + + + + + + + + + + + + cpe:/o:bluecoat:proxysgos:5.5.11 + cpe:/o:bluecoat:proxysgos:5.5 + cpe:/o:bluecoat:proxysgos:6.1 + cpe:/o:bluecoat:proxysgos:6.1.6.3 + cpe:/o:bluecoat:proxysgos:6.3 + cpe:/o:bluecoat:proxysgos:6.2.15.3 + cpe:/o:bluecoat:proxysgos:6.2 + cpe:/o:bluecoat:proxysgos:6.5 + cpe:/o:bluecoat:proxysgos:6.4.6.1 + cpe:/o:bluecoat:proxysgos:6.4 + + CVE-2014-2033 + 2014-03-02T12:55:02.893-05:00 + 2014-03-03T13:10:15.227-05:00 + + + 7.9 + ADJACENT_NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-03T13:10:15.167-05:00 + + + + + CERT-VN + VU#221620 + + + CONFIRM + https://kb.bluecoat.com/index?page=content&id=SA77 + + The caching feature in SGOS in Blue Coat ProxySG 5.5 through 5.5.11.3, 6.1 through 6.1.6.3, 6.2 through 6.2.15.3, 6.4 through 6.4.6.1, and 6.3 and 6.5 before 6.5.4 allows remote authenticated users to bypass intended access restrictions during a time window after account deletion or modification by leveraging knowledge of previously valid credentials. + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:sonatype:nexus:2.7.0::~~professional~~~ + cpe:/a:sonatype:nexus:2.7.1::~~professional~~~ + cpe:/a:sonatype:nexus:2.6.2::~~open_source~~~ + cpe:/a:sonatype:nexus:2.6.3::~~open_source~~~ + cpe:/a:sonatype:nexus:2.5.0::~~professional~~~ + cpe:/a:sonatype:nexus:2.4.0::~~open_source~~~ + cpe:/a:sonatype:nexus:2.6.3::~~professional~~~ + cpe:/a:sonatype:nexus:2.6.1::~~professional~~~ + cpe:/a:sonatype:nexus:2.6.0::~~open_source~~~ + cpe:/a:sonatype:nexus:2.6.2::~~professional~~~ + cpe:/a:sonatype:nexus:2.6.1::~~open_source~~~ + cpe:/a:sonatype:nexus:2.6.4::~~open_source~~~ + cpe:/a:sonatype:nexus:2.6.0::~~professional~~~ + cpe:/a:sonatype:nexus:2.6.4::~~professional~~~ + cpe:/a:sonatype:nexus:2.7.0::~~open_source~~~ + cpe:/a:sonatype:nexus:2.6.5::~~professional~~~ + cpe:/a:sonatype:nexus:2.4.0::~~professional~~~ + cpe:/a:sonatype:nexus:2.5.0::~~open_source~~~ + cpe:/a:sonatype:nexus:2.7.1::~~open_source~~~ + + CVE-2014-2034 + 2014-03-31T23:25:11.347-04:00 + 2014-04-01T08:55:00.310-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-01T08:54:59.777-04:00 + + + + CONFIRM + https://support.sonatype.com/entries/42374566-CVE-2014-2034-Nexus-Security-Advisory-REST-API + + + CONFIRM + http://www.sonatype.org/advisories/archive/2014-03-03-Nexus + + + BID + 65956 + + + OSVDB + 104049 + + + SECUNIA + 57142 + + Unspecified vulnerability in Sonatype Nexus OSS and Pro 2.4.0 through 2.7.1 allows attackers to create arbitrary user accounts via unknown vectors related to "an unauthenticated execution path." + + + + + + + + + + + + + cpe:/a:interworx:web_control_panel:5.0.11 + cpe:/a:interworx:web_control_panel:5.0.10 + cpe:/a:interworx:web_control_panel:5.0 + cpe:/a:interworx:web_control_panel:5.0.13 + cpe:/a:interworx:web_control_panel:5.0.12 + + CVE-2014-2035 + 2014-02-27T10:55:15.670-05:00 + 2014-02-28T10:32:57.063-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-28T10:32:57.000-05:00 + + + + + BUGTRAQ + 20140220 [CVE-2014-2035] XSS in InterWorx Web Control Panel <= 5.0.12 + + + CONFIRM + http://www.interworx.com/developers/changelog/version-5-0-13-build-574-2014-02-19 + + Cross-site scripting (XSS) vulnerability in xhr.php in InterWorx Web Control Panel (aka InterWorx Hosting Control Panel and InterWorx-CP) before 5.0.13 build 574 allows remote attackers to inject arbitrary web script or HTML via the i parameter. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:linux:linux_kernel:3.0.48 + cpe:/o:linux:linux_kernel:3.0.49 + cpe:/o:linux:linux_kernel:3.0.46 + cpe:/o:linux:linux_kernel:3.0.47 + cpe:/o:linux:linux_kernel:3.0.44 + cpe:/o:linux:linux_kernel:3.0.45 + cpe:/o:linux:linux_kernel:3.0.42 + cpe:/o:linux:linux_kernel:3.4.70 + cpe:/o:linux:linux_kernel:3.4.71 + cpe:/o:linux:linux_kernel:3.0.40 + cpe:/o:linux:linux_kernel:3.0.41 + cpe:/o:linux:linux_kernel:3.4.45 + cpe:/o:linux:linux_kernel:3.4.44 + cpe:/o:linux:linux_kernel:3.4.46 + cpe:/o:linux:linux_kernel:3.4.41 + cpe:/o:linux:linux_kernel:3.4.40 + cpe:/o:linux:linux_kernel:3.4.43 + cpe:/o:linux:linux_kernel:3.4.42 + cpe:/o:linux:linux_kernel:3.4.49 + cpe:/o:linux:linux_kernel:3.4.48 + cpe:/o:linux:linux_kernel:3.0.59 + cpe:/o:linux:linux_kernel:3.4.47 + cpe:/o:linux:linux_kernel:3.0.55 + cpe:/o:linux:linux_kernel:3.0.56 + cpe:/o:linux:linux_kernel:3.0.57 + cpe:/o:linux:linux_kernel:3.0.58 + cpe:/o:linux:linux_kernel:3.0.51 + cpe:/o:linux:linux_kernel:3.0.52 + cpe:/o:linux:linux_kernel:3.0.53 + cpe:/o:linux:linux_kernel:3.11.10 + cpe:/o:linux:linux_kernel:3.0.50 + cpe:/o:linux:linux_kernel:3.4.57 + cpe:/o:linux:linux_kernel:3.4.56 + cpe:/o:linux:linux_kernel:3.4.55 + cpe:/o:linux:linux_kernel:3.4.54 + cpe:/o:linux:linux_kernel:3.4.53 + cpe:/o:linux:linux_kernel:3.4.52 + cpe:/o:linux:linux_kernel:3.4.51 + cpe:/o:linux:linux_kernel:3.4.50 + cpe:/o:linux:linux_kernel:3.0.43 + cpe:/o:linux:linux_kernel:3.10.26 + cpe:/o:linux:linux_kernel:3.4.59 + cpe:/o:linux:linux_kernel:3.0.24 + cpe:/o:linux:linux_kernel:3.0.25 + cpe:/o:linux:linux_kernel:3.0.22 + cpe:/o:linux:linux_kernel:3.1.9 + cpe:/o:linux:linux_kernel:3.0.23 + cpe:/o:linux:linux_kernel:3.10.28 + cpe:/o:linux:linux_kernel:3.0.28 + cpe:/o:linux:linux_kernel:3.10.27 + cpe:/o:linux:linux_kernel:3.0.26 + cpe:/o:linux:linux_kernel:3.10.29 + cpe:/o:linux:linux_kernel:3.4.58 + cpe:/o:linux:linux_kernel:3.0.27 + cpe:/o:linux:linux_kernel:3.10.24 + cpe:/o:linux:linux_kernel:3.10.23 + cpe:/o:linux:linux_kernel:3.10.25 + cpe:/o:linux:linux_kernel:3.10.20 + cpe:/o:linux:linux_kernel:3.1.8 + cpe:/o:linux:linux_kernel:3.0.20 + cpe:/o:linux:linux_kernel:3.10.22 + cpe:/o:linux:linux_kernel:3.10.21 + cpe:/o:linux:linux_kernel:3.4.21 + cpe:/o:linux:linux_kernel:3.4.20 + cpe:/o:linux:linux_kernel:3.4.23 + cpe:/o:linux:linux_kernel:3.4.22 + cpe:/o:linux:linux_kernel:3.4.24 + cpe:/o:linux:linux_kernel:3.4.27 + cpe:/o:linux:linux_kernel:3.4.26 + cpe:/o:linux:linux_kernel:3.4.29 + cpe:/o:linux:linux_kernel:3.10.15 + cpe:/o:linux:linux_kernel:3.4.28 + cpe:/o:linux:linux_kernel:3.0.54 + cpe:/o:linux:linux_kernel:3.0.33 + cpe:/o:linux:linux_kernel:3.0.34 + cpe:/o:linux:linux_kernel:3.0.35 + cpe:/o:linux:linux_kernel:3.0.36 + cpe:/o:linux:linux_kernel:3.10.19 + cpe:/o:linux:linux_kernel:3.0.37 + cpe:/o:linux:linux_kernel:3.10.18 + cpe:/o:linux:linux_kernel:3.0.38 + cpe:/o:linux:linux_kernel:3.4.25 + cpe:/o:linux:linux_kernel:3.10.17 + cpe:/o:linux:linux_kernel:3.0.39 + cpe:/o:linux:linux_kernel:3.10.16 + cpe:/o:linux:linux_kernel:3.10.14 + cpe:/o:linux:linux_kernel:3.10.13 + cpe:/o:linux:linux_kernel:3.10.12 + cpe:/o:linux:linux_kernel:3.10.11 + cpe:/o:linux:linux_kernel:3.10.10 + cpe:/o:linux:linux_kernel:3.0.30 + cpe:/o:linux:linux_kernel:3.0.31 + cpe:/o:linux:linux_kernel:3.9.8 + cpe:/o:linux:linux_kernel:3.5.5 + cpe:/o:linux:linux_kernel:3.4.32 + cpe:/o:linux:linux_kernel:3.9.9 + cpe:/o:linux:linux_kernel:3.5.6 + cpe:/o:linux:linux_kernel:3.4.31 + cpe:/o:linux:linux_kernel:3.5.7 + cpe:/o:linux:linux_kernel:3.4.30 + cpe:/o:linux:linux_kernel:3.7.1 + cpe:/o:linux:linux_kernel:3.4.35 + cpe:/o:linux:linux_kernel:3.9.0 + cpe:/o:linux:linux_kernel:3.0.18 + cpe:/o:linux:linux_kernel:3.4.34 + cpe:/o:linux:linux_kernel:3.4.33 + cpe:/o:linux:linux_kernel:3.9.2 + cpe:/o:linux:linux_kernel:3.9.1 + cpe:/o:linux:linux_kernel:3.0.19 + cpe:/o:linux:linux_kernel:3.4.39 + cpe:/o:linux:linux_kernel:3.9.4 + cpe:/o:linux:linux_kernel:3.4.38 + cpe:/o:linux:linux_kernel:3.9.3 + cpe:/o:linux:linux_kernel:3.4.37 + cpe:/o:linux:linux_kernel:3.9.6 + cpe:/o:linux:linux_kernel:3.9.5 + cpe:/o:linux:linux_kernel:3.0.21 + cpe:/o:linux:linux_kernel:3.9.7 + cpe:/o:linux:linux_kernel:3.5.4 + cpe:/o:linux:linux_kernel:3.0.4 + cpe:/o:linux:linux_kernel:3.0.5 + cpe:/o:linux:linux_kernel:3.0.2 + cpe:/o:linux:linux_kernel:3.0.3 + cpe:/o:linux:linux_kernel:3.0.8 + cpe:/o:linux:linux_kernel:3.0.6 + cpe:/o:linux:linux_kernel:3.0.7 + cpe:/o:linux:linux_kernel:3.4.36 + cpe:/o:linux:linux_kernel:3.13.1 + cpe:/o:linux:linux_kernel:3.6.10 + cpe:/o:linux:linux_kernel:3.6.11 + cpe:/o:linux:linux_kernel:3.13.2 + cpe:/o:linux:linux_kernel:3.4.1 + cpe:/o:linux:linux_kernel:3.4.19 + cpe:/o:linux:linux_kernel:3.4.17 + cpe:/o:linux:linux_kernel:3.4.3 + cpe:/o:linux:linux_kernel:3.4.18 + cpe:/o:linux:linux_kernel:3.4.2 + cpe:/o:linux:linux_kernel:3.2.9 + cpe:/o:linux:linux_kernel:3.4.15 + cpe:/o:linux:linux_kernel:3.2.8 + cpe:/o:linux:linux_kernel:3.4.16 + cpe:/o:linux:linux_kernel:3.4.4 + cpe:/o:linux:linux_kernel:3.12.12 + cpe:/o:linux:linux_kernel:3.2.7 + cpe:/o:linux:linux_kernel:3.4.13 + cpe:/o:linux:linux_kernel:3.12.13 + cpe:/o:linux:linux_kernel:3.12.10 + cpe:/o:linux:linux_kernel:3.4.11 + cpe:/o:linux:linux_kernel:3.12.11 + cpe:/o:linux:linux_kernel:3.4.12 + cpe:/o:linux:linux_kernel:3.4.10 + cpe:/o:linux:linux_kernel:3.0.61 + cpe:/o:linux:linux_kernel:3.3:rc2 + cpe:/o:linux:linux_kernel:3.4:rc7 + cpe:/o:linux:linux_kernel:3.0.60 + cpe:/o:linux:linux_kernel:3.3:rc7 + cpe:/o:linux:linux_kernel:3.4:rc5 + cpe:/o:linux:linux_kernel:3.3:rc5 + cpe:/o:linux:linux_kernel:3.4:rc6 + cpe:/o:linux:linux_kernel:3.3:rc6 + cpe:/o:linux:linux_kernel:3.0.64 + cpe:/o:linux:linux_kernel:3.0.63 + cpe:/o:linux:linux_kernel:3.0.62 + cpe:/o:linux:linux_kernel:3.12.1 + cpe:/o:linux:linux_kernel:3.0.68 + cpe:/o:linux:linux_kernel:3.0.67 + cpe:/o:linux:linux_kernel:3.0.66 + cpe:/o:linux:linux_kernel:3.4.14 + cpe:/o:linux:linux_kernel:3.12.7 + cpe:/o:linux:linux_kernel:3.2:rc2 + cpe:/o:linux:linux_kernel:3.1:rc1 + cpe:/o:linux:linux_kernel:3.0.9 + cpe:/o:linux:linux_kernel:3.0:rc4 + cpe:/o:linux:linux_kernel:3.12.8 + cpe:/o:linux:linux_kernel:3.1:rc4 + cpe:/o:linux:linux_kernel:3.0:rc3 + cpe:/o:linux:linux_kernel:3.12.9 + cpe:/o:linux:linux_kernel:3.0:rc2 + cpe:/o:linux:linux_kernel:3.1:rc2 + cpe:/o:linux:linux_kernel:3.0:rc1 + cpe:/o:linux:linux_kernel:3.2:rc7 + cpe:/o:linux:linux_kernel:3.12.3 + cpe:/o:linux:linux_kernel:3.2:rc6 + cpe:/o:linux:linux_kernel:3.1.10 + cpe:/o:linux:linux_kernel:3.12.4 + cpe:/o:linux:linux_kernel:3.2:rc5 + cpe:/o:linux:linux_kernel:3.0:rc7 + cpe:/o:linux:linux_kernel:3.12.5 + cpe:/o:linux:linux_kernel:3.9:rc3 + cpe:/o:linux:linux_kernel:3.0:rc6 + cpe:/o:linux:linux_kernel:3.12.6 + cpe:/o:linux:linux_kernel:3.0:rc5 + cpe:/o:linux:linux_kernel:3.9:rc1 + cpe:/o:linux:linux_kernel:3.9:rc4 + cpe:/o:linux:linux_kernel:3.9:rc7 + cpe:/o:linux:linux_kernel:3.12.2 + cpe:/o:linux:linux_kernel:3.9:rc2 + cpe:/o:linux:linux_kernel:3.9:rc5 + cpe:/o:linux:linux_kernel:3.3:rc3 + cpe:/o:linux:linux_kernel:3.4:rc4 + cpe:/o:linux:linux_kernel:3.4:rc3 + cpe:/o:linux:linux_kernel:3.3:rc1 + cpe:/o:linux:linux_kernel:3.4:rc2 + cpe:/o:linux:linux_kernel:3.9:rc6 + cpe:/o:linux:linux_kernel:3.3:rc4 + cpe:/o:linux:linux_kernel:3.4:rc1 + cpe:/o:linux:linux_kernel:3.4.5 + cpe:/o:linux:linux_kernel:3.2.2 + cpe:/o:linux:linux_kernel:3.2.3 + cpe:/o:linux:linux_kernel:3.2.1 + cpe:/o:linux:linux_kernel:3.4.6 + cpe:/o:linux:linux_kernel:3.2:rc3 + cpe:/o:linux:linux_kernel:3.2.6 + cpe:/o:linux:linux_kernel:3.4.7 + cpe:/o:linux:linux_kernel:3.2:rc4 + cpe:/o:linux:linux_kernel:3.1:rc3 + cpe:/o:linux:linux_kernel:3.4.8 + cpe:/o:linux:linux_kernel:3.2.4 + cpe:/o:linux:linux_kernel:3.4.9 + cpe:/o:linux:linux_kernel:3.2.5 + cpe:/o:linux:linux_kernel:3.0.65 + cpe:/o:linux:linux_kernel:3.2.12 + cpe:/o:linux:linux_kernel:3.8.10 + cpe:/o:linux:linux_kernel:3.8.12 + cpe:/o:linux:linux_kernel:3.8.11 + cpe:/o:linux:linux_kernel:3.8.13 + cpe:/o:linux:linux_kernel:3.7.9 + cpe:/o:linux:linux_kernel:3.7.8 + cpe:/o:linux:linux_kernel:3.7.7 + cpe:/o:linux:linux_kernel:3.7.6 + cpe:/o:linux:linux_kernel:3.6.3 + cpe:/o:linux:linux_kernel:3.7.5 + cpe:/o:linux:linux_kernel:3.7.4 + cpe:/o:linux:linux_kernel:3.7.3 + cpe:/o:linux:linux_kernel:3.7.2 + cpe:/o:linux:linux_kernel:3.6.7 + cpe:/o:linux:linux_kernel:3.6.6 + cpe:/o:linux:linux_kernel:3.6.5 + cpe:/o:linux:linux_kernel:3.6.4 + cpe:/o:linux:linux_kernel:3.6.9 + cpe:/o:linux:linux_kernel:3.6.8 + cpe:/o:linux:linux_kernel:3.10 + cpe:/o:linux:linux_kernel:3.11 + cpe:/o:linux:linux_kernel:3.12 + cpe:/o:linux:linux_kernel:3.13 + cpe:/o:linux:linux_kernel:3.10.1 + cpe:/o:linux:linux_kernel:3.10.2 + cpe:/o:linux:linux_kernel:3.10.3 + cpe:/o:linux:linux_kernel:3.6.2 + cpe:/o:linux:linux_kernel:3.6.1 + cpe:/o:linux:linux_kernel:3.3.6 + cpe:/o:linux:linux_kernel:3.3.7 + cpe:/o:linux:linux_kernel:3.3.8 + cpe:/o:linux:linux_kernel:3.0.1 + cpe:/o:linux:linux_kernel:3.2 + cpe:/o:linux:linux_kernel:3.1 + cpe:/o:linux:linux_kernel:3.7 + cpe:/o:linux:linux_kernel:3.6 + cpe:/o:linux:linux_kernel:3.4 + cpe:/o:linux:linux_kernel:3.1.6 + cpe:/o:linux:linux_kernel:3.1.5 + cpe:/o:linux:linux_kernel:3.1.7 + cpe:/o:linux:linux_kernel:3.0.32 + cpe:/o:linux:linux_kernel:3.8.9 + cpe:/o:linux:linux_kernel:3.1.2 + cpe:/o:linux:linux_kernel:3.1.1 + cpe:/o:linux:linux_kernel:3.1.4 + cpe:/o:linux:linux_kernel:3.1.3 + cpe:/o:linux:linux_kernel:3.9.10 + cpe:/o:linux:linux_kernel:3.0.29 + cpe:/o:linux:linux_kernel:3.3 + cpe:/o:linux:linux_kernel:3.8.4 + cpe:/o:linux:linux_kernel:3.2.26 + cpe:/o:linux:linux_kernel:3.8.5 + cpe:/o:linux:linux_kernel:3.2.27 + cpe:/o:linux:linux_kernel:3.8.2 + cpe:/o:linux:linux_kernel:3.2.24 + cpe:/o:linux:linux_kernel:3.8.3 + cpe:/o:linux:linux_kernel:3.2.25 + cpe:/o:linux:linux_kernel:3.8.8 + cpe:/o:linux:linux_kernel:3.8.6 + cpe:/o:linux:linux_kernel:3.2.28 + cpe:/o:linux:linux_kernel:3.8.7 + cpe:/o:linux:linux_kernel:3.2.29 + cpe:/o:linux:linux_kernel:3.3.3 + cpe:/o:linux:linux_kernel:3.3.4 + cpe:/o:linux:linux_kernel:3.3.5 + cpe:/o:linux:linux_kernel:3.2.22 + cpe:/o:linux:linux_kernel:3.8.1 + cpe:/o:linux:linux_kernel:3.2.20 + cpe:/o:linux:linux_kernel:3.3.1 + cpe:/o:linux:linux_kernel:3.2.21 + cpe:/o:linux:linux_kernel:3.3.2 + cpe:/o:linux:linux_kernel:3.11.1 + cpe:/o:linux:linux_kernel:3.11.2 + cpe:/o:linux:linux_kernel:3.2.23 + cpe:/o:linux:linux_kernel:3.0.17 + cpe:/o:linux:linux_kernel:3.9.11 + cpe:/o:linux:linux_kernel:3.0.16 + cpe:/o:linux:linux_kernel:3.0.15 + cpe:/o:linux:linux_kernel:3.2.30 + cpe:/o:linux:linux_kernel:3.0.14 + cpe:/o:linux:linux_kernel:3.0.13 + cpe:/o:linux:linux_kernel:3.0.12 + cpe:/o:linux:linux_kernel:3.0.11 + cpe:/o:linux:linux_kernel:3.4.61 + cpe:/o:linux:linux_kernel:3.0.10 + cpe:/o:linux:linux_kernel:3.4.64 + cpe:/o:linux:linux_kernel:3.8.0 + cpe:/o:linux:linux_kernel:3.4.65 + cpe:/o:linux:linux_kernel:3.4.62 + cpe:/o:linux:linux_kernel:3.4.63 + cpe:/o:linux:linux_kernel:3.4.68 + cpe:/o:linux:linux_kernel:3.4.66 + cpe:/o:linux:linux_kernel:3.4.67 + cpe:/o:linux:linux_kernel:3.5.3 + cpe:/o:linux:linux_kernel:3.5.1 + cpe:/o:linux:linux_kernel:3.5.2 + cpe:/o:linux:linux_kernel:3.10.4 + cpe:/o:linux:linux_kernel:3.4.72 + cpe:/o:linux:linux_kernel:3.10.9 + cpe:/o:linux:linux_kernel:3.4.73 + cpe:/o:linux:linux_kernel:3.4.74 + cpe:/o:linux:linux_kernel:3.4.75 + cpe:/o:linux:linux_kernel:3.4.76 + cpe:/o:linux:linux_kernel:3.10.5 + cpe:/o:linux:linux_kernel:3.4.77 + cpe:/o:linux:linux_kernel:3.10.6 + cpe:/o:linux:linux_kernel:3.4.78 + cpe:/o:linux:linux_kernel:3.10.7 + cpe:/o:linux:linux_kernel:3.4.79 + cpe:/o:linux:linux_kernel:3.10.8 + cpe:/o:linux:linux_kernel:3.7.10 + cpe:/o:linux:linux_kernel:3.2.17 + cpe:/o:linux:linux_kernel:3.2.18 + cpe:/o:linux:linux_kernel:3.2.19 + cpe:/o:linux:linux_kernel:3.2.13 + cpe:/o:linux:linux_kernel:3.2.14 + cpe:/o:linux:linux_kernel:3.11.3 + cpe:/o:linux:linux_kernel:3.2.15 + cpe:/o:linux:linux_kernel:3.4.60 + cpe:/o:linux:linux_kernel:3.2.16 + cpe:/o:linux:linux_kernel:3.11.5 + cpe:/o:linux:linux_kernel:3.11.4 + cpe:/o:linux:linux_kernel:3.2.10 + cpe:/o:linux:linux_kernel:3.11.7 + cpe:/o:linux:linux_kernel:3.2.11 + cpe:/o:linux:linux_kernel:3.11.6 + cpe:/o:linux:linux_kernel:3.11.9 + cpe:/o:linux:linux_kernel:3.11.8 + cpe:/o:linux:linux_kernel:3.4.69 + + CVE-2014-2038 + 2014-02-28T01:18:54.617-05:00 + 2014-03-16T00:45:41.973-04:00 + + + 3.7 + LOCAL + HIGH + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-28T13:08:48.560-05:00 + + + + + CONFIRM + https://github.com/torvalds/linux/commit/263b4509ec4d47e0da3e753f85a39ea12d1eff24 + + + CONFIRM + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=263b4509ec4d47e0da3e753f85a39ea12d1eff24 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1066939 + + + UBUNTU + USN-2140-1 + + + UBUNTU + USN-2137-1 + + + MLIST + [oss-security] 20140221 Re: Re: CVE request: Linux kernel: nfs: information leakage + + + CONFIRM + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.3 + + The nfs_can_extend_write function in fs/nfs/write.c in the Linux kernel before 3.13.3 relies on a write delegation to extend a write operation without a certain up-to-date verification, which allows local users to obtain sensitive information from kernel memory in opportunistic circumstances by writing to a file in an NFS filesystem and then reading the same file. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:linux:linux_kernel:3.0.48 + cpe:/o:linux:linux_kernel:3.0.49 + cpe:/o:linux:linux_kernel:3.0.46 + cpe:/o:linux:linux_kernel:3.0.47 + cpe:/o:linux:linux_kernel:3.0.44 + cpe:/o:linux:linux_kernel:3.0.45 + cpe:/o:linux:linux_kernel:3.0.42 + cpe:/o:linux:linux_kernel:3.4.70 + cpe:/o:linux:linux_kernel:3.4.71 + cpe:/o:linux:linux_kernel:3.0.40 + cpe:/o:linux:linux_kernel:3.0.41 + cpe:/o:linux:linux_kernel:3.4.45 + cpe:/o:linux:linux_kernel:3.4.44 + cpe:/o:linux:linux_kernel:3.4.46 + cpe:/o:linux:linux_kernel:3.4.41 + cpe:/o:linux:linux_kernel:3.4.40 + cpe:/o:linux:linux_kernel:3.4.43 + cpe:/o:linux:linux_kernel:3.4.42 + cpe:/o:linux:linux_kernel:3.4.49 + cpe:/o:linux:linux_kernel:3.4.48 + cpe:/o:linux:linux_kernel:3.0.59 + cpe:/o:linux:linux_kernel:3.4.47 + cpe:/o:linux:linux_kernel:3.0.55 + cpe:/o:linux:linux_kernel:3.0.56 + cpe:/o:linux:linux_kernel:3.0.57 + cpe:/o:linux:linux_kernel:3.0.58 + cpe:/o:linux:linux_kernel:3.0.51 + cpe:/o:linux:linux_kernel:3.0.52 + cpe:/o:linux:linux_kernel:3.0.53 + cpe:/o:linux:linux_kernel:3.11.10 + cpe:/o:linux:linux_kernel:3.0.50 + cpe:/o:linux:linux_kernel:3.4.57 + cpe:/o:linux:linux_kernel:3.4.56 + cpe:/o:linux:linux_kernel:3.4.55 + cpe:/o:linux:linux_kernel:3.4.54 + cpe:/o:linux:linux_kernel:3.4.53 + cpe:/o:linux:linux_kernel:3.4.52 + cpe:/o:linux:linux_kernel:3.4.51 + cpe:/o:linux:linux_kernel:3.4.50 + cpe:/o:linux:linux_kernel:3.0.43 + cpe:/o:linux:linux_kernel:3.10.26 + cpe:/o:linux:linux_kernel:3.4.59 + cpe:/o:linux:linux_kernel:3.0.24 + cpe:/o:linux:linux_kernel:3.0.25 + cpe:/o:linux:linux_kernel:3.0.22 + cpe:/o:linux:linux_kernel:3.1.9 + cpe:/o:linux:linux_kernel:3.0.23 + cpe:/o:linux:linux_kernel:3.10.28 + cpe:/o:linux:linux_kernel:3.0.28 + cpe:/o:linux:linux_kernel:3.10.27 + cpe:/o:linux:linux_kernel:3.0.26 + cpe:/o:linux:linux_kernel:3.10.29 + cpe:/o:linux:linux_kernel:3.4.58 + cpe:/o:linux:linux_kernel:3.0.27 + cpe:/o:linux:linux_kernel:3.10.24 + cpe:/o:linux:linux_kernel:3.10.23 + cpe:/o:linux:linux_kernel:3.10.25 + cpe:/o:linux:linux_kernel:3.10.20 + cpe:/o:linux:linux_kernel:3.1.8 + cpe:/o:linux:linux_kernel:3.0.20 + cpe:/o:linux:linux_kernel:3.10.22 + cpe:/o:linux:linux_kernel:3.10.21 + cpe:/o:linux:linux_kernel:3.4.21 + cpe:/o:linux:linux_kernel:3.4.20 + cpe:/o:linux:linux_kernel:3.4.23 + cpe:/o:linux:linux_kernel:3.4.22 + cpe:/o:linux:linux_kernel:3.4.24 + cpe:/o:linux:linux_kernel:3.4.27 + cpe:/o:linux:linux_kernel:3.4.26 + cpe:/o:linux:linux_kernel:3.4.29 + cpe:/o:linux:linux_kernel:3.10.15 + cpe:/o:linux:linux_kernel:3.4.28 + cpe:/o:linux:linux_kernel:3.0.54 + cpe:/o:linux:linux_kernel:3.0.33 + cpe:/o:linux:linux_kernel:3.0.34 + cpe:/o:linux:linux_kernel:3.0.35 + cpe:/o:linux:linux_kernel:3.0.36 + cpe:/o:linux:linux_kernel:3.10.19 + cpe:/o:linux:linux_kernel:3.0.37 + cpe:/o:linux:linux_kernel:3.10.18 + cpe:/o:linux:linux_kernel:3.0.38 + cpe:/o:linux:linux_kernel:3.4.25 + cpe:/o:linux:linux_kernel:3.10.17 + cpe:/o:linux:linux_kernel:3.0.39 + cpe:/o:linux:linux_kernel:3.10.16 + cpe:/o:linux:linux_kernel:3.10.14 + cpe:/o:linux:linux_kernel:3.10.13 + cpe:/o:linux:linux_kernel:3.10.12 + cpe:/o:linux:linux_kernel:3.10.11 + cpe:/o:linux:linux_kernel:3.10.10 + cpe:/o:linux:linux_kernel:3.0.30 + cpe:/o:linux:linux_kernel:3.0.31 + cpe:/o:linux:linux_kernel:3.9.8 + cpe:/o:linux:linux_kernel:3.5.5 + cpe:/o:linux:linux_kernel:3.4.32 + cpe:/o:linux:linux_kernel:3.9.9 + cpe:/o:linux:linux_kernel:3.5.6 + cpe:/o:linux:linux_kernel:3.4.31 + cpe:/o:linux:linux_kernel:3.5.7 + cpe:/o:linux:linux_kernel:3.4.30 + cpe:/o:linux:linux_kernel:3.7.1 + cpe:/o:linux:linux_kernel:3.4.35 + cpe:/o:linux:linux_kernel:3.9.0 + cpe:/o:linux:linux_kernel:3.0.18 + cpe:/o:linux:linux_kernel:3.4.34 + cpe:/o:linux:linux_kernel:3.4.33 + cpe:/o:linux:linux_kernel:3.9.2 + cpe:/o:linux:linux_kernel:3.9.1 + cpe:/o:linux:linux_kernel:3.0.19 + cpe:/o:linux:linux_kernel:3.4.39 + cpe:/o:linux:linux_kernel:3.9.4 + cpe:/o:linux:linux_kernel:3.4.38 + cpe:/o:linux:linux_kernel:3.9.3 + cpe:/o:linux:linux_kernel:3.4.37 + cpe:/o:linux:linux_kernel:3.9.6 + cpe:/o:linux:linux_kernel:3.9.5 + cpe:/o:linux:linux_kernel:3.0.21 + cpe:/o:linux:linux_kernel:3.9.7 + cpe:/o:linux:linux_kernel:3.5.4 + cpe:/o:linux:linux_kernel:3.0.4 + cpe:/o:linux:linux_kernel:3.0.5 + cpe:/o:linux:linux_kernel:3.0.2 + cpe:/o:linux:linux_kernel:3.0.3 + cpe:/o:linux:linux_kernel:3.0.8 + cpe:/o:linux:linux_kernel:3.0.6 + cpe:/o:linux:linux_kernel:3.0.7 + cpe:/o:linux:linux_kernel:3.4.36 + cpe:/o:linux:linux_kernel:3.13.1 + cpe:/o:linux:linux_kernel:3.6.10 + cpe:/o:linux:linux_kernel:3.6.11 + cpe:/o:linux:linux_kernel:3.13.4 + cpe:/o:linux:linux_kernel:3.13.2 + cpe:/o:linux:linux_kernel:3.13.3 + cpe:/o:linux:linux_kernel:3.4.1 + cpe:/o:linux:linux_kernel:3.4.19 + cpe:/o:linux:linux_kernel:3.4.17 + cpe:/o:linux:linux_kernel:3.4.3 + cpe:/o:linux:linux_kernel:3.4.18 + cpe:/o:linux:linux_kernel:3.4.2 + cpe:/o:linux:linux_kernel:3.2.9 + cpe:/o:linux:linux_kernel:3.4.15 + cpe:/o:linux:linux_kernel:3.2.8 + cpe:/o:linux:linux_kernel:3.4.16 + cpe:/o:linux:linux_kernel:3.4.4 + cpe:/o:linux:linux_kernel:3.12.12 + cpe:/o:linux:linux_kernel:3.2.7 + cpe:/o:linux:linux_kernel:3.4.13 + cpe:/o:linux:linux_kernel:3.12.13 + cpe:/o:linux:linux_kernel:3.12.10 + cpe:/o:linux:linux_kernel:3.4.11 + cpe:/o:linux:linux_kernel:3.12.11 + cpe:/o:linux:linux_kernel:3.4.12 + cpe:/o:linux:linux_kernel:3.4.10 + cpe:/o:linux:linux_kernel:3.0.61 + cpe:/o:linux:linux_kernel:3.3:rc2 + cpe:/o:linux:linux_kernel:3.4:rc7 + cpe:/o:linux:linux_kernel:3.0.60 + cpe:/o:linux:linux_kernel:3.3:rc7 + cpe:/o:linux:linux_kernel:3.4:rc5 + cpe:/o:linux:linux_kernel:3.3:rc5 + cpe:/o:linux:linux_kernel:3.4:rc6 + cpe:/o:linux:linux_kernel:3.3:rc6 + cpe:/o:linux:linux_kernel:3.0.64 + cpe:/o:linux:linux_kernel:3.0.63 + cpe:/o:linux:linux_kernel:3.0.62 + cpe:/o:linux:linux_kernel:3.12.1 + cpe:/o:linux:linux_kernel:3.0.68 + cpe:/o:linux:linux_kernel:3.0.67 + cpe:/o:linux:linux_kernel:3.0.66 + cpe:/o:linux:linux_kernel:3.4.14 + cpe:/o:linux:linux_kernel:3.12.7 + cpe:/o:linux:linux_kernel:3.2:rc2 + cpe:/o:linux:linux_kernel:3.1:rc1 + cpe:/o:linux:linux_kernel:3.0.9 + cpe:/o:linux:linux_kernel:3.0:rc4 + cpe:/o:linux:linux_kernel:3.12.8 + cpe:/o:linux:linux_kernel:3.1:rc4 + cpe:/o:linux:linux_kernel:3.0:rc3 + cpe:/o:linux:linux_kernel:3.12.9 + cpe:/o:linux:linux_kernel:3.0:rc2 + cpe:/o:linux:linux_kernel:3.1:rc2 + cpe:/o:linux:linux_kernel:3.0:rc1 + cpe:/o:linux:linux_kernel:3.2:rc7 + cpe:/o:linux:linux_kernel:3.12.3 + cpe:/o:linux:linux_kernel:3.2:rc6 + cpe:/o:linux:linux_kernel:3.1.10 + cpe:/o:linux:linux_kernel:3.12.4 + cpe:/o:linux:linux_kernel:3.2:rc5 + cpe:/o:linux:linux_kernel:3.0:rc7 + cpe:/o:linux:linux_kernel:3.12.5 + cpe:/o:linux:linux_kernel:3.9:rc3 + cpe:/o:linux:linux_kernel:3.0:rc6 + cpe:/o:linux:linux_kernel:3.12.6 + cpe:/o:linux:linux_kernel:3.0:rc5 + cpe:/o:linux:linux_kernel:3.9:rc1 + cpe:/o:linux:linux_kernel:3.9:rc4 + cpe:/o:linux:linux_kernel:3.9:rc7 + cpe:/o:linux:linux_kernel:3.12.2 + cpe:/o:linux:linux_kernel:3.9:rc2 + cpe:/o:linux:linux_kernel:3.9:rc5 + cpe:/o:linux:linux_kernel:3.3:rc3 + cpe:/o:linux:linux_kernel:3.4:rc4 + cpe:/o:linux:linux_kernel:3.4:rc3 + cpe:/o:linux:linux_kernel:3.3:rc1 + cpe:/o:linux:linux_kernel:3.4:rc2 + cpe:/o:linux:linux_kernel:3.9:rc6 + cpe:/o:linux:linux_kernel:3.3:rc4 + cpe:/o:linux:linux_kernel:3.4:rc1 + cpe:/o:linux:linux_kernel:3.4.5 + cpe:/o:linux:linux_kernel:3.2.2 + cpe:/o:linux:linux_kernel:3.2.3 + cpe:/o:linux:linux_kernel:3.2.1 + cpe:/o:linux:linux_kernel:3.4.6 + cpe:/o:linux:linux_kernel:3.2:rc3 + cpe:/o:linux:linux_kernel:3.2.6 + cpe:/o:linux:linux_kernel:3.4.7 + cpe:/o:linux:linux_kernel:3.2:rc4 + cpe:/o:linux:linux_kernel:3.1:rc3 + cpe:/o:linux:linux_kernel:3.4.8 + cpe:/o:linux:linux_kernel:3.2.4 + cpe:/o:linux:linux_kernel:3.4.9 + cpe:/o:linux:linux_kernel:3.2.5 + cpe:/o:linux:linux_kernel:3.0.65 + cpe:/o:linux:linux_kernel:3.2.12 + cpe:/o:linux:linux_kernel:3.8.10 + cpe:/o:linux:linux_kernel:3.8.12 + cpe:/o:linux:linux_kernel:3.8.11 + cpe:/o:linux:linux_kernel:3.8.13 + cpe:/o:linux:linux_kernel:3.7.9 + cpe:/o:linux:linux_kernel:3.7.8 + cpe:/o:linux:linux_kernel:3.7.7 + cpe:/o:linux:linux_kernel:3.7.6 + cpe:/o:linux:linux_kernel:3.6.3 + cpe:/o:linux:linux_kernel:3.7.5 + cpe:/o:linux:linux_kernel:3.7.4 + cpe:/o:linux:linux_kernel:3.7.3 + cpe:/o:linux:linux_kernel:3.7.2 + cpe:/o:linux:linux_kernel:3.6.7 + cpe:/o:linux:linux_kernel:3.6.6 + cpe:/o:linux:linux_kernel:3.6.5 + cpe:/o:linux:linux_kernel:3.6.4 + cpe:/o:linux:linux_kernel:3.6.9 + cpe:/o:linux:linux_kernel:3.6.8 + cpe:/o:linux:linux_kernel:3.10 + cpe:/o:linux:linux_kernel:3.11 + cpe:/o:linux:linux_kernel:3.12 + cpe:/o:linux:linux_kernel:3.13 + cpe:/o:linux:linux_kernel:3.10.1 + cpe:/o:linux:linux_kernel:3.10.2 + cpe:/o:linux:linux_kernel:3.10.3 + cpe:/o:linux:linux_kernel:3.6.2 + cpe:/o:linux:linux_kernel:3.6.1 + cpe:/o:linux:linux_kernel:3.3.6 + cpe:/o:linux:linux_kernel:3.3.7 + cpe:/o:linux:linux_kernel:3.3.8 + cpe:/o:linux:linux_kernel:3.0.1 + cpe:/o:linux:linux_kernel:3.2 + cpe:/o:linux:linux_kernel:3.1 + cpe:/o:linux:linux_kernel:3.7 + cpe:/o:linux:linux_kernel:3.6 + cpe:/o:linux:linux_kernel:3.4 + cpe:/o:linux:linux_kernel:3.1.6 + cpe:/o:linux:linux_kernel:3.1.5 + cpe:/o:linux:linux_kernel:3.1.7 + cpe:/o:linux:linux_kernel:3.0.32 + cpe:/o:linux:linux_kernel:3.8.9 + cpe:/o:linux:linux_kernel:3.1.2 + cpe:/o:linux:linux_kernel:3.1.1 + cpe:/o:linux:linux_kernel:3.1.4 + cpe:/o:linux:linux_kernel:3.1.3 + cpe:/o:linux:linux_kernel:3.9.10 + cpe:/o:linux:linux_kernel:3.0.29 + cpe:/o:linux:linux_kernel:3.3 + cpe:/o:linux:linux_kernel:3.8.4 + cpe:/o:linux:linux_kernel:3.2.26 + cpe:/o:linux:linux_kernel:3.8.5 + cpe:/o:linux:linux_kernel:3.2.27 + cpe:/o:linux:linux_kernel:3.8.2 + cpe:/o:linux:linux_kernel:3.2.24 + cpe:/o:linux:linux_kernel:3.8.3 + cpe:/o:linux:linux_kernel:3.2.25 + cpe:/o:linux:linux_kernel:3.8.8 + cpe:/o:linux:linux_kernel:3.8.6 + cpe:/o:linux:linux_kernel:3.2.28 + cpe:/o:linux:linux_kernel:3.8.7 + cpe:/o:linux:linux_kernel:3.2.29 + cpe:/o:linux:linux_kernel:3.3.3 + cpe:/o:linux:linux_kernel:3.3.4 + cpe:/o:linux:linux_kernel:3.3.5 + cpe:/o:linux:linux_kernel:3.2.22 + cpe:/o:linux:linux_kernel:3.8.1 + cpe:/o:linux:linux_kernel:3.2.20 + cpe:/o:linux:linux_kernel:3.3.1 + cpe:/o:linux:linux_kernel:3.2.21 + cpe:/o:linux:linux_kernel:3.3.2 + cpe:/o:linux:linux_kernel:3.11.1 + cpe:/o:linux:linux_kernel:3.11.2 + cpe:/o:linux:linux_kernel:3.2.23 + cpe:/o:linux:linux_kernel:3.0.17 + cpe:/o:linux:linux_kernel:3.9.11 + cpe:/o:linux:linux_kernel:3.0.16 + cpe:/o:linux:linux_kernel:3.0.15 + cpe:/o:linux:linux_kernel:3.2.30 + cpe:/o:linux:linux_kernel:3.0.14 + cpe:/o:linux:linux_kernel:3.0.13 + cpe:/o:linux:linux_kernel:3.0.12 + cpe:/o:linux:linux_kernel:3.0.11 + cpe:/o:linux:linux_kernel:3.4.61 + cpe:/o:linux:linux_kernel:3.0.10 + cpe:/o:linux:linux_kernel:3.4.64 + cpe:/o:linux:linux_kernel:3.8.0 + cpe:/o:linux:linux_kernel:3.4.65 + cpe:/o:linux:linux_kernel:3.4.62 + cpe:/o:linux:linux_kernel:3.4.63 + cpe:/o:linux:linux_kernel:3.4.68 + cpe:/o:linux:linux_kernel:3.4.66 + cpe:/o:linux:linux_kernel:3.4.67 + cpe:/o:linux:linux_kernel:3.5.3 + cpe:/o:linux:linux_kernel:3.5.1 + cpe:/o:linux:linux_kernel:3.5.2 + cpe:/o:linux:linux_kernel:3.10.4 + cpe:/o:linux:linux_kernel:3.4.72 + cpe:/o:linux:linux_kernel:3.10.9 + cpe:/o:linux:linux_kernel:3.4.73 + cpe:/o:linux:linux_kernel:3.4.74 + cpe:/o:linux:linux_kernel:3.4.75 + cpe:/o:linux:linux_kernel:3.4.76 + cpe:/o:linux:linux_kernel:3.10.5 + cpe:/o:linux:linux_kernel:3.4.77 + cpe:/o:linux:linux_kernel:3.10.6 + cpe:/o:linux:linux_kernel:3.4.78 + cpe:/o:linux:linux_kernel:3.10.7 + cpe:/o:linux:linux_kernel:3.4.79 + cpe:/o:linux:linux_kernel:3.10.8 + cpe:/o:linux:linux_kernel:3.7.10 + cpe:/o:linux:linux_kernel:3.2.17 + cpe:/o:linux:linux_kernel:3.2.18 + cpe:/o:linux:linux_kernel:3.2.19 + cpe:/o:linux:linux_kernel:3.2.13 + cpe:/o:linux:linux_kernel:3.2.14 + cpe:/o:linux:linux_kernel:3.11.3 + cpe:/o:linux:linux_kernel:3.2.15 + cpe:/o:linux:linux_kernel:3.4.60 + cpe:/o:linux:linux_kernel:3.2.16 + cpe:/o:linux:linux_kernel:3.11.5 + cpe:/o:linux:linux_kernel:3.11.4 + cpe:/o:linux:linux_kernel:3.2.10 + cpe:/o:linux:linux_kernel:3.11.7 + cpe:/o:linux:linux_kernel:3.2.11 + cpe:/o:linux:linux_kernel:3.11.6 + cpe:/o:linux:linux_kernel:3.11.9 + cpe:/o:linux:linux_kernel:3.11.8 + cpe:/o:linux:linux_kernel:3.4.69 + + CVE-2014-2039 + 2014-02-28T01:18:54.633-05:00 + 2014-02-28T13:13:30.020-05:00 + + + 4.9 + LOCAL + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-02-28T13:13:28.457-05:00 + + + + + CONFIRM + https://github.com/torvalds/linux/commit/8d7f6690cedb83456edd41c9bd583783f0703bf0 + + + CONFIRM + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8d7f6690cedb83456edd41c9bd583783f0703bf0 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1067558 + + + MLIST + [oss-security] 20140220 Re: CVE Request: Linux kernel: s390: crash due to linkage stack instruction + + + CONFIRM + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.5 + + arch/s390/kernel/head64.S in the Linux kernel before 3.13.5 on the s390 platform does not properly handle attempted use of the linkage stack, which allows local users to cause a denial of service (system crash) by executing a crafted instruction. + + + + + + + + + cpe:/a:jordy_meow:media_file_renamer:1.7.0::~~~wordpress~~ + + CVE-2014-2040 + 2014-03-03T13:55:03.637-05:00 + 2014-03-07T15:32:07.630-05:00 + + + 2.1 + NETWORK + HIGH + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-04T09:14:22.000-05:00 + + + + + MISC + http://www.vapid.dhs.org/advisories/wordpress/plugins/MediaFileRenamer-1.7.0/index.html + + + BID + 65715 + + + BUGTRAQ + 20140226 Persistent XSS in Media File Renamer V1.7.0 wordpress plugin + + Multiple cross-site scripting (XSS) vulnerabilities in the (1) callback_multicheck, (2) callback_radio, and (3) callback_wysiwygin functions in mfrh_class.settings-api.php in the Media File Renamer plugin 1.7.0 for WordPress allow remote authenticated users with permissions to add media or edit media to inject arbitrary web script or HTML via unspecified parameters, as demonstrated by the title of an uploaded file. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:livetecs:timeline:6.2.7 + cpe:/a:livetecs:timeline:2.94 + cpe:/a:livetecs:timeline:3.1.1 + cpe:/a:livetecs:timeline:3.5.1 + cpe:/a:livetecs:timeline:6.2.8 + cpe:/a:livetecs:timeline:2.91 + cpe:/a:livetecs:timeline:3.0.3 + cpe:/a:livetecs:timeline:3.0.1 + cpe:/a:livetecs:timeline:4.2.1 + cpe:/a:livetecs:timeline:2.81 + cpe:/a:livetecs:timeline:6.0.1 + cpe:/a:livetecs:timeline:3.0.5 + cpe:/a:livetecs:timeline:6.2.71 + cpe:/a:livetecs:timeline:3.6.1 + cpe:/a:livetecs:timeline:4.3.1 + cpe:/a:livetecs:timeline:6.2.1 + cpe:/a:livetecs:timeline:6.2.3 + cpe:/a:livetecs:timeline:3.8.1 + cpe:/a:livetecs:timeline:3.2.1 + cpe:/a:livetecs:timeline:6.2.4 + cpe:/a:livetecs:timeline:5.2.1 + cpe:/a:livetecs:timeline:4.9.1 + cpe:/a:livetecs:timeline:6.2.6 + cpe:/a:livetecs:timeline:3.7.1 + + CVE-2014-2042 + 2014-04-28T10:09:06.563-04:00 + 2014-04-29T08:18:50.870-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-29T08:18:50.713-04:00 + + + + BUGTRAQ + 20140423 CVE-2014-2042 - Unrestricted file upload in Livetecs Timelive + + + FULLDISC + 20140423 CVE-2014-2042 - Unrestricted file upload in Livetecs Timelive + + Unrestricted file upload vulnerability in the Manage Project functionality in Livetecs Timelive before 6.5.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in a predictable directory in Uploads/. + + + + + + + + + cpe:/a:procentia:intellipen:1.1.12.1520 + + CVE-2014-2043 + 2014-03-13T10:55:05.313-04:00 + 2014-03-13T14:22:50.210-04:00 + + + 6.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-13T14:22:42.883-04:00 + + + + + MISC + https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2043 + + + BUGTRAQ + 20140312 CVE-2014-2043 - SQL Injection in Procentia IntelliPen + + + EXPLOIT-DB + 32212 + + SQL injection vulnerability in Resources/System/Templates/Data.aspx in Procentia IntelliPen before 1.1.18.1658 allows remote authenticated users to execute arbitrary SQL commands via the value parameter. + + + + + + + + + + cpe:/a:owncloud:owncloud:6.0.1 + cpe:/a:owncloud:owncloud:6.0.0 + + CVE-2014-2047 + 2014-03-14T12:55:05.613-04:00 + 2014-03-25T15:36:46.027-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-17T07:17:35.000-04:00 + + + + + CONFIRM + http://owncloud.org/about/security/advisories/oC-SA-2014-001/ + + Session fixation vulnerability in ownCloud before 6.0.2, when PHP is configured to accept session parameters through a GET request, allows remote attackers to hijack web sessions via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:owncloud:owncloud:4.0.15 + cpe:/a:owncloud:owncloud:4.0.14 + cpe:/a:owncloud:owncloud:4.0.16 + cpe:/a:owncloud:owncloud:4.0.10 + cpe:/a:owncloud:owncloud:5.0.9 + cpe:/a:owncloud:owncloud:5.0.8 + cpe:/a:owncloud:owncloud:5.0.7 + cpe:/a:owncloud:owncloud:4.0.11 + cpe:/a:owncloud:owncloud:4.0.12 + cpe:/a:owncloud:owncloud:4.0.13 + cpe:/a:owncloud:owncloud:6.0.1 + cpe:/a:owncloud:owncloud:5.0.13 + cpe:/a:owncloud:owncloud:5.0.14 + cpe:/a:owncloud:owncloud:5.0.12 + cpe:/a:owncloud:owncloud:5.0.10 + cpe:/a:owncloud:owncloud:5.0.11 + cpe:/a:owncloud:owncloud:6.0.0 + cpe:/a:owncloud:owncloud:5.0.0 + cpe:/a:owncloud:owncloud:5.0.1 + cpe:/a:owncloud:owncloud:4.0.8 + cpe:/a:owncloud:owncloud:4.0.9 + cpe:/a:owncloud:owncloud:5.0.6 + cpe:/a:owncloud:owncloud:5.0.5 + cpe:/a:owncloud:owncloud:5.0.4 + cpe:/a:owncloud:owncloud:5.0.3 + cpe:/a:owncloud:owncloud:5.0.2 + cpe:/a:owncloud:owncloud:4.5.0 + cpe:/a:owncloud:owncloud:4.5.7 + cpe:/a:owncloud:owncloud:4.5.1 + cpe:/a:owncloud:owncloud:4.5.6 + cpe:/a:owncloud:owncloud:3.0.1 + cpe:/a:owncloud:owncloud:4.5.9 + cpe:/a:owncloud:owncloud:3.0.2 + cpe:/a:owncloud:owncloud:4.5.8 + cpe:/a:owncloud:owncloud:3.0.3 + cpe:/a:owncloud:owncloud:4.5.2 + cpe:/a:owncloud:owncloud:4.5.3 + cpe:/a:owncloud:owncloud:4.0.1 + cpe:/a:owncloud:owncloud:4.0.2 + cpe:/a:owncloud:owncloud:4.5.5 + cpe:/a:owncloud:owncloud:4.5.4 + cpe:/a:owncloud:owncloud:4.0.0 + cpe:/a:owncloud:owncloud:4.0.6 + cpe:/a:owncloud:owncloud:4.0.5 + cpe:/a:owncloud:owncloud:3.0.0 + cpe:/a:owncloud:owncloud:4.0.4 + cpe:/a:owncloud:owncloud:4.0.3 + cpe:/a:owncloud:owncloud:4.5.13 + cpe:/a:owncloud:owncloud:4.5.11 + cpe:/a:owncloud:owncloud:4.5.12 + cpe:/a:owncloud:owncloud:4.0.7 + cpe:/a:owncloud:owncloud:4.5.10 + + CVE-2014-2049 + 2014-03-14T12:55:05.647-04:00 + 2014-03-25T15:32:36.610-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-03-17T11:16:37.613-04:00 + + + + + CONFIRM + http://owncloud.org/about/security/advisories/oC-SA-2014-003/ + + The default Flash Cross Domain policies in ownCloud before 5.0.15 and 6.x before 6.0.2 allows remote attackers to access user files via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:owncloud:owncloud:4.0.15 + cpe:/a:owncloud:owncloud:4.0.14 + cpe:/a:owncloud:owncloud:4.0.16 + cpe:/a:owncloud:owncloud:4.0.10 + cpe:/a:owncloud:owncloud:5.0.9 + cpe:/a:owncloud:owncloud:5.0.8 + cpe:/a:owncloud:owncloud:5.0.7 + cpe:/a:owncloud:owncloud:4.0.11 + cpe:/a:owncloud:owncloud:4.0.12 + cpe:/a:owncloud:owncloud:4.0.13 + cpe:/a:owncloud:owncloud:6.0.1 + cpe:/a:owncloud:owncloud:5.0.13 + cpe:/a:owncloud:owncloud:5.0.14 + cpe:/a:owncloud:owncloud:5.0.12 + cpe:/a:owncloud:owncloud:5.0.10 + cpe:/a:owncloud:owncloud:5.0.11 + cpe:/a:owncloud:owncloud:6.0.0 + cpe:/a:owncloud:owncloud:5.0.0 + cpe:/a:owncloud:owncloud:5.0.1 + cpe:/a:owncloud:owncloud:5.0.14:a + cpe:/a:owncloud:owncloud:4.0.8 + cpe:/a:owncloud:owncloud:4.0.9 + cpe:/a:owncloud:owncloud:5.0.6 + cpe:/a:owncloud:owncloud:5.0.5 + cpe:/a:owncloud:owncloud:5.0.4 + cpe:/a:owncloud:owncloud:5.0.3 + cpe:/a:owncloud:owncloud:5.0.2 + cpe:/a:owncloud:owncloud:4.5.0 + cpe:/a:owncloud:owncloud:4.5.7 + cpe:/a:owncloud:owncloud:4.5.1 + cpe:/a:owncloud:owncloud:3.0.1 + cpe:/a:owncloud:owncloud:4.5.6 + cpe:/a:owncloud:owncloud:3.0.2 + cpe:/a:owncloud:owncloud:4.5.9 + cpe:/a:owncloud:owncloud:3.0.3 + cpe:/a:owncloud:owncloud:4.5.8 + cpe:/a:owncloud:owncloud:4.5.2 + cpe:/a:owncloud:owncloud:4.0.1 + cpe:/a:owncloud:owncloud:4.5.3 + cpe:/a:owncloud:owncloud:4.0.2 + cpe:/a:owncloud:owncloud:4.5.5 + cpe:/a:owncloud:owncloud:4.0.0 + cpe:/a:owncloud:owncloud:4.5.4 + cpe:/a:owncloud:owncloud:4.0.6 + cpe:/a:owncloud:owncloud:4.0.5 + cpe:/a:owncloud:owncloud:3.0.0 + cpe:/a:owncloud:owncloud:4.0.4 + cpe:/a:owncloud:owncloud:4.0.3 + cpe:/a:owncloud:owncloud:4.5.13 + cpe:/a:owncloud:owncloud:4.5.11 + cpe:/a:owncloud:owncloud:4.0.7 + cpe:/a:owncloud:owncloud:4.5.12 + cpe:/a:owncloud:owncloud:4.5.10 + + CVE-2014-2057 + 2014-03-24T12:31:08.480-04:00 + 2014-03-24T18:16:57.047-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-24T12:53:15.523-04:00 + + + + + CONFIRM + http://owncloud.org/about/security/advisories/oC-SA-2014-007/ + + Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 6.0.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cloudbees:jenkins:1.384 + cpe:/a:cloudbees:jenkins:1.383 + cpe:/a:cloudbees:jenkins:1.382 + cpe:/a:cloudbees:jenkins:1.388 + cpe:/a:cloudbees:jenkins:1.387 + cpe:/a:cloudbees:jenkins:1.386 + cpe:/a:cloudbees:jenkins:1.523 + cpe:/a:cloudbees:jenkins:1.524 + cpe:/a:cloudbees:jenkins:1.389 + cpe:/a:cloudbees:jenkins:1.528 + cpe:/a:cloudbees:jenkins:1.400.0.12::lts + cpe:/a:cloudbees:jenkins:1.380 + cpe:/a:cloudbees:jenkins:1.527 + cpe:/a:cloudbees:jenkins:1.526 + cpe:/a:cloudbees:jenkins:1.525 + cpe:/a:cloudbees:jenkins:1.529 + cpe:/a:cloudbees:jenkins:1.424:-:lts + cpe:/a:cloudbees:jenkins:1.447.1:-:lts + cpe:/a:cloudbees:jenkins:1.433 + cpe:/a:cloudbees:jenkins:1.432 + cpe:/a:cloudbees:jenkins:1.431 + cpe:/a:cloudbees:jenkins:1.324 + cpe:/a:cloudbees:jenkins:1.430 + cpe:/a:cloudbees:jenkins:1.325 + cpe:/a:cloudbees:jenkins:1.351 + cpe:/a:cloudbees:jenkins:1.326 + cpe:/a:cloudbees:jenkins:1.350 + cpe:/a:cloudbees:jenkins:1.353 + cpe:/a:cloudbees:jenkins:1.352 + cpe:/a:cloudbees:jenkins:1.355 + cpe:/a:cloudbees:jenkins:1.354 + cpe:/a:cloudbees:jenkins:1.356 + cpe:/a:cloudbees:jenkins:1.437 + cpe:/a:cloudbees:jenkins:1.435 + cpe:/a:cloudbees:jenkins:1.320 + cpe:/a:cloudbees:jenkins:1.436 + cpe:/a:cloudbees:jenkins:1.322 + cpe:/a:cloudbees:jenkins:1.434 + cpe:/a:cloudbees:jenkins:1.321 + cpe:/a:cloudbees:jenkins:1.323 + cpe:/a:cloudbees:jenkins:1.328 + cpe:/a:cloudbees:jenkins:1.327 + cpe:/a:cloudbees:jenkins:1.329 + cpe:/a:cloudbees:jenkins:1.447.2:-:lts + cpe:/a:cloudbees:jenkins:1.357 + cpe:/a:cloudbees:jenkins:1.358 + cpe:/a:cloudbees:jenkins:1.359 + cpe:/a:cloudbees:jenkins:1.402 + cpe:/a:cloudbees:jenkins:1.403 + cpe:/a:cloudbees:jenkins:1.401 + cpe:/a:cloudbees:jenkins:1.409.1:-:lts + cpe:/a:cloudbees:jenkins:1.409.3:-:lts + cpe:/a:cloudbees:jenkins:1.409.2:-:lts + cpe:/a:cloudbees:jenkins:1.400:-:lts + cpe:/a:cloudbees:jenkins:1.400 + cpe:/a:cloudbees:jenkins:1.407 + cpe:/a:cloudbees:jenkins:1.406 + cpe:/a:cloudbees:jenkins:1.405 + cpe:/a:cloudbees:jenkins:1.404 + cpe:/a:cloudbees:jenkins:1.424.6:-:lts + cpe:/a:cloudbees:jenkins:1.424.5:-:lts + cpe:/a:cloudbees:jenkins:1.408 + cpe:/a:cloudbees:jenkins:1.371 + cpe:/a:cloudbees:jenkins:1.302 + cpe:/a:cloudbees:jenkins:1.373 + cpe:/a:cloudbees:jenkins:1.303 + cpe:/a:cloudbees:jenkins:1.372 + cpe:/a:cloudbees:jenkins:1.304 + cpe:/a:cloudbees:jenkins:1.409.2::lts + cpe:/a:cloudbees:jenkins:1.409.1::lts + cpe:/a:cloudbees:jenkins:1.378 + cpe:/a:cloudbees:jenkins:1.375 + cpe:/a:cloudbees:jenkins:1.374 + cpe:/a:cloudbees:jenkins:1.377 + cpe:/a:cloudbees:jenkins:1.376 + cpe:/a:cloudbees:jenkins:1.550 + cpe:/a:cloudbees:jenkins:1.370 + cpe:/a:cloudbees:jenkins:1.301 + cpe:/a:cloudbees:jenkins:1.466.1:-:lts + cpe:/a:cloudbees:jenkins:1.466.2:-:lts + cpe:/a:cloudbees:jenkins:1.379 + cpe:/a:cloudbees:jenkins:1.309 + cpe:/a:cloudbees:jenkins:1.532.1:-:lts + cpe:/a:cloudbees:jenkins:1.306 + cpe:/a:cloudbees:jenkins:1.305 + cpe:/a:cloudbees:jenkins:1.308 + cpe:/a:cloudbees:jenkins:1.307 + cpe:/a:cloudbees:jenkins:1.509.2:-:lts + cpe:/a:cloudbees:jenkins:1.509.1:-:lts + cpe:/a:cloudbees:jenkins:1.426 + cpe:/a:cloudbees:jenkins:1.427 + cpe:/a:cloudbees:jenkins:1.428 + cpe:/a:cloudbees:jenkins:1.429 + cpe:/a:cloudbees:jenkins:1.422 + cpe:/a:cloudbees:jenkins:1.509.4:-:lts + cpe:/a:cloudbees:jenkins:1.337 + cpe:/a:cloudbees:jenkins:1.509.3:-:lts + cpe:/a:cloudbees:jenkins:1.336 + cpe:/a:cloudbees:jenkins:1.420 + cpe:/a:cloudbees:jenkins:1.335 + cpe:/a:cloudbees:jenkins:1.421 + cpe:/a:cloudbees:jenkins:1.338 + cpe:/a:cloudbees:jenkins:1.339 + cpe:/a:cloudbees:jenkins:1.423 + cpe:/a:cloudbees:jenkins:1.332 + cpe:/a:cloudbees:jenkins:1.333 + cpe:/a:cloudbees:jenkins:1.425 + cpe:/a:cloudbees:jenkins:1.330 + cpe:/a:cloudbees:jenkins:1.424 + cpe:/a:cloudbees:jenkins:1.331 + cpe:/a:cloudbees:jenkins:1.334 + cpe:/a:cloudbees:jenkins:1.396 + cpe:/a:cloudbees:jenkins:1.530 + cpe:/a:cloudbees:jenkins:1.397 + cpe:/a:cloudbees:jenkins:1.531 + cpe:/a:cloudbees:jenkins:1.398 + cpe:/a:cloudbees:jenkins:1.399 + cpe:/a:cloudbees:jenkins:1.532 + cpe:/a:cloudbees:jenkins:1.538 + cpe:/a:cloudbees:jenkins:1.539 + cpe:/a:cloudbees:jenkins:1.536 + cpe:/a:cloudbees:jenkins:1.537 + cpe:/a:cloudbees:jenkins:1.424.1:-:lts + cpe:/a:cloudbees:jenkins:1.368 + cpe:/a:cloudbees:jenkins:1.424.2:-:lts + cpe:/a:cloudbees:jenkins:1.393 + cpe:/a:cloudbees:jenkins:1.394 + cpe:/a:cloudbees:jenkins:1.395 + cpe:/a:cloudbees:jenkins:1.369 + cpe:/a:cloudbees:jenkins:1.424.4:-:lts + cpe:/a:cloudbees:jenkins:1.424.3:-:lts + cpe:/a:cloudbees:jenkins:1.535 + cpe:/a:cloudbees:jenkins:1.360 + cpe:/a:cloudbees:jenkins:1.534 + cpe:/a:cloudbees:jenkins:1.361 + cpe:/a:cloudbees:jenkins:1.533 + cpe:/a:cloudbees:jenkins:1.362 + cpe:/a:cloudbees:jenkins:1.363 + cpe:/a:cloudbees:jenkins:1.364 + cpe:/a:cloudbees:jenkins:1.391 + cpe:/a:cloudbees:jenkins:1.365 + cpe:/a:cloudbees:jenkins:1.390 + cpe:/a:cloudbees:jenkins:1.366 + cpe:/a:cloudbees:jenkins:1.367 + cpe:/a:cloudbees:jenkins:1.392 + cpe:/a:cloudbees:jenkins:1.543 + cpe:/a:cloudbees:jenkins:1.540 + cpe:/a:cloudbees:jenkins:1.541 + cpe:/a:cloudbees:jenkins:1.542 + cpe:/a:cloudbees:jenkins:1.315 + cpe:/a:cloudbees:jenkins:1.314 + cpe:/a:cloudbees:jenkins:1.313 + cpe:/a:cloudbees:jenkins:1.547 + cpe:/a:cloudbees:jenkins:1.548 + cpe:/a:cloudbees:jenkins:1.549 + cpe:/a:cloudbees:jenkins:1.544 + cpe:/a:cloudbees:jenkins:1.447:-:lts + cpe:/a:cloudbees:jenkins:1.546 + cpe:/a:cloudbees:jenkins:1.545 + cpe:/a:cloudbees:jenkins:1.318 + cpe:/a:cloudbees:jenkins:1.319 + cpe:/a:cloudbees:jenkins:1.316 + cpe:/a:cloudbees:jenkins:1.317 + cpe:/a:cloudbees:jenkins:1.312 + cpe:/a:cloudbees:jenkins:1.310 + cpe:/a:cloudbees:jenkins:1.311 + cpe:/a:cloudbees:jenkins:1.417 + cpe:/a:cloudbees:jenkins:1.418 + cpe:/a:cloudbees:jenkins:1.415 + cpe:/a:cloudbees:jenkins:1.416 + cpe:/a:cloudbees:jenkins:1.400::lts + cpe:/a:cloudbees:jenkins:1.419 + cpe:/a:cloudbees:jenkins:1.346 + cpe:/a:cloudbees:jenkins:1.410 + cpe:/a:cloudbees:jenkins:1.348 + cpe:/a:cloudbees:jenkins:1.347 + cpe:/a:cloudbees:jenkins:1.411 + cpe:/a:cloudbees:jenkins:1.340 + cpe:/a:cloudbees:jenkins:1.349 + cpe:/a:cloudbees:jenkins:1.480.3:-:lts + cpe:/a:cloudbees:jenkins:1.480.2:-:lts + cpe:/a:cloudbees:jenkins:1.409 + cpe:/a:cloudbees:jenkins:1.480.1:-:lts + cpe:/a:cloudbees:jenkins:1.345 + cpe:/a:cloudbees:jenkins:1.414 + cpe:/a:cloudbees:jenkins:1.341 + cpe:/a:cloudbees:jenkins:1.413 + cpe:/a:cloudbees:jenkins:1.342 + cpe:/a:cloudbees:jenkins:1.412 + cpe:/a:cloudbees:jenkins:1.480.3.1 + cpe:/a:cloudbees:jenkins:1.343 + cpe:/a:cloudbees:jenkins:1.344 + + CVE-2014-2059 + 2014-02-28T19:01:09.387-05:00 + 2014-03-04T14:16:27.153-05:00 + + + 6.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-03T06:30:28.000-05:00 + + + + + CONFIRM + https://github.com/jenkinsci/jenkins/commit/ad38d8480f20ce3cbf8fec3e2003bc83efda4f7d + + + CONFIRM + https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14 + + + XF + jenkins-cve20142059-dir-trav(91346) + + + MLIST + [oss-security] 20140220 Re: Possible CVE Requests: several issues fixed in Jenkins (Advisory 2014-02-14) + + Directory traversal vulnerability in the CLI job creation (hudson/cli/CreateJobCommand.java) in CloudBees Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to overwrite arbitrary files via the job name. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cloudbees:jenkins:1.384 + cpe:/a:cloudbees:jenkins:1.383 + cpe:/a:cloudbees:jenkins:1.382 + cpe:/a:cloudbees:jenkins:1.388 + cpe:/a:cloudbees:jenkins:1.387 + cpe:/a:cloudbees:jenkins:1.386 + cpe:/a:cloudbees:jenkins:1.523 + cpe:/a:cloudbees:jenkins:1.524 + cpe:/a:cloudbees:jenkins:1.389 + cpe:/a:cloudbees:jenkins:1.528 + cpe:/a:cloudbees:jenkins:1.400.0.12::lts + cpe:/a:cloudbees:jenkins:1.380 + cpe:/a:cloudbees:jenkins:1.527 + cpe:/a:cloudbees:jenkins:1.526 + cpe:/a:cloudbees:jenkins:1.525 + cpe:/a:cloudbees:jenkins:1.529 + cpe:/a:cloudbees:jenkins:1.424:-:lts + cpe:/a:cloudbees:jenkins:1.447.1:-:lts + cpe:/a:cloudbees:jenkins:1.433 + cpe:/a:cloudbees:jenkins:1.432 + cpe:/a:cloudbees:jenkins:1.431 + cpe:/a:cloudbees:jenkins:1.324 + cpe:/a:cloudbees:jenkins:1.430 + cpe:/a:cloudbees:jenkins:1.325 + cpe:/a:cloudbees:jenkins:1.351 + cpe:/a:cloudbees:jenkins:1.326 + cpe:/a:cloudbees:jenkins:1.350 + cpe:/a:cloudbees:jenkins:1.353 + cpe:/a:cloudbees:jenkins:1.352 + cpe:/a:cloudbees:jenkins:1.355 + cpe:/a:cloudbees:jenkins:1.354 + cpe:/a:cloudbees:jenkins:1.356 + cpe:/a:cloudbees:jenkins:1.437 + cpe:/a:cloudbees:jenkins:1.435 + cpe:/a:cloudbees:jenkins:1.320 + cpe:/a:cloudbees:jenkins:1.436 + cpe:/a:cloudbees:jenkins:1.322 + cpe:/a:cloudbees:jenkins:1.434 + cpe:/a:cloudbees:jenkins:1.321 + cpe:/a:cloudbees:jenkins:1.323 + cpe:/a:cloudbees:jenkins:1.328 + cpe:/a:cloudbees:jenkins:1.327 + cpe:/a:cloudbees:jenkins:1.329 + cpe:/a:cloudbees:jenkins:1.447.2:-:lts + cpe:/a:cloudbees:jenkins:1.357 + cpe:/a:cloudbees:jenkins:1.358 + cpe:/a:cloudbees:jenkins:1.359 + cpe:/a:cloudbees:jenkins:1.402 + cpe:/a:cloudbees:jenkins:1.403 + cpe:/a:cloudbees:jenkins:1.401 + cpe:/a:cloudbees:jenkins:1.409.1:-:lts + cpe:/a:cloudbees:jenkins:1.409.3:-:lts + cpe:/a:cloudbees:jenkins:1.409.2:-:lts + cpe:/a:cloudbees:jenkins:1.400:-:lts + cpe:/a:cloudbees:jenkins:1.400 + cpe:/a:cloudbees:jenkins:1.407 + cpe:/a:cloudbees:jenkins:1.406 + cpe:/a:cloudbees:jenkins:1.405 + cpe:/a:cloudbees:jenkins:1.404 + cpe:/a:cloudbees:jenkins:1.424.6:-:lts + cpe:/a:cloudbees:jenkins:1.424.5:-:lts + cpe:/a:cloudbees:jenkins:1.408 + cpe:/a:cloudbees:jenkins:1.371 + cpe:/a:cloudbees:jenkins:1.302 + cpe:/a:cloudbees:jenkins:1.373 + cpe:/a:cloudbees:jenkins:1.303 + cpe:/a:cloudbees:jenkins:1.372 + cpe:/a:cloudbees:jenkins:1.304 + cpe:/a:cloudbees:jenkins:1.409.2::lts + cpe:/a:cloudbees:jenkins:1.409.1::lts + cpe:/a:cloudbees:jenkins:1.378 + cpe:/a:cloudbees:jenkins:1.375 + cpe:/a:cloudbees:jenkins:1.374 + cpe:/a:cloudbees:jenkins:1.377 + cpe:/a:cloudbees:jenkins:1.376 + cpe:/a:cloudbees:jenkins:1.550 + cpe:/a:cloudbees:jenkins:1.370 + cpe:/a:cloudbees:jenkins:1.301 + cpe:/a:cloudbees:jenkins:1.466.1:-:lts + cpe:/a:cloudbees:jenkins:1.466.2:-:lts + cpe:/a:cloudbees:jenkins:1.379 + cpe:/a:cloudbees:jenkins:1.309 + cpe:/a:cloudbees:jenkins:1.532.1:-:lts + cpe:/a:cloudbees:jenkins:1.306 + cpe:/a:cloudbees:jenkins:1.305 + cpe:/a:cloudbees:jenkins:1.308 + cpe:/a:cloudbees:jenkins:1.307 + cpe:/a:cloudbees:jenkins:1.509.2:-:lts + cpe:/a:cloudbees:jenkins:1.509.1:-:lts + cpe:/a:cloudbees:jenkins:1.426 + cpe:/a:cloudbees:jenkins:1.427 + cpe:/a:cloudbees:jenkins:1.428 + cpe:/a:cloudbees:jenkins:1.429 + cpe:/a:cloudbees:jenkins:1.422 + cpe:/a:cloudbees:jenkins:1.509.4:-:lts + cpe:/a:cloudbees:jenkins:1.337 + cpe:/a:cloudbees:jenkins:1.509.3:-:lts + cpe:/a:cloudbees:jenkins:1.336 + cpe:/a:cloudbees:jenkins:1.420 + cpe:/a:cloudbees:jenkins:1.335 + cpe:/a:cloudbees:jenkins:1.421 + cpe:/a:cloudbees:jenkins:1.338 + cpe:/a:cloudbees:jenkins:1.339 + cpe:/a:cloudbees:jenkins:1.423 + cpe:/a:cloudbees:jenkins:1.332 + cpe:/a:cloudbees:jenkins:1.333 + cpe:/a:cloudbees:jenkins:1.425 + cpe:/a:cloudbees:jenkins:1.330 + cpe:/a:cloudbees:jenkins:1.424 + cpe:/a:cloudbees:jenkins:1.331 + cpe:/a:cloudbees:jenkins:1.334 + cpe:/a:cloudbees:jenkins:1.396 + cpe:/a:cloudbees:jenkins:1.530 + cpe:/a:cloudbees:jenkins:1.397 + cpe:/a:cloudbees:jenkins:1.531 + cpe:/a:cloudbees:jenkins:1.398 + cpe:/a:cloudbees:jenkins:1.399 + cpe:/a:cloudbees:jenkins:1.532 + cpe:/a:cloudbees:jenkins:1.538 + cpe:/a:cloudbees:jenkins:1.539 + cpe:/a:cloudbees:jenkins:1.536 + cpe:/a:cloudbees:jenkins:1.537 + cpe:/a:cloudbees:jenkins:1.424.1:-:lts + cpe:/a:cloudbees:jenkins:1.368 + cpe:/a:cloudbees:jenkins:1.424.2:-:lts + cpe:/a:cloudbees:jenkins:1.393 + cpe:/a:cloudbees:jenkins:1.394 + cpe:/a:cloudbees:jenkins:1.395 + cpe:/a:cloudbees:jenkins:1.369 + cpe:/a:cloudbees:jenkins:1.424.4:-:lts + cpe:/a:cloudbees:jenkins:1.424.3:-:lts + cpe:/a:cloudbees:jenkins:1.535 + cpe:/a:cloudbees:jenkins:1.360 + cpe:/a:cloudbees:jenkins:1.534 + cpe:/a:cloudbees:jenkins:1.361 + cpe:/a:cloudbees:jenkins:1.533 + cpe:/a:cloudbees:jenkins:1.362 + cpe:/a:cloudbees:jenkins:1.363 + cpe:/a:cloudbees:jenkins:1.364 + cpe:/a:cloudbees:jenkins:1.391 + cpe:/a:cloudbees:jenkins:1.365 + cpe:/a:cloudbees:jenkins:1.390 + cpe:/a:cloudbees:jenkins:1.366 + cpe:/a:cloudbees:jenkins:1.367 + cpe:/a:cloudbees:jenkins:1.392 + cpe:/a:cloudbees:jenkins:1.543 + cpe:/a:cloudbees:jenkins:1.540 + cpe:/a:cloudbees:jenkins:1.541 + cpe:/a:cloudbees:jenkins:1.542 + cpe:/a:cloudbees:jenkins:1.315 + cpe:/a:cloudbees:jenkins:1.314 + cpe:/a:cloudbees:jenkins:1.313 + cpe:/a:cloudbees:jenkins:1.547 + cpe:/a:cloudbees:jenkins:1.548 + cpe:/a:cloudbees:jenkins:1.549 + cpe:/a:cloudbees:jenkins:1.544 + cpe:/a:cloudbees:jenkins:1.447:-:lts + cpe:/a:cloudbees:jenkins:1.546 + cpe:/a:cloudbees:jenkins:1.545 + cpe:/a:cloudbees:jenkins:1.318 + cpe:/a:cloudbees:jenkins:1.319 + cpe:/a:cloudbees:jenkins:1.316 + cpe:/a:cloudbees:jenkins:1.317 + cpe:/a:cloudbees:jenkins:1.312 + cpe:/a:cloudbees:jenkins:1.310 + cpe:/a:cloudbees:jenkins:1.311 + cpe:/a:cloudbees:jenkins:1.417 + cpe:/a:cloudbees:jenkins:1.418 + cpe:/a:cloudbees:jenkins:1.415 + cpe:/a:cloudbees:jenkins:1.416 + cpe:/a:cloudbees:jenkins:1.400::lts + cpe:/a:cloudbees:jenkins:1.419 + cpe:/a:cloudbees:jenkins:1.346 + cpe:/a:cloudbees:jenkins:1.410 + cpe:/a:cloudbees:jenkins:1.348 + cpe:/a:cloudbees:jenkins:1.347 + cpe:/a:cloudbees:jenkins:1.411 + cpe:/a:cloudbees:jenkins:1.340 + cpe:/a:cloudbees:jenkins:1.349 + cpe:/a:cloudbees:jenkins:1.480.3:-:lts + cpe:/a:cloudbees:jenkins:1.480.2:-:lts + cpe:/a:cloudbees:jenkins:1.409 + cpe:/a:cloudbees:jenkins:1.480.1:-:lts + cpe:/a:cloudbees:jenkins:1.345 + cpe:/a:cloudbees:jenkins:1.414 + cpe:/a:cloudbees:jenkins:1.341 + cpe:/a:cloudbees:jenkins:1.413 + cpe:/a:cloudbees:jenkins:1.342 + cpe:/a:cloudbees:jenkins:1.412 + cpe:/a:cloudbees:jenkins:1.480.3.1 + cpe:/a:cloudbees:jenkins:1.343 + cpe:/a:cloudbees:jenkins:1.344 + + CVE-2014-2067 + 2014-02-28T19:01:09.417-05:00 + 2014-03-03T15:59:28.663-05:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-03T11:30:49.143-05:00 + + + + + CONFIRM + https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14 + + + CONFIRM + https://github.com/jenkinsci/jenkins/commit/5d57c855f3147bfc5e7fda9252317b428a700014 + + + XF + jenkins-cve20142067-xss(91354) + + + MLIST + [oss-security] 20140220 Re: Possible CVE Requests: several issues fixed in Jenkins (Advisory 2014-02-14) + + Cross-site scripting (XSS) vulnerability in java/hudson/model/Cause.java in CloudBees Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to inject arbitrary web script or HTML via a "remote cause note." + + + + + + + + + + cpe:/a:tibco:enterprise_administrator:1.0.0 + cpe:/a:tibco:enterprise_administrator_sdk:1.0.0 + + CVE-2014-2075 + 2014-02-27T06:55:03.627-05:00 + 2014-02-27T14:26:43.250-05:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-02-27T14:26:42.627-05:00 + + + + + CONFIRM + http://www.tibco.com/multimedia/enterprise_administator_advisory_20140226_tcm8-20533.txt + + + CONFIRM + http://www.tibco.com/mk/advisory.jsp + + TIBCO Enterprise Administrator 1.0.0 and Enterprise Administrator SDK 1.0.0 do not properly enforce administrative authentication requirements, which allows remote attackers to execute arbitrary commands via unspecified vectors. + + + + + + + + + + cpe:/a:open-xchange:open-xchange_appsuite:7.4.1 + cpe:/a:open-xchange:open-xchange_appsuite:7.4.2 + + CVE-2014-2077 + 2014-03-20T12:55:16.950-04:00 + 2014-03-24T18:55:34.780-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-21T08:57:33.687-04:00 + + + + + SECUNIA + 57290 + + + BUGTRAQ + 20140317 Open-Xchange Security Advisory 2014-03-17 + + Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite 7.4.1 before 7.4.1-rev10 and 7.4.2 before 7.4.2-rev8 allows remote attackers to inject arbitrary web script or HTML via the subject of an email, involving 'the aria "tags" for screenreaders at the top bar'. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:modx:modx_revolution:2.2.9 + cpe:/a:modx:modx_revolution:2.2.8 + cpe:/a:modx:modx_revolution:2.2.10 + cpe:/a:modx:modx_revolution:2.0.2 + cpe:/a:modx:modx_revolution:2.0.4 + cpe:/a:modx:modx_revolution:2.0.3 + cpe:/a:modx:modx_revolution:2.0.6 + cpe:/a:modx:modx_revolution:2.0.5 + cpe:/a:modx:modx_revolution:2.0.8 + cpe:/a:modx:modx_revolution:2.2.7 + cpe:/a:modx:modx_revolution:2.0.7 + cpe:/a:modx:modx_revolution:2.0.0 + cpe:/a:modx:modx_revolution:2.2.0 + cpe:/a:modx:modx_revolution:2.2.1 + cpe:/a:modx:modx_revolution:2.2.2 + cpe:/a:modx:modx_revolution:2.2.3 + cpe:/a:modx:modx_revolution:2.2.4 + cpe:/a:modx:modx_revolution:2.2.5 + cpe:/a:modx:modx_revolution:2.2.6 + cpe:/a:modx:modx_revolution:2.0.1 + cpe:/a:modx:modx_revolution:2.1.2 + cpe:/a:modx:modx_revolution:2.1.3 + cpe:/a:modx:modx_revolution:2.1.0 + cpe:/a:modx:modx_revolution:2.1.1 + cpe:/a:modx:modx_revolution:2.1.4 + cpe:/a:modx:modx_revolution:2.1.5 + + CVE-2014-2080 + 2014-02-28T19:01:09.590-05:00 + 2014-03-03T10:34:52.187-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-03T10:34:52.060-05:00 + + + + + CONFIRM + https://github.com/modxcms/revolution/commit/77463eb6a8090f474b04fdc1b72225cb93c558ea + + + CONFIRM + http://modx.com/blog/2014/01/21/revolution-2.2.11%E2%80%94security-fixes-and-prevent-change-loss + + + SECUNIA + 57038 + + + MLIST + [oss-security] 20140224 Re: CVE request: XSS in MODX Revolution before 2.2.11 + + Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in ModX Evolution before 2.2.11 allows remote attackers to inject arbitrary web script or HTML via the "a" parameter. + + + + + + + + + + cpe:/a:freedownloadmanager:free_download_manager:3.8 + cpe:/a:freedownloadmanager:free_download_manager:3.9.3 + + CVE-2014-2087 + 2014-03-18T13:04:17.203-04:00 + 2014-03-19T10:23:55.160-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-19T10:23:55.113-04:00 + + + + + MISC + https://www.rcesecurity.com/2014/03/cve-2014-2087-free-download-manager-cdownloads_deleted-updatedownload-remote-code-execution + + + BID + 66211 + + Stack-based buffer overflow in the CDownloads_Deleted::UpdateDownload function in Downloads_Deleted.cpp in Free Download Manager 3.9.3 build 1360, 3.8 build 1173, 3.0 build 852, and earlier allows user-assisted remote attackers to execute arbitrary code via a long file name, which is then deleted from the download queue by the user. + + + + + + + + + cpe:/a:ilias:ilias:4.4.1 + + CVE-2014-2088 + 2014-03-02T12:55:02.940-05:00 + 2014-03-03T12:24:30.533-05:00 + + + 6.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-03T12:24:30.520-05:00 + + + + MISC + http://packetstormsecurity.com/files/125350/ILIAS-4.4.1-Cross-Site-Scripting-Shell-Upload.html + + Unrestricted file upload vulnerability in ilias.php in ILIAS 4.4.1 allows remote authenticated users to execute arbitrary PHP code by using a .php filename in an upload_files action to the uploadFiles command, and then accessing the .php file via a direct request to a certain client_id pathname. + + + + + + + + + cpe:/a:ilias:ilias:4.4.1 + + CVE-2014-2089 + 2014-03-02T12:55:02.970-05:00 + 2014-03-03T12:25:25.037-05:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-03T12:25:25.003-05:00 + + + + + MISC + http://packetstormsecurity.com/files/125350/ILIAS-4.4.1-Cross-Site-Scripting-Shell-Upload.html + + ILIAS 4.4.1 allows remote attackers to execute arbitrary PHP code via an e-mail attachment that leads to creation of a .php file with a certain client_id pathname. + + + + + + + + + cpe:/a:ilias:ilias:4.4.1 + + CVE-2014-2090 + 2014-03-02T12:55:03.003-05:00 + 2014-03-03T15:58:47.570-05:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-03T12:26:02.210-05:00 + + + + + MISC + http://packetstormsecurity.com/files/125350/ILIAS-4.4.1-Cross-Site-Scripting-Shell-Upload.html + + Multiple cross-site scripting (XSS) vulnerabilities in ilias.php in ILIAS 4.4.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) tar, (2) tar_val, or (3) title parameter. + + + + + + + + + cpe:/a:atutor:atutor:2.1.1 + + CVE-2014-2091 + 2014-03-02T12:55:03.033-05:00 + 2014-03-03T13:15:50.767-05:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-03T13:15:50.720-05:00 + + + + + MISC + http://packetstormsecurity.com/files/125348/ATutor-2.1.1-Cross-Site-Scripting.html + + Cross-site scripting (XSS) vulnerability in mods/_standard/forums/admin/forum_add.php in ATutor 2.1.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the title parameter in an add_forum action. NOTE: the original disclosure also reported issues that may not cross privilege boundaries. + + + + + + + + + cpe:/a:cmsmadesimple:cms_made_simple:1.11.10 + + CVE-2014-2092 + 2014-03-02T12:55:03.067-05:00 + 2014-03-03T15:56:06.660-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-03T13:17:34.753-05:00 + + + + + MISC + http://packetstormsecurity.com/files/125353/CMSMadeSimple-1.11.10-Cross-Site-Scripting.html + + Cross-site scripting (XSS) vulnerability in lib/filemanager/ImageManager/editorFrame.php in CMS Made Simple 1.11.10 allows remote attackers to inject arbitrary web script or HTML via the action parameter, a different issue than CVE-2014-0334. NOTE: the original disclosure also reported issues that may not cross privilege boundaries. + + + + + + + + + + + + cpe:/a:catfish_project:catfish:0.4.0.1 + cpe:/a:catfish_project:catfish:0.4.0.2 + cpe:/a:catfish_project:catfish:0.4.0 + cpe:/a:catfish_project:catfish:0.4.0.3 + + CVE-2014-2093 + 2014-02-26T09:55:08.553-05:00 + 2014-03-11T12:57:31.520-04:00 + + + 4.6 + LOCAL + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-26T04:35:16.000-05:00 + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1069396 + + + CONFIRM + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739958 + + + MLIST + [oss-security] 20140225 Re: CVE request for catfish program + + + MLIST + [oss-security] 20140225 Re: CVE request for catfish program + + Untrusted search path vulnerability in Catfish through 0.4.0.3 allows local users to gain privileges via a Trojan horse catfish.py in the current working directory. + + + + + + + + + + + + cpe:/a:catfish_project:catfish:0.4.0.1 + cpe:/a:catfish_project:catfish:0.4.0.2 + cpe:/a:catfish_project:catfish:0.4.0 + cpe:/a:catfish_project:catfish:0.4.0.3 + + CVE-2014-2094 + 2014-02-26T09:55:08.567-05:00 + 2014-03-11T12:55:02.173-04:00 + + + 4.6 + LOCAL + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-26T04:36:24.000-05:00 + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1069396 + + + CONFIRM + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739958 + + + MLIST + [oss-security] 20140225 Re: CVE request for catfish program + + + MLIST + [oss-security] 20140225 Re: CVE request for catfish program + + Untrusted search path vulnerability in Catfish through 0.4.0.3, when a Fedora package such as 0.4.0.2-2 is not used, allows local users to gain privileges via a Trojan horse catfish.pyc in the current working directory. + + + + + + + + + + + + + + + + + cpe:/a:catfish_project:catfish:0.8.0 + cpe:/a:catfish_project:catfish:0.6.3 + cpe:/a:catfish_project:catfish:0.6.4 + cpe:/a:catfish_project:catfish:0.6.1 + cpe:/a:catfish_project:catfish:0.6.2 + cpe:/a:catfish_project:catfish:0.6.0 + cpe:/a:catfish_project:catfish:1.0.0 + cpe:/a:catfish_project:catfish:0.8.2 + cpe:/a:catfish_project:catfish:0.8.1 + + CVE-2014-2095 + 2014-02-26T09:55:08.583-05:00 + 2014-03-11T12:56:27.457-04:00 + + + 4.6 + LOCAL + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-26T04:39:46.000-05:00 + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1069396 + + + CONFIRM + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739958 + + + MLIST + [oss-security] 20140225 Re: CVE request for catfish program + + + MLIST + [oss-security] 20140225 Re: CVE request for catfish program + + Untrusted search path vulnerability in Catfish 0.6.0 through 1.0.0, when a Fedora package such as 0.8.2-1 is not used, allows local users to gain privileges via a Trojan horse bin/catfish.pyc under the current working directory. + + + + + + + + + + + + + + + + + cpe:/a:catfish_project:catfish:0.8.0 + cpe:/a:catfish_project:catfish:0.6.3 + cpe:/a:catfish_project:catfish:0.6.4 + cpe:/a:catfish_project:catfish:0.6.1 + cpe:/a:catfish_project:catfish:0.6.2 + cpe:/a:catfish_project:catfish:0.6.0 + cpe:/a:catfish_project:catfish:1.0.0 + cpe:/a:catfish_project:catfish:0.8.2 + cpe:/a:catfish_project:catfish:0.8.1 + + CVE-2014-2096 + 2014-02-26T09:55:08.600-05:00 + 2014-03-11T12:57:14.160-04:00 + + + 4.6 + LOCAL + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-02-26T04:40:19.000-05:00 + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1069396 + + + CONFIRM + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739958 + + + MLIST + [oss-security] 20140225 Re: CVE request for catfish program + + + MLIST + [oss-security] 20140225 Re: CVE request for catfish program + + Untrusted search path vulnerability in Catfish 0.6.0 through 1.0.0 allows local users to gain privileges via a Trojan horse bin/catfish.py under the current working directory. + + + + + + + + + + + + + + + + cpe:/a:ffmpeg:ffmpeg:2.0.2 + cpe:/a:ffmpeg:ffmpeg:2.0.1 + cpe:/a:ffmpeg:ffmpeg:2.0 + cpe:/a:ffmpeg:ffmpeg:2.0.3 + cpe:/a:ffmpeg:ffmpeg:2.1 + cpe:/a:ffmpeg:ffmpeg:2.1.1 + cpe:/a:ffmpeg:ffmpeg:2.1.3 + cpe:/a:ffmpeg:ffmpeg:2.1.2 + + CVE-2014-2097 + 2014-03-01T23:57:25.807-05:00 + 2014-03-03T11:41:03.877-05:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-03T11:41:02.893-05:00 + + + + + CONFIRM + http://git.videolan.org/?p=ffmpeg.git;a=commit;h=f58eab151214d2d35ff0973f2b3e51c5eb372da4 + + The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before 2.1.4 does not properly validate a certain bits-per-sample value, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted TAK (aka Tom's lossless Audio Kompressor) data. + + + + + + + + + + + + + + + + cpe:/a:ffmpeg:ffmpeg:2.0.2 + cpe:/a:ffmpeg:ffmpeg:2.0.1 + cpe:/a:ffmpeg:ffmpeg:2.0 + cpe:/a:ffmpeg:ffmpeg:2.0.3 + cpe:/a:ffmpeg:ffmpeg:2.1 + cpe:/a:ffmpeg:ffmpeg:2.1.1 + cpe:/a:ffmpeg:ffmpeg:2.1.3 + cpe:/a:ffmpeg:ffmpeg:2.1.2 + + CVE-2014-2098 + 2014-03-01T23:57:25.823-05:00 + 2014-03-03T11:41:11.487-05:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-03T11:41:11.440-05:00 + + + + + CONFIRM + http://git.videolan.org/?p=ffmpeg.git;a=commit;h=ec9578d54d09b64bf112c2bf7a34b1ef3b93dbd3 + + libavcodec/wmalosslessdec.c in FFmpeg before 2.1.4 uses an incorrect data-structure size for certain coefficients, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted WMA data. + + + + + + + + + + + + + + + + cpe:/a:ffmpeg:ffmpeg:2.0.2 + cpe:/a:ffmpeg:ffmpeg:2.0.1 + cpe:/a:ffmpeg:ffmpeg:2.0 + cpe:/a:ffmpeg:ffmpeg:2.0.3 + cpe:/a:ffmpeg:ffmpeg:2.1 + cpe:/a:ffmpeg:ffmpeg:2.1.1 + cpe:/a:ffmpeg:ffmpeg:2.1.3 + cpe:/a:ffmpeg:ffmpeg:2.1.2 + + CVE-2014-2099 + 2014-03-01T23:57:25.840-05:00 + 2014-03-03T11:42:20.253-05:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-03T11:42:18.770-05:00 + + + + + CONFIRM + http://git.videolan.org/?p=ffmpeg.git;a=commit;h=c919e1ca2ecfc47d796382973ba0e48b8f6f92a2 + + The msrle_decode_frame function in libavcodec/msrle.c in FFmpeg before 2.1.4 does not properly calculate line sizes, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Microsoft RLE video data. + + + + + + + + + cpe:/a:cisco:unified_contact_center_express_editor_software:- + + CVE-2014-2102 + 2014-02-26T20:55:04.307-05:00 + 2014-02-27T16:31:52.980-05:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-02-27T04:09:20.000-05:00 + + + + + CISCO + 20140225 Cisco Unified Contact Center Express CCMConfig Sensitive Information Disclosure Vulnerability + + Cisco Unified Contact Center Express (Unified CCX) does not properly restrict the content of the CCMConfig page, which allows remote authenticated users to obtain sensitive information by examining this content, aka Bug ID CSCum95575. + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:intrusion_prevention_system:7.0%288%29e4 + cpe:/a:cisco:intrusion_prevention_system:6.0.2.0 + cpe:/a:cisco:intrusion_prevention_system:5.1 + cpe:/a:cisco:intrusion_prevention_system:7.0%285a%29e4 + cpe:/a:cisco:intrusion_prevention_system:7.0%289%29e4 + cpe:/a:cisco:intrusion_prevention_system:7.0%286%29e4 + cpe:/a:cisco:intrusion_prevention_system:7.1 + cpe:/a:cisco:intrusion_prevention_system:7.0 + cpe:/a:cisco:intrusion_prevention_system:7.0%287%29e4 + cpe:/h:cisco:intrusion_prevention_system + cpe:/a:cisco:intrusion_prevention_system:7.0%282%29e4 + cpe:/a:cisco:intrusion_prevention_system:7.0%282%29e3 + cpe:/a:cisco:intrusion_prevention_system:7.0%283%29e4 + cpe:/a:cisco:intrusion_prevention_system:7.0%284%29e4 + cpe:/a:cisco:intrusion_prevention_system:6.0 + cpe:/a:cisco:intrusion_prevention_system:7.0%281%29e3 + + CVE-2014-2103 + 2014-02-27T15:55:06.957-05:00 + 2014-02-28T11:48:16.063-05:00 + + + 6.8 + NETWORK + LOW + SINGLE_INSTANCE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-02-28T11:48:15.860-05:00 + + + + + CISCO + 20140227 Cisco IPS MainApp SNMP Denial of Service Vulnerability + + Cisco Intrusion Prevention System (IPS) Software allows remote attackers to cause a denial of service (MainApp process outage) via malformed SNMP packets, aka Bug IDs CSCum52355 and CSCul49309. + + + + + + + + + cpe:/a:cisco:unified_communications_domain_manager:9.0%28.1%29 + + CVE-2014-2104 + 2014-03-01T23:57:25.870-05:00 + 2014-03-03T15:57:28.223-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-03T11:39:48.610-05:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=33111 + + + CISCO + 20140227 Cisco Unified Communications Domain Manager Cross-Site Scripting Vulnerability + + Multiple cross-site scripting (XSS) vulnerabilities in the Business Voice Services Manager (BVSM) page in Cisco Unified Communications Domain Manager 9.0(.1) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCum78536, CSCum78526, CSCum69809, and CSCum63113. + + + + + + + + + + + + cpe:/o:cisco:ios_xe:3.10.1s1 + cpe:/o:cisco:ios:15.3%283%29m1 + cpe:/o:cisco:ios_xe:3.10.0s + cpe:/o:cisco:ios:15.3%283%29m + + CVE-2014-2106 + 2014-03-27T17:55:08.940-04:00 + 2014-03-28T09:30:52.210-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-03-28T09:30:51.270-04:00 + + + + + CISCO + 20140326 Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability + + Cisco IOS 15.3M before 15.3(3)M2 and IOS XE 3.10.xS before 3.10.2S allow remote attackers to cause a denial of service (device reload) via crafted SIP messages, aka Bug ID CSCug45898. + + + + + + + + + + + + + + cpe:/o:cisco:ios:15.0%281%29se + cpe:/o:cisco:ios:15.3 + cpe:/o:cisco:ios:15.0 + cpe:/o:cisco:ios:12.2 + cpe:/o:cisco:ios:15.1 + cpe:/o:cisco:ios:15.2 + + CVE-2014-2107 + 2014-03-27T17:55:08.987-04:00 + 2014-03-28T09:41:30.357-04:00 + + + 7.1 + NETWORK + MEDIUM + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-03-28T09:41:26.543-04:00 + + + + + CISCO + 20140326 Cisco 7600 Series Route Switch Processor 720 with 10 Gigabit Ethernet Uplinks Denial of Service Vulnerability + + Cisco IOS 12.2 and 15.0 through 15.3, when used with the Kailash FPGA before 2.6 on RSP720-3C-10GE and RSP720-3CXL-10GE devices, allows remote attackers to cause a denial of service (route switch processor outage) via crafted IP packets, aka Bug ID CSCug84789. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:cisco:ios_xe:3.3.2s + cpe:/o:cisco:ios_xe:3.3.0sg + cpe:/o:cisco:ios_xe:3.7s%28.0%29 + cpe:/o:cisco:ios_xe:3.4s%28.6%29 + cpe:/o:cisco:ios_xe:3.4s%28.2%29 + cpe:/o:cisco:ios_xe:3.8s%28.2%29 + cpe:/o:cisco:ios_xe:3.6s%28.0%29 + cpe:/o:cisco:ios_xe:3.7.0s + cpe:/o:cisco:ios_xe:3.4.1s + cpe:/o:cisco:ios_xe:3.5.2s + cpe:/o:cisco:ios_xe:3.3s%28.0%29 + cpe:/o:cisco:ios_xe:3.2s%28.0%29 + cpe:/o:cisco:ios_xe:3.6.0s + cpe:/o:cisco:ios_xe:3.4.5s + cpe:/o:cisco:ios_xe:3.4.0s + cpe:/o:cisco:ios_xe:3.2.4sg + cpe:/o:cisco:ios_xe:3.2s%28.1%29 + cpe:/o:cisco:ios_xe:3.9.0s + cpe:/o:cisco:ios_xe:3.2.2s + cpe:/o:cisco:ios_xe:3.3.1sg + cpe:/o:cisco:ios_xe:3.9.1s + cpe:/o:cisco:ios_xe:3.4s%28.3%29 + cpe:/o:cisco:ios_xe:3.3.1s + cpe:/o:cisco:ios_xe:3.2.3sg + cpe:/o:cisco:ios_xe:3.6s%28.1%29 + cpe:/o:cisco:ios_xe:3.8.0s + cpe:/o:cisco:ios_xe:3.5.1s + cpe:/o:cisco:ios_xe:3.6.1s + cpe:/o:cisco:ios_xe:3.5s%28.0%29 + cpe:/o:cisco:ios_xe:3.4.4s + cpe:/o:cisco:ios_xe:3.5s%28.1%29 + cpe:/o:cisco:ios_xe:3.4s%28.1%29 + cpe:/o:cisco:ios_xe:3.2.1sg + cpe:/o:cisco:ios_xe:3.8s%28.0%29 + cpe:/o:cisco:ios_xe:3.2s%28.2%29 + cpe:/o:cisco:ios_xe:3.4s%28.4%29 + cpe:/o:cisco:ios_xe:3.2.1s + cpe:/o:cisco:ios_xe:3.2.2sg + cpe:/o:cisco:ios_xe:3.4.3s + cpe:/o:cisco:ios_xe:3.6s%28.2%29 + cpe:/o:cisco:ios_xe:3.5.0s + cpe:/o:cisco:ios_xe:3.7.2s + cpe:/o:cisco:ios_xe:3.3.0s + cpe:/o:cisco:ios_xe:3.10 + cpe:/o:cisco:ios_xe:3.5.xs + cpe:/o:cisco:ios_xe:3.2.0xo + cpe:/o:cisco:ios_xe:3.3s%28.2%29 + cpe:/o:cisco:ios_xe:3.3.3s + cpe:/o:cisco:ios_xe:3.4.0as + cpe:/o:cisco:ios_xe:3.2.0sg + cpe:/o:cisco:ios:15.3 + cpe:/o:cisco:ios_xe:3.4s%28.0%29 + cpe:/o:cisco:ios_xe:3.7s%28.1%29 + cpe:/o:cisco:ios_xe:3.8s%28.1%29 + cpe:/o:cisco:ios_xe:3.4.xs + cpe:/o:cisco:ios_xe:3.5s%28.2%29 + cpe:/o:cisco:ios_xe:3.2.0s + cpe:/o:cisco:ios_xe:3.4s%28.5%29 + cpe:/o:cisco:ios:15.0 + cpe:/o:cisco:ios:15.1 + cpe:/o:cisco:ios:12.2 + cpe:/o:cisco:ios:15.0%281%29se + cpe:/o:cisco:ios_xe:3.6.2s + cpe:/o:cisco:ios_xe:3.4.2s + cpe:/o:cisco:ios_xe:3.7.1s + cpe:/o:cisco:ios_xe:3.3s%28.1%29 + cpe:/o:cisco:ios:15.2 + + CVE-2014-2108 + 2014-03-27T17:55:09.003-04:00 + 2014-03-28T09:49:30.060-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-03-28T09:49:29.747-04:00 + + + + + CISCO + 20140326 Cisco IOS Software Internet Key Exchange Version 2 Denial of Service Vulnerability + + Cisco IOS 12.2 and 15.0 through 15.3 and IOS XE 3.2 through 3.7 before 3.7.5S and 3.8 through 3.10 before 3.10.1S allow remote attackers to cause a denial of service (device reload) via a malformed IKEv2 packet, aka Bug ID CSCui88426. + + + + + + + + + + + + + + + + cpe:/o:cisco:ios:15.4 + cpe:/o:cisco:ios:15.3 + cpe:/o:cisco:ios:15.0 + cpe:/o:cisco:ios:12.4 + cpe:/o:cisco:ios:12.3 + cpe:/o:cisco:ios:12.2 + cpe:/o:cisco:ios:15.1 + cpe:/o:cisco:ios:15.2 + + CVE-2014-2109 + 2014-03-27T17:55:09.033-04:00 + 2014-03-28T10:01:47.163-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-03-28T10:01:32.897-04:00 + + + + + CISCO + 20140326 Cisco IOS Software Network Address Translation Vulnerabilities + + The TCP Input module in Cisco IOS 12.2 through 12.4 and 15.0 through 15.4, when NAT is used, allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted TCP packets, aka Bug IDs CSCuh33843 and CSCuj41494. + + + + + + + + + + + + + + + + cpe:/o:cisco:ios:15.4 + cpe:/o:cisco:ios:15.3 + cpe:/o:cisco:ios:15.0 + cpe:/o:cisco:ios:12.4 + cpe:/o:cisco:ios:12.3 + cpe:/o:cisco:ios:12.2 + cpe:/o:cisco:ios:15.1 + cpe:/o:cisco:ios:15.2 + + CVE-2014-2111 + 2014-03-27T17:55:09.063-04:00 + 2014-03-28T10:06:04.780-04:00 + + + 7.1 + NETWORK + MEDIUM + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-03-28T10:06:04.717-04:00 + + + + + CISCO + 20140326 Cisco IOS Software Network Address Translation Vulnerabilities + + The Application Layer Gateway (ALG) module in Cisco IOS 12.2 through 12.4 and 15.0 through 15.4, when NAT is used, allows remote attackers to cause a denial of service (device reload) via crafted DNS packets, aka Bug ID CSCue00996. + + + + + + + + + + + + cpe:/o:cisco:ios:15.4 + cpe:/o:cisco:ios:15.3 + cpe:/o:cisco:ios:15.1 + cpe:/o:cisco:ios:15.2 + + CVE-2014-2112 + 2014-03-27T17:55:09.080-04:00 + 2014-03-28T11:34:53.333-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-03-28T11:34:53.287-04:00 + + + + + CISCO + 20140326 Cisco IOS Software SSL VPN Denial of Service Vulnerability + + The SSL VPN (aka WebVPN) feature in Cisco IOS 15.1 through 15.4 allows remote attackers to cause a denial of service (memory consumption) via crafted HTTP requests, aka Bug ID CSCuf51357. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:cisco:ios_xe:3.3.2s + cpe:/o:cisco:ios_xe:3.5s%28.1%29 + cpe:/o:cisco:ios_xe:3.3.0sg + cpe:/o:cisco:ios_xe:3.7s%28.0%29 + cpe:/o:cisco:ios_xe:3.8s%28.0%29 + cpe:/o:cisco:ios_xe:3.8s%28.2%29 + cpe:/o:cisco:ios_xe:3.7.0s + cpe:/o:cisco:ios_xe:3.5.0s + cpe:/o:cisco:ios_xe:3.7.2s + cpe:/o:cisco:ios_xe:3.3.0s + cpe:/o:cisco:ios_xe:3.3s%28.0%29 + cpe:/o:cisco:ios_xe:3.10 + cpe:/o:cisco:ios_xe:3.5.xs + cpe:/o:cisco:ios_xe:3.3s%28.2%29 + cpe:/o:cisco:ios_xe:3.3.3s + cpe:/o:cisco:ios:15.3 + cpe:/o:cisco:ios_xe:3.10.1s1 + cpe:/o:cisco:ios_xe:3.10.0s + cpe:/o:cisco:ios_xe:3.7s%28.1%29 + cpe:/o:cisco:ios_xe:3.8s%28.1%29 + cpe:/o:cisco:ios_xe:3.9.0s + cpe:/o:cisco:ios_xe:3.5s%28.2%29 + cpe:/o:cisco:ios_xe:3.3.1sg + cpe:/o:cisco:ios_xe:3.9.1s + cpe:/o:cisco:ios:15.1 + cpe:/o:cisco:ios_xe:3.3.1s + cpe:/o:cisco:ios_xe:3.7.1s + cpe:/o:cisco:ios_xe:3.8.0s + cpe:/o:cisco:ios_xe:3.5.1s + cpe:/o:cisco:ios_xe:3.3s%28.1%29 + cpe:/o:cisco:ios_xe:3.10.1s + cpe:/o:cisco:ios_xe:3.5s%28.0%29 + cpe:/o:cisco:ios:15.2 + + CVE-2014-2113 + 2014-03-27T17:55:09.110-04:00 + 2014-03-28T12:08:42.327-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-03-28T12:08:42.107-04:00 + + + + + CISCO + 20140326 Cisco IOS Software Crafted IPv6 Packet Denial of Service Vulnerability + + Cisco IOS 15.1 through 15.3 and IOS XE 3.3 and 3.5 before 3.5.2E; 3.7 before 3.7.5S; and 3.8, 3.9, and 3.10 before 3.10.2S allow remote attackers to cause a denial of service (I/O memory consumption and device reload) via a malformed IPv6 packet, aka Bug ID CSCui59540. + + + + + + + + + cpe:/a:cisco:emergency_responder:8.6 + + CVE-2014-2114 + 2014-04-04T11:10:20.293-04:00 + 2014-04-04T12:51:05.043-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-04T12:51:00.573-04:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=33644 + + + CISCO + 20140403 Cisco Emergency Responder Cross-Site Scripting Vulnerability + + Cross-site scripting (XSS) vulnerability in UserServlet in Cisco Emergency Responder (ER) 8.6 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun24384. + + + + + + + + + cpe:/a:cisco:emergency_responder:8.6 + + CVE-2014-2115 + 2014-04-04T11:10:37.387-04:00 + 2014-04-04T12:50:04.243-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-04T08:47:07.000-04:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=33643 + + + CISCO + 20140403 Cisco Emergency Responder Cross-Site Request Forgery Vulnerability + + Multiple cross-site request forgery (CSRF) vulnerabilities in CERUserServlet pages in Cisco Emergency Responder (ER) 8.6 and earlier allow remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCun24250. + + + + + + + + + cpe:/a:cisco:emergency_responder:8.6 + + CVE-2014-2116 + 2014-04-04T11:10:37.403-04:00 + 2014-04-04T13:02:02.363-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-04T12:49:02.680-04:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=33641 + + + CISCO + 20140403 Cisco Emergency Responder Dynamic Content Modification Vulnerability + + Cisco Emergency Responder (ER) 8.6 and earlier allows remote attackers to inject web pages and modify dynamic content via unspecified parameters, aka Bug ID CSCun37882. + + + + + + + + + cpe:/a:cisco:emergency_responder:8.6 + + CVE-2014-2117 + 2014-04-04T11:10:37.450-04:00 + 2014-04-04T13:01:51.363-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-04T13:01:46.330-04:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=33642 + + + CISCO + 20140403 Cisco Emergency Responder Open Redirect Vulnerability + + Multiple open redirect vulnerabilities in Cisco Emergency Responder (ER) 8.6 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified parameters, aka Bug ID CSCun37909. + + + + + + + + + + + + + + + + + + cpe:/a:cisco:prime_security_manager:9.0 + cpe:/a:cisco:prime_security_manager:9.1.2-29 + cpe:/a:cisco:prime_security_manager:9.1.3-8 + cpe:/a:cisco:prime_security_manager:9.1.2-42 + cpe:/a:cisco:prime_security_manager:9.1.3-10 + cpe:/a:cisco:prime_security_manager:9.2.1-1 + cpe:/a:cisco:prime_security_manager:9.2.1-2 + cpe:/a:cisco:prime_security_manager:9.1.3-13 + cpe:/a:cisco:prime_security_manager:9.2 + cpe:/a:cisco:prime_security_manager:9.1 + + CVE-2014-2118 + 2014-03-27T17:55:09.127-04:00 + 2014-03-28T12:26:26.500-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-28T12:26:26.407-04:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=33542 + + + CISCO + 20140327 Cisco Prime Security Manager Cross-Site Scripting Vulnerability + + Multiple cross-site scripting (XSS) vulnerabilities in dashboard-related HTML documents in Cisco Prime Security Manager (aka PRSM) 9.2(.1-2) and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCun50687. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:cisco:ironport_asyncos:8.0 + cpe:/o:cisco:ironport_asyncos:7.9.1-039 + cpe:/o:cisco:ironport_asyncos:8.1 + cpe:/o:cisco:ironport_asyncos:8.0.1 + cpe:/h:cisco:content_security_management_appliance:- + cpe:/h:cisco:email_security_appliance:- + cpe:/o:cisco:ironport_asyncos:7.6.2-201 + + CVE-2014-2119 + 2014-03-20T21:04:02.937-04:00 + 2014-03-21T10:13:32.373-04:00 + + + 8.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-21T10:13:29.277-04:00 + + + + + CISCO + 20140319 Cisco AsyncOS Software Code Execution Vulnerability + + The End User Safelist/Blocklist (aka SLBL) service in Cisco AsyncOS Software for Email Security Appliance (ESA) before 7.6.3-023 and 8.x before 8.0.1-023 and Cisco Content Security Management Appliance (SMA) before 7.9.1-110 and 8.x before 8.1.1-013 allows remote authenticated users to execute arbitrary code with root privileges via an FTP session that uploads a modified SLBL database file, aka Bug IDs CSCug79377 and CSCug80118. + + + + + + + + + cpe:/a:cisco:adaptive_security_appliance_software:- + + CVE-2014-2120 + 2014-03-18T21:15:04.007-04:00 + 2014-03-19T14:26:29.703-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-19T14:26:13.233-04:00 + + + + + CISCO + 20140318 Cisco Adaptive Security Appliance WebVPN Login Page Cross-Site Scripting Vulnerability + + Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun19025. + + + + + + + + + cpe:/a:cisco:hosted_collaboration_solution:- + + CVE-2014-2121 + 2014-03-18T21:15:04.037-04:00 + 2014-04-01T02:29:23.203-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-03-19T14:34:09.730-04:00 + + + + + SECTRACK + 1029933 + + + BID + 66283 + + + CISCO + 20140318 Cisco Hosted Collaboration Solution Denial of Service Vulnerability + + The Java-based software in Cisco Hosted Collaboration Solution (HCS) allows remote attackers to cause a denial of service (closing of TCP ports) via unspecified vectors, aka Bug IDs CSCug77633, CSCug77667, CSCug78266, CSCug82795, and CSCuh58643. + + + + + + + + + cpe:/a:cisco:hosted_collaboration_solution:- + + CVE-2014-2122 + 2014-03-18T21:15:04.053-04:00 + 2014-04-01T02:29:26.080-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-03-19T14:36:23.373-04:00 + + + + + XF + cisco-hosted-cve20142122-dos(91907) + + + SECTRACK + 1029936 + + + BID + 66293 + + + CISCO + 20140318 Cisco Hosted Collaboration Solution Memory Leak Vulnerability + + Memory leak in the GUI in the Impact server in Cisco Hosted Collaboration Solution (HCS) allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, aka Bug ID CSCub58999. + + + + + + + + + + + + + + cpe:/o:cisco:ios:15.1%282%29sy3 + cpe:/h:cisco:catalyst_6500 + + CVE-2014-2124 + 2014-03-20T21:04:02.967-04:00 + 2014-04-01T02:29:26.173-04:00 + + + 7.1 + NETWORK + MEDIUM + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-03-21T10:26:00.740-04:00 + + + + + XF + ciscoios-cve20142124-dos(91904) + + + SECTRACK + 1029942 + + + BID + 66301 + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=33413 + + + CISCO + 20140319 Cisco IOS Software Sup2T Denial of Service Vulnerability + + + SECUNIA + 57515 + + Cisco IOS 15.1(2)SY3 and earlier, when used with Supervisor Engine 2T (aka Sup2T) on Catalyst 6500 devices, allows remote attackers to cause a denial of service (device crash) via crafted multicast packets, aka Bug ID CSCuf60783. + + + + + + + + + + + + + + + + cpe:/a:cisco:unity_connection:8.6:%282a%29su3 + cpe:/a:cisco:unity_connection:8.6:%282a%29su2 + cpe:/a:cisco:unity_connection:8.6:%282%29 + cpe:/a:cisco:unity_connection:8.6%282a%29 + cpe:/a:cisco:unity_connection:8.6%281a%29 + cpe:/a:cisco:unity_connection:8.6 + cpe:/a:cisco:unity_connection:8.6:%281%29 + cpe:/a:cisco:unity_connection:8.6:%282a%29su1 + + CVE-2014-2125 + 2014-04-01T23:58:17.090-04:00 + 2014-04-02T12:12:16.860-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-02T12:12:11.937-04:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=33603 + + + CISCO + 20140401 Cisco Unity Connection Cross-Site Scripting Vulnerability + + Cross-site scripting (XSS) vulnerability in the Web Inbox in Cisco Unity Connection 8.6(2a)SU3 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCui33028. + + + + + + + + + + + + + cpe:/a:cisco:adaptive_security_appliance_software:8.4 + cpe:/a:cisco:adaptive_security_appliance_software:8.7 + cpe:/a:cisco:adaptive_security_appliance_software:8.2 + cpe:/a:cisco:adaptive_security_appliance_software:9.0 + cpe:/a:cisco:adaptive_security_appliance_software:9.1 + + CVE-2014-2126 + 2014-04-10T00:34:50.930-04:00 + 2014-04-10T14:04:08.210-04:00 + + + 8.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-10T14:04:08.053-04:00 + + + + + CISCO + 20140409 Multiple Vulnerabilities in Cisco ASA Software + + Cisco Adaptive Security Appliance (ASA) Software 8.2 before 8.2(5.47), 8.4 before 8.4(7.5), 8.7 before 8.7(1.11), 9.0 before 9.0(3.10), and 9.1 before 9.1(3.4) allows remote authenticated users to gain privileges by leveraging level-0 ASDM access, aka Bug ID CSCuj33496. + + + + + + + + + + + + + + + + cpe:/a:cisco:adaptive_security_appliance_software:8.4 + cpe:/a:cisco:adaptive_security_appliance_software:8.6 + cpe:/a:cisco:adaptive_security_appliance_software:8.1 + cpe:/a:cisco:adaptive_security_appliance_software:8.2 + cpe:/a:cisco:adaptive_security_appliance_software:9.0 + cpe:/a:cisco:adaptive_security_appliance_software:8.3%281%29 + cpe:/a:cisco:adaptive_security_appliance_software:9.1 + cpe:/a:cisco:adaptive_security_appliance_software:8.0 + + CVE-2014-2127 + 2014-04-10T00:34:50.960-04:00 + 2014-04-10T14:09:34.750-04:00 + + + 8.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-10T14:09:34.643-04:00 + + + + + CISCO + 20140409 Multiple Vulnerabilities in Cisco ASA Software + + Cisco Adaptive Security Appliance (ASA) Software 8.x before 8.2(5.48), 8.3 before 8.3(2.40), 8.4 before 8.4(7.9), 8.6 before 8.6(1.13), 9.0 before 9.0(4.1), and 9.1 before 9.1(4.3) does not properly process management-session information during privilege validation for SSL VPN portal connections, which allows remote authenticated users to gain privileges by establishing a Clientless SSL VPN session and entering crafted URLs, aka Bug ID CSCul70099. + + + + + + + + + + + + + + cpe:/a:cisco:adaptive_security_appliance_software:8.4 + cpe:/a:cisco:adaptive_security_appliance_software:8.6 + cpe:/a:cisco:adaptive_security_appliance_software:8.2 + cpe:/a:cisco:adaptive_security_appliance_software:8.3%281%29 + cpe:/a:cisco:adaptive_security_appliance_software:9.0 + cpe:/a:cisco:adaptive_security_appliance_software:9.1 + + CVE-2014-2128 + 2014-04-10T00:34:51.007-04:00 + 2014-04-10T14:22:38.107-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-10T14:22:16.497-04:00 + + + + + CISCO + 20140409 Multiple Vulnerabilities in Cisco ASA Software + + The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 8.2 before 8.2(5.47, 8.3 before 8.3(2.40), 8.4 before 8.4(7.3), 8.6 before 8.6(1.13), 9.0 before 9.0(3.8), and 9.1 before 9.1(3.2) allows remote attackers to bypass authentication via (1) a crafted cookie value within modified HTTP POST data or (2) a crafted URL, aka Bug ID CSCua85555. + + + + + + + + + + + + cpe:/a:cisco:adaptive_security_appliance_software:8.4 + cpe:/a:cisco:adaptive_security_appliance_software:8.2 + cpe:/a:cisco:adaptive_security_appliance_software:9.0 + cpe:/a:cisco:adaptive_security_appliance_software:9.1 + + CVE-2014-2129 + 2014-04-10T00:34:51.037-04:00 + 2014-04-10T14:29:00.573-04:00 + + + 7.1 + NETWORK + MEDIUM + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-10T14:29:00.527-04:00 + + + + + CISCO + 20140409 Multiple Vulnerabilities in Cisco ASA Software + + The SIP inspection engine in Cisco Adaptive Security Appliance (ASA) Software 8.2 before 8.2(5.48), 8.4 before 8.4(6.5), 9.0 before 9.0(3.1), and 9.1 before 9.1(2.5) allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted SIP packets, aka Bug ID CSCuh44052. + + + + + + + + + cpe:/o:cisco:ios:- + + CVE-2014-2131 + 2014-03-28T21:55:07.327-04:00 + 2014-03-31T12:07:27.930-04:00 + + + 6.1 + ADJACENT_NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-03-31T12:07:27.883-04:00 + + + + + CISCO + 20140328 Cisco IOS Software High Priority Queue Denial of Service Vulnerability + + The packet driver in Cisco IOS allows remote attackers to cause a denial of service (device reload) via a series of (1) Virtual Switching Systems (VSS) or (2) Bidirectional Forwarding Detection (BFD) packets, aka Bug IDs CSCug41049 and CSCue61890. + + + + + + + + + + + + + + + + + cpe:/h:cisco:web_security_appliance:- + cpe:/a:cisco:web_security_virtual_appliance:7.5.0 + cpe:/a:cisco:web_security_virtual_appliance:7.5.1 + cpe:/a:cisco:web_security_virtual_appliance:7.1.3 + cpe:/a:cisco:web_security_virtual_appliance:7.1.2 + cpe:/a:cisco:web_security_virtual_appliance:7.1.1 + cpe:/a:cisco:web_security_virtual_appliance:7.1.0 + cpe:/a:cisco:web_security_virtual_appliance:7.1.4 + cpe:/a:cisco:web_security_virtual_appliance:7.7 + + CVE-2014-2137 + 2014-04-01T23:58:17.123-04:00 + 2014-04-02T12:28:44.673-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-02T12:28:28.393-04:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=33608 + + + CISCO + 20140401 Cisco WSA HTTP Header Injection Vulnerability + + CRLF injection vulnerability in the web framework in Cisco Web Security Appliance (WSA) 7.7 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct redirection attacks via a crafted URL, aka Bug ID CSCuj61002. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:security_manager:3.2:sp1 + cpe:/a:cisco:security_manager:3.3.1:- + cpe:/a:cisco:security_manager:4.0.1:sp1 + cpe:/a:cisco:security_manager:4.0.1:sp2 + cpe:/a:cisco:security_manager:3.2.1 + cpe:/a:cisco:security_manager:4.0:- + cpe:/a:cisco:security_manager:3.1 + cpe:/a:cisco:security_manager:3.2 + cpe:/a:cisco:security_manager:3.2:sp2 + cpe:/a:cisco:security_manager:3.3:- + cpe:/a:cisco:security_manager:3.3:sp2 + cpe:/a:cisco:security_manager:3.3:sp1 + cpe:/a:cisco:security_manager:4.2:- + cpe:/a:cisco:security_manager:3.2.2:sp2 + cpe:/a:cisco:security_manager:3.2.1:sp1 + cpe:/a:cisco:security_manager:3.2.2:sp3 + cpe:/a:cisco:security_manager:3.2.2:sp1 + cpe:/a:cisco:security_manager:3.2.2:- + cpe:/a:cisco:security_manager:3.2.2:sp4 + cpe:/a:cisco:security_manager:3.1.1 + cpe:/a:cisco:security_manager:4.0.1:- + cpe:/a:cisco:security_manager:4.1:sp1 + cpe:/a:cisco:security_manager:4.1:sp2 + cpe:/a:cisco:security_manager:4.0:sp1 + cpe:/a:cisco:security_manager:3.3.1:sp3 + cpe:/a:cisco:security_manager:3.3.1:sp4 + cpe:/a:cisco:security_manager:3.3.1:sp1 + cpe:/a:cisco:security_manager:3.3.1:sp2 + cpe:/a:cisco:security_manager:3.1.1:sp3 + cpe:/a:cisco:security_manager:3.0.2 + cpe:/a:cisco:security_manager:4.1 + + CVE-2014-2138 + 2014-04-01T23:58:17.137-04:00 + 2014-04-02T12:56:56.573-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-02T12:56:51.120-04:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=33607 + + + CISCO + 20140401 Cisco Security Manager HTTP Header Redirection Vulnerability + + CRLF injection vulnerability in the web framework in Cisco Security Manager 4.2 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct redirection attacks via a crafted URL, aka Bug ID CSCun82349. + + + + + + + + + + + + + + + + + + + + + cpe:/o:cisco:cisco_ons_15454_system_software:9.2.2 + cpe:/o:cisco:cisco_ons_15454_system_software:9.2.1 + cpe:/o:cisco:cisco_ons_15454_system_software:9.4 + cpe:/h:cisco:ons_15454 + cpe:/o:cisco:cisco_ons_15454_system_software:9.3 + cpe:/o:cisco:cisco_ons_15454_system_software:9.0 + cpe:/o:cisco:cisco_ons_15454_system_software:9.6 + cpe:/o:cisco:cisco_ons_15454_system_software:9.2 + cpe:/o:cisco:cisco_ons_15454_system_software:9.1 + + CVE-2014-2139 + 2014-04-12T00:37:31.817-04:00 + 2014-04-14T14:05:46.210-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-14T14:05:45.960-04:00 + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=33681 + + + CISCO + 20140407 Cisco ONS 15454 Controller Card Denial of Service Vulnerability + + Cisco ONS 15454 controller cards with software 9.6 and earlier allow remote attackers to cause a denial of service (flash write outage) via a TCP FIN attack that triggers file-descriptor exhaustion, aka Bug ID CSCug97315. + + + + + + + + + + + + + + + + + + + + + cpe:/o:cisco:cisco_ons_15454_system_software:9.2.2 + cpe:/o:cisco:cisco_ons_15454_system_software:9.2.1 + cpe:/o:cisco:cisco_ons_15454_system_software:9.4 + cpe:/h:cisco:ons_15454 + cpe:/o:cisco:cisco_ons_15454_system_software:9.3 + cpe:/o:cisco:cisco_ons_15454_system_software:9.0 + cpe:/o:cisco:cisco_ons_15454_system_software:9.6 + cpe:/o:cisco:cisco_ons_15454_system_software:9.2 + cpe:/o:cisco:cisco_ons_15454_system_software:9.1 + + CVE-2014-2140 + 2014-04-12T00:37:31.847-04:00 + 2014-04-14T14:05:53.537-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-14T14:05:53.367-04:00 + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=33680 + + + CISCO + 20140407 Cisco ONS 15454 Controller Card Denial of Service Vulnerability + + Cisco ONS 15454 controller cards with software 9.6 and earlier allow remote attackers to cause a denial of service (card reset) via a TCP FIN attack that triggers file-descriptor exhaustion and a failure to open a CAL pipe, aka Bug ID CSCug97348. + + + + + + + + + + + + + + + + + + + + + cpe:/o:cisco:cisco_ons_15454_system_software:9.2.2 + cpe:/o:cisco:cisco_ons_15454_system_software:9.2.1 + cpe:/o:cisco:cisco_ons_15454_system_software:9.4 + cpe:/h:cisco:ons_15454 + cpe:/o:cisco:cisco_ons_15454_system_software:9.3 + cpe:/o:cisco:cisco_ons_15454_system_software:9.0 + cpe:/o:cisco:cisco_ons_15454_system_software:9.6 + cpe:/o:cisco:cisco_ons_15454_system_software:9.2 + cpe:/o:cisco:cisco_ons_15454_system_software:9.1 + + CVE-2014-2141 + 2014-04-10T00:34:51.053-04:00 + 2014-04-10T14:33:03.800-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-10T14:32:34.203-04:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=33682 + + + CISCO + 20140407 Cisco ONS 15454 Controller Card Denial of Service Vulnerability + + The session-termination functionality on Cisco ONS 15454 controller cards with software 9.6 and earlier does not initialize an unspecified pointer, which allows remote authenticated users to cause a denial of service (card reset) via crafted session-close actions, aka Bug ID CSCug97416. + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:cisco:ons_15454_system_software:9.8 + cpe:/o:cisco:cisco_ons_15454_system_software:9.2.2 + cpe:/o:cisco:cisco_ons_15454_system_software:9.2.1 + cpe:/o:cisco:ons_15454_system_software:10.0 + cpe:/o:cisco:cisco_ons_15454_system_software:9.4 + cpe:/h:cisco:ons_15454 + cpe:/o:cisco:cisco_ons_15454_system_software:9.3 + cpe:/o:cisco:cisco_ons_15454_system_software:9.0 + cpe:/o:cisco:cisco_ons_15454_system_software:9.6 + cpe:/o:cisco:cisco_ons_15454_system_software:9.2 + cpe:/o:cisco:cisco_ons_15454_system_software:9.1 + + CVE-2014-2142 + 2014-04-12T00:37:31.877-04:00 + 2014-04-14T14:10:22.923-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-14T14:10:22.673-04:00 + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=33679 + + + CISCO + 20140407 Cisco ONS 15454 Controller Card Denial of Service Vulnerability + + Cisco ONS 15454 controller cards with software 10.0 and earlier allow remote attackers to cause a denial of service (card reload) via a crafted HTTP URI, aka Bug ID CSCun06870. + + + + + + + + + + + + + + + + + + + + + + cpe:/o:cisco:ios:15.4 + cpe:/o:cisco:ios:15.3 + cpe:/o:cisco:ios:15.0%281%29se + cpe:/o:cisco:ios:15.3%283%29m1 + cpe:/o:cisco:ios:15.3%283%29m2 + cpe:/o:cisco:ios:15.3%282%29s + cpe:/o:cisco:ios:15.4%281%29t + cpe:/o:cisco:ios:15.3s + cpe:/o:cisco:ios:15.3%283%29m + cpe:/o:cisco:ios:15.3%283%29s + cpe:/o:cisco:ios:15.0 + cpe:/o:cisco:ios_xe:- + cpe:/o:cisco:ios:15.2 + cpe:/o:cisco:ios:15.1 + + CVE-2014-2143 + 2014-04-04T11:10:37.513-04:00 + 2014-04-04T13:23:50.640-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-04T13:23:50.517-04:00 + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=33639 + + + CISCO + 20140403 Cisco IOS Software IKE Main Mode Vulnerability + + The IKE implementation in Cisco IOS 15.4(1)T and earlier and IOS XE allows remote attackers to cause a denial of service (security-association drop) via crafted Main Mode packets, aka Bug ID CSCun31021. + + + + + + + + + cpe:/o:cisco:ios_xr + + CVE-2014-2144 + 2014-04-05T00:01:38.687-04:00 + 2014-04-07T10:16:51.877-04:00 + + + 6.1 + ADJACENT_NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-07T10:14:26.890-04:00 + + + + + CISCO + 20140404 Cisco IOS XR Software ICMPv6 Redirect Vulnerability + + Cisco IOS XR does not properly throttle ICMPv6 redirect packets, which allows remote attackers to cause a denial of service (IPv4 and IPv6 transit outage) via crafted redirect messages, aka Bug ID CSCum14266. + + + + + + + + + cpe:/a:cisco:unity_connection:- + + CVE-2014-2145 + 2014-04-05T00:01:38.700-04:00 + 2014-04-07T10:27:32.103-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-07T10:27:23.243-04:00 + + + + + CISCO + 20140404 Cisco Unity Connection Directory Traversal Vulnerability + + Directory traversal vulnerability in the messaging API in Cisco Unity Connection allows remote authenticated users to read arbitrary files via vectors related to unenforced access constraints for .wav files and the audio/x-wav MIME type, aka Bug ID CSCun91071. + + + + + + + + + cpe:/a:cisco:adaptive_security_appliance_software:- + + CVE-2014-2154 + 2014-04-23T07:52:59.790-04:00 + 2014-04-24T10:09:17.650-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-24T10:09:17.617-04:00 + + + + + CISCO + 20140422 Cisco ASA SIP Inspection Memory Leak Vulnerability + + Memory leak in the SIP inspection engine in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to cause a denial of service (memory consumption and instability) via crafted SIP packets, aka Bug ID CSCuf67469. + + + + + + + + + cpe:/a:cisco:cns_network_registrar:7.1 + + CVE-2014-2155 + 2014-04-19T17:55:07.087-04:00 + 2014-04-21T15:59:10.873-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-21T15:59:10.813-04:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=33850 + + + CISCO + 20140417 Cisco Network Registrar DHCPv6 Denial of Service Vulnerability + + The DHCPv6 server module in Cisco CNS Network Registrar 7.1 allows remote attackers to cause a denial of service (daemon reload) via a malformed DHCPv6 packet, aka Bug ID CSCuo07437. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_system_software:f9.3 + cpe:/h:cisco:telepresence_system_codec_3000_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.2 + cpe:/h:cisco:telepresence_system_edge_75_mxp:- + cpe:/h:cisco:telepresence_system_edge_95_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.1 + cpe:/h:cisco:tandberg_880_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.0 + cpe:/h:cisco:telepresence_system_edge_85_mxp:- + cpe:/h:cisco:telepresence_system_codec_6000_mxp:- + cpe:/h:cisco:tandberg_550_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.1.2 + cpe:/a:cisco:telepresence_system_software:f9.1.1 + cpe:/h:cisco:tandberg_990_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.1.0 + cpe:/a:cisco:telepresence_system_software:fnc9.3 + cpe:/h:cisco:telepresence_system_1700_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.0.1 + cpe:/h:cisco:tandberg_770_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.0.2 + cpe:/h:cisco:telepresence_system_1000_mxp:- + cpe:/h:cisco:tandberg_2000_mxp:- + + CVE-2014-2156 + 2014-05-02T06:55:07.977-04:00 + 2014-05-02T11:49:05.840-04:00 + + + 7.1 + NETWORK + MEDIUM + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-05-02T11:49:05.340-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series + + Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCty45739. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_system_software:f9.3 + cpe:/h:cisco:telepresence_system_codec_3000_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.2 + cpe:/h:cisco:telepresence_system_edge_75_mxp:- + cpe:/h:cisco:telepresence_system_edge_95_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.1 + cpe:/h:cisco:tandberg_880_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.0 + cpe:/h:cisco:telepresence_system_edge_85_mxp:- + cpe:/h:cisco:telepresence_system_codec_6000_mxp:- + cpe:/h:cisco:tandberg_550_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.1.2 + cpe:/a:cisco:telepresence_system_software:f9.1.1 + cpe:/h:cisco:tandberg_990_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.1.0 + cpe:/a:cisco:telepresence_system_software:fnc9.3 + cpe:/h:cisco:telepresence_system_1700_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.0.1 + cpe:/h:cisco:tandberg_770_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.0.2 + cpe:/h:cisco:telepresence_system_1000_mxp:- + cpe:/h:cisco:tandberg_2000_mxp:- + + CVE-2014-2157 + 2014-05-02T06:55:08.007-04:00 + 2014-05-02T12:03:27.213-04:00 + + + 7.1 + NETWORK + MEDIUM + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-05-02T12:03:26.963-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series + + Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCty45733. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_system_software:f9.3 + cpe:/h:cisco:telepresence_system_codec_3000_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.2 + cpe:/h:cisco:telepresence_system_edge_75_mxp:- + cpe:/h:cisco:telepresence_system_edge_95_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.1 + cpe:/h:cisco:tandberg_880_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.0 + cpe:/h:cisco:telepresence_system_edge_85_mxp:- + cpe:/h:cisco:telepresence_system_codec_6000_mxp:- + cpe:/h:cisco:tandberg_550_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.1.2 + cpe:/a:cisco:telepresence_system_software:f9.1.1 + cpe:/h:cisco:tandberg_990_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.1.0 + cpe:/a:cisco:telepresence_system_software:fnc9.3 + cpe:/h:cisco:telepresence_system_1700_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.0.1 + cpe:/h:cisco:tandberg_770_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.0.2 + cpe:/h:cisco:telepresence_system_1000_mxp:- + cpe:/h:cisco:tandberg_2000_mxp:- + + CVE-2014-2158 + 2014-05-02T06:55:08.037-04:00 + 2014-05-02T12:18:44.133-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-05-02T12:18:43.603-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series + + Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCty45720. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_system_software:f9.3 + cpe:/h:cisco:telepresence_system_codec_3000_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.2 + cpe:/h:cisco:telepresence_system_edge_75_mxp:- + cpe:/h:cisco:telepresence_system_edge_95_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.1 + cpe:/h:cisco:tandberg_880_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.0 + cpe:/h:cisco:telepresence_system_edge_85_mxp:- + cpe:/h:cisco:telepresence_system_codec_6000_mxp:- + cpe:/h:cisco:tandberg_550_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.1.2 + cpe:/a:cisco:telepresence_system_software:f9.1.1 + cpe:/h:cisco:tandberg_990_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.1.0 + cpe:/a:cisco:telepresence_system_software:fnc9.3 + cpe:/h:cisco:telepresence_system_1700_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.0.1 + cpe:/h:cisco:tandberg_770_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.0.2 + cpe:/h:cisco:telepresence_system_1000_mxp:- + cpe:/h:cisco:tandberg_2000_mxp:- + + CVE-2014-2159 + 2014-05-02T06:55:08.070-04:00 + 2014-05-02T12:23:55.550-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-05-02T12:23:55.317-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series + + The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted packets, aka Bug ID CSCtq78722. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_system_software:f9.3 + cpe:/h:cisco:telepresence_system_codec_3000_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.2 + cpe:/h:cisco:telepresence_system_edge_75_mxp:- + cpe:/h:cisco:telepresence_system_edge_95_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.1 + cpe:/h:cisco:tandberg_880_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.0 + cpe:/h:cisco:telepresence_system_edge_85_mxp:- + cpe:/h:cisco:telepresence_system_codec_6000_mxp:- + cpe:/h:cisco:tandberg_550_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.1.2 + cpe:/a:cisco:telepresence_system_software:f9.1.1 + cpe:/h:cisco:tandberg_990_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.1.0 + cpe:/a:cisco:telepresence_system_software:fnc9.3 + cpe:/h:cisco:telepresence_system_1700_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.0.1 + cpe:/h:cisco:tandberg_770_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.0.2 + cpe:/h:cisco:telepresence_system_1000_mxp:- + cpe:/h:cisco:tandberg_2000_mxp:- + + CVE-2014-2160 + 2014-05-02T06:55:08.100-04:00 + 2014-05-02T12:40:58.290-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-05-02T12:40:57.930-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series + + The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted packets, aka Bug ID CSCty45745. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_system_software:f9.3 + cpe:/h:cisco:telepresence_system_codec_3000_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.2 + cpe:/h:cisco:telepresence_system_edge_75_mxp:- + cpe:/h:cisco:telepresence_system_edge_95_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.1 + cpe:/h:cisco:tandberg_880_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.0 + cpe:/h:cisco:telepresence_system_edge_85_mxp:- + cpe:/h:cisco:telepresence_system_codec_6000_mxp:- + cpe:/h:cisco:tandberg_550_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.1.2 + cpe:/a:cisco:telepresence_system_software:f9.1.1 + cpe:/h:cisco:tandberg_990_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.1.0 + cpe:/a:cisco:telepresence_system_software:fnc9.3 + cpe:/h:cisco:telepresence_system_1700_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.0.1 + cpe:/h:cisco:tandberg_770_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.0.2 + cpe:/h:cisco:telepresence_system_1000_mxp:- + cpe:/h:cisco:tandberg_2000_mxp:- + + CVE-2014-2161 + 2014-05-02T06:55:08.117-04:00 + 2014-05-02T12:43:40.373-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-05-02T12:43:40.200-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series + + The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted packets, aka Bug ID CSCty45731. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_tc_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.3 + cpe:/a:cisco:telepresence_tc_software:4.1.1 + cpe:/a:cisco:telepresence_te_software:4.1.0 + cpe:/a:cisco:telepresence_te_software:4.1.1 + cpe:/a:cisco:telepresence_tc_software:4.0.4 + cpe:/a:cisco:telepresence_te_software:6.0 + cpe:/a:cisco:telepresence_tc_software:4.0.0 + cpe:/a:cisco:telepresence_tc_software:4.0.1 + cpe:/a:cisco:telepresence_tc_software:4.2.0 + cpe:/a:cisco:telepresence_tc_software:4.2.1 + cpe:/a:cisco:telepresence_tc_software:4.2.2 + cpe:/a:cisco:telepresence_tc_software:4.2.3 + cpe:/a:cisco:telepresence_tc_software:4.2.4 + cpe:/a:cisco:telepresence_tc_software:5.1.3 + cpe:/a:cisco:telepresence_tc_software:5.0.2 + cpe:/a:cisco:telepresence_tc_software:5.1.4 + cpe:/a:cisco:telepresence_tc_software:5.1.1 + cpe:/a:cisco:telepresence_tc_software:5.1.2 + cpe:/a:cisco:telepresence_tc_software:5.1.5 + cpe:/a:cisco:telepresence_tc_software:5.1.7 + cpe:/a:cisco:telepresence_tc_software:5.1.0 + cpe:/a:cisco:telepresence_tc_software:5.0.0 + cpe:/a:cisco:telepresence_tc_software:5.1.6 + cpe:/a:cisco:telepresence_tc_software:5.0.1 + + CVE-2014-2162 + 2014-05-02T06:55:08.147-04:00 + 2014-05-02T14:14:17.070-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-05-02T14:14:14.103-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCud29566. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_tc_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.3 + cpe:/a:cisco:telepresence_tc_software:4.1.1 + cpe:/a:cisco:telepresence_te_software:4.1.0 + cpe:/a:cisco:telepresence_te_software:4.1.1 + cpe:/a:cisco:telepresence_tc_software:4.0.4 + cpe:/a:cisco:telepresence_tc_software:4.0.0 + cpe:/a:cisco:telepresence_tc_software:4.0.1 + cpe:/a:cisco:telepresence_tc_software:4.2.0 + cpe:/a:cisco:telepresence_tc_software:4.2.1 + cpe:/a:cisco:telepresence_tc_software:4.2.2 + cpe:/a:cisco:telepresence_tc_software:4.2.3 + cpe:/a:cisco:telepresence_tc_software:4.2.4 + cpe:/a:cisco:telepresence_tc_software:5.1.3 + cpe:/a:cisco:telepresence_tc_software:5.0.2 + cpe:/a:cisco:telepresence_tc_software:5.1.4 + cpe:/a:cisco:telepresence_tc_software:5.1.1 + cpe:/a:cisco:telepresence_tc_software:5.1.2 + cpe:/a:cisco:telepresence_tc_software:5.1.5 + cpe:/a:cisco:telepresence_tc_software:5.1.7 + cpe:/a:cisco:telepresence_tc_software:5.1.0 + cpe:/a:cisco:telepresence_tc_software:5.0.0 + cpe:/a:cisco:telepresence_tc_software:5.1.6 + cpe:/a:cisco:telepresence_tc_software:5.0.1 + + CVE-2014-2163 + 2014-05-02T06:55:08.180-04:00 + 2014-05-02T14:13:53.820-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-05-02T14:13:50.697-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCua64961. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_tc_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.3 + cpe:/a:cisco:telepresence_te_software:4.1.0 + cpe:/a:cisco:telepresence_tc_software:4.1.1 + cpe:/a:cisco:telepresence_te_software:4.1.1 + cpe:/a:cisco:telepresence_tc_software:4.0.4 + cpe:/a:cisco:telepresence_te_software:6.0 + cpe:/a:cisco:telepresence_tc_software:4.0.0 + cpe:/a:cisco:telepresence_tc_software:4.0.1 + cpe:/a:cisco:telepresence_tc_software:4.2.0 + cpe:/a:cisco:telepresence_tc_software:4.2.1 + cpe:/a:cisco:telepresence_tc_software:4.2.2 + cpe:/a:cisco:telepresence_tc_software:4.2.3 + cpe:/a:cisco:telepresence_tc_software:4.2.4 + cpe:/a:cisco:telepresence_tc_software:5.0.2 + cpe:/a:cisco:telepresence_tc_software:5.1.3 + cpe:/a:cisco:telepresence_tc_software:5.1.4 + cpe:/a:cisco:telepresence_tc_software:5.1.1 + cpe:/a:cisco:telepresence_tc_software:5.1.2 + cpe:/a:cisco:telepresence_tc_software:5.1.5 + cpe:/a:cisco:telepresence_tc_software:5.1.7 + cpe:/a:cisco:telepresence_tc_software:5.1.0 + cpe:/a:cisco:telepresence_tc_software:5.0.0 + cpe:/a:cisco:telepresence_tc_software:5.0.1 + cpe:/a:cisco:telepresence_tc_software:5.1.6 + + CVE-2014-2164 + 2014-05-02T06:55:08.193-04:00 + 2014-05-02T14:13:20.710-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-05-02T14:13:17.883-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCuj94651. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_tc_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.3 + cpe:/a:cisco:telepresence_te_software:4.1.0 + cpe:/a:cisco:telepresence_tc_software:4.1.1 + cpe:/a:cisco:telepresence_te_software:4.1.1 + cpe:/a:cisco:telepresence_tc_software:4.0.4 + cpe:/a:cisco:telepresence_te_software:6.0 + cpe:/a:cisco:telepresence_tc_software:4.0.0 + cpe:/a:cisco:telepresence_tc_software:4.0.1 + cpe:/a:cisco:telepresence_tc_software:4.2.0 + cpe:/a:cisco:telepresence_tc_software:4.2.1 + cpe:/a:cisco:telepresence_tc_software:4.2.2 + cpe:/a:cisco:telepresence_tc_software:4.2.3 + cpe:/a:cisco:telepresence_tc_software:4.2.4 + cpe:/a:cisco:telepresence_tc_software:5.0.2 + cpe:/a:cisco:telepresence_tc_software:5.1.3 + cpe:/a:cisco:telepresence_tc_software:5.1.4 + cpe:/a:cisco:telepresence_tc_software:5.1.1 + cpe:/a:cisco:telepresence_tc_software:5.1.2 + cpe:/a:cisco:telepresence_tc_software:5.1.5 + cpe:/a:cisco:telepresence_tc_software:5.1.7 + cpe:/a:cisco:telepresence_tc_software:5.1.0 + cpe:/a:cisco:telepresence_tc_software:5.0.0 + cpe:/a:cisco:telepresence_tc_software:5.0.1 + cpe:/a:cisco:telepresence_tc_software:5.1.6 + + CVE-2014-2165 + 2014-05-02T06:55:08.227-04:00 + 2014-05-02T14:12:54.537-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-05-02T14:12:52.367-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCtq72699. + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_tc_software:4.1.2 + cpe:/a:cisco:telepresence_tc_software:4.2.0 + cpe:/a:cisco:telepresence_te_software:4.1.2 + cpe:/a:cisco:telepresence_tc_software:4.2.1 + cpe:/a:cisco:telepresence_te_software:4.1.3 + cpe:/a:cisco:telepresence_tc_software:4.2.2 + cpe:/a:cisco:telepresence_tc_software:4.1.1 + cpe:/a:cisco:telepresence_tc_software:4.2.3 + cpe:/a:cisco:telepresence_te_software:4.1.0 + cpe:/a:cisco:telepresence_tc_software:4.2.4 + cpe:/a:cisco:telepresence_te_software:4.1.1 + cpe:/a:cisco:telepresence_tc_software:4.0.4 + cpe:/a:cisco:telepresence_tc_software:4.0.0 + cpe:/a:cisco:telepresence_tc_software:4.0.1 + + CVE-2014-2166 + 2014-05-02T06:55:08.240-04:00 + 2014-05-02T13:41:32.207-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-05-02T13:41:31.647-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + The SIP implementation in Cisco TelePresence TC Software 4.x and TE Software 4.x allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCto70562. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_tc_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.3 + cpe:/a:cisco:telepresence_tc_software:4.1.1 + cpe:/a:cisco:telepresence_te_software:4.1.0 + cpe:/a:cisco:telepresence_te_software:4.1.1 + cpe:/a:cisco:telepresence_tc_software:4.0.4 + cpe:/a:cisco:telepresence_te_software:6.0 + cpe:/a:cisco:telepresence_tc_software:4.0.0 + cpe:/a:cisco:telepresence_tc_software:4.0.1 + cpe:/a:cisco:telepresence_tc_software:4.2.0 + cpe:/a:cisco:telepresence_tc_software:4.2.1 + cpe:/a:cisco:telepresence_tc_software:4.2.2 + cpe:/a:cisco:telepresence_tc_software:4.2.3 + cpe:/a:cisco:telepresence_tc_software:4.2.4 + cpe:/a:cisco:telepresence_tc_software:5.1.3 + cpe:/a:cisco:telepresence_tc_software:5.0.2 + cpe:/a:cisco:telepresence_tc_software:5.1.4 + cpe:/a:cisco:telepresence_tc_software:5.1.1 + cpe:/a:cisco:telepresence_tc_software:5.1.2 + cpe:/a:cisco:telepresence_tc_software:5.1.5 + cpe:/a:cisco:telepresence_tc_software:5.1.7 + cpe:/a:cisco:telepresence_tc_software:5.1.0 + cpe:/a:cisco:telepresence_tc_software:5.0.0 + cpe:/a:cisco:telepresence_tc_software:5.1.6 + cpe:/a:cisco:telepresence_tc_software:5.0.1 + + CVE-2014-2167 + 2014-05-02T06:55:08.273-04:00 + 2014-05-02T14:12:16.380-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-05-02T14:12:14.223-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCua86589. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_tc_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.3 + cpe:/a:cisco:telepresence_te_software:4.1.0 + cpe:/a:cisco:telepresence_tc_software:4.1.1 + cpe:/a:cisco:telepresence_te_software:4.1.1 + cpe:/a:cisco:telepresence_tc_software:4.0.4 + cpe:/a:cisco:telepresence_te_software:6.0 + cpe:/a:cisco:telepresence_tc_software:4.0.0 + cpe:/a:cisco:telepresence_tc_software:4.0.1 + cpe:/a:cisco:telepresence_tc_software:4.2.0 + cpe:/a:cisco:telepresence_tc_software:4.2.1 + cpe:/a:cisco:telepresence_tc_software:4.2.2 + cpe:/a:cisco:telepresence_tc_software:4.2.3 + cpe:/a:cisco:telepresence_tc_software:4.2.4 + cpe:/a:cisco:telepresence_tc_software:5.0.2 + cpe:/a:cisco:telepresence_tc_software:5.1.3 + cpe:/a:cisco:telepresence_tc_software:5.1.4 + cpe:/a:cisco:telepresence_tc_software:5.1.1 + cpe:/a:cisco:telepresence_tc_software:5.1.2 + cpe:/a:cisco:telepresence_tc_software:5.1.5 + cpe:/a:cisco:telepresence_tc_software:5.1.7 + cpe:/a:cisco:telepresence_tc_software:5.1.0 + cpe:/a:cisco:telepresence_tc_software:5.0.0 + cpe:/a:cisco:telepresence_tc_software:5.0.1 + cpe:/a:cisco:telepresence_tc_software:5.1.6 + + CVE-2014-2168 + 2014-05-02T06:55:08.287-04:00 + 2014-05-02T14:11:50.380-04:00 + + + 7.6 + NETWORK + HIGH + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-05-02T14:11:45.863-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + Buffer overflow in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to execute arbitrary code via crafted DNS response packets, aka Bug ID CSCty44804. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_tc_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.3 + cpe:/a:cisco:telepresence_te_software:4.1.0 + cpe:/a:cisco:telepresence_tc_software:4.1.1 + cpe:/a:cisco:telepresence_te_software:4.1.1 + cpe:/a:cisco:telepresence_tc_software:4.0.4 + cpe:/a:cisco:telepresence_te_software:6.0 + cpe:/a:cisco:telepresence_tc_software:4.0.0 + cpe:/a:cisco:telepresence_tc_software:4.0.1 + cpe:/a:cisco:telepresence_tc_software:4.2.0 + cpe:/a:cisco:telepresence_tc_software:4.2.1 + cpe:/a:cisco:telepresence_tc_software:4.2.2 + cpe:/a:cisco:telepresence_tc_software:4.2.3 + cpe:/a:cisco:telepresence_tc_software:4.2.4 + cpe:/a:cisco:telepresence_tc_software:5.0.2 + cpe:/a:cisco:telepresence_tc_software:5.1.3 + cpe:/a:cisco:telepresence_tc_software:5.1.4 + cpe:/a:cisco:telepresence_tc_software:5.1.1 + cpe:/a:cisco:telepresence_tc_software:5.1.2 + cpe:/a:cisco:telepresence_tc_software:6.0.0 + cpe:/a:cisco:telepresence_tc_software:5.1.5 + cpe:/a:cisco:telepresence_tc_software:6.0.1 + cpe:/a:cisco:telepresence_tc_software:6.1.0 + cpe:/a:cisco:telepresence_tc_software:5.1.7 + cpe:/a:cisco:telepresence_tc_software:5.1.0 + cpe:/a:cisco:telepresence_tc_software:6.1.1 + cpe:/a:cisco:telepresence_tc_software:5.0.0 + cpe:/a:cisco:telepresence_tc_software:6.1.2 + cpe:/a:cisco:telepresence_tc_software:5.0.1 + cpe:/a:cisco:telepresence_tc_software:5.1.6 + + CVE-2014-2169 + 2014-05-02T06:55:08.320-04:00 + 2014-05-02T14:11:05.753-04:00 + + + 9.0 + NETWORK + LOW + SINGLE_INSTANCE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-05-02T14:11:03.360-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + Cisco TelePresence TC Software 4.x through 6.x before 6.2.0 and TE Software 4.x and 6.0 allow remote authenticated users to execute arbitrary commands by using the commands as arguments to internal system scripts, aka Bug ID CSCue60211. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_tc_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.3 + cpe:/a:cisco:telepresence_te_software:4.1.0 + cpe:/a:cisco:telepresence_tc_software:4.1.1 + cpe:/a:cisco:telepresence_te_software:4.1.1 + cpe:/a:cisco:telepresence_tc_software:4.0.4 + cpe:/a:cisco:telepresence_te_software:6.0 + cpe:/a:cisco:telepresence_tc_software:4.0.0 + cpe:/a:cisco:telepresence_tc_software:4.0.1 + cpe:/a:cisco:telepresence_tc_software:4.2.0 + cpe:/a:cisco:telepresence_tc_software:4.2.1 + cpe:/a:cisco:telepresence_tc_software:4.2.2 + cpe:/a:cisco:telepresence_tc_software:4.2.3 + cpe:/a:cisco:telepresence_tc_software:4.2.4 + cpe:/a:cisco:telepresence_tc_software:5.0.2 + cpe:/a:cisco:telepresence_tc_software:5.1.3 + cpe:/a:cisco:telepresence_tc_software:5.1.4 + cpe:/a:cisco:telepresence_tc_software:5.1.1 + cpe:/a:cisco:telepresence_tc_software:5.1.2 + cpe:/a:cisco:telepresence_tc_software:6.0.0 + cpe:/a:cisco:telepresence_tc_software:5.1.5 + cpe:/a:cisco:telepresence_tc_software:5.1.0 + cpe:/a:cisco:telepresence_tc_software:5.0.0 + cpe:/a:cisco:telepresence_tc_software:5.0.1 + cpe:/a:cisco:telepresence_tc_software:5.1.6 + + CVE-2014-2170 + 2014-05-02T06:55:08.337-04:00 + 2014-05-02T14:00:25.717-04:00 + + + 9.0 + NETWORK + LOW + SINGLE_INSTANCE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-05-02T14:00:25.403-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + Cisco TelePresence TC Software 4.x and 5.x before 5.1.7 and 6.x before 6.0.1 and TE Software 4.x and 6.0 allow remote authenticated users to execute arbitrary commands by using the commands as arguments to tshell (aka tcsh) scripts, aka Bug ID CSCue60202. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_te_software:6.0.1 + cpe:/a:cisco:telepresence_tc_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.3 + cpe:/a:cisco:telepresence_te_software:4.1.0 + cpe:/a:cisco:telepresence_tc_software:4.1.1 + cpe:/a:cisco:telepresence_te_software:4.1.1 + cpe:/a:cisco:telepresence_tc_software:4.0.4 + cpe:/a:cisco:telepresence_te_software:6.0 + cpe:/a:cisco:telepresence_tc_software:4.0.0 + cpe:/a:cisco:telepresence_tc_software:4.0.1 + cpe:/a:cisco:telepresence_tc_software:4.2.0 + cpe:/a:cisco:telepresence_tc_software:4.2.1 + cpe:/a:cisco:telepresence_tc_software:4.2.2 + cpe:/a:cisco:telepresence_tc_software:4.2.3 + cpe:/a:cisco:telepresence_tc_software:4.2.4 + cpe:/a:cisco:telepresence_tc_software:5.0.2 + cpe:/a:cisco:telepresence_tc_software:5.1.3 + cpe:/a:cisco:telepresence_tc_software:5.1.4 + cpe:/a:cisco:telepresence_tc_software:5.1.1 + cpe:/a:cisco:telepresence_tc_software:5.1.2 + cpe:/a:cisco:telepresence_tc_software:6.0.0 + cpe:/a:cisco:telepresence_tc_software:5.1.5 + cpe:/a:cisco:telepresence_tc_software:5.1.7 + cpe:/a:cisco:telepresence_tc_software:5.1.0 + cpe:/a:cisco:telepresence_tc_software:5.0.0 + cpe:/a:cisco:telepresence_tc_software:5.0.1 + cpe:/a:cisco:telepresence_tc_software:5.1.6 + + CVE-2014-2171 + 2014-05-02T06:55:08.367-04:00 + 2014-05-02T14:10:31.783-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-05-02T14:10:29.673-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + Heap-based buffer overflow in Cisco TelePresence TC Software 4.x through 6.x before 6.0.1 and TE Software 4.x and 6.0.x before 6.0.2 allows remote attackers to execute arbitrary code via crafted SIP packets, aka Bug ID CSCud81796. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_tc_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.3 + cpe:/a:cisco:telepresence_tc_software:4.1.1 + cpe:/a:cisco:telepresence_te_software:4.1.0 + cpe:/a:cisco:telepresence_te_software:4.1.1 + cpe:/a:cisco:telepresence_tc_software:4.0.4 + cpe:/a:cisco:telepresence_te_software:6.0 + cpe:/a:cisco:telepresence_tc_software:4.0.0 + cpe:/a:cisco:telepresence_tc_software:4.0.1 + cpe:/a:cisco:telepresence_tc_software:4.2.0 + cpe:/a:cisco:telepresence_tc_software:4.2.1 + cpe:/a:cisco:telepresence_tc_software:4.2.2 + cpe:/a:cisco:telepresence_tc_software:4.2.3 + cpe:/a:cisco:telepresence_tc_software:4.2.4 + cpe:/a:cisco:telepresence_tc_software:5.1.3 + cpe:/a:cisco:telepresence_tc_software:5.0.2 + cpe:/a:cisco:telepresence_tc_software:5.1.4 + cpe:/a:cisco:telepresence_tc_software:5.1.1 + cpe:/a:cisco:telepresence_tc_software:5.1.2 + cpe:/a:cisco:telepresence_tc_software:5.1.5 + cpe:/a:cisco:telepresence_tc_software:5.1.7 + cpe:/a:cisco:telepresence_tc_software:5.1.0 + cpe:/a:cisco:telepresence_tc_software:5.0.0 + cpe:/a:cisco:telepresence_tc_software:5.1.6 + cpe:/a:cisco:telepresence_tc_software:5.0.1 + + CVE-2014-2172 + 2014-05-02T06:55:08.383-04:00 + 2014-05-02T14:09:54.500-04:00 + + + 6.6 + LOCAL + MEDIUM + SINGLE_INSTANCE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-05-02T14:09:54.360-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + Buffer overflow in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows local users to gain privileges by leveraging improper handling of the u-boot compiler flag for internal executable files, aka Bug ID CSCub67693. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_tc_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.3 + cpe:/a:cisco:telepresence_te_software:4.1.0 + cpe:/a:cisco:telepresence_tc_software:4.1.1 + cpe:/a:cisco:telepresence_te_software:4.1.1 + cpe:/a:cisco:telepresence_tc_software:4.0.4 + cpe:/a:cisco:telepresence_te_software:6.0 + cpe:/a:cisco:telepresence_tc_software:4.0.0 + cpe:/a:cisco:telepresence_tc_software:4.0.1 + cpe:/a:cisco:telepresence_tc_software:4.2.0 + cpe:/a:cisco:telepresence_tc_software:4.2.1 + cpe:/a:cisco:telepresence_tc_software:4.2.2 + cpe:/a:cisco:telepresence_tc_software:4.2.3 + cpe:/a:cisco:telepresence_tc_software:4.2.4 + cpe:/a:cisco:telepresence_tc_software:5.0.2 + cpe:/a:cisco:telepresence_tc_software:5.1.3 + cpe:/a:cisco:telepresence_tc_software:5.1.4 + cpe:/a:cisco:telepresence_tc_software:5.1.1 + cpe:/a:cisco:telepresence_tc_software:5.1.2 + cpe:/a:cisco:telepresence_tc_software:5.1.5 + cpe:/a:cisco:telepresence_tc_software:5.1.7 + cpe:/a:cisco:telepresence_tc_software:5.1.0 + cpe:/a:cisco:telepresence_tc_software:5.0.0 + cpe:/a:cisco:telepresence_tc_software:5.0.1 + cpe:/a:cisco:telepresence_tc_software:5.1.6 + + CVE-2014-2173 + 2014-05-02T06:55:08.413-04:00 + 2014-05-02T14:15:25.027-04:00 + + + 7.2 + LOCAL + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-05-02T14:15:24.760-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 do not properly restrict access to the serial port, which allows local users to gain privileges via unspecified commands, aka Bug ID CSCub67692. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_tc_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.3 + cpe:/a:cisco:telepresence_tc_software:4.1.1 + cpe:/a:cisco:telepresence_te_software:4.1.0 + cpe:/a:cisco:telepresence_te_software:4.1.1 + cpe:/a:cisco:telepresence_tc_software:4.0.4 + cpe:/a:cisco:telepresence_te_software:6.0 + cpe:/a:cisco:telepresence_tc_software:4.0.0 + cpe:/a:cisco:telepresence_tc_software:4.0.1 + cpe:/a:cisco:telepresence_tc_software:4.2.0 + cpe:/a:cisco:telepresence_tc_software:4.2.1 + cpe:/a:cisco:telepresence_tc_software:4.2.2 + cpe:/a:cisco:telepresence_tc_software:4.2.3 + cpe:/a:cisco:telepresence_tc_software:4.2.4 + cpe:/a:cisco:telepresence_tc_software:5.1.3 + cpe:/a:cisco:telepresence_tc_software:5.0.2 + cpe:/a:cisco:telepresence_tc_software:5.1.4 + cpe:/a:cisco:telepresence_tc_software:5.1.1 + cpe:/a:cisco:telepresence_tc_software:5.1.2 + cpe:/a:cisco:telepresence_tc_software:5.1.5 + cpe:/a:cisco:telepresence_tc_software:5.1.7 + cpe:/a:cisco:telepresence_tc_software:5.1.0 + cpe:/a:cisco:telepresence_tc_software:5.0.0 + cpe:/a:cisco:telepresence_tc_software:5.1.6 + cpe:/a:cisco:telepresence_tc_software:5.0.1 + + CVE-2014-2175 + 2014-05-02T06:55:08.430-04:00 + 2014-05-02T14:17:51.313-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-05-02T14:17:51.077-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allow remote attackers to cause a denial of service (memory consumption) via crafted H.225 packets, aka Bug ID CSCtq78849. + + + + + + + + + + cpe:/a:cisco:unified_contact_center_enterprise + cpe:/a:cisco:unified_contact_center_express_editor_software:- + + CVE-2014-2180 + 2014-04-29T06:37:03.967-04:00 + 2014-04-29T11:42:38.457-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-29T11:42:38.363-04:00 + + + + + CISCO + 20140428 Cisco Unified Contact Center Express Arbitrary File Upload Vulnerability + + The Document Management component in Cisco Unified Contact Center Express does not properly validate a parameter, which allows remote authenticated users to upload files to arbitrary pathnames via a crafted HTTP request, aka Bug ID CSCun74133. + + + + + + + + + cpe:/a:cisco:adaptive_security_appliance_software:- + + CVE-2014-2182 + 2014-04-29T06:37:03.997-04:00 + 2014-04-29T11:46:24.903-04:00 + + + 6.1 + ADJACENT_NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-29T11:46:24.870-04:00 + + + + + CISCO + 20140428 Cisco ASA DHCPv6 Denial of Service Vulnerability + + Cisco Adaptive Security Appliance (ASA) Software, when DHCPv6 replay is configured, allows remote attackers to cause a denial of service (device reload) via a crafted DHCPv6 packet, aka Bug ID CSCun45520. + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:cisco:ios_xe:3.10.1s1 + cpe:/h:cisco:asr_1006_router:- + cpe:/h:cisco:asr_1023_router:- + cpe:/o:cisco:ios_xe:3.10.0s + cpe:/h:cisco:asr_1001_router:- + cpe:/h:cisco:asr_1002-x_router:- + cpe:/h:cisco:asr_1004_router:- + cpe:/o:cisco:ios_xe:3.10 + cpe:/h:cisco:asr_1013_router:- + cpe:/h:cisco:asr_1002_fixed_router:- + cpe:/h:cisco:asr_1002_router:- + cpe:/o:cisco:ios_xe:3.10.1s + cpe:/o:cisco:ios_xe:3.10.2s + + CVE-2014-2183 + 2014-04-29T06:37:04.013-04:00 + 2014-04-29T12:19:28.250-04:00 + + + 6.3 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-29T12:19:27.877-04:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=33971 + + + CISCO + 20140428 Cisco IOS XE Software Malformed L2TP Packet Vulnerability + + The L2TP module in Cisco IOS XE 3.10S(.2) and earlier on ASR 1000 routers allows remote authenticated users to cause a denial of service (ESP card reload) via a malformed L2TP packet, aka Bug ID CSCun09973. + + + + + + + + + cpe:/a:cisco:unified_communications_manager + + CVE-2014-2184 + 2014-04-29T06:37:04.047-04:00 + 2014-04-29T12:08:03.257-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-29T12:08:03.210-04:00 + + + + + CISCO + 20140428 Cisco Unified Communications Manager Sensitive Information Disclosure Vulnerability + + The IP Manager Assistant (IPMA) component in Cisco Unified Communications Manager (Unified CM) allows remote attackers to obtain sensitive information via a crafted URL, aka Bug ID CSCun74352. + + + + + + + + + cpe:/a:cisco:unified_communications_manager + + CVE-2014-2185 + 2014-04-29T06:37:04.077-04:00 + 2014-04-29T12:08:08.930-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-29T12:08:08.900-04:00 + + + + + CISCO + 20140428 Cisco Unified Communications Manager CDR Management Vulnerability + + The Call Detail Records (CDR) Management component in Cisco Unified Communications Manager (Unified CM) allows remote authenticated users to obtain sensitive information by reading extraneous fields in an HTML document, aka Bug ID CSCun74374. + + + + + + + + + cpe:/a:cisco:webex_meetings_server:- + + CVE-2014-2186 + 2014-04-30T06:49:05.207-04:00 + 2014-04-30T13:56:16.513-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-30T13:56:16.467-04:00 + + + + + CISCO + 20140429 Cisco WebEx Meetings Server Cross-Site Request Forgery Vulnerability + + Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco WebEx Meetings Server allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj81777. + + + + + + + + + + + + + + + + cpe:/a:mcafee:epolicy_orchestrator:4.6.5 + cpe:/a:mcafee:epolicy_orchestrator:4.6.4 + cpe:/a:mcafee:epolicy_orchestrator:4.6.7 + cpe:/a:mcafee:epolicy_orchestrator:4.6.6 + cpe:/a:mcafee:epolicy_orchestrator:4.6.2 + cpe:/a:mcafee:epolicy_orchestrator:4.6.3 + cpe:/a:mcafee:epolicy_orchestrator:4.6.1 + cpe:/a:mcafee:epolicy_orchestrator:4.6.0 + + CVE-2014-2205 + 2014-02-26T10:55:08.983-05:00 + 2014-03-05T23:51:01.877-05:00 + + + 6.3 + NETWORK + MEDIUM + SINGLE_INSTANCE + COMPLETE + NONE + NONE + http://nvd.nist.gov + 2014-02-27T11:06:08.767-05:00 + + + + + MISC + https://www.redteam-pentesting.de/advisories/rt-sa-2014-001.txt + + + CONFIRM + https://kc.mcafee.com/corporate/index?page=content&id=SB10065 + + + BID + 65771 + + + BUGTRAQ + 20140225 [RT-SA-2014-001] McAfee ePolicy Orchestrator: XML External Entity Expansion in Dashboard + + + SECUNIA + 57114 + + The Import and Export Framework in McAfee ePolicy Orchestrator (ePO) before 4.6.7 Hotfix 940148 allows remote authenticated users with permissions to add dashboards to read arbitrary files by importing a crafted XML file, related to an XML External Entity (XXE) issue. + + + + + + + + + + + cpe:/a:getgosoft:getgo_download_manager:4.9.0.1982 + cpe:/a:getgosoft:getgo_download_manager:4.4.5.502 + cpe:/a:getgosoft:getgo_download_manager:4.8.2.1346 + + CVE-2014-2206 + 2014-03-05T11:37:40.500-05:00 + 2014-03-05T15:05:24.417-05:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-05T15:05:24.387-05:00 + + + + + BID + 65913 + + + BUGTRAQ + 20140302 [CVE-2014-2206] GetGo Download Manager HTTP Response Header Buffer Overflow Remote Code Execution + + + MISC + http://www.rcesecurity.com/2014/03/cve-2014-2206-getgo-download-manager-http-response-header-buffer-overflow-remote-code-execution + + Stack-based buffer overflow in GetGo Download Manager 4.9.0.1982, 4.8.2.1346, 4.4.5.502, and earlier allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a long HTTP Response Header. + + + + + + + + + cpe:/a:ca:erwin_web_portal:9.5 + + CVE-2014-2210 + 2014-04-04T11:10:43.077-04:00 + 2014-04-04T13:31:45.737-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-04T13:31:45.703-04:00 + + + + + CONFIRM + https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7B7F968A14-7407-4BCF-9EB1-EFE9F0E6D663%7D + + Multiple directory traversal vulnerabilities in CA ERwin Web Portal 9.5 allow remote attackers to obtain sensitive information, bypass intended access restrictions, cause a denial of service, or possibly execute arbitrary code via unspecified vectors. + + + + + + + + + + + + + + + + + cpe:/a:posh_project:posh:3.2.1 + cpe:/a:posh_project:posh:3.0.1 + cpe:/a:posh_project:posh:3.1.2 + cpe:/a:posh_project:posh:3.1.1 + cpe:/a:posh_project:posh:3.1.0 + cpe:/a:posh_project:posh:3.0.4 + cpe:/a:posh_project:posh:3.0.2 + cpe:/a:posh_project:posh:3.0.3 + cpe:/a:posh_project:posh:3.0 + + CVE-2014-2211 + 2014-03-03T11:55:04.380-05:00 + 2014-03-07T15:32:54.630-05:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-04T13:46:23.000-05:00 + + + + + MISC + http://www.sysdream.com/CVE-2014-2211_2214 + + + MISC + http://www.sysdream.com/system/files/POSH-3.2.1-advisory_0.pdf + + + BID + 65817 + + + CONFIRM + http://sourceforge.net/p/posh/svn/3540/ + + + MLIST + [oss-security] 20140227 [CVE assignment notification] Multiple vulnerabilities in POSH + + SQL injection vulnerability in portal/addtoapplication.php in POSH (aka Posh portal or Portaneo) 3.0 before 3.3.0 allows remote attackers to execute arbitrary SQL commands via the rssurl parameter. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:posh_project:posh:2.1:p2 + cpe:/a:posh_project:posh:3.2.1 + cpe:/a:posh_project:posh:1.3.2 + cpe:/a:posh_project:posh:1.2.0 + cpe:/a:posh_project:posh:2.1:p1 + cpe:/a:posh_project:posh:2.0:p1 + cpe:/a:posh_project:posh:3.0.1 + cpe:/a:posh_project:posh:3.0.4 + cpe:/a:posh_project:posh:3.0.2 + cpe:/a:posh_project:posh:3.0.3 + cpe:/a:posh_project:posh:1.3.0 + cpe:/a:posh_project:posh:2.1:b + cpe:/a:posh_project:posh:1.5:beta + cpe:/a:posh_project:posh:2.0:beta2 + cpe:/a:posh_project:posh:1.5:rc + cpe:/a:posh_project:posh:2.0:rc + cpe:/a:posh_project:posh:2.1:rc + cpe:/a:posh_project:posh:2.2:rc + cpe:/a:posh_project:posh:2.2.1 + cpe:/a:posh_project:posh:2.2.3 + cpe:/a:posh_project:posh:3.3.0 + cpe:/a:posh_project:posh:1.5:beta2 + cpe:/a:posh_project:posh:1.5.1 + cpe:/a:posh_project:posh:3.0:beta + cpe:/a:posh_project:posh:1.4.2 + cpe:/a:posh_project:posh:2.2:- + cpe:/a:posh_project:posh:3.0:- + cpe:/a:posh_project:posh:2.0:beta + cpe:/a:posh_project:posh:1.0.1 + cpe:/a:posh_project:posh:2.2:beta + cpe:/a:posh_project:posh:1.1.0 + cpe:/a:posh_project:posh:2.0:- + cpe:/a:posh_project:posh:2.1:- + cpe:/a:posh_project:posh:1.5:- + cpe:/a:posh_project:posh:3.1.2 + cpe:/a:posh_project:posh:3.1.1 + cpe:/a:posh_project:posh:3.1.0 + cpe:/a:posh_project:posh:2.3 + + CVE-2014-2212 + 2014-04-01T13:55:05.670-04:00 + 2014-04-02T11:03:51.423-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-02T11:03:14.860-04:00 + + + + + MISC + http://www.sysdream.com/system/files/POSH-3.2.1-advisory_0.pdf + + + MISC + http://www.sysdream.com/CVE-2014-2211_2214 + + + MLIST + [oss-security] 20140227 [CVE assignment notification] Multiple vulnerabilities in POSH + + The remember me feature in portal/scr_authentif.php in POSH (aka Posh portal or Portaneo) 3.0, 3.2.1, 3.3.0, and earlier stores the username and MD5 digest of the password in cleartext in a cookie, which allows attackers to obtain sensitive information by reading this cookie. + + + + + + + + + cpe:/a:cmsimple:cmsimple_classic:3.5.4 + + CVE-2014-2219 + 2014-03-20T12:55:17.137-04:00 + 2014-03-24T18:54:01.153-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-21T09:09:40.057-04:00 + + + + + MISC + https://www.htbridge.com/advisory/HTB23205 + + + BUGTRAQ + 20140319 Cross-Site Scripting (XSS) in CMSimple + + Cross-site scripting (XSS) vulnerability in whizzywig/wb.php in CMSimple Classic 3.54 and earlier, possibly as downloaded before February 26, 2014, allows remote attackers to inject arbitrary web script or HTML via the d parameter. + + + + + + + + + + + + + + + + cpe:/a:i-doit:i-doit:1.1.2::~~pro~~~ + cpe:/a:i-doit:i-doit:1.1.1::~~pro~~~ + cpe:/a:i-doit:i-doit:1.0::~~pro~~~ + cpe:/a:i-doit:i-doit:1.0.2::~~pro~~~ + cpe:/a:i-doit:i-doit:1.2.4::~~pro~~~ + cpe:/a:i-doit:i-doit:1.2.1::~~pro~~~ + cpe:/a:i-doit:i-doit:1.2.2::~~pro~~~ + cpe:/a:i-doit:i-doit:1.2.3::~~pro~~~ + + CVE-2014-2231 + 2014-02-27T10:55:15.687-05:00 + 2014-02-28T10:27:20.240-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-02-28T10:27:17.663-05:00 + + + + + CONFIRM + http://www.i-doit.com/en/company/news/single-news/?tx_ttnews%5Btt_news%5D=141 + + + SECUNIA + 56931 + + Cross-site scripting (XSS) vulnerability in the API in synetics i-doit pro before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via a property title. + + + + + + + + + cpe:/o:apple:mac_os_x:10.9.2 + + CVE-2014-2234 + 2014-03-05T00:11:22.453-05:00 + 2014-03-05T12:44:42.177-05:00 + + + 6.4 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-05T12:44:42.130-05:00 + + + + + MISC + https://hynek.me/articles/apple-openssl-verification-surprises/ + + A certain Apple patch for OpenSSL in Apple OS X 10.9.2 and earlier uses a Trust Evaluation Agent (TEA) feature without terminating certain TLS/SSL handshakes as specified in the SSL_CTX_set_verify callback function's documentation, which allows remote attackers to bypass extra verification within a custom application via a crafted certificate chain that is acceptable to TEA but not acceptable to that application. + + + + + + + + + cpe:/a:askbot:askbot:0.7.48 + + CVE-2014-2235 + 2014-03-05T11:37:40.703-05:00 + 2014-03-05T15:15:24.680-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-05T15:15:24.540-05:00 + + + + + CONFIRM + https://github.com/ASKBOT/askbot-devel/commit/876e3662ff6b78cc6241338c15e3a0cb49edf4e2 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1070852 + + + MLIST + [oss-security] 20140228 Re: CVE request: askbot xss + + + SECUNIA + 57163 + + Cross-site scripting (XSS) vulnerability in Askbot before 0.7.49 allows remote attackers to inject arbitrary web script or HTML via vectors related to the question search form. + + + + + + + + + + + + + + + + + cpe:/a:askbot:askbot:0.7.41 + cpe:/a:askbot:askbot:0.7.40 + cpe:/a:askbot:askbot:0.7.48 + cpe:/a:askbot:askbot:0.7.46 + cpe:/a:askbot:askbot:0.7.47 + cpe:/a:askbot:askbot:0.7.45 + cpe:/a:askbot:askbot:0.7.44 + cpe:/a:askbot:askbot:0.7.43 + cpe:/a:askbot:askbot:0.7.42 + + CVE-2014-2236 + 2014-03-05T11:37:40.703-05:00 + 2014-03-07T14:50:20.210-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-06T05:06:36.000-05:00 + + + + + CONFIRM + https://github.com/ASKBOT/askbot-devel/commit/a676a86b6b7a5737d4da4f59f71e037406f88d29 + + + CONFIRM + https://github.com/ASKBOT/askbot-devel/commit/876e3662ff6b78cc6241338c15e3a0cb49edf4e2#diff-b693b4c02739be4b3231bece15b0eb87 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1070852 + + + MLIST + [oss-security] 20140228 Re: CVE request: askbot xss + + + SECUNIA + 57163 + + Multiple cross-site scripting (XSS) vulnerabilities in Askbot before 0.7.49 allow remote attackers to inject arbitrary web script or HTML via vectors related to the (1) tag or (2) user search forms. + + + + + + + + + + + + + + cpe:/a:openstack:keystone:2013.1.2 + cpe:/a:openstack:keystone:2013.1.3 + cpe:/a:openstack:keystone:2013.1.4 + cpe:/a:openstack:keystone:2013.1 + cpe:/a:openstack:keystone:2013.1.1 + cpe:/a:openstack:keystone:2013.2.2 + + CVE-2014-2237 + 2014-04-01T02:35:53.637-04:00 + 2014-04-01T19:37:03.280-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-01T19:37:03.203-04:00 + + + + + CONFIRM + https://bugs.launchpad.net/keystone/+bug/1260080 + + + MLIST + [oss-security] 20140304 [OSSA 2014-006] Trustee token revocation does not work with memcache backend (CVE-2014-2237) + + The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-3, when issuing a trust token with impersonation enabled, does not include this token in the trustee's token-index-list, which prevents the token from being invalidated by bulk token revocation and allows the trustee to bypass intended access restrictions. + + + + + + + + + + + + cpe:/a:mantisbt:mantisbt:1.2.16 + cpe:/a:mantisbt:mantisbt:1.2.15 + cpe:/a:mantisbt:mantisbt:1.2.14 + cpe:/a:mantisbt:mantisbt:1.2.13 + + CVE-2014-2238 + 2014-03-05T11:37:41.047-05:00 + 2014-03-07T14:49:32.693-05:00 + + + 6.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-06T10:16:00.663-05:00 + + + + + MLIST + [oss-security] 20140304 Re: CVE request: MantisBT 1.2.13 SQL injection vulnerability + + + BID + 65903 + + + CONFIRM + http://www.mantisbt.org/blog/?p=288 + + + MLIST + [oss-security] 20140228 CVE request: MantisBT 1.2.13 SQL injection vulnerability + + + CONFIRM + http://mantisbt.domainunion.de/bugs/view.php?id=17055 + + SQL injection vulnerability in the manage configuration page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.16 allows remote authenticated administrators to execute arbitrary SQL commands via the filter_config_id parameter. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:freetype:freetype:2.4.3 + cpe:/a:freetype:freetype:2.4.4 + cpe:/a:freetype:freetype:2.4.1 + cpe:/a:freetype:freetype:2.4.2 + cpe:/a:freetype:freetype:2.4.5 + cpe:/a:freetype:freetype:2.4.11 + cpe:/a:freetype:freetype:2.4.10 + cpe:/a:freetype:freetype:2.4.12 + cpe:/a:freetype:freetype:2.3.10 + cpe:/a:freetype:freetype:2.3.11 + cpe:/a:freetype:freetype:2.0.1 + cpe:/a:freetype:freetype:2.0.8 + cpe:/a:freetype:freetype:2.3.7 + cpe:/a:freetype:freetype:2.0.7 + cpe:/a:freetype:freetype:2.1.8 + cpe:/a:freetype:freetype:2.0.6 + cpe:/a:freetype:freetype:2.3.9 + cpe:/a:freetype:freetype:2.0.5 + cpe:/a:freetype:freetype:2.3.8 + cpe:/a:freetype:freetype:2.1.6 + cpe:/a:freetype:freetype:2.1.7 + cpe:/a:freetype:freetype:2.1.4 + cpe:/a:freetype:freetype:2.1.5 + cpe:/a:freetype:freetype:2.0.9 + cpe:/a:freetype:freetype:2.3.6 + cpe:/a:freetype:freetype:2.3.5 + cpe:/a:freetype:freetype:2.3.4 + cpe:/a:freetype:freetype:2.3.3 + cpe:/a:freetype:freetype:2.5 + cpe:/a:freetype:freetype:2.3.2 + cpe:/a:freetype:freetype:2.1.8:rc1 + cpe:/a:freetype:freetype:2.5.2 + cpe:/a:freetype:freetype:2.5.1 + cpe:/a:freetype:freetype:2.1.9 + cpe:/a:freetype:freetype:2.2.1 + cpe:/a:freetype:freetype:2.4.8 + cpe:/a:freetype:freetype:2.4.7 + cpe:/a:freetype:freetype:2.4.6 + cpe:/a:freetype:freetype:2.3.0 + cpe:/a:freetype:freetype:2.3.1 + cpe:/a:freetype:freetype:1.3.1 + cpe:/a:freetype:freetype:2.1 + cpe:/a:freetype:freetype:2.2 + cpe:/a:freetype:freetype:2.4.9 + cpe:/a:freetype:freetype:2.0 + cpe:/a:freetype:freetype:2.3.12 + cpe:/a:freetype:freetype:2.1.10 + cpe:/a:freetype:freetype:2.1.3 + cpe:/a:freetype:freetype:2.0.2 + cpe:/a:freetype:freetype:2.0.4 + cpe:/a:freetype:freetype:2.0.3 + cpe:/a:freetype:freetype:2.1.8_rc1 + cpe:/a:freetype:freetype:2.4.0 + + CVE-2014-2240 + 2014-03-12T10:55:30.773-04:00 + 2014-04-01T02:29:28.000-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-13T12:21:37.847-04:00 + + + + + CONFIRM + http://www.freetype.org/index.html + + + UBUNTU + USN-2148-1 + + + SECTRACK + 1029895 + + + BID + 66074 + + + CONFIRM + http://sourceforge.net/projects/freetype/files/freetype2/2.5.3 + + + SECUNIA + 57447 + + + SECUNIA + 57291 + + + CONFIRM + http://savannah.nongnu.org/bugs/?41697 + + Stack-based buffer overflow in the cf2_hintmap_build function in cff/cf2hints.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of stem hints in a font file. + + + + + + + + + + + + + + + + cpe:/a:freetype:freetype:2.5.2 + cpe:/a:freetype:freetype:2.5.1 + cpe:/o:canonical:ubuntu_linux:13.10 + cpe:/a:freetype:freetype:2.5 + + CVE-2014-2241 + 2014-03-18T13:04:18.140-04:00 + 2014-04-01T02:29:28.140-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-19T10:49:56.540-04:00 + + + + + CONFIRM + http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=135c3faebb96f8f550bd4f318716f2e1e095a969 + + + UBUNTU + USN-2148-1 + + + MLIST + [oss-security] 20140312 Re: Two stack-based issues in freetype [NOT a request] + + + SECUNIA + 57447 + + + CONFIRM + http://savannah.nongnu.org/bugs/?41697 + + The (1) cf2_initLocalRegionBuffer and (2) cf2_initGlobalRegionBuffer functions in cff/cf2ft.c in FreeType before 2.5.3 do not properly check if a subroutine exists, which allows remote attackers to cause a denial of service (assertion failure), as demonstrated by a crafted ttf file. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mediawiki:mediawiki:1.10.2 + cpe:/a:mediawiki:mediawiki:1.10.4 + cpe:/a:mediawiki:mediawiki:1.10.3 + cpe:/a:mediawiki:mediawiki:1.19.0 + cpe:/a:mediawiki:mediawiki:1.17:beta_1 + cpe:/a:mediawiki:mediawiki:1.21.1 + cpe:/a:mediawiki:mediawiki:1.14.0:rc1 + cpe:/a:mediawiki:mediawiki:1.19.9 + cpe:/a:mediawiki:mediawiki:1.18.0:rc1 + cpe:/a:mediawiki:mediawiki:1.13.1 + cpe:/a:mediawiki:mediawiki:1.20.1 + cpe:/a:mediawiki:mediawiki:1.13.0 + cpe:/a:mediawiki:mediawiki:1.14.1 + cpe:/a:mediawiki:mediawiki:1.19:beta_2 + cpe:/a:mediawiki:mediawiki:1.18:beta_1 + cpe:/a:mediawiki:mediawiki:1.17.0:rc1 + cpe:/a:mediawiki:mediawiki:1.11 + cpe:/a:mediawiki:mediawiki:1.19:beta_1 + cpe:/a:mediawiki:mediawiki:1.13.4 + cpe:/a:mediawiki:mediawiki:1.14.0 + cpe:/a:mediawiki:mediawiki:1.13.3 + cpe:/a:mediawiki:mediawiki:1.13.2 + cpe:/a:mediawiki:mediawiki:1.13.0:rc2 + cpe:/a:mediawiki:mediawiki:1.13.0:rc1 + cpe:/a:mediawiki:mediawiki:1.20.2 + cpe:/a:mediawiki:mediawiki:1.11.0 + cpe:/a:mediawiki:mediawiki:1.19.5 + cpe:/a:mediawiki:mediawiki:1.19.4 + cpe:/a:mediawiki:mediawiki:1.19.7 + cpe:/a:mediawiki:mediawiki:1.19.6 + cpe:/a:mediawiki:mediawiki:1.19.1 + cpe:/a:mediawiki:mediawiki:1.19.3 + cpe:/a:mediawiki:mediawiki:1.22.0 + cpe:/a:mediawiki:mediawiki:1.19.2 + cpe:/a:mediawiki:mediawiki:1.19.8 + cpe:/a:mediawiki:mediawiki:1.19 + cpe:/a:mediawiki:mediawiki:1.20.4 + cpe:/a:mediawiki:mediawiki:1.11.2 + cpe:/a:mediawiki:mediawiki:1.20.5 + cpe:/a:mediawiki:mediawiki:1.17 + cpe:/a:mediawiki:mediawiki:1.18 + cpe:/a:mediawiki:mediawiki:1.20.3 + cpe:/a:mediawiki:mediawiki:1.11.1 + cpe:/a:mediawiki:mediawiki:1.10.0:rc2 + cpe:/a:mediawiki:mediawiki:1.20.8 + cpe:/a:mediawiki:mediawiki:1.15.5 + cpe:/a:mediawiki:mediawiki:1.20.6 + cpe:/a:mediawiki:mediawiki:1.20.7 + cpe:/a:mediawiki:mediawiki:1.16.0:beta2 + cpe:/a:mediawiki:mediawiki:1.15.0 + cpe:/a:mediawiki:mediawiki:1.15.1 + cpe:/a:mediawiki:mediawiki:1.15.2 + cpe:/a:mediawiki:mediawiki:1.15.3 + cpe:/a:mediawiki:mediawiki:1.10.0:rc1 + cpe:/a:mediawiki:mediawiki:1.16.0:beta1 + cpe:/a:mediawiki:mediawiki:1.10.1 + cpe:/a:mediawiki:mediawiki:1.1.0 + cpe:/a:mediawiki:mediawiki:1.16.0:beta3 + cpe:/a:mediawiki:mediawiki:1.19.10 + cpe:/a:mediawiki:mediawiki:1.18.1 + cpe:/a:mediawiki:mediawiki:1.21.5 + cpe:/a:mediawiki:mediawiki:1.10.0 + cpe:/a:mediawiki:mediawiki:1.19.11 + cpe:/a:mediawiki:mediawiki:1.16.2 + cpe:/a:mediawiki:mediawiki:1.21.3 + cpe:/a:mediawiki:mediawiki:1.17.2 + cpe:/a:mediawiki:mediawiki:1.16.1 + cpe:/a:mediawiki:mediawiki:1.22.1 + cpe:/a:mediawiki:mediawiki:1.21.4 + cpe:/a:mediawiki:mediawiki:1.16.0 + cpe:/a:mediawiki:mediawiki:1.22.2 + cpe:/a:mediawiki:mediawiki:1.21.2 + cpe:/a:mediawiki:mediawiki:1.17.0 + cpe:/a:mediawiki:mediawiki:1.17.1 + cpe:/a:mediawiki:mediawiki:1.15.0:rc1 + cpe:/a:mediawiki:mediawiki:1.18.0 + cpe:/a:mediawiki:mediawiki:1.18.3 + cpe:/a:mediawiki:mediawiki:1.18.2 + cpe:/a:mediawiki:mediawiki:1.17.4 + cpe:/a:mediawiki:mediawiki:1.17.3 + cpe:/a:mediawiki:mediawiki:1.12.0 + cpe:/a:mediawiki:mediawiki:1.12.2 + cpe:/a:mediawiki:mediawiki:1.12.1 + cpe:/a:mediawiki:mediawiki:1.12.4 + cpe:/a:mediawiki:mediawiki:1.12.3 + cpe:/a:mediawiki:mediawiki:1.15.4 + cpe:/a:mediawiki:mediawiki:1.21 + cpe:/a:mediawiki:mediawiki:1.20 + cpe:/a:mediawiki:mediawiki:1.12.0:rc1 + cpe:/a:mediawiki:mediawiki:1.11.0:rc1 + + CVE-2014-2242 + 2014-03-01T23:57:25.887-05:00 + 2014-03-03T15:56:56.677-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-03T11:55:46.820-05:00 + + + + + MLIST + [mediawiki-announce] 20140228 MediaWiki Security and Maintenance Releases: 1.22.3, 1.21.6 and 1.19.12 + + + CONFIRM + https://gerrit.wikimedia.org/r/#/q/7d923a6b53f7fbcb0cbc3a19797d741bf6f440eb,n,z + + + CONFIRM + https://bugzilla.wikimedia.org/show_bug.cgi?id=60771 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1071135 + + + MLIST + [oss-security] 20140301 Re: CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release + + + MLIST + [oss-security] 20140228 CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release + + includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload, as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mediawiki:mediawiki:1.10.2 + cpe:/a:mediawiki:mediawiki:1.10.4 + cpe:/a:mediawiki:mediawiki:1.10.3 + cpe:/a:mediawiki:mediawiki:1.19.0 + cpe:/a:mediawiki:mediawiki:1.17:beta_1 + cpe:/a:mediawiki:mediawiki:1.21.1 + cpe:/a:mediawiki:mediawiki:1.14.0:rc1 + cpe:/a:mediawiki:mediawiki:1.19.9 + cpe:/a:mediawiki:mediawiki:1.18.0:rc1 + cpe:/a:mediawiki:mediawiki:1.13.1 + cpe:/a:mediawiki:mediawiki:1.20.1 + cpe:/a:mediawiki:mediawiki:1.13.0 + cpe:/a:mediawiki:mediawiki:1.14.1 + cpe:/a:mediawiki:mediawiki:1.19:beta_2 + cpe:/a:mediawiki:mediawiki:1.18:beta_1 + cpe:/a:mediawiki:mediawiki:1.17.0:rc1 + cpe:/a:mediawiki:mediawiki:1.11 + cpe:/a:mediawiki:mediawiki:1.19:beta_1 + cpe:/a:mediawiki:mediawiki:1.13.4 + cpe:/a:mediawiki:mediawiki:1.14.0 + cpe:/a:mediawiki:mediawiki:1.13.3 + cpe:/a:mediawiki:mediawiki:1.13.2 + cpe:/a:mediawiki:mediawiki:1.13.0:rc2 + cpe:/a:mediawiki:mediawiki:1.13.0:rc1 + cpe:/a:mediawiki:mediawiki:1.20.2 + cpe:/a:mediawiki:mediawiki:1.11.0 + cpe:/a:mediawiki:mediawiki:1.19.5 + cpe:/a:mediawiki:mediawiki:1.19.4 + cpe:/a:mediawiki:mediawiki:1.19.7 + cpe:/a:mediawiki:mediawiki:1.19.6 + cpe:/a:mediawiki:mediawiki:1.19.1 + cpe:/a:mediawiki:mediawiki:1.19.3 + cpe:/a:mediawiki:mediawiki:1.22.0 + cpe:/a:mediawiki:mediawiki:1.19.2 + cpe:/a:mediawiki:mediawiki:1.19.8 + cpe:/a:mediawiki:mediawiki:1.19 + cpe:/a:mediawiki:mediawiki:1.20.4 + cpe:/a:mediawiki:mediawiki:1.11.2 + cpe:/a:mediawiki:mediawiki:1.20.5 + cpe:/a:mediawiki:mediawiki:1.17 + cpe:/a:mediawiki:mediawiki:1.18 + cpe:/a:mediawiki:mediawiki:1.20.3 + cpe:/a:mediawiki:mediawiki:1.11.1 + cpe:/a:mediawiki:mediawiki:1.10.0:rc2 + cpe:/a:mediawiki:mediawiki:1.20.8 + cpe:/a:mediawiki:mediawiki:1.15.5 + cpe:/a:mediawiki:mediawiki:1.20.6 + cpe:/a:mediawiki:mediawiki:1.20.7 + cpe:/a:mediawiki:mediawiki:1.16.0:beta2 + cpe:/a:mediawiki:mediawiki:1.15.0 + cpe:/a:mediawiki:mediawiki:1.15.1 + cpe:/a:mediawiki:mediawiki:1.15.2 + cpe:/a:mediawiki:mediawiki:1.15.3 + cpe:/a:mediawiki:mediawiki:1.10.0:rc1 + cpe:/a:mediawiki:mediawiki:1.16.0:beta1 + cpe:/a:mediawiki:mediawiki:1.10.1 + cpe:/a:mediawiki:mediawiki:1.1.0 + cpe:/a:mediawiki:mediawiki:1.16.0:beta3 + cpe:/a:mediawiki:mediawiki:1.19.10 + cpe:/a:mediawiki:mediawiki:1.18.1 + cpe:/a:mediawiki:mediawiki:1.21.5 + cpe:/a:mediawiki:mediawiki:1.10.0 + cpe:/a:mediawiki:mediawiki:1.19.11 + cpe:/a:mediawiki:mediawiki:1.16.2 + cpe:/a:mediawiki:mediawiki:1.21.3 + cpe:/a:mediawiki:mediawiki:1.17.2 + cpe:/a:mediawiki:mediawiki:1.16.1 + cpe:/a:mediawiki:mediawiki:1.22.1 + cpe:/a:mediawiki:mediawiki:1.21.4 + cpe:/a:mediawiki:mediawiki:1.16.0 + cpe:/a:mediawiki:mediawiki:1.22.2 + cpe:/a:mediawiki:mediawiki:1.21.2 + cpe:/a:mediawiki:mediawiki:1.17.0 + cpe:/a:mediawiki:mediawiki:1.17.1 + cpe:/a:mediawiki:mediawiki:1.15.0:rc1 + cpe:/a:mediawiki:mediawiki:1.18.0 + cpe:/a:mediawiki:mediawiki:1.18.3 + cpe:/a:mediawiki:mediawiki:1.18.2 + cpe:/a:mediawiki:mediawiki:1.17.4 + cpe:/a:mediawiki:mediawiki:1.17.3 + cpe:/a:mediawiki:mediawiki:1.12.0 + cpe:/a:mediawiki:mediawiki:1.12.2 + cpe:/a:mediawiki:mediawiki:1.12.1 + cpe:/a:mediawiki:mediawiki:1.12.4 + cpe:/a:mediawiki:mediawiki:1.12.3 + cpe:/a:mediawiki:mediawiki:1.15.4 + cpe:/a:mediawiki:mediawiki:1.21 + cpe:/a:mediawiki:mediawiki:1.20 + cpe:/a:mediawiki:mediawiki:1.12.0:rc1 + cpe:/a:mediawiki:mediawiki:1.11.0:rc1 + + CVE-2014-2243 + 2014-03-01T23:57:25.917-05:00 + 2014-03-03T15:55:01.720-05:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-03T11:57:46.540-05:00 + + + + + MLIST + [mediawiki-announce] 20140228 MediaWiki Security and Maintenance Releases: 1.22.3, 1.21.6 and 1.19.12 + + + CONFIRM + https://gerrit.wikimedia.org/r/#/q/I2a9e89120f7092015495e638c6fa9f67adc9b84f,n,z + + + CONFIRM + https://bugzilla.wikimedia.org/show_bug.cgi?id=61346 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1071136 + + + MLIST + [oss-security] 20140301 Re: CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release + + + MLIST + [oss-security] 20140228 CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release + + includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote attackers to obtain access via a brute-force attack that relies on timing differences in responses to incorrect token guesses. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mediawiki:mediawiki:1.10.2 + cpe:/a:mediawiki:mediawiki:1.10.4 + cpe:/a:mediawiki:mediawiki:1.10.3 + cpe:/a:mediawiki:mediawiki:1.19.0 + cpe:/a:mediawiki:mediawiki:1.17:beta_1 + cpe:/a:mediawiki:mediawiki:1.21.1 + cpe:/a:mediawiki:mediawiki:1.14.0:rc1 + cpe:/a:mediawiki:mediawiki:1.19.9 + cpe:/a:mediawiki:mediawiki:1.18.0:rc1 + cpe:/a:mediawiki:mediawiki:1.13.1 + cpe:/a:mediawiki:mediawiki:1.20.1 + cpe:/a:mediawiki:mediawiki:1.13.0 + cpe:/a:mediawiki:mediawiki:1.14.1 + cpe:/a:mediawiki:mediawiki:1.19:beta_2 + cpe:/a:mediawiki:mediawiki:1.18:beta_1 + cpe:/a:mediawiki:mediawiki:1.17.0:rc1 + cpe:/a:mediawiki:mediawiki:1.11 + cpe:/a:mediawiki:mediawiki:1.19:beta_1 + cpe:/a:mediawiki:mediawiki:1.13.4 + cpe:/a:mediawiki:mediawiki:1.14.0 + cpe:/a:mediawiki:mediawiki:1.13.3 + cpe:/a:mediawiki:mediawiki:1.13.2 + cpe:/a:mediawiki:mediawiki:1.13.0:rc2 + cpe:/a:mediawiki:mediawiki:1.13.0:rc1 + cpe:/a:mediawiki:mediawiki:1.20.2 + cpe:/a:mediawiki:mediawiki:1.11.0 + cpe:/a:mediawiki:mediawiki:1.19.5 + cpe:/a:mediawiki:mediawiki:1.19.4 + cpe:/a:mediawiki:mediawiki:1.19.7 + cpe:/a:mediawiki:mediawiki:1.19.6 + cpe:/a:mediawiki:mediawiki:1.19.1 + cpe:/a:mediawiki:mediawiki:1.19.3 + cpe:/a:mediawiki:mediawiki:1.22.0 + cpe:/a:mediawiki:mediawiki:1.19.2 + cpe:/a:mediawiki:mediawiki:1.19.8 + cpe:/a:mediawiki:mediawiki:1.19 + cpe:/a:mediawiki:mediawiki:1.20.4 + cpe:/a:mediawiki:mediawiki:1.11.2 + cpe:/a:mediawiki:mediawiki:1.20.5 + cpe:/a:mediawiki:mediawiki:1.17 + cpe:/a:mediawiki:mediawiki:1.18 + cpe:/a:mediawiki:mediawiki:1.20.3 + cpe:/a:mediawiki:mediawiki:1.11.1 + cpe:/a:mediawiki:mediawiki:1.10.0:rc2 + cpe:/a:mediawiki:mediawiki:1.20.8 + cpe:/a:mediawiki:mediawiki:1.15.5 + cpe:/a:mediawiki:mediawiki:1.20.6 + cpe:/a:mediawiki:mediawiki:1.20.7 + cpe:/a:mediawiki:mediawiki:1.16.0:beta2 + cpe:/a:mediawiki:mediawiki:1.15.0 + cpe:/a:mediawiki:mediawiki:1.15.1 + cpe:/a:mediawiki:mediawiki:1.15.2 + cpe:/a:mediawiki:mediawiki:1.15.3 + cpe:/a:mediawiki:mediawiki:1.10.0:rc1 + cpe:/a:mediawiki:mediawiki:1.16.0:beta1 + cpe:/a:mediawiki:mediawiki:1.10.1 + cpe:/a:mediawiki:mediawiki:1.1.0 + cpe:/a:mediawiki:mediawiki:1.16.0:beta3 + cpe:/a:mediawiki:mediawiki:1.19.10 + cpe:/a:mediawiki:mediawiki:1.18.1 + cpe:/a:mediawiki:mediawiki:1.21.5 + cpe:/a:mediawiki:mediawiki:1.10.0 + cpe:/a:mediawiki:mediawiki:1.19.11 + cpe:/a:mediawiki:mediawiki:1.16.2 + cpe:/a:mediawiki:mediawiki:1.21.3 + cpe:/a:mediawiki:mediawiki:1.17.2 + cpe:/a:mediawiki:mediawiki:1.16.1 + cpe:/a:mediawiki:mediawiki:1.22.1 + cpe:/a:mediawiki:mediawiki:1.21.4 + cpe:/a:mediawiki:mediawiki:1.16.0 + cpe:/a:mediawiki:mediawiki:1.22.2 + cpe:/a:mediawiki:mediawiki:1.21.2 + cpe:/a:mediawiki:mediawiki:1.17.0 + cpe:/a:mediawiki:mediawiki:1.17.1 + cpe:/a:mediawiki:mediawiki:1.15.0:rc1 + cpe:/a:mediawiki:mediawiki:1.18.0 + cpe:/a:mediawiki:mediawiki:1.18.3 + cpe:/a:mediawiki:mediawiki:1.18.2 + cpe:/a:mediawiki:mediawiki:1.17.4 + cpe:/a:mediawiki:mediawiki:1.17.3 + cpe:/a:mediawiki:mediawiki:1.12.0 + cpe:/a:mediawiki:mediawiki:1.12.2 + cpe:/a:mediawiki:mediawiki:1.12.1 + cpe:/a:mediawiki:mediawiki:1.12.4 + cpe:/a:mediawiki:mediawiki:1.12.3 + cpe:/a:mediawiki:mediawiki:1.15.4 + cpe:/a:mediawiki:mediawiki:1.21 + cpe:/a:mediawiki:mediawiki:1.20 + cpe:/a:mediawiki:mediawiki:1.12.0:rc1 + cpe:/a:mediawiki:mediawiki:1.11.0:rc1 + + CVE-2014-2244 + 2014-03-01T23:57:25.950-05:00 + 2014-03-03T15:48:05.320-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-03T11:58:37.543-05:00 + + + + + MLIST + [mediawiki-announce] 20140228 MediaWiki Security and Maintenance Releases: 1.22.3, 1.21.6 and 1.19.12 + + + CONFIRM + https://gerrit.wikimedia.org/r/#/q/Idf985e4e69c2f11778a8a90503914678441cb3fb,n,z + + + CONFIRM + https://bugzilla.wikimedia.org/show_bug.cgi?id=61362 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1071139 + + + MLIST + [oss-security] 20140301 Re: CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release + + + MLIST + [oss-security] 20140228 CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release + + Cross-site scripting (XSS) vulnerability in the formatHTML function in includes/api/ApiFormatBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 allows remote attackers to inject arbitrary web script or HTML via a crafted string located after http:// in the text parameter to api.php. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cmsmadesimple:cms_made_simple:0.2 + cpe:/a:cmsmadesimple:cms_made_simple:0.1 + cpe:/a:cmsmadesimple:cms_made_simple:0.6 + cpe:/a:cmsmadesimple:cms_made_simple:0.9 + cpe:/a:cmsmadesimple:cms_made_simple:0.8 + cpe:/a:cmsmadesimple:cms_made_simple:0.7 + cpe:/a:cmsmadesimple:cms_made_simple:1.0.3 + cpe:/a:cmsmadesimple:cms_made_simple:1.0.6 + cpe:/a:cmsmadesimple:cms_made_simple:1.0.5 + cpe:/a:cmsmadesimple:cms_made_simple:1.0 + cpe:/a:cmsmadesimple:cms_made_simple:1.0.4 + cpe:/a:cmsmadesimple:cms_made_simple:1.1 + cpe:/a:cmsmadesimple:cms_made_simple:0.4.1 + cpe:/a:cmsmadesimple:cms_made_simple:0.11.2 + cpe:/a:cmsmadesimple:cms_made_simple:1.1.4 + cpe:/a:cmsmadesimple:cms_made_simple:0.5.1 + cpe:/a:cmsmadesimple:cms_made_simple:0.11.1 + cpe:/a:cmsmadesimple:cms_made_simple:0.13 + cpe:/a:cmsmadesimple:cms_made_simple:1.1.3 + cpe:/a:cmsmadesimple:cms_made_simple:1.10.1 + cpe:/a:cmsmadesimple:cms_made_simple:1.1.2 + cpe:/a:cmsmadesimple:cms_made_simple:0.2.1 + cpe:/a:cmsmadesimple:cms_made_simple:0.12.1 + cpe:/a:cmsmadesimple:cms_made_simple:0.12.2 + cpe:/a:cmsmadesimple:cms_made_simple:1.11.1 + cpe:/a:cmsmadesimple:cms_made_simple:0.10 + cpe:/a:cmsmadesimple:cms_made_simple:1.11.2 + cpe:/a:cmsmadesimple:cms_made_simple:0.11 + cpe:/a:cmsmadesimple:cms_made_simple:1.11.3 + cpe:/a:cmsmadesimple:cms_made_simple:0.7.1 + cpe:/a:cmsmadesimple:cms_made_simple:0.12 + cpe:/a:cmsmadesimple:cms_made_simple:1.11.4 + cpe:/a:cmsmadesimple:cms_made_simple:0.6.3 + cpe:/a:cmsmadesimple:cms_made_simple:1.11.5 + cpe:/a:cmsmadesimple:cms_made_simple:0.6.1 + cpe:/a:cmsmadesimple:cms_made_simple:0.6.2 + cpe:/a:cmsmadesimple:cms_made_simple:0.7.2 + cpe:/a:cmsmadesimple:cms_made_simple:1.11.9 + cpe:/a:cmsmadesimple:cms_made_simple:0.7.3 + cpe:/a:cmsmadesimple:cms_made_simple:1.0.2 + cpe:/a:cmsmadesimple:cms_made_simple:1.0.1 + cpe:/a:cmsmadesimple:cms_made_simple:0.3.2 + cpe:/a:cmsmadesimple:cms_made_simple:0.10.1 + cpe:/a:cmsmadesimple:cms_made_simple:0.10.2 + cpe:/a:cmsmadesimple:cms_made_simple:0.10.3 + cpe:/a:cmsmadesimple:cms_made_simple:0.10.4 + cpe:/a:cmsmadesimple:cms_made_simple:0.3.1 + cpe:/a:cmsmadesimple:cms_made_simple:1.11.7 + cpe:/a:cmsmadesimple:cms_made_simple:1.11.6 + cpe:/a:cmsmadesimple:cms_made_simple:1.1.1 + cpe:/a:cmsmadesimple:cms_made_simple:1.11.8 + cpe:/a:cmsmadesimple:cms_made_simple:1.11.2.1 + cpe:/a:cmsmadesimple:cms_made_simple:1.10.3 + cpe:/a:cmsmadesimple:cms_made_simple:1.1.3.1 + cpe:/a:cmsmadesimple:cms_made_simple:0.3 + cpe:/a:cmsmadesimple:cms_made_simple:0.4 + cpe:/a:cmsmadesimple:cms_made_simple:1.10.2 + cpe:/a:cmsmadesimple:cms_made_simple:0.5 + cpe:/a:cmsmadesimple:cms_made_simple:0.9.2 + cpe:/a:cmsmadesimple:cms_made_simple:0.9.1 + cpe:/a:cmsmadesimple:cms_made_simple:1.10 + cpe:/a:cmsmadesimple:cms_made_simple:1.11 + cpe:/a:cmsmadesimple:cms_made_simple:0.8.1 + cpe:/a:cmsmadesimple:cms_made_simple:0.8.2 + + CVE-2014-2245 + 2014-03-05T11:37:41.063-05:00 + 2014-03-07T14:43:02.667-05:00 + + + 6.0 + NETWORK + MEDIUM + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-06T05:26:26.000-05:00 + + + + + BID + 65953 + + + SECUNIA + 56996 + + + MLIST + [oss-security] 20140301 Re: CVE request: CMS Made Simple SQL injection fixed in 1.11.10 + + + CONFIRM + http://dev.cmsmadesimple.org/project/changelog/4602 + + SQL injection vulnerability in the News module in CMS Made Simple (CMSMS) before 1.11.10 allows remote authenticated users with the "Modify News" permission to execute arbitrary SQL commands via the sortby parameter to admin/moduleinterface.php. NOTE: some of these details are obtained from third party information. + + + + + + + + + + + + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.1.2 + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.0.1 + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.1.1 + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.1.0 + + CVE-2014-2246 + 2014-03-16T10:06:45.773-04:00 + 2014-03-25T20:59:21.693-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-17T12:49:44.937-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01 + + + CONFIRM + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf + + Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + + + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.1.2 + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.0.1 + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.1.1 + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.1.0 + + CVE-2014-2247 + 2014-03-16T10:06:45.803-04:00 + 2014-03-25T20:58:11.300-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-17T08:59:00.000-04:00 + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01 + + + CONFIRM + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf + + The integrated web server on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allows remote attackers to inject headers via unspecified vectors. + + + + + + + + + + + + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.1.2 + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.0.1 + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.1.1 + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.1.0 + + CVE-2014-2248 + 2014-03-16T10:06:45.820-04:00 + 2014-03-25T21:02:43.933-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-17T13:04:22.367-04:00 + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01 + + + CONFIRM + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf + + Open redirect vulnerability in the integrated web server on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. + + + + + + + + + + + + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.1.2 + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.0.1 + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.1.1 + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.1.0 + + CVE-2014-2249 + 2014-03-16T10:06:45.850-04:00 + 2014-03-26T00:57:55.257-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-17T13:07:15.527-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02 + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01 + + + CONFIRM + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf + + + CONFIRM + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf + + Cross-site request forgery (CSRF) vulnerability on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 and SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. + + + + + + + + + + + + + + + + + + + cpe:/h:siemens:simatic_s7_cpu-1211c:- + cpe:/h:siemens:simatic_s7_cpu_1212c:- + cpe:/o:siemens:simatic_s7_cpu_1200_firmware:3.0 + cpe:/h:siemens:simatic_s7_cpu_1217c:- + cpe:/h:siemens:simatic_s7_cpu_1215c:- + cpe:/h:siemens:simatic_s7_cpu_1214c:- + cpe:/o:siemens:simatic_s7_cpu_1200_firmware:3.0.2 + + CVE-2014-2250 + 2014-03-24T10:20:39.557-04:00 + 2014-03-24T11:47:18.813-04:00 + + + 8.3 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + COMPLETE + http://nvd.nist.gov + 2014-03-24T11:47:16.733-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02 + + + CONFIRM + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf + + The random-number generator on Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors, a different vulnerability than CVE-2014-2251. + + + + + + + + + + + + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.1.2 + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.0.1 + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.1.1 + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.1.0 + + CVE-2014-2251 + 2014-03-16T10:06:45.867-04:00 + 2014-03-25T21:01:16.883-04:00 + + + 8.3 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + COMPLETE + http://nvd.nist.gov + 2014-03-17T13:10:57.127-04:00 + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01 + + + CONFIRM + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf + + The random-number generator on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors. + + + + + + + + + + + + + + + + + + + cpe:/h:siemens:simatic_s7_cpu-1211c:- + cpe:/h:siemens:simatic_s7_cpu_1212c:- + cpe:/o:siemens:simatic_s7_cpu_1200_firmware:3.0 + cpe:/h:siemens:simatic_s7_cpu_1217c:- + cpe:/h:siemens:simatic_s7_cpu_1215c:- + cpe:/h:siemens:simatic_s7_cpu_1214c:- + cpe:/o:siemens:simatic_s7_cpu_1200_firmware:3.0.2 + + CVE-2014-2252 + 2014-03-24T10:20:39.573-04:00 + 2014-03-24T11:51:59.900-04:00 + + + 6.1 + ADJACENT_NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-03-24T11:51:59.820-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02 + + + CONFIRM + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf + + Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted PROFINET packets, a different vulnerability than CVE-2014-2253. + + + + + + + + + + + + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.1.2 + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.0.1 + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.1.1 + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.1.0 + + CVE-2014-2253 + 2014-03-16T10:06:45.897-04:00 + 2014-03-25T21:11:56.857-04:00 + + + 6.1 + ADJACENT_NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-03-17T13:13:15.333-04:00 + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01 + + + CONFIRM + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf + + Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted Profinet packets. + + + + + + + + + + + + + + + + + + + cpe:/h:siemens:simatic_s7_cpu-1211c:- + cpe:/h:siemens:simatic_s7_cpu_1212c:- + cpe:/o:siemens:simatic_s7_cpu_1200_firmware:3.0 + cpe:/h:siemens:simatic_s7_cpu_1217c:- + cpe:/h:siemens:simatic_s7_cpu_1215c:- + cpe:/h:siemens:simatic_s7_cpu_1214c:- + cpe:/o:siemens:simatic_s7_cpu_1200_firmware:3.0.2 + + CVE-2014-2254 + 2014-03-24T10:20:39.590-04:00 + 2014-03-24T11:59:15.897-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-03-24T11:59:15.757-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02 + + + CONFIRM + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf + + Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted HTTP packets, a different vulnerability than CVE-2014-2255. + + + + + + + + + + + + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.1.2 + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.0.1 + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.1.1 + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.1.0 + + CVE-2014-2255 + 2014-03-16T10:06:45.913-04:00 + 2014-03-25T21:15:25.617-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-03-17T13:16:56.790-04:00 + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01 + + + CONFIRM + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf + + Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted HTTP packets. + + + + + + + + + + + + + + + + + + + cpe:/h:siemens:simatic_s7_cpu-1211c:- + cpe:/h:siemens:simatic_s7_cpu_1212c:- + cpe:/o:siemens:simatic_s7_cpu_1200_firmware:3.0 + cpe:/h:siemens:simatic_s7_cpu_1217c:- + cpe:/h:siemens:simatic_s7_cpu_1215c:- + cpe:/h:siemens:simatic_s7_cpu_1214c:- + cpe:/o:siemens:simatic_s7_cpu_1200_firmware:3.0.2 + + CVE-2014-2256 + 2014-03-24T10:20:39.590-04:00 + 2014-03-24T12:00:33.980-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-03-24T12:00:28.713-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02 + + + CONFIRM + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf + + Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted ISO-TSAP packets, a different vulnerability than CVE-2014-2257. + + + + + + + + + + + + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.1.2 + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.0.1 + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.1.1 + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.1.0 + + CVE-2014-2257 + 2014-03-16T10:06:45.943-04:00 + 2014-03-25T21:52:03.783-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-03-17T13:20:23.013-04:00 + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01 + + + CONFIRM + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf + + Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted ISO-TSAP packets. + + + + + + + + + + + + + + + + + + + cpe:/h:siemens:simatic_s7_cpu-1211c:- + cpe:/h:siemens:simatic_s7_cpu_1212c:- + cpe:/o:siemens:simatic_s7_cpu_1200_firmware:3.0 + cpe:/h:siemens:simatic_s7_cpu_1217c:- + cpe:/h:siemens:simatic_s7_cpu_1215c:- + cpe:/h:siemens:simatic_s7_cpu_1214c:- + cpe:/o:siemens:simatic_s7_cpu_1200_firmware:3.0.2 + + CVE-2014-2258 + 2014-03-24T10:20:39.607-04:00 + 2014-03-24T12:01:21.230-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-03-24T12:01:21.153-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02 + + + CONFIRM + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf + + Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted HTTPS packets, a different vulnerability than CVE-2014-2259. + + + + + + + + + + + + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.1.2 + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.0.1 + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.1.1 + cpe:/o:siemens:simatic_s7-1500_cpu_firmware:1.1.0 + + CVE-2014-2259 + 2014-03-16T10:06:45.960-04:00 + 2014-03-25T21:02:54.153-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-03-17T13:21:42.187-04:00 + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01 + + + CONFIRM + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf + + Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted HTTPS packets. + + + + + + + + + cpe:/a:ajenti:ajenti:1.2.13 + + CVE-2014-2260 + 2014-04-30T19:58:26.733-04:00 + 2014-05-01T11:42:19.917-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-05-01T11:42:19.870-04:00 + + + + + MISC + https://github.com/Eugeny/ajenti/commit/3270fd1d78391bb847b4c9ce37cf921f485b1310 + + + CONFIRM + https://github.com/Eugeny/ajenti/issues/233 + + + BID + 64982 + + + OSVDB + 102174 + + + MISC + http://packetstormsecurity.com/files/124804/Ajenti-1.2.13-Cross-Site-Scripting.html + + Cross-site scripting (XSS) vulnerability in plugins/main/content/js/ajenti.coffee in Eugene Pankov Ajenti 1.2.13 allows remote authenticated users to inject arbitrary web script or HTML via the command field in the Cron functionality. + + + + + + + + + + + + cpe:/a:sas:base_sas:9.3:ts1m2 + cpe:/a:sas:base_sas:9.4:ts1m0 + cpe:/a:sas:base_sas:9.3:ts1m1 + cpe:/a:sas:base_sas:9.2:ts2m + + CVE-2014-2262 + 2014-02-28T19:55:05.623-05:00 + 2014-03-03T11:15:58.777-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-03T11:15:58.730-05:00 + + + + + MISC + https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140227-0_SAS_Buffer_overflow_v10.txt + + + BID + 65853 + + + BUGTRAQ + 20140227 SEC Consult SA-20140227-0 :: Local Buffer Overflow vulnerability in SAS for Windows (Statistical Analysis System) + + + CONFIRM + http://support.sas.com/kb/51/701.html + + + SECUNIA + 57029 + + Buffer overflow in the client application in Base SAS 9.2 TS2M3, SAS 9.3 TS1M1 and TS1M2, and SAS 9.4 TS1M0 allows user-assisted remote attackers to execute arbitrary code via a crafted SAS program. + + + + + + + + + + + + + cpe:/a:ffmpeg:ffmpeg:2.0.2 + cpe:/a:ffmpeg:ffmpeg:2.0.1 + cpe:/a:ffmpeg:ffmpeg:2.0 + cpe:/a:ffmpeg:ffmpeg:2.0.3 + cpe:/a:ffmpeg:ffmpeg:2.1 + + CVE-2014-2263 + 2014-02-28T19:55:05.657-05:00 + 2014-03-03T11:28:20.810-05:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-03T11:28:20.763-05:00 + + + + + CONFIRM + http://git.videolan.org/?p=ffmpeg.git;a=commit;h=842b6c14bc + + + XF + ffmpeg-mpegtswritepmt-bo(91174) + + + BID + 65560 + + + SECUNIA + 56971 + + The mpegts_write_pmt function in the MPEG2 transport stream (aka DVB) muxer (libavformat/mpegtsenc.c) in FFmpeg, possibly 2.1 and earlier, allows remote attackers to have unspecified impact and vectors, which trigger an out-of-bounds write. + + + + + + + + + cpe:/a:synology:diskstation_manager:4.3-3810:1 + + CVE-2014-2264 + 2014-03-02T12:55:03.097-05:00 + 2014-03-03T15:47:16.803-05:00 + + + 7.8 + NETWORK + LOW + NONE + COMPLETE + NONE + NONE + http://nvd.nist.gov + 2014-03-03T09:30:01.000-05:00 + + + + + + CERT-VN + VU#534284 + + + MISC + http://forum.synology.com/enu/viewtopic.php?f=173&t=77644 + + The OpenVPN module in Synology DiskStation Manager (DSM) 4.3-3810 update 1 has a hardcoded root password of synopass, which makes it easier for remote attackers to obtain access via a VPN session. + + + + + + + + + + + + + + + + cpe:/a:rocklobster:contact_form_7:3.6::~~~wordpress~~ + cpe:/a:rocklobster:contact_form_7:3.7::~~~wordpress~~ + cpe:/a:rocklobster:contact_form_7:3.7.1::~~~wordpress~~ + + CVE-2014-2265 + 2014-03-14T06:55:06.397-04:00 + 2014-04-09T00:17:57.497-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-14T14:13:25.807-04:00 + + + + + CONFIRM + http://contactform7.com/2014/02/26/contact-form-7-372/ + + + MISC + http://www.hedgehogsecurity.co.uk/2014/02/26/contactform7-vulnerability/ + + + CONFIRM + http://wordpress.org/plugins/contact-form-7/changelog + + Rock Lobster Contact Form 7 before 3.7.2 allows remote attackers to bypass the CAPTCHA protection mechanism and submit arbitrary form data by omitting the _wpcf7_captcha_challenge_captcha-719 parameter. + + + + + + + + + cpe:/a:vtiger:vtiger_crm:6.0.0 + + CVE-2014-2269 + 2014-04-22T09:06:28.523-04:00 + 2014-04-22T12:31:24.980-04:00 + + + 6.4 + NETWORK + LOW + NONE + NONE + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-22T12:31:24.807-04:00 + + + + + MLIST + [Vtigercrm-developers] 20140316 IMP: forgot password and re-installation security fix + + + BID + 66758 + + modules/Users/ForgotPassword.php in vTiger 6.0 before Security Patch 2 allows remote attackers to reset the password for arbitrary users via a request containing the username, password, and confirmPassword parameters. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:christos_zoulas:file:5.07 + cpe:/a:christos_zoulas:file:5.08 + cpe:/a:christos_zoulas:file:5.09 + cpe:/a:tim_robbins:libmagic:- + cpe:/a:christos_zoulas:file:5.06 + cpe:/a:christos_zoulas:file:5.14 + cpe:/a:christos_zoulas:file:5.05 + cpe:/a:christos_zoulas:file:5.04 + cpe:/a:christos_zoulas:file:5.13 + cpe:/a:christos_zoulas:file:5.03 + cpe:/a:christos_zoulas:file:5.16 + cpe:/a:christos_zoulas:file:5.02 + cpe:/a:christos_zoulas:file:5.15 + cpe:/a:christos_zoulas:file:5.01 + cpe:/a:christos_zoulas:file:5.10 + cpe:/a:christos_zoulas:file:5.00 + cpe:/a:christos_zoulas:file:5.12 + cpe:/a:christos_zoulas:file:5.11 + + CVE-2014-2270 + 2014-03-14T11:55:05.667-04:00 + 2014-04-19T00:48:23.863-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-03-17T09:29:44.037-04:00 + + + + + CONFIRM + https://github.com/file/file/commit/447558595a3650db2886cd2f416ad0beba965801 + + + CONFIRM + http://bugs.gw.com/view.php?id=313 + + + UBUNTU + USN-2163-1 + + + UBUNTU + USN-2162-1 + + + CONFIRM + http://www.php.net/ChangeLog-5.php + + + DEBIAN + DSA-2873 + + + MLIST + [oss-security] 20140305 Re: CVE Request: file: crashes when checking softmagic for some corrupt PE executables + + + MLIST + [oss-security] 20140305 Re: CVE Request: file: crashes when checking softmagic for some corrupt PE executables + + + MLIST + [oss-security] 20140303 CVE Request: file: crashes when checking softmagic for some corrupt PE executables + + + SUSE + openSUSE-SU-2014:0435 + + + SUSE + openSUSE-SU-2014:0367 + + + SUSE + openSUSE-SU-2014:0364 + + softmagic.c in file before 5.17 and libmagic allows context-dependent attackers to cause a denial of service (out-of-bounds memory access and crash) via crafted offsets in the softmagic of a PE executable. + + + + + + + + + cpe:/a:emc:connectrix_manager:12.1.2:-:~-~converged_network_edition~~~ + + CVE-2014-2276 + 2014-03-21T10:55:07.160-04:00 + 2014-04-01T02:29:31.047-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-03-21T12:57:08.000-04:00 + + + + + XF + connectrix-cve20142276-info-disc(91987) + + + SECTRACK + 1029939 + + + BID + 66308 + + + SECUNIA + 57513 + + + BUGTRAQ + 20140318 ESA-2014-018: EMC Connectrix Manager Converged Network Edition Information Disclosure Vulnerability + + The FileUploadController servlet in EMC Connectrix Manager Converged Network Edition (CMCNE) before 12.1.5 does not properly restrict additions to the Connectrix Manager repository, which allows remote attackers to obtain sensitive information by importing a crafted firmware file. + + + + + + + + + + + cpe:/a:seeddms:seeddms:4.2.2 + cpe:/a:seeddms:seeddms:3.3.12 + cpe:/a:seeddms:seeddms:3.4.3 + + CVE-2014-2280 + 2014-03-20T12:55:17.260-04:00 + 2014-03-24T19:03:18.233-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-21T09:22:49.083-04:00 + + + + + XF + seeddms-cve20142280-xss(91830) + + + CONFIRM + http://sourceforge.net/p/seeddms/code/ci/master/tree/CHANGELOG + + + SECUNIA + 57475 + + + MISC + http://packetstormsecurity.com/files/125726 + + + BUGTRAQ + 20140314 Multiple Vulnerabilities in SeedDMS < = 4.3.3 + + Cross-site scripting (XSS) vulnerability in the search feature in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allows remote attackers to inject arbitrary web script or HTML via the query parameter. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:wireshark:wireshark:1.10.1 + cpe:/a:wireshark:wireshark:1.8.2 + cpe:/a:wireshark:wireshark:1.8.10 + cpe:/a:wireshark:wireshark:1.8.1 + cpe:/a:wireshark:wireshark:1.8.12 + cpe:/a:wireshark:wireshark:1.8.0 + cpe:/a:wireshark:wireshark:1.10.0 + cpe:/a:wireshark:wireshark:1.8.11 + cpe:/a:wireshark:wireshark:1.8.6 + cpe:/a:wireshark:wireshark:1.8.7 + cpe:/a:wireshark:wireshark:1.10.5 + cpe:/a:wireshark:wireshark:1.8.8 + cpe:/a:wireshark:wireshark:1.8.9 + cpe:/a:wireshark:wireshark:1.10.2 + cpe:/a:wireshark:wireshark:1.8.3 + cpe:/a:wireshark:wireshark:1.8.4 + cpe:/a:wireshark:wireshark:1.10.4 + cpe:/a:wireshark:wireshark:1.8.5 + cpe:/a:wireshark:wireshark:1.10.3 + + CVE-2014-2281 + 2014-03-11T09:01:10.077-04:00 + 2014-04-19T00:48:24.270-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-03-11T11:54:18.083-04:00 + + + + + CONFIRM + https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9672 + + + CONFIRM + http://anonsvn.wireshark.org/viewvc?view=revision&revision=54875 + + + CONFIRM + http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-nfs.c?r1=54875&r2=54874&pathrev=54875 + + + CONFIRM + http://www.wireshark.org/security/wnpa-sec-2014-01.html + + + DEBIAN + DSA-2871 + + + SECUNIA + 57489 + + + SECUNIA + 57480 + + + REDHAT + RHSA-2014:0342 + + + REDHAT + RHSA-2014:0341 + + + SUSE + openSUSE-SU-2014:0383 + + + SUSE + openSUSE-SU-2014:0382 + + The nfs_name_snoop_add_name function in epan/dissectors/packet-nfs.c in the NFS dissector in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 does not validate a certain length value, which allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted NFS packet. + + + + + + + + + + + + + + cpe:/a:wireshark:wireshark:1.10.1 + cpe:/a:wireshark:wireshark:1.10.5 + cpe:/a:wireshark:wireshark:1.10.2 + cpe:/a:wireshark:wireshark:1.10.4 + cpe:/a:wireshark:wireshark:1.10.3 + cpe:/a:wireshark:wireshark:1.10.0 + + CVE-2014-2282 + 2014-03-11T09:01:10.093-04:00 + 2014-04-01T02:29:31.627-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-03-11T11:56:16.430-04:00 + + + + + CONFIRM + http://anonsvn.wireshark.org/viewvc?view=revision&revision=51608 + + + CONFIRM + http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-m3ua.c?r1=51608&r2=51607&pathrev=51608 + + + CONFIRM + https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9699 + + + CONFIRM + http://www.wireshark.org/security/wnpa-sec-2014-02.html + + + SECUNIA + 57480 + + + SUSE + openSUSE-SU-2014:0382 + + The dissect_protocol_data_parameter function in epan/dissectors/packet-m3ua.c in the M3UA dissector in Wireshark 1.10.x before 1.10.6 does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) via a crafted SS7 MTP3 packet. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:wireshark:wireshark:1.10.1 + cpe:/a:wireshark:wireshark:1.8.2 + cpe:/a:wireshark:wireshark:1.8.10 + cpe:/a:wireshark:wireshark:1.8.1 + cpe:/a:wireshark:wireshark:1.8.12 + cpe:/a:wireshark:wireshark:1.8.0 + cpe:/a:wireshark:wireshark:1.10.0 + cpe:/a:wireshark:wireshark:1.8.11 + cpe:/a:wireshark:wireshark:1.8.6 + cpe:/a:wireshark:wireshark:1.8.7 + cpe:/a:wireshark:wireshark:1.10.5 + cpe:/a:wireshark:wireshark:1.8.8 + cpe:/a:wireshark:wireshark:1.8.9 + cpe:/a:wireshark:wireshark:1.10.2 + cpe:/a:wireshark:wireshark:1.8.3 + cpe:/a:wireshark:wireshark:1.8.4 + cpe:/a:wireshark:wireshark:1.10.4 + cpe:/a:wireshark:wireshark:1.8.5 + cpe:/a:wireshark:wireshark:1.10.3 + + CVE-2014-2283 + 2014-03-11T09:01:10.263-04:00 + 2014-04-19T00:48:24.537-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-03-11T12:00:19.030-04:00 + + + + + CONFIRM + https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=217293ba4a0353bf5d657e74fe8623dd3c86fe08 + + + CONFIRM + https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9802 + + + CONFIRM + https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9730 + + + CONFIRM + http://www.wireshark.org/security/wnpa-sec-2014-03.html + + + DEBIAN + DSA-2871 + + + SECUNIA + 57489 + + + SECUNIA + 57480 + + + REDHAT + RHSA-2014:0342 + + + SUSE + openSUSE-SU-2014:0383 + + + SUSE + openSUSE-SU-2014:0382 + + epan/dissectors/packet-rlc in the RLC dissector in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 uses inconsistent memory-management approaches, which allows remote attackers to cause a denial of service (use-after-free error and application crash) via a crafted UMTS Radio Link Control packet. + + + + + + + + + + + + + + + + + + + + cpe:/a:net-snmp:net-snmp:5.7 + cpe:/a:net-snmp:net-snmp:5.6 + cpe:/a:net-snmp:net-snmp:5.5.1 + cpe:/a:net-snmp:net-snmp:5.5 + cpe:/a:net-snmp:net-snmp:5.7.1 + cpe:/a:net-snmp:net-snmp:5.7.2 + cpe:/a:net-snmp:net-snmp:5.5.0.1 + cpe:/a:net-snmp:net-snmp:5.5.0.2 + cpe:/a:net-snmp:net-snmp:5.6.1.1 + cpe:/a:net-snmp:net-snmp:5.5.1.1 + cpe:/a:net-snmp:net-snmp:5.5.2 + cpe:/a:net-snmp:net-snmp:5.6.2 + + CVE-2014-2284 + 2014-03-24T12:43:02.177-04:00 + 2014-04-24T01:05:56.453-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-03-24T14:45:57.530-04:00 + + + + + UBUNTU + USN-2166-1 + + + MLIST + [net-snmp-announce] 20140225 Multiple Security-fix Net-SNMP Releases: 5.5.2.1, 5.6.2.1, and 5.7.2.1 + + + SECUNIA + 57870 + + + SECUNIA + 57583 + + + SECUNIA + 57526 + + + REDHAT + RHSA-2014:0321 + + + SUSE + openSUSE-SU-2014:0399 + + + SUSE + openSUSE-SU-2014:0398 + + + MLIST + [oss-security] 20140305 CVE request for two net-snmp remote DoS flaws + + The Linux implementation of the ICMP-MIB in Net-SNMP 5.5 before 5.5.2.1, 5.6.x before 5.6.2.1, and 5.7.x before 5.7.2.1 does not properly validate input, which allows remote attackers to cause a denial of service via unspecified vectors. + + + + + + + + + cpe:/a:net-snmp:net-snmp:5.7.3:pre1 + + CVE-2014-2285 + 2014-04-27T18:55:05.990-04:00 + 2014-04-28T15:43:31.097-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-28T15:43:31.067-04:00 + + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1072778 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1072044 + + + MISC + http://www.nntp.perl.org/group/perl.perl5.porters/2006/09/msg116250.html + + + CONFIRM + http://sourceforge.net/p/net-snmp/patches/1275/ + + + SUSE + openSUSE-SU-2014:0399 + + + SUSE + openSUSE-SU-2014:0398 + + + MLIST + [oss-security] 20140305 CVE request for two net-snmp remote DoS flaws + + The perl_trapd_handler function in perl/TrapReceiver/TrapReceiver.xs in Net-SNMP 5.7.3.pre3 and earlier, when using certain Perl versions, allows remote attackers to cause a denial of service (snmptrapd crash) via an empty community string in an SNMP trap, which triggers a NULL pointer dereference within the newSVpv function in Perl. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:digium:certified_asterisk:1.8.1.0:rc1 + cpe:/a:digium:asterisk:1.8.24.0:- + cpe:/a:digium:asterisk:1.8.23.0:- + cpe:/a:digium:asterisk:1.8.19.1 + cpe:/a:digium:asterisk:1.8.21.0:- + cpe:/a:digium:asterisk:1.8.19.0:- + cpe:/a:digium:asterisk:1.8.19.0 + cpe:/a:digium:certified_asterisk:1.8.13.0:- + cpe:/a:digium:certified_asterisk:1.8.0.0:rc5 + cpe:/a:digium:asterisk:1.8.15.0 + cpe:/a:digium:asterisk:1.8.11.0 + cpe:/a:digium:asterisk:12.1.0:rc3 + cpe:/a:digium:asterisk:12.1.0:rc2 + cpe:/a:digium:asterisk:1.8.15.1 + cpe:/a:digium:asterisk:12.1.0:rc1 + cpe:/a:digium:asterisk:1.8.1:rc1 + cpe:/a:digium:asterisk:1.8.0:rc4 + cpe:/a:digium:asterisk:1.8.0:rc3 + cpe:/a:digium:certified_asterisk:1.8.5.0:rc1 + cpe:/a:digium:certified_asterisk:1.8.0.0:rc3 + cpe:/a:digium:asterisk:1.8.0:rc5 + cpe:/a:digium:certified_asterisk:1.8.0.0:rc2 + cpe:/a:digium:asterisk:1.8.23.1 + cpe:/a:digium:asterisk:1.8.20.0:rc1 + cpe:/a:digium:certified_asterisk:1.8.0.0:rc1 + cpe:/a:digium:asterisk:1.8.20.0:rc2 + cpe:/a:digium:certified_asterisk:1.8.0.0:rc4 + cpe:/a:digium:asterisk:1.8.0:rc2 + cpe:/a:digium:certified_asterisk:1.8.8.0:rc4 + cpe:/a:digium:asterisk:1.8.16.0:- + cpe:/a:digium:certified_asterisk:1.8.8.0:rc1 + cpe:/a:digium:asterisk:1.8.0 + cpe:/a:digium:certified_asterisk:1.8.8.0:rc2 + cpe:/a:digium:asterisk:11.8.0:rc2 + cpe:/a:digium:asterisk:11.8.0:rc1 + cpe:/a:digium:certified_asterisk:1.8.8.0:rc3 + cpe:/a:digium:certified_asterisk:1.8.15:cert1_rc2 + cpe:/a:digium:asterisk:11.8.0:rc3 + cpe:/a:digium:certified_asterisk:1.8.8.0:rc5 + cpe:/a:digium:asterisk:1.8.1 + cpe:/a:digium:asterisk:1.8.2 + cpe:/a:digium:certified_asterisk:1.8.6.0:rc2 + cpe:/a:digium:asterisk:1.8.13.0:rc1 + cpe:/a:digium:asterisk:1.8.13.0:rc2 + cpe:/a:digium:asterisk:1.8.9.0:- + cpe:/a:digium:certified_asterisk:1.8.6.0:rc3 + cpe:/a:digium:certified_asterisk:1.8.15:cert1_rc1 + cpe:/a:digium:certified_asterisk:1.8.6.0:rc1 + cpe:/a:digium:asterisk:1.8.15.0:rc1 + cpe:/a:digium:certified_asterisk:1.8.0.0:beta3 + cpe:/a:digium:asterisk:1.8.3:rc3 + cpe:/a:digium:asterisk:1.8.5:rc1 + cpe:/a:digium:asterisk:1.8.4:rc1 + cpe:/a:digium:certified_asterisk:1.8.0.0:beta1 + cpe:/a:digium:asterisk:1.8.25.0:rc2 + cpe:/a:digium:asterisk:1.8.25.0:rc1 + cpe:/a:digium:asterisk:1.8.4:rc3 + cpe:/a:digium:asterisk:1.8.19.0:rc1 + cpe:/a:digium:asterisk:1.8.19.0:rc3 + cpe:/a:digium:asterisk:1.8.3:rc1 + cpe:/a:digium:asterisk:1.8.4:rc2 + cpe:/a:digium:certified_asterisk:1.8.0.0:beta2 + cpe:/a:digium:asterisk:1.8.3:rc2 + cpe:/a:digium:certified_asterisk:1.8.7.0:- + cpe:/a:digium:asterisk:1.8.17.0:rc2 + cpe:/a:digium:asterisk:1.8.9.2 + cpe:/a:digium:asterisk:1.8.17.0:rc1 + cpe:/a:digium:asterisk:1.8.9.3 + cpe:/a:digium:asterisk:1.8.9.0 + cpe:/a:digium:asterisk:1.8.9.1 + cpe:/a:digium:certified_asterisk:1.8.3.0:- + cpe:/a:digium:certified_asterisk:1.8.0.0:beta4 + cpe:/a:digium:asterisk:1.8.24.0:rc2 + cpe:/a:digium:asterisk:1.8.17.0:rc3 + cpe:/a:digium:certified_asterisk:1.8.0.0:beta5 + cpe:/a:digium:asterisk:1.8.24.0:rc1 + cpe:/a:digium:asterisk:1.8.12.0:- + cpe:/a:digium:certified_asterisk:11.6.0:rc1 + cpe:/a:digium:certified_asterisk:11.6.0:rc2 + cpe:/a:digium:asterisk:1.8.11.1:- + cpe:/a:digium:asterisk:1.8.11.0:- + cpe:/a:digium:asterisk:1.8.8.0:patch + cpe:/a:digium:asterisk:1.8.22.0:- + cpe:/a:digium:asterisk:1.8.11.1:patch + cpe:/a:digium:asterisk:1.8.11.0:patch + cpe:/a:digium:asterisk:12.1.0:- + cpe:/a:digium:asterisk:1.8.26.0:- + cpe:/a:digium:certified_asterisk:1.8.13.0:rc1 + cpe:/a:digium:certified_asterisk:1.8.13.0:rc2 + cpe:/a:digium:asterisk:1.8.16.0 + cpe:/a:digium:asterisk:1.8.0:beta2 + cpe:/a:digium:asterisk:1.8.0:beta3 + cpe:/a:digium:asterisk:1.8.0:beta1 + cpe:/a:digium:asterisk:1.8.0:beta4 + cpe:/a:digium:asterisk:1.8.0:beta5 + cpe:/a:digium:asterisk:1.8.12.2 + cpe:/a:digium:asterisk:1.8.14.0:rc1 + cpe:/a:digium:asterisk:1.8.14.0:rc2 + cpe:/a:digium:asterisk:1.8.10.0:rc2 + cpe:/a:digium:asterisk:1.8.10.0:rc1 + cpe:/a:digium:asterisk:1.8.12.1 + cpe:/a:digium:asterisk:1.8.12.0 + cpe:/a:digium:asterisk:1.8.11.0:rc2 + cpe:/a:digium:certified_asterisk:1.8.4.0:- + cpe:/a:digium:asterisk:1.8.11.0:rc3 + cpe:/a:digium:asterisk:1.8.10.0:rc3 + cpe:/a:digium:asterisk:1.8.10.0:rc4 + cpe:/a:digium:certified_asterisk:1.8.7.0:rc1 + cpe:/a:digium:certified_asterisk:1.8.7.0:rc2 + cpe:/a:digium:certified_asterisk:1.8.0.0:- + cpe:/a:digium:asterisk:1.8.8.1 + cpe:/a:digium:asterisk:1.8.8.2 + cpe:/a:digium:certified_asterisk:1.8.2.0:- + cpe:/a:digium:asterisk:1.8.18.0 + cpe:/a:digium:asterisk:1.8.18.1 + cpe:/a:digium:asterisk:11.8.0:- + cpe:/a:digium:asterisk:1.8.5 + cpe:/a:digium:certified_asterisk:1.8.6.0:- + cpe:/a:digium:asterisk:1.8.3 + cpe:/a:digium:asterisk:1.8.18.0:rc1 + cpe:/a:digium:asterisk:1.8.4 + cpe:/a:digium:asterisk:1.8.8.0 + cpe:/a:digium:asterisk:1.8.6.0 + cpe:/a:digium:asterisk:1.8.2.3 + cpe:/a:digium:asterisk:1.8.8.0:rc2 + cpe:/a:digium:asterisk:1.8.2.4 + cpe:/a:digium:asterisk:1.8.2.1 + cpe:/a:digium:asterisk:1.8.8.0:rc4 + cpe:/a:digium:asterisk:1.8.2.2 + cpe:/a:digium:asterisk:1.8.8.0:rc1 + cpe:/a:digium:asterisk:1.8.22.0:rc2 + cpe:/a:digium:asterisk:1.8.8.0:rc3 + cpe:/a:digium:asterisk:1.8.4.3 + cpe:/a:digium:certified_asterisk:1.8.8.0:- + cpe:/a:digium:asterisk:1.8.4.4 + cpe:/a:digium:asterisk:1.8.23.0:patch + cpe:/a:digium:asterisk:1.8.12 + cpe:/a:digium:certified_asterisk:1.8.15:cert4 + cpe:/a:digium:asterisk:1.8.7.0:rc2 + cpe:/a:digium:asterisk:1.8.7.0:rc1 + cpe:/a:digium:asterisk:1.8.17.0 + cpe:/a:digium:asterisk:1.8.4.2 + cpe:/a:digium:asterisk:1.8.6.0:rc1 + cpe:/a:digium:asterisk:1.8.4.1 + cpe:/a:digium:asterisk:1.8.22.0:rc1 + cpe:/a:digium:asterisk:1.8.6.0:rc3 + cpe:/a:digium:certified_asterisk:1.8.9.0:- + cpe:/a:digium:asterisk:1.8.6.0:rc2 + cpe:/a:digium:certified_asterisk:1.8.15:- + cpe:/o:fedoraproject:fedora:19 + cpe:/a:digium:certified_asterisk:1.8.15:cert3 + cpe:/a:digium:asterisk:1.8.10.1 + cpe:/a:digium:asterisk:1.8.10.0 + cpe:/a:digium:certified_asterisk:1.8.15:cert1 + cpe:/a:digium:asterisk:1.8.12.0:rc2 + cpe:/a:digium:asterisk:1.8.12.0:rc1 + cpe:/a:digium:asterisk:1.8.12.0:rc3 + cpe:/a:digium:certified_asterisk:11.6:cert1 + cpe:/a:digium:certified_asterisk:1.8.15:cert2 + cpe:/a:digium:asterisk:1.8.15.0:- + cpe:/a:digium:asterisk:1.8.9.0:rc3 + cpe:/a:digium:certified_asterisk:1.8.3.0:rc3 + cpe:/a:digium:asterisk:1.8.8.0:rc5 + cpe:/a:digium:asterisk:1.8.9.0:rc2 + cpe:/a:digium:asterisk:1.8.9.0:rc1 + cpe:/a:digium:certified_asterisk:1.8.3.0:rc1 + cpe:/a:digium:certified_asterisk:1.8.3.0:rc2 + cpe:/a:digium:asterisk:1.8.10.0:- + cpe:/a:digium:asterisk:1.8.25.0:- + cpe:/a:digium:asterisk:1.8.14.1 + cpe:/a:digium:certified_asterisk:1.8.12.0:rc2 + cpe:/a:digium:certified_asterisk:1.8.12.0:rc1 + cpe:/a:digium:certified_asterisk:1.8.10.0:- + cpe:/a:digium:certified_asterisk:1.8.12.0:rc3 + cpe:/a:digium:asterisk:1.8.1.2 + cpe:/a:digium:asterisk:1.8.14.0:- + cpe:/a:digium:certified_asterisk:1.8.11.0:- + cpe:/a:digium:asterisk:1.8.14.1:- + cpe:/a:digium:certified_asterisk:1.8.1.0:- + cpe:/a:digium:asterisk:1.8.13.1 + cpe:/a:digium:asterisk:1.8.1.1 + cpe:/a:digium:asterisk:1.8.7.1 + cpe:/a:digium:asterisk:1.8.7.0 + cpe:/a:digium:asterisk:1.8.3.1 + cpe:/a:digium:certified_asterisk:1.8.5.0:- + cpe:/a:digium:asterisk:1.8.3.3 + cpe:/a:digium:asterisk:1.8.3.2 + cpe:/a:digium:asterisk:1.8.20.0:patch + cpe:/a:digium:asterisk:1.8.20.1:patch + cpe:/a:digium:asterisk:1.8.18.0:- + cpe:/a:digium:asterisk:1.8.20.2:patch + cpe:/a:digium:certified_asterisk:11.6.0:- + cpe:/a:digium:asterisk:1.8.21.0:rc2 + cpe:/a:digium:asterisk:1.8.21.0:rc1 + cpe:/a:digium:certified_asterisk:1.8.9.0:rc3 + cpe:/a:digium:certified_asterisk:1.8.9.0:rc1 + cpe:/a:digium:certified_asterisk:1.8.9.0:rc2 + cpe:/a:digium:asterisk:1.8.5.0 + cpe:/a:digium:asterisk:1.8.23.0:rc2 + cpe:/a:digium:asterisk:1.8.17.0:patch + cpe:/a:digium:asterisk:1.8.23.0:rc1 + cpe:/a:digium:asterisk:1.8.26.0:rc1 + cpe:/a:digium:asterisk:1.8.24.1 + cpe:/a:digium:asterisk:1.8.20.1:- + cpe:/a:digium:certified_asterisk:1.8.4.0:rc1 + cpe:/a:digium:asterisk:1.8.20.0:- + cpe:/a:digium:certified_asterisk:1.8.4.0:rc2 + cpe:/a:digium:asterisk:1.8.20.2:- + cpe:/a:digium:certified_asterisk:1.8.4.0:rc3 + cpe:/a:digium:asterisk:1.8.13.0 + cpe:/a:digium:certified_asterisk:1.8.2.0:rc1 + cpe:/a:digium:asterisk:1.8.14.1:patch + cpe:/a:digium:asterisk:1.8.14.0:patch + cpe:/a:digium:certified_asterisk:1.8.15:cert1_rc3 + cpe:/a:digium:certified_asterisk:1.8.11.0:rc1 + cpe:/a:digium:certified_asterisk:1.8.10.0:rc1 + cpe:/a:digium:certified_asterisk:1.8.11.0:rc3 + cpe:/a:digium:certified_asterisk:1.8.10.0:rc2 + cpe:/a:digium:asterisk:1.8.16.0:rc2 + cpe:/a:digium:certified_asterisk:1.8.10.0:rc3 + cpe:/a:digium:asterisk:1.8.16.0:rc1 + cpe:/a:digium:certified_asterisk:1.8.12.0:- + cpe:/a:digium:certified_asterisk:1.8.10.0:rc4 + cpe:/a:digium:asterisk:1.8.11.1 + cpe:/a:digium:certified_asterisk:1.8.11.0:rc2 + cpe:/a:digium:asterisk:1.8.8.0:- + cpe:/a:digium:certified_asterisk:1.8.14.0:rc1 + cpe:/a:digium:certified_asterisk:1.8.14.0:rc2 + cpe:/a:digium:certified_asterisk:11.6:cert1_rc2 + cpe:/a:digium:certified_asterisk:11.6:cert1_rc1 + cpe:/o:fedoraproject:fedora:20 + cpe:/a:digium:asterisk:1.8.17.0:- + + CVE-2014-2286 + 2014-04-18T18:14:37.917-04:00 + 2014-04-21T13:20:45.550-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-21T13:20:44.503-04:00 + + + + + CONFIRM + http://downloads.asterisk.org/pub/security/AST-2014-001.html + + + MISC + http://downloads.asterisk.org/pub/security/AST-2014-001-1.8.diff + + + CONFIRM + https://issues.asterisk.org/jira/browse/ASTERISK-23340 + + + BID + 66093 + + + MANDRIVA + MDVSA-2014:078 + + + FEDORA + FEDORA-2014-3762 + + + FEDORA + FEDORA-2014-3779 + + main/http.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.x before 1.8.15-cert5 and 11.6 before 11.6-cert2, allows remote attackers to cause a denial of service (stack consumption) and possibly execute arbitrary code via an HTTP request with a large number of Cookie headers. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:digium:certified_asterisk:1.8.1.0:rc1 + cpe:/a:digium:asterisk:1.8.24.0:- + cpe:/a:digium:asterisk:1.8.23.0:- + cpe:/a:digium:asterisk:1.8.19.1 + cpe:/a:digium:asterisk:1.8.21.0:- + cpe:/a:digium:asterisk:1.8.19.0:- + cpe:/a:digium:asterisk:1.8.19.0 + cpe:/a:digium:certified_asterisk:1.8.13.0:- + cpe:/a:digium:certified_asterisk:1.8.0.0:rc5 + cpe:/a:digium:asterisk:1.8.15.0 + cpe:/a:digium:asterisk:12.1.0:rc3 + cpe:/a:digium:asterisk:1.8.11.0 + cpe:/a:digium:asterisk:12.1.0:rc2 + cpe:/a:digium:asterisk:12.1.0:rc1 + cpe:/a:digium:asterisk:1.8.15.1 + cpe:/a:digium:asterisk:1.8.0:rc4 + cpe:/a:digium:asterisk:1.8.1:rc1 + cpe:/a:digium:asterisk:1.8.0:rc3 + cpe:/a:digium:certified_asterisk:1.8.5.0:rc1 + cpe:/a:digium:certified_asterisk:1.8.0.0:rc3 + cpe:/a:digium:asterisk:1.8.0:rc5 + cpe:/a:digium:asterisk:1.8.23.1 + cpe:/a:digium:certified_asterisk:1.8.0.0:rc2 + cpe:/a:digium:asterisk:1.8.20.0:rc1 + cpe:/a:digium:certified_asterisk:1.8.0.0:rc1 + cpe:/a:digium:asterisk:1.8.20.0:rc2 + cpe:/a:digium:certified_asterisk:1.8.0.0:rc4 + cpe:/a:digium:asterisk:1.8.0:rc2 + cpe:/a:digium:certified_asterisk:1.8.8.0:rc4 + cpe:/a:digium:asterisk:1.8.16.0:- + cpe:/a:digium:certified_asterisk:1.8.8.0:rc1 + cpe:/a:digium:asterisk:1.8.0 + cpe:/a:digium:certified_asterisk:1.8.8.0:rc2 + cpe:/a:digium:asterisk:11.8.0:rc2 + cpe:/a:digium:asterisk:11.8.0:rc1 + cpe:/a:digium:certified_asterisk:1.8.15:cert1_rc2 + cpe:/a:digium:certified_asterisk:1.8.8.0:rc3 + cpe:/a:digium:asterisk:11.8.0:rc3 + cpe:/a:digium:certified_asterisk:1.8.8.0:rc5 + cpe:/a:digium:asterisk:1.8.1 + cpe:/a:digium:asterisk:1.8.2 + cpe:/a:digium:certified_asterisk:1.8.6.0:rc2 + cpe:/a:digium:asterisk:1.8.13.0:rc1 + cpe:/a:digium:asterisk:1.8.13.0:rc2 + cpe:/a:digium:asterisk:1.8.9.0:- + cpe:/a:digium:certified_asterisk:1.8.6.0:rc3 + cpe:/a:digium:certified_asterisk:1.8.15:cert1_rc1 + cpe:/a:digium:certified_asterisk:1.8.6.0:rc1 + cpe:/a:digium:asterisk:1.8.15.0:rc1 + cpe:/a:digium:asterisk:1.8.5:rc1 + cpe:/a:digium:asterisk:1.8.3:rc3 + cpe:/a:digium:certified_asterisk:1.8.0.0:beta3 + cpe:/a:digium:asterisk:1.8.4:rc1 + cpe:/a:digium:asterisk:1.8.25.0:rc2 + cpe:/a:digium:certified_asterisk:1.8.0.0:beta1 + cpe:/a:digium:asterisk:1.8.4:rc3 + cpe:/a:digium:asterisk:1.8.25.0:rc1 + cpe:/a:digium:asterisk:1.8.19.0:rc1 + cpe:/a:digium:asterisk:1.8.4:rc2 + cpe:/a:digium:asterisk:1.8.19.0:rc3 + cpe:/a:digium:asterisk:1.8.3:rc1 + cpe:/a:digium:certified_asterisk:1.8.0.0:beta2 + cpe:/a:digium:asterisk:1.8.3:rc2 + cpe:/a:digium:certified_asterisk:1.8.7.0:- + cpe:/a:digium:asterisk:1.8.17.0:rc2 + cpe:/a:digium:asterisk:1.8.9.2 + cpe:/a:digium:asterisk:1.8.9.3 + cpe:/a:digium:asterisk:1.8.17.0:rc1 + cpe:/a:digium:asterisk:1.8.9.0 + cpe:/a:digium:asterisk:1.8.9.1 + cpe:/a:digium:certified_asterisk:1.8.3.0:- + cpe:/a:digium:asterisk:1.8.24.0:rc2 + cpe:/a:digium:certified_asterisk:1.8.0.0:beta4 + cpe:/a:digium:asterisk:1.8.17.0:rc3 + cpe:/a:digium:asterisk:1.8.24.0:rc1 + cpe:/a:digium:certified_asterisk:1.8.0.0:beta5 + cpe:/a:digium:asterisk:1.8.12.0:- + cpe:/a:digium:certified_asterisk:11.6.0:rc1 + cpe:/a:digium:certified_asterisk:11.6.0:rc2 + cpe:/a:digium:asterisk:1.8.11.1:- + cpe:/a:digium:asterisk:1.8.11.0:- + cpe:/a:digium:asterisk:1.8.8.0:patch + cpe:/a:digium:asterisk:1.8.22.0:- + cpe:/a:digium:asterisk:1.8.11.1:patch + cpe:/a:digium:asterisk:12.1.0:- + cpe:/a:digium:asterisk:1.8.11.0:patch + cpe:/a:digium:asterisk:1.8.26.0:- + cpe:/a:digium:certified_asterisk:1.8.13.0:rc1 + cpe:/a:digium:certified_asterisk:1.8.13.0:rc2 + cpe:/a:digium:asterisk:1.8.16.0 + cpe:/a:digium:asterisk:1.8.0:beta2 + cpe:/a:digium:asterisk:1.8.0:beta3 + cpe:/a:digium:asterisk:1.8.0:beta1 + cpe:/a:digium:asterisk:1.8.0:beta4 + cpe:/a:digium:asterisk:1.8.12.2 + cpe:/a:digium:asterisk:1.8.0:beta5 + cpe:/a:digium:asterisk:1.8.14.0:rc1 + cpe:/a:digium:asterisk:1.8.14.0:rc2 + cpe:/a:digium:asterisk:1.8.10.0:rc2 + cpe:/a:digium:asterisk:1.8.10.0:rc1 + cpe:/a:digium:asterisk:1.8.12.1 + cpe:/a:digium:asterisk:1.8.11.0:rc2 + cpe:/a:digium:asterisk:1.8.12.0 + cpe:/a:digium:certified_asterisk:1.8.4.0:- + cpe:/a:digium:asterisk:1.8.11.0:rc3 + cpe:/a:digium:asterisk:1.8.10.0:rc3 + cpe:/a:digium:asterisk:1.8.10.0:rc4 + cpe:/a:digium:certified_asterisk:1.8.7.0:rc1 + cpe:/a:digium:certified_asterisk:1.8.7.0:rc2 + cpe:/a:digium:certified_asterisk:1.8.0.0:- + cpe:/a:digium:asterisk:1.8.8.1 + cpe:/a:digium:asterisk:1.8.8.2 + cpe:/a:digium:certified_asterisk:1.8.2.0:- + cpe:/a:digium:asterisk:1.8.18.0 + cpe:/a:digium:asterisk:1.8.18.1 + cpe:/a:digium:asterisk:1.8.5 + cpe:/a:digium:asterisk:11.8.0:- + cpe:/a:digium:certified_asterisk:1.8.6.0:- + cpe:/a:digium:asterisk:1.8.3 + cpe:/a:digium:asterisk:1.8.4 + cpe:/a:digium:asterisk:1.8.18.0:rc1 + cpe:/a:digium:asterisk:1.8.8.0 + cpe:/a:digium:asterisk:1.8.6.0 + cpe:/a:digium:asterisk:1.8.8.0:rc2 + cpe:/a:digium:asterisk:1.8.2.3 + cpe:/a:digium:asterisk:1.8.2.4 + cpe:/a:digium:asterisk:1.8.8.0:rc4 + cpe:/a:digium:asterisk:1.8.2.1 + cpe:/a:digium:asterisk:1.8.8.0:rc1 + cpe:/a:digium:asterisk:1.8.2.2 + cpe:/a:digium:asterisk:1.8.22.0:rc2 + cpe:/a:digium:asterisk:1.8.8.0:rc3 + cpe:/a:digium:asterisk:1.8.4.3 + cpe:/a:digium:asterisk:1.8.4.4 + cpe:/a:digium:certified_asterisk:1.8.8.0:- + cpe:/a:digium:asterisk:1.8.23.0:patch + cpe:/a:digium:asterisk:1.8.12 + cpe:/a:digium:certified_asterisk:1.8.15:cert4 + cpe:/a:digium:asterisk:1.8.7.0:rc2 + cpe:/a:digium:asterisk:1.8.7.0:rc1 + cpe:/a:digium:asterisk:1.8.17.0 + cpe:/a:digium:asterisk:1.8.6.0:rc1 + cpe:/a:digium:asterisk:1.8.4.2 + cpe:/a:digium:asterisk:1.8.4.1 + cpe:/a:digium:asterisk:1.8.6.0:rc3 + cpe:/a:digium:asterisk:1.8.22.0:rc1 + cpe:/a:digium:certified_asterisk:1.8.9.0:- + cpe:/a:digium:asterisk:1.8.6.0:rc2 + cpe:/a:digium:certified_asterisk:1.8.15:- + cpe:/o:fedoraproject:fedora:19 + cpe:/a:digium:certified_asterisk:1.8.15:cert3 + cpe:/a:digium:asterisk:1.8.10.1 + cpe:/a:digium:certified_asterisk:1.8.15:cert1 + cpe:/a:digium:asterisk:1.8.10.0 + cpe:/a:digium:asterisk:1.8.12.0:rc2 + cpe:/a:digium:asterisk:1.8.12.0:rc1 + cpe:/a:digium:asterisk:1.8.12.0:rc3 + cpe:/a:digium:certified_asterisk:11.6:cert1 + cpe:/a:digium:certified_asterisk:1.8.15:cert2 + cpe:/a:digium:asterisk:1.8.15.0:- + cpe:/a:digium:asterisk:1.8.9.0:rc3 + cpe:/a:digium:asterisk:1.8.9.0:rc2 + cpe:/a:digium:asterisk:1.8.8.0:rc5 + cpe:/a:digium:certified_asterisk:1.8.3.0:rc3 + cpe:/a:digium:asterisk:1.8.9.0:rc1 + cpe:/a:digium:certified_asterisk:1.8.3.0:rc1 + cpe:/a:digium:certified_asterisk:1.8.3.0:rc2 + cpe:/a:digium:asterisk:1.8.10.0:- + cpe:/a:digium:asterisk:1.8.25.0:- + cpe:/a:digium:asterisk:1.8.14.1 + cpe:/a:digium:certified_asterisk:1.8.12.0:rc2 + cpe:/a:digium:certified_asterisk:1.8.12.0:rc1 + cpe:/a:digium:certified_asterisk:1.8.10.0:- + cpe:/a:digium:certified_asterisk:1.8.12.0:rc3 + cpe:/a:digium:asterisk:1.8.1.2 + cpe:/a:digium:certified_asterisk:1.8.11.0:- + cpe:/a:digium:asterisk:1.8.14.0:- + cpe:/a:digium:asterisk:1.8.14.1:- + cpe:/a:digium:certified_asterisk:1.8.1.0:- + cpe:/a:digium:asterisk:1.8.13.1 + cpe:/a:digium:asterisk:1.8.1.1 + cpe:/a:digium:asterisk:1.8.7.1 + cpe:/a:digium:asterisk:1.8.7.0 + cpe:/a:digium:asterisk:1.8.3.1 + cpe:/a:digium:asterisk:1.8.3.3 + cpe:/a:digium:certified_asterisk:1.8.5.0:- + cpe:/a:digium:asterisk:1.8.3.2 + cpe:/a:digium:asterisk:1.8.20.0:patch + cpe:/a:digium:asterisk:1.8.20.1:patch + cpe:/a:digium:asterisk:1.8.18.0:- + cpe:/a:digium:certified_asterisk:11.6.0:- + cpe:/a:digium:asterisk:1.8.20.2:patch + cpe:/a:digium:asterisk:1.8.21.0:rc2 + cpe:/a:digium:asterisk:1.8.21.0:rc1 + cpe:/a:digium:certified_asterisk:1.8.9.0:rc3 + cpe:/a:digium:certified_asterisk:1.8.9.0:rc1 + cpe:/a:digium:asterisk:1.8.5.0 + cpe:/a:digium:certified_asterisk:1.8.9.0:rc2 + cpe:/a:digium:asterisk:1.8.23.0:rc2 + cpe:/a:digium:asterisk:1.8.17.0:patch + cpe:/a:digium:asterisk:1.8.23.0:rc1 + cpe:/a:digium:asterisk:1.8.26.0:rc1 + cpe:/a:digium:asterisk:1.8.24.1 + cpe:/a:digium:asterisk:1.8.20.1:- + cpe:/a:digium:certified_asterisk:1.8.4.0:rc1 + cpe:/a:digium:asterisk:1.8.20.0:- + cpe:/a:digium:certified_asterisk:1.8.4.0:rc2 + cpe:/a:digium:asterisk:1.8.20.2:- + cpe:/a:digium:certified_asterisk:1.8.4.0:rc3 + cpe:/a:digium:asterisk:1.8.13.0 + cpe:/a:digium:certified_asterisk:1.8.2.0:rc1 + cpe:/a:digium:asterisk:1.8.14.1:patch + cpe:/a:digium:asterisk:1.8.14.0:patch + cpe:/a:digium:certified_asterisk:1.8.15:cert1_rc3 + cpe:/a:digium:certified_asterisk:1.8.11.0:rc1 + cpe:/a:digium:certified_asterisk:1.8.10.0:rc1 + cpe:/a:digium:certified_asterisk:1.8.11.0:rc3 + cpe:/a:digium:certified_asterisk:1.8.10.0:rc2 + cpe:/a:digium:certified_asterisk:1.8.10.0:rc3 + cpe:/a:digium:asterisk:1.8.16.0:rc2 + cpe:/a:digium:certified_asterisk:1.8.12.0:- + cpe:/a:digium:certified_asterisk:1.8.10.0:rc4 + cpe:/a:digium:asterisk:1.8.16.0:rc1 + cpe:/a:digium:certified_asterisk:1.8.11.0:rc2 + cpe:/a:digium:asterisk:1.8.11.1 + cpe:/a:digium:asterisk:1.8.8.0:- + cpe:/a:digium:certified_asterisk:1.8.14.0:rc1 + cpe:/a:digium:certified_asterisk:1.8.14.0:rc2 + cpe:/a:digium:certified_asterisk:11.6:cert1_rc2 + cpe:/a:digium:certified_asterisk:11.6:cert1_rc1 + cpe:/o:fedoraproject:fedora:20 + cpe:/a:digium:asterisk:1.8.17.0:- + + CVE-2014-2287 + 2014-04-18T18:14:38.010-04:00 + 2014-04-21T13:37:29.257-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-21T13:37:28.070-04:00 + + + + + CONFIRM + http://downloads.asterisk.org/pub/security/AST-2014-002.html + + + MISC + http://downloads.asterisk.org/pub/security/AST-2014-002-1.8.diff + + + CONFIRM + https://issues.asterisk.org/jira/browse/ASTERISK-23373 + + + BID + 66094 + + + MANDRIVA + MDVSA-2014:078 + + + FEDORA + FEDORA-2014-3762 + + + FEDORA + FEDORA-2014-3779 + + channels/chan_sip.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.15 before 1.8.15-cert5 and 11.6 before 11.6-cert2, when chan_sip has a certain configuration, allows remote authenticated users to cause a denial of service (channel and file descriptor consumption) via an INVITE request with a (1) Session-Expires or (2) Min-SE header with a malformed or invalid value. + + + + + + + + + + + + + cpe:/a:digium:asterisk:12.0.0 + cpe:/a:digium:asterisk:12.1.0:- + cpe:/a:digium:asterisk:12.1.0:rc3 + cpe:/a:digium:asterisk:12.1.0:rc2 + cpe:/a:digium:asterisk:12.1.0:rc1 + + CVE-2014-2288 + 2014-04-18T18:14:38.087-04:00 + 2014-04-21T13:50:16.990-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-21T13:50:16.067-04:00 + + + + + MISC + http://downloads.asterisk.org/pub/security/AST-2014-003-12.diff + + + CONFIRM + https://issues.asterisk.org/jira/browse/ASTERISK-23210 + + + FEDORA + FEDORA-2014-3762 + + + FEDORA + FEDORA-2014-3779 + + + CONFIRM + http://downloads.asterisk.org/pub/security/AST-2014-003.html + + The PJSIP channel driver in Asterisk Open Source 12.x before 12.1.1, when qualify_frequency "is enabled on an AOR and the remote SIP server challenges for authentication of the resulting OPTIONS request," allows remote attackers to cause a denial of service (crash) via a PJSIP endpoint that does not have an associated outgoing request. + + + + + + + + + + + + cpe:/a:digium:asterisk:12.0.0 + cpe:/a:digium:asterisk:12.1.0:rc3 + cpe:/a:digium:asterisk:12.1.0:rc2 + cpe:/a:digium:asterisk:12.1.0:rc1 + + CVE-2014-2289 + 2014-04-18T18:14:38.137-04:00 + 2014-04-21T13:50:19.630-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-21T13:50:19.583-04:00 + + + + + CONFIRM + http://downloads.asterisk.org/pub/security/AST-2014-004.html + + + MISC + http://downloads.asterisk.org/pub/security/AST-2014-004-12.diff + + + CONFIRM + https://issues.asterisk.org/jira/browse/ASTERISK-23139 + + + FEDORA + FEDORA-2014-3762 + + + FEDORA + FEDORA-2014-3779 + + res/res_pjsip_exten_state.c in the PJSIP channel driver in Asterisk Open Source 12.x before 12.1.0 allows remote authenticated users to cause a denial of service (crash) via a SUBSCRIBE request without any Accept headers, which triggers an invalid pointer dereference. + + + + + + + + + + + + cpe:/o:juniper:ive_os:8.0 + cpe:/o:juniper:ive_os:7.4 + cpe:/o:juniper:ive_os:7.1 + cpe:/o:juniper:ive_os:7.3 + + CVE-2014-2291 + 2014-03-14T11:55:05.697-04:00 + 2014-04-01T02:29:32.080-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-17T09:57:58.747-04:00 + + + + + CONFIRM + https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10617 + + + XF + juniper-junos-cve20142291-xss(91770) + + + SECUNIA + 57375 + + Cross-site scripting (XSS) vulnerability in the Pulse Collaboration (Secure Meeting) user pages in Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS before 7.1r18, 7.3 before 7.3r10, 7.4 before 7.4r8, and 8.0 before 8.0r1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + + + cpe:/o:juniper:ive_os:8.0 + cpe:/o:juniper:ive_os:7.4 + cpe:/o:juniper:ive_os:7.1 + cpe:/o:juniper:ive_os:7.3 + + CVE-2014-2292 + 2014-03-14T11:55:05.713-04:00 + 2014-03-17T09:57:50.153-04:00 + + + 7.2 + LOCAL + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-17T09:57:43.857-04:00 + + + + CONFIRM + https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10616 + + Unspecified vulnerability in the Linux Network Connect client in Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS before 7.1r18, 7.3 before 7.3r10, 7.4 before 7.4r8, and 8.0 before 8.0r1 allows local users to gain privileges via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:wireshark:wireshark:1.10.1 + cpe:/a:wireshark:wireshark:1.8.2 + cpe:/a:wireshark:wireshark:1.8.10 + cpe:/a:wireshark:wireshark:1.8.1 + cpe:/a:wireshark:wireshark:1.8.12 + cpe:/a:wireshark:wireshark:1.8.0 + cpe:/a:wireshark:wireshark:1.10.0 + cpe:/a:wireshark:wireshark:1.8.11 + cpe:/a:wireshark:wireshark:1.8.6 + cpe:/a:wireshark:wireshark:1.8.7 + cpe:/a:wireshark:wireshark:1.10.5 + cpe:/a:wireshark:wireshark:1.8.8 + cpe:/a:wireshark:wireshark:1.8.9 + cpe:/a:wireshark:wireshark:1.10.2 + cpe:/a:wireshark:wireshark:1.8.3 + cpe:/a:wireshark:wireshark:1.8.4 + cpe:/a:wireshark:wireshark:1.10.4 + cpe:/a:wireshark:wireshark:1.8.5 + cpe:/a:wireshark:wireshark:1.10.3 + + CVE-2014-2299 + 2014-03-11T09:01:10.280-04:00 + 2014-04-19T00:48:25.237-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-11T12:07:41.493-04:00 + + + + + CONFIRM + https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=f567435ac7140c96a5de56dbce3d5e7659af4d09 + + + CONFIRM + https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9843 + + + CONFIRM + http://www.wireshark.org/security/wnpa-sec-2014-04.html + + + DEBIAN + DSA-2871 + + + SECUNIA + 57489 + + + SECUNIA + 57480 + + + REDHAT + RHSA-2014:0342 + + + REDHAT + RHSA-2014:0341 + + + SUSE + openSUSE-SU-2014:0383 + + + SUSE + openSUSE-SU-2014:0382 + + Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a large record in MPEG data. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:linux:linux_kernel:3.0.48 + cpe:/o:linux:linux_kernel:3.0.49 + cpe:/o:linux:linux_kernel:3.0.46 + cpe:/o:linux:linux_kernel:3.0.47 + cpe:/o:linux:linux_kernel:3.0.44 + cpe:/o:linux:linux_kernel:3.0.45 + cpe:/o:linux:linux_kernel:3.0.42 + cpe:/o:linux:linux_kernel:3.4.70 + cpe:/o:linux:linux_kernel:3.4.71 + cpe:/o:linux:linux_kernel:3.0.40 + cpe:/o:linux:linux_kernel:3.0.41 + cpe:/o:linux:linux_kernel:3.4.45 + cpe:/o:linux:linux_kernel:3.4.44 + cpe:/o:linux:linux_kernel:3.4.46 + cpe:/o:linux:linux_kernel:3.4.41 + cpe:/o:linux:linux_kernel:3.4.40 + cpe:/o:linux:linux_kernel:3.4.43 + cpe:/o:linux:linux_kernel:3.4.42 + cpe:/o:linux:linux_kernel:3.4.49 + cpe:/o:linux:linux_kernel:3.4.48 + cpe:/o:linux:linux_kernel:3.0.59 + cpe:/o:linux:linux_kernel:3.4.47 + cpe:/o:linux:linux_kernel:3.0.55 + cpe:/o:linux:linux_kernel:3.0.56 + cpe:/o:linux:linux_kernel:3.0.57 + cpe:/o:linux:linux_kernel:3.0.58 + cpe:/o:linux:linux_kernel:3.0.51 + cpe:/o:linux:linux_kernel:3.0.52 + cpe:/o:linux:linux_kernel:3.0.53 + cpe:/o:linux:linux_kernel:3.11.10 + cpe:/o:linux:linux_kernel:3.0.50 + cpe:/o:linux:linux_kernel:3.4.57 + cpe:/o:linux:linux_kernel:3.4.56 + cpe:/o:linux:linux_kernel:3.4.55 + cpe:/o:linux:linux_kernel:3.4.54 + cpe:/o:linux:linux_kernel:3.4.53 + cpe:/o:linux:linux_kernel:3.4.52 + cpe:/o:linux:linux_kernel:3.4.51 + cpe:/o:linux:linux_kernel:3.4.50 + cpe:/o:linux:linux_kernel:3.0.43 + cpe:/o:linux:linux_kernel:3.10.26 + cpe:/o:linux:linux_kernel:3.4.59 + cpe:/o:linux:linux_kernel:3.0.24 + cpe:/o:linux:linux_kernel:3.0.25 + cpe:/o:linux:linux_kernel:3.0.22 + cpe:/o:linux:linux_kernel:3.1.9 + cpe:/o:linux:linux_kernel:3.0.23 + cpe:/o:linux:linux_kernel:3.10.28 + cpe:/o:linux:linux_kernel:3.0.28 + cpe:/o:linux:linux_kernel:3.10.27 + cpe:/o:linux:linux_kernel:3.0.26 + cpe:/o:linux:linux_kernel:3.10.29 + cpe:/o:linux:linux_kernel:3.4.58 + cpe:/o:linux:linux_kernel:3.0.27 + cpe:/o:linux:linux_kernel:3.10.24 + cpe:/o:linux:linux_kernel:3.10.23 + cpe:/o:linux:linux_kernel:3.10.25 + cpe:/o:linux:linux_kernel:3.10.20 + cpe:/o:linux:linux_kernel:3.1.8 + cpe:/o:linux:linux_kernel:3.0.20 + cpe:/o:linux:linux_kernel:3.10.22 + cpe:/o:linux:linux_kernel:3.10.21 + cpe:/o:linux:linux_kernel:3.4.21 + cpe:/o:linux:linux_kernel:3.4.20 + cpe:/o:linux:linux_kernel:3.4.23 + cpe:/o:linux:linux_kernel:3.4.22 + cpe:/o:linux:linux_kernel:3.4.24 + cpe:/o:linux:linux_kernel:3.4.27 + cpe:/o:linux:linux_kernel:3.4.26 + cpe:/o:linux:linux_kernel:3.4.29 + cpe:/o:linux:linux_kernel:3.10.15 + cpe:/o:linux:linux_kernel:3.4.28 + cpe:/o:linux:linux_kernel:3.0.54 + cpe:/o:linux:linux_kernel:3.0.33 + cpe:/o:linux:linux_kernel:3.0.34 + cpe:/o:linux:linux_kernel:3.0.35 + cpe:/o:linux:linux_kernel:3.0.36 + cpe:/o:linux:linux_kernel:3.10.19 + cpe:/o:linux:linux_kernel:3.0.37 + cpe:/o:linux:linux_kernel:3.10.18 + cpe:/o:linux:linux_kernel:3.0.38 + cpe:/o:linux:linux_kernel:3.4.25 + cpe:/o:linux:linux_kernel:3.10.17 + cpe:/o:linux:linux_kernel:3.0.39 + cpe:/o:linux:linux_kernel:3.10.16 + cpe:/o:linux:linux_kernel:3.10.14 + cpe:/o:linux:linux_kernel:3.10.13 + cpe:/o:linux:linux_kernel:3.10.12 + cpe:/o:linux:linux_kernel:3.10.11 + cpe:/o:linux:linux_kernel:3.10.10 + cpe:/o:linux:linux_kernel:3.0.30 + cpe:/o:linux:linux_kernel:3.0.31 + cpe:/o:linux:linux_kernel:3.9.8 + cpe:/o:linux:linux_kernel:3.5.5 + cpe:/o:linux:linux_kernel:3.4.32 + cpe:/o:linux:linux_kernel:3.9.9 + cpe:/o:linux:linux_kernel:3.5.6 + cpe:/o:linux:linux_kernel:3.4.31 + cpe:/o:linux:linux_kernel:3.5.7 + cpe:/o:linux:linux_kernel:3.4.30 + cpe:/o:linux:linux_kernel:3.7.1 + cpe:/o:linux:linux_kernel:3.4.35 + cpe:/o:linux:linux_kernel:3.9.0 + cpe:/o:linux:linux_kernel:3.0.18 + cpe:/o:linux:linux_kernel:3.4.34 + cpe:/o:linux:linux_kernel:3.4.33 + cpe:/o:linux:linux_kernel:3.9.2 + cpe:/o:linux:linux_kernel:3.9.1 + cpe:/o:linux:linux_kernel:3.0.19 + cpe:/o:linux:linux_kernel:3.4.39 + cpe:/o:linux:linux_kernel:3.9.4 + cpe:/o:linux:linux_kernel:3.4.38 + cpe:/o:linux:linux_kernel:3.9.3 + cpe:/o:linux:linux_kernel:3.4.37 + cpe:/o:linux:linux_kernel:3.9.6 + cpe:/o:linux:linux_kernel:3.9.5 + cpe:/o:linux:linux_kernel:3.0.21 + cpe:/o:linux:linux_kernel:3.9.7 + cpe:/o:linux:linux_kernel:3.5.4 + cpe:/o:linux:linux_kernel:3.0.4 + cpe:/o:linux:linux_kernel:3.0.5 + cpe:/o:linux:linux_kernel:3.0.2 + cpe:/o:linux:linux_kernel:3.0.3 + cpe:/o:linux:linux_kernel:3.0.8 + cpe:/o:linux:linux_kernel:3.0.6 + cpe:/o:linux:linux_kernel:3.0.7 + cpe:/o:linux:linux_kernel:3.4.36 + cpe:/o:linux:linux_kernel:3.13.1 + cpe:/o:linux:linux_kernel:3.6.10 + cpe:/o:linux:linux_kernel:3.6.11 + cpe:/o:linux:linux_kernel:3.13.6 + cpe:/o:linux:linux_kernel:3.13.4 + cpe:/o:linux:linux_kernel:3.13.5 + cpe:/o:linux:linux_kernel:3.13.2 + cpe:/o:linux:linux_kernel:3.13.3 + cpe:/o:linux:linux_kernel:3.4.1 + cpe:/o:linux:linux_kernel:3.4.19 + cpe:/o:linux:linux_kernel:3.4.17 + cpe:/o:linux:linux_kernel:3.4.3 + cpe:/o:linux:linux_kernel:3.4.18 + cpe:/o:linux:linux_kernel:3.4.2 + cpe:/o:linux:linux_kernel:3.2.9 + cpe:/o:linux:linux_kernel:3.4.15 + cpe:/o:linux:linux_kernel:3.2.8 + cpe:/o:linux:linux_kernel:3.4.16 + cpe:/o:linux:linux_kernel:3.4.4 + cpe:/o:linux:linux_kernel:3.12.12 + cpe:/o:linux:linux_kernel:3.2.7 + cpe:/o:linux:linux_kernel:3.4.13 + cpe:/o:linux:linux_kernel:3.12.13 + cpe:/o:linux:linux_kernel:3.12.10 + cpe:/o:linux:linux_kernel:3.4.11 + cpe:/o:linux:linux_kernel:3.12.11 + cpe:/o:linux:linux_kernel:3.4.12 + cpe:/o:linux:linux_kernel:3.4.10 + cpe:/o:linux:linux_kernel:3.0.61 + cpe:/o:linux:linux_kernel:3.3:rc2 + cpe:/o:linux:linux_kernel:3.4:rc7 + cpe:/o:linux:linux_kernel:3.0.60 + cpe:/o:linux:linux_kernel:3.3:rc7 + cpe:/o:linux:linux_kernel:3.4:rc5 + cpe:/o:linux:linux_kernel:3.3:rc5 + cpe:/o:linux:linux_kernel:3.4:rc6 + cpe:/o:linux:linux_kernel:3.3:rc6 + cpe:/o:linux:linux_kernel:3.0.64 + cpe:/o:linux:linux_kernel:3.0.63 + cpe:/o:linux:linux_kernel:3.0.62 + cpe:/o:linux:linux_kernel:3.12.1 + cpe:/o:linux:linux_kernel:3.0.68 + cpe:/o:linux:linux_kernel:3.0.67 + cpe:/o:linux:linux_kernel:3.0.66 + cpe:/o:linux:linux_kernel:3.4.14 + cpe:/o:linux:linux_kernel:3.12.7 + cpe:/o:linux:linux_kernel:3.2:rc2 + cpe:/o:linux:linux_kernel:3.1:rc1 + cpe:/o:linux:linux_kernel:3.0.9 + cpe:/o:linux:linux_kernel:3.0:rc4 + cpe:/o:linux:linux_kernel:3.12.8 + cpe:/o:linux:linux_kernel:3.1:rc4 + cpe:/o:linux:linux_kernel:3.0:rc3 + cpe:/o:linux:linux_kernel:3.12.9 + cpe:/o:linux:linux_kernel:3.0:rc2 + cpe:/o:linux:linux_kernel:3.1:rc2 + cpe:/o:linux:linux_kernel:3.0:rc1 + cpe:/o:linux:linux_kernel:3.2:rc7 + cpe:/o:linux:linux_kernel:3.12.3 + cpe:/o:linux:linux_kernel:3.1.10 + cpe:/o:linux:linux_kernel:3.2:rc6 + cpe:/o:linux:linux_kernel:3.12.4 + cpe:/o:linux:linux_kernel:3.0:rc7 + cpe:/o:linux:linux_kernel:3.2:rc5 + cpe:/o:linux:linux_kernel:3.12.5 + cpe:/o:linux:linux_kernel:3.9:rc3 + cpe:/o:linux:linux_kernel:3.0:rc6 + cpe:/o:linux:linux_kernel:3.12.6 + cpe:/o:linux:linux_kernel:3.0:rc5 + cpe:/o:linux:linux_kernel:3.9:rc1 + cpe:/o:linux:linux_kernel:3.9:rc4 + cpe:/o:linux:linux_kernel:3.9:rc7 + cpe:/o:linux:linux_kernel:3.12.2 + cpe:/o:linux:linux_kernel:3.9:rc2 + cpe:/o:linux:linux_kernel:3.9:rc5 + cpe:/o:linux:linux_kernel:3.3:rc3 + cpe:/o:linux:linux_kernel:3.4:rc4 + cpe:/o:linux:linux_kernel:3.4:rc3 + cpe:/o:linux:linux_kernel:3.3:rc1 + cpe:/o:linux:linux_kernel:3.4:rc2 + cpe:/o:linux:linux_kernel:3.9:rc6 + cpe:/o:linux:linux_kernel:3.3:rc4 + cpe:/o:linux:linux_kernel:3.4:rc1 + cpe:/o:linux:linux_kernel:3.4.5 + cpe:/o:linux:linux_kernel:3.2.2 + cpe:/o:linux:linux_kernel:3.2.3 + cpe:/o:linux:linux_kernel:3.2.1 + cpe:/o:linux:linux_kernel:3.4.6 + cpe:/o:linux:linux_kernel:3.2:rc3 + cpe:/o:linux:linux_kernel:3.2.6 + cpe:/o:linux:linux_kernel:3.4.7 + cpe:/o:linux:linux_kernel:3.2:rc4 + cpe:/o:linux:linux_kernel:3.1:rc3 + cpe:/o:linux:linux_kernel:3.4.8 + cpe:/o:linux:linux_kernel:3.2.4 + cpe:/o:linux:linux_kernel:3.4.9 + cpe:/o:linux:linux_kernel:3.2.5 + cpe:/o:linux:linux_kernel:3.0.65 + cpe:/o:linux:linux_kernel:3.2.12 + cpe:/o:linux:linux_kernel:3.8.10 + cpe:/o:linux:linux_kernel:3.8.12 + cpe:/o:linux:linux_kernel:3.8.11 + cpe:/o:linux:linux_kernel:3.8.13 + cpe:/o:linux:linux_kernel:3.7.9 + cpe:/o:linux:linux_kernel:3.7.8 + cpe:/o:linux:linux_kernel:3.7.7 + cpe:/o:linux:linux_kernel:3.7.6 + cpe:/o:linux:linux_kernel:3.6.3 + cpe:/o:linux:linux_kernel:3.7.5 + cpe:/o:linux:linux_kernel:3.7.4 + cpe:/o:linux:linux_kernel:3.7.3 + cpe:/o:linux:linux_kernel:3.7.2 + cpe:/o:linux:linux_kernel:3.6.7 + cpe:/o:linux:linux_kernel:3.6.6 + cpe:/o:linux:linux_kernel:3.6.5 + cpe:/o:linux:linux_kernel:3.6.4 + cpe:/o:linux:linux_kernel:3.6.9 + cpe:/o:linux:linux_kernel:3.6.8 + cpe:/o:linux:linux_kernel:3.10 + cpe:/o:linux:linux_kernel:3.11 + cpe:/o:linux:linux_kernel:3.12 + cpe:/o:linux:linux_kernel:3.13 + cpe:/o:linux:linux_kernel:3.10.1 + cpe:/o:linux:linux_kernel:3.10.2 + cpe:/o:linux:linux_kernel:3.10.3 + cpe:/o:linux:linux_kernel:3.6.2 + cpe:/o:linux:linux_kernel:3.6.1 + cpe:/o:linux:linux_kernel:3.3.6 + cpe:/o:linux:linux_kernel:3.3.7 + cpe:/o:linux:linux_kernel:3.3.8 + cpe:/o:linux:linux_kernel:3.0.1 + cpe:/o:linux:linux_kernel:3.2 + cpe:/o:linux:linux_kernel:3.1 + cpe:/o:linux:linux_kernel:3.7 + cpe:/o:linux:linux_kernel:3.6 + cpe:/o:linux:linux_kernel:3.4 + cpe:/o:linux:linux_kernel:3.1.6 + cpe:/o:linux:linux_kernel:3.1.5 + cpe:/o:linux:linux_kernel:3.1.7 + cpe:/o:linux:linux_kernel:3.0.32 + cpe:/o:linux:linux_kernel:3.8.9 + cpe:/o:linux:linux_kernel:3.1.2 + cpe:/o:linux:linux_kernel:3.1.1 + cpe:/o:linux:linux_kernel:3.1.4 + cpe:/o:linux:linux_kernel:3.1.3 + cpe:/o:linux:linux_kernel:3.9.10 + cpe:/o:linux:linux_kernel:3.0.29 + cpe:/o:linux:linux_kernel:3.3 + cpe:/o:linux:linux_kernel:3.8.4 + cpe:/o:linux:linux_kernel:3.2.26 + cpe:/o:linux:linux_kernel:3.8.5 + cpe:/o:linux:linux_kernel:3.2.27 + cpe:/o:linux:linux_kernel:3.8.2 + cpe:/o:linux:linux_kernel:3.2.24 + cpe:/o:linux:linux_kernel:3.8.3 + cpe:/o:linux:linux_kernel:3.2.25 + cpe:/o:linux:linux_kernel:3.8.8 + cpe:/o:linux:linux_kernel:3.8.6 + cpe:/o:linux:linux_kernel:3.2.28 + cpe:/o:linux:linux_kernel:3.8.7 + cpe:/o:linux:linux_kernel:3.2.29 + cpe:/o:linux:linux_kernel:3.3.3 + cpe:/o:linux:linux_kernel:3.3.4 + cpe:/o:linux:linux_kernel:3.3.5 + cpe:/o:linux:linux_kernel:3.2.22 + cpe:/o:linux:linux_kernel:3.8.1 + cpe:/o:linux:linux_kernel:3.2.20 + cpe:/o:linux:linux_kernel:3.3.1 + cpe:/o:linux:linux_kernel:3.2.21 + cpe:/o:linux:linux_kernel:3.3.2 + cpe:/o:linux:linux_kernel:3.11.1 + cpe:/o:linux:linux_kernel:3.11.2 + cpe:/o:linux:linux_kernel:3.2.23 + cpe:/o:linux:linux_kernel:3.0.17 + cpe:/o:linux:linux_kernel:3.9.11 + cpe:/o:linux:linux_kernel:3.0.16 + cpe:/o:linux:linux_kernel:3.0.15 + cpe:/o:linux:linux_kernel:3.2.30 + cpe:/o:linux:linux_kernel:3.0.14 + cpe:/o:linux:linux_kernel:3.0.13 + cpe:/o:linux:linux_kernel:3.0.12 + cpe:/o:linux:linux_kernel:3.0.11 + cpe:/o:linux:linux_kernel:3.4.61 + cpe:/o:linux:linux_kernel:3.0.10 + cpe:/o:linux:linux_kernel:3.4.64 + cpe:/o:linux:linux_kernel:3.8.0 + cpe:/o:linux:linux_kernel:3.4.65 + cpe:/o:linux:linux_kernel:3.4.62 + cpe:/o:linux:linux_kernel:3.4.63 + cpe:/o:linux:linux_kernel:3.4.68 + cpe:/o:linux:linux_kernel:3.4.66 + cpe:/o:linux:linux_kernel:3.4.67 + cpe:/o:linux:linux_kernel:3.5.3 + cpe:/o:linux:linux_kernel:3.5.1 + cpe:/o:linux:linux_kernel:3.5.2 + cpe:/o:linux:linux_kernel:3.10.4 + cpe:/o:linux:linux_kernel:3.4.72 + cpe:/o:linux:linux_kernel:3.10.9 + cpe:/o:linux:linux_kernel:3.4.73 + cpe:/o:linux:linux_kernel:3.4.74 + cpe:/o:linux:linux_kernel:3.4.75 + cpe:/o:linux:linux_kernel:3.4.76 + cpe:/o:linux:linux_kernel:3.10.5 + cpe:/o:linux:linux_kernel:3.4.77 + cpe:/o:linux:linux_kernel:3.10.6 + cpe:/o:linux:linux_kernel:3.4.78 + cpe:/o:linux:linux_kernel:3.10.7 + cpe:/o:linux:linux_kernel:3.4.79 + cpe:/o:linux:linux_kernel:3.10.8 + cpe:/o:linux:linux_kernel:3.7.10 + cpe:/o:linux:linux_kernel:3.2.17 + cpe:/o:linux:linux_kernel:3.2.18 + cpe:/o:linux:linux_kernel:3.2.19 + cpe:/o:linux:linux_kernel:3.2.13 + cpe:/o:linux:linux_kernel:3.2.14 + cpe:/o:linux:linux_kernel:3.11.3 + cpe:/o:linux:linux_kernel:3.2.15 + cpe:/o:linux:linux_kernel:3.4.60 + cpe:/o:linux:linux_kernel:3.2.16 + cpe:/o:linux:linux_kernel:3.11.5 + cpe:/o:linux:linux_kernel:3.11.4 + cpe:/o:linux:linux_kernel:3.2.10 + cpe:/o:linux:linux_kernel:3.11.7 + cpe:/o:linux:linux_kernel:3.2.11 + cpe:/o:linux:linux_kernel:3.11.6 + cpe:/o:linux:linux_kernel:3.11.9 + cpe:/o:linux:linux_kernel:3.11.8 + cpe:/o:linux:linux_kernel:3.4.69 + + CVE-2014-2309 + 2014-03-11T09:01:10.297-04:00 + 2014-04-01T02:29:32.360-04:00 + + + 6.1 + ADJACENT_NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-03-11T12:11:14.123-04:00 + + + + + CONFIRM + http://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=c88507fbad8055297c1d1e21e599f46960cbee39 + + + SECTRACK + 1029894 + + + MLIST + [oss-security] 20140307 Re: CVE Request: Linux kernel: IPv6: crash due to router advertisement flooding + + + SECUNIA + 57250 + + The ip6_route_add function in net/ipv6/route.c in the Linux kernel through 3.13.6 does not properly count the addition of routes, which allows remote attackers to cause a denial of service (memory consumption) via a flood of ICMPv6 Router Advertisement packets. + + + + + + + + + cpe:/a:net-snmp:net-snmp:5.4 + + CVE-2014-2310 + 2014-04-17T10:55:11.217-04:00 + 2014-04-18T11:52:40.250-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-18T11:52:40.187-04:00 + + + + + CONFIRM + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=684388 + + + UBUNTU + USN-2166-1 + + + CONFIRM + http://sourceforge.net/p/net-snmp/patches/1113/ + + + CONFIRM + http://sourceforge.net/p/net-snmp/code/ci/eb816330a1887798d844d2fd5dc6482002123cbd/ + + + SECUNIA + 57870 + + + MLIST + [oss-security] 20140307 Re: CVE request: net-snmp agentx incorrect handling of multi-object requests DoS + + + MLIST + [oss-security] 20140306 CVE request: net-snmp agentx incorrect handling of multi-object requests DoS + + The AgentX subagent in Net-SNMP before 5.4.4 allows remote attackers to cause a denial of service (hang) by sending a multi-object request with an Object ID (OID) containing more subids than previous requests, a different vulnerability than CVE-2012-6151. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:modx:modx_revolution:2.0.2:pl1 + cpe:/a:modx:modx_revolution:2.2.9 + cpe:/a:modx:modx_revolution:2.2.8 + cpe:/a:modx:modx_revolution:2.2.10 + cpe:/a:modx:modx_revolution:2.0.4 + cpe:/a:modx:modx_revolution:2.0.3 + cpe:/a:modx:modx_revolution:2.0.6 + cpe:/a:modx:modx_revolution:2.0.5 + cpe:/a:modx:modx_revolution:2.0.8 + cpe:/a:modx:modx_revolution:2.2.7 + cpe:/a:modx:modx_revolution:2.0.7 + cpe:/a:modx:modx_revolution:2.0.0 + cpe:/a:modx:modx_revolution:2.2.0 + cpe:/a:modx:modx_revolution:2.2.1 + cpe:/a:modx:modx_revolution:2.2.2 + cpe:/a:modx:modx_revolution:2.2.3 + cpe:/a:modx:modx_revolution:2.2.4 + cpe:/a:modx:modx_revolution:2.2.5 + cpe:/a:modx:modx_revolution:2.2.6 + cpe:/a:modx:modx_revolution:2.0.1 + cpe:/a:modx:modx_revolution:2.1.2 + cpe:/a:modx:modx_revolution:2.1.3 + cpe:/a:modx:modx_revolution:2.1.0 + cpe:/a:modx:modx_revolution:2.1.1 + cpe:/a:modx:modx_revolution:2.1.4 + cpe:/a:modx:modx_revolution:2.1.5 + cpe:/a:modx:modx_revolution:2.2.11 + cpe:/a:modx:modx_revolution:2.2.12 + + CVE-2014-2311 + 2014-03-11T15:37:04.913-04:00 + 2014-03-12T14:48:58.043-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-12T14:48:55.873-04:00 + + + + + MLIST + [oss-security] 20140308 Re: CVE request: SQL injection in MODX Revolution before 2.2.13 + + + CONFIRM + http://modx.com/blog/2014/03/07/revolution-2.2.13/ + + + CONFIRM + http://forums.modx.com/thread/89486/modx-revolution-2-x-sql-injection + + SQL injection vulnerability in modx.class.php in MODX Revolution 2.0.0 before 2.2.13 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. + + + + + + + + + + + + + + + + + + cpe:/a:atlassian:jira:6.0.2 + cpe:/a:atlassian:jira:6.0.1 + cpe:/a:atlassian:jira:6.0.4 + cpe:/a:atlassian:jira:6.0.3 + cpe:/a:atlassian:jira:6.0 + + CVE-2014-2313 + 2014-03-09T09:16:57.117-04:00 + 2014-03-10T12:38:26.140-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-10T12:38:22.907-04:00 + + + + + CONFIRM + https://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2014-02-26 + + Directory traversal vulnerability in the Importers plugin in Atlassian JIRA before 6.0.5 allows remote attackers to create arbitrary files via unspecified vectors. + + + + + + + + + + + + + + + + + cpe:/a:atlassian:jira:6.0.2 + cpe:/a:atlassian:jira:6.0.1 + cpe:/a:atlassian:jira:6.0.3 + cpe:/a:atlassian:jira:6.0 + + CVE-2014-2314 + 2014-03-09T09:16:57.130-04:00 + 2014-03-10T12:37:31.123-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-10T12:37:31.063-04:00 + + + + + CONFIRM + https://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2014-02-26 + + Directory traversal vulnerability in the Issue Collector plugin in Atlassian JIRA before 6.0.4 allows remote attackers to create arbitrary files via unspecified vectors. + + + + + + + + + + + + + + cpe:/a:shinephp:thank_you_counter_button:1.8.7::~~~wordpress~~ + + CVE-2014-2315 + 2014-03-09T09:16:57.130-04:00 + 2014-03-10T13:06:35.213-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-10T13:06:34.870-04:00 + + + + + XF + thanks-you-wordpress-xss(91474) + + + MISC + http://packetstormsecurity.com/files/125397 + + Multiple cross-site scripting (XSS) vulnerabilities in the Thank You Counter Button plugin 1.8.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) thanks_caption, (2) thanks_caption_style, or (3) thanks_style parameter to wp-admin/options.php. + + + + + + + + + + + + + + cpe:/a:zemanta:search_everything:7.0.2::~~~wordpress~~ + + CVE-2014-2316 + 2014-03-09T09:16:57.147-04:00 + 2014-03-10T13:15:26.007-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-10T13:15:25.960-04:00 + + + + + CONFIRM + http://wordpress.org/plugins/search-everything/changelog/ + + + SECUNIA + 56820 + + SQL injection vulnerability in se_search_default in the Search Everything plugin before 7.0.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the s parameter to index.php. NOTE: some of these details are obtained from third party information. + + + + + + + + + + + + + + + + + + + + cpe:/a:opendocman:opendocman:1.2.6.5 + cpe:/a:opendocman:opendocman:1.2.7 + cpe:/a:opendocman:opendocman:1.2.6.6 + cpe:/a:opendocman:opendocman:1.2.6.7:- + cpe:/a:opendocman:opendocman:1.2.6.2:- + cpe:/a:opendocman:opendocman:1.2.6.3:a + cpe:/a:opendocman:opendocman:1.2.6.2:a + cpe:/a:opendocman:opendocman:1.2.6.7:beta + cpe:/a:opendocman:opendocman:1.2.6.3:- + cpe:/a:opendocman:opendocman:1.2.6.8 + cpe:/a:opendocman:opendocman:1.2.7.1 + cpe:/a:opendocman:opendocman:1.2.6.2:b + + CVE-2014-2317 + 2014-03-09T09:16:57.163-04:00 + 2014-03-10T12:25:26.653-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-10T12:25:26.590-04:00 + + + + + MISC + http://www.opendocman.com/opendocman-v1-2-7-2-released + + + BID + 65775 + + + SECUNIA + 56189 + + SQL injection vulnerability in ajax_udf.php in OpenDocMan before 1.2.7.2 allows remote attackers to execute arbitrary SQL commands via the table parameter. NOTE: some of these details are obtained from third party information. + + + + + + + + + cpe:/a:atcom:netvolution:3.0 + + CVE-2014-2318 + 2014-03-11T09:00:38.013-04:00 + 2014-03-11T10:06:01.783-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-11T10:06:01.533-04:00 + + + + + XF + netvolution-m-sql-injection(91543) + + + BID + 65942 + + + MISC + http://packetstormsecurity.com/files/125507 + + SQL injection vulnerability in ATCOM Netvolution 3 allows remote attackers to execute arbitrary SQL commands via the m parameter. + + + + + + + + + + + + cpe:/a:powerarchiver:powerarchiver:14.02 + cpe:/a:powerarchiver:powerarchiver:14.00 + cpe:/a:powerarchiver:powerarchiver:14.02.03 + cpe:/a:powerarchiver:powerarchiver:14.01 + + CVE-2014-2319 + 2014-03-14T06:55:06.410-04:00 + 2014-03-14T12:37:29.433-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-03-14T12:37:29.370-04:00 + + + + + CONFIRM + http://www.powerarchiver.com/2014/03/12/powerarchiver-2013-14-02-05-released/ + + + MISC + http://int21.de/cve/CVE-2014-2319-powerarchiver.html + + The Encrypt Files feature in ConeXware PowerArchiver before 14.02.05 uses legacy ZIP encryption even if the AES 256-bit selection is chosen, which makes it easier for context-dependent attackers to obtain sensitive information via a known-plaintext attack. + + + + + + + + + + cpe:/h:zte:f460:- + cpe:/h:zte:f660:- + + CVE-2014-2321 + 2014-03-11T09:01:19.140-04:00 + 2014-03-11T12:22:42.157-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-11T12:22:35.437-04:00 + + + + + CERT-VN + VU#600724 + + + MISC + https://community.rapid7.com/community/infosec/blog/2014/03/03/disclosure-r7-2013-18-zte-f460-and-zte-f660-webshellcmdgch-backdoor + + + MISC + http://www.myxzy.com/post-411.html + + web_shell_cmd.gch on ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests, as demonstrated by using "set TelnetCfg" commands to enable a TELNET service with specified credentials. + + + CVE-2014-2322 + 2014-05-02T10:55:07.217-04:00 + 2014-05-02T10:55:07.217-04:00 + + MISC + http://www.vapid.dhs.org/advisories/arabic-ruby-gem.html + + + MLIST + [oss-security] 20140312 Re: Remote Command Injection in Arabic Prawn 0.0.1 Ruby Gem + + + MLIST + [oss-security] 20140310 Remote Command Injection in Arabic Prawn 0.0.1 Ruby Gem + + lib/string_utf_support.rb in the Arabic Prawn 0.0.1 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) downloaded_file or (2) url variable. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:lighttpd:lighttpd:1.3.16 + cpe:/a:lighttpd:lighttpd:1.4.34 + cpe:/a:lighttpd:lighttpd:1.4.20 + cpe:/a:lighttpd:lighttpd:1.4.21 + cpe:/a:lighttpd:lighttpd:1.4.22 + cpe:/a:lighttpd:lighttpd:1.4.28 + cpe:/a:lighttpd:lighttpd:1.4.29 + cpe:/a:lighttpd:lighttpd:1.4.26 + cpe:/a:lighttpd:lighttpd:1.4.27 + cpe:/a:lighttpd:lighttpd:1.4.5 + cpe:/a:lighttpd:lighttpd:1.4.4 + cpe:/a:lighttpd:lighttpd:1.4.3 + cpe:/a:lighttpd:lighttpd:1.4.23 + cpe:/a:lighttpd:lighttpd:1.4.25 + cpe:/a:lighttpd:lighttpd:1.4.6 + cpe:/a:lighttpd:lighttpd:1.4.24 + cpe:/a:lighttpd:lighttpd:1.4.8 + cpe:/a:lighttpd:lighttpd:1.4.11 + cpe:/a:lighttpd:lighttpd:1.4.9 + cpe:/a:lighttpd:lighttpd:1.4.30 + cpe:/a:lighttpd:lighttpd:1.4.31 + cpe:/a:lighttpd:lighttpd:1.4.7 + cpe:/a:lighttpd:lighttpd:1.4.32 + cpe:/a:lighttpd:lighttpd:1.4.33 + cpe:/a:lighttpd:lighttpd:1.4.10 + cpe:/a:lighttpd:lighttpd:1.4.19 + cpe:/a:lighttpd:lighttpd:1.4.12 + cpe:/a:lighttpd:lighttpd:1.4.13 + cpe:/a:lighttpd:lighttpd:1.4.14 + cpe:/a:lighttpd:lighttpd:1.4.15 + cpe:/a:lighttpd:lighttpd:1.4.16 + cpe:/a:lighttpd:lighttpd:1.4.17 + cpe:/a:lighttpd:lighttpd:1.4.18 + + CVE-2014-2323 + 2014-03-14T11:55:05.743-04:00 + 2014-04-19T00:48:27.897-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-17T09:52:26.443-04:00 + + + + + CONFIRM + http://www.lighttpd.net/2014/3/12/1.4.35/ + + + DEBIAN + DSA-2877 + + + SECUNIA + 57514 + + + SECUNIA + 57404 + + + MLIST + [oss-security] 20140312 Re: lighttpd 1.4.34 SQL injection and path traversal CVE request + + + MLIST + [oss-security] 20140312 lighttpd 1.4.34 SQL injection and path traversal CVE request + + + SUSE + openSUSE-SU-2014:0496 + + + SUSE + SUSE-SU-2014:0474 + + + SUSE + openSUSE-SU-2014:0449 + + + CONFIRM + http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2014_01.txt + + SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:lighttpd:lighttpd:1.3.16 + cpe:/a:lighttpd:lighttpd:1.4.34 + cpe:/a:lighttpd:lighttpd:1.4.20 + cpe:/a:lighttpd:lighttpd:1.4.21 + cpe:/a:lighttpd:lighttpd:1.4.22 + cpe:/a:lighttpd:lighttpd:1.4.28 + cpe:/a:lighttpd:lighttpd:1.4.29 + cpe:/a:lighttpd:lighttpd:1.4.26 + cpe:/a:lighttpd:lighttpd:1.4.27 + cpe:/a:lighttpd:lighttpd:1.4.5 + cpe:/a:lighttpd:lighttpd:1.4.4 + cpe:/a:lighttpd:lighttpd:1.4.3 + cpe:/a:lighttpd:lighttpd:1.4.23 + cpe:/a:lighttpd:lighttpd:1.4.25 + cpe:/a:lighttpd:lighttpd:1.4.6 + cpe:/a:lighttpd:lighttpd:1.4.24 + cpe:/a:lighttpd:lighttpd:1.4.8 + cpe:/a:lighttpd:lighttpd:1.4.11 + cpe:/a:lighttpd:lighttpd:1.4.9 + cpe:/a:lighttpd:lighttpd:1.4.30 + cpe:/a:lighttpd:lighttpd:1.4.31 + cpe:/a:lighttpd:lighttpd:1.4.7 + cpe:/a:lighttpd:lighttpd:1.4.32 + cpe:/a:lighttpd:lighttpd:1.4.33 + cpe:/a:lighttpd:lighttpd:1.4.10 + cpe:/a:lighttpd:lighttpd:1.4.19 + cpe:/a:lighttpd:lighttpd:1.4.12 + cpe:/a:lighttpd:lighttpd:1.4.13 + cpe:/a:lighttpd:lighttpd:1.4.14 + cpe:/a:lighttpd:lighttpd:1.4.15 + cpe:/a:lighttpd:lighttpd:1.4.16 + cpe:/a:lighttpd:lighttpd:1.4.17 + cpe:/a:lighttpd:lighttpd:1.4.18 + + CVE-2014-2324 + 2014-03-14T11:55:05.760-04:00 + 2014-04-19T00:48:27.987-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-03-17T09:55:26.573-04:00 + + + + + CONFIRM + http://www.lighttpd.net/2014/3/12/1.4.35/ + + + DEBIAN + DSA-2877 + + + SECUNIA + 57514 + + + SECUNIA + 57404 + + + MLIST + [oss-security] 20140312 Re: lighttpd 1.4.34 SQL injection and path traversal CVE request + + + MLIST + [oss-security] 20140312 lighttpd 1.4.34 SQL injection and path traversal CVE request + + + SUSE + openSUSE-SU-2014:0496 + + + SUSE + SUSE-SU-2014:0474 + + + SUSE + openSUSE-SU-2014:0449 + + + CONFIRM + http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2014_01.txt + + Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname. + + + + + + + + + + + + + cpe:/a:proxmox:mail_gateway:3.1-5673 + cpe:/a:proxmox:mail_gateway:3.1 + cpe:/a:proxmox:mail_gateway:3.0 + cpe:/a:proxmox:mail_gateway:3.1-5741 + cpe:/a:proxmox:mail_gateway:3.1-5670 + + CVE-2014-2325 + 2014-03-14T10:55:04.407-04:00 + 2014-03-25T20:42:03.097-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-17T08:34:11.343-04:00 + + + + + CONFIRM + http://proxmox.com/news/archive/view/listid-1-proxmox-newsletter/mailid-48-proxmox-newsletter-march-2014-proxmox-ve-3-2-released/tmpl-component + + + BID + 66169 + + + FULLDISC + 20140312 Multiplus XSS in Proxmox Mail Gateway 3.1 (CVE-2014-2325) + + Multiple cross-site scripting (XSS) vulnerabilities in Proxmox Mail Gateway before 3.1-5829 allow remote attackers to inject arbitrary web script or HTML via the (1) state parameter to objects/who/index.htm or (2) User email address to quarantine/spam/manage.htm. + + + + + + + + + cpe:/a:cacti:cacti:0.8.7g + + CVE-2014-2326 + 2014-03-27T12:55:05.693-04:00 + 2014-03-27T15:23:15.993-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-27T15:23:15.947-04:00 + + + + + BID + 66390 + + + MISC + http://packetstormsecurity.com/files/125849/Deutsche-Telekom-CERT-Advisory-DTC-A-20140324-001.html + + Cross-site scripting (XSS) vulnerability in Cacti 0.8.7g allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + + + + + + + + + + cpe:/a:cacti:cacti:0.8.7f + cpe:/a:cacti:cacti:0.8.7 + cpe:/a:cacti:cacti:0.8.7g + cpe:/a:cacti:cacti:0.8.8 + cpe:/a:cacti:cacti:0.8.7b + cpe:/a:cacti:cacti:0.8.8b + cpe:/a:cacti:cacti:0.8.8a + cpe:/a:cacti:cacti:0.8.7c + cpe:/a:cacti:cacti:0.8.7d + cpe:/a:cacti:cacti:0.8.7a + cpe:/a:cacti:cacti:0.8.7e + + CVE-2014-2327 + 2014-04-23T11:55:03.390-04:00 + 2014-04-24T10:59:27.333-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-24T10:59:27.240-04:00 + + + + + CONFIRM + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768 + + + BID + 66392 + + + BUGTRAQ + 20140324 Deutsche Telekom CERT Advisory [DTC-A-20140324-001] vulnerabilities in cacti + + Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users. + + + + + + + + + + + + + + + + + + + cpe:/a:cacti:cacti:0.8.7f + cpe:/a:cacti:cacti:0.8.7 + cpe:/a:cacti:cacti:0.8.7g + cpe:/a:cacti:cacti:0.8.8 + cpe:/a:cacti:cacti:0.8.7b + cpe:/a:cacti:cacti:0.8.8b + cpe:/a:cacti:cacti:0.8.8a + cpe:/a:cacti:cacti:0.8.7c + cpe:/a:cacti:cacti:0.8.7d + cpe:/a:cacti:cacti:0.8.7a + cpe:/a:cacti:cacti:0.8.7e + + CVE-2014-2328 + 2014-04-23T11:55:03.767-04:00 + 2014-04-24T11:12:51.857-04:00 + + + 6.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-24T11:12:51.777-04:00 + + + + CONFIRM + http://svn.cacti.net/viewvc?view=rev&revision=7442 + + + CONFIRM + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768 + + + BID + 66387 + + + BUGTRAQ + 20140324 Deutsche Telekom CERT Advisory [DTC-A-20140324-001] vulnerabilities in cacti + + + FEDORA + FEDORA-2014-4892 + + + FEDORA + FEDORA-2014-4928 + + + CONFIRM + http://bugs.cacti.net/view.php?id=2433 + + lib/graph_export.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:marcel_brinkkemper:lazyest-gallery:1.1.19::~~~wordpress~~ + cpe:/a:marcel_brinkkemper:lazyest-gallery:1.1.18::~~~wordpress~~ + cpe:/a:marcel_brinkkemper:lazyest-gallery:1.1.19.1::~~~wordpress~~ + cpe:/a:marcel_brinkkemper:lazyest-gallery:1.1.20::~~~wordpress~~ + cpe:/a:marcel_brinkkemper:lazyest-gallery:1.1.9::~~~wordpress~~ + cpe:/a:marcel_brinkkemper:lazyest-gallery:1.1.7::~~~wordpress~~ + cpe:/a:marcel_brinkkemper:lazyest-gallery:1.1.9.1::~~~wordpress~~ + cpe:/a:marcel_brinkkemper:lazyest-gallery:1.1.8::~~~wordpress~~ + cpe:/a:marcel_brinkkemper:lazyest-gallery:1.1.5::~~~wordpress~~ + cpe:/a:marcel_brinkkemper:lazyest-gallery:1.1.6::~~~wordpress~~ + cpe:/a:marcel_brinkkemper:lazyest-gallery:1.1.3::~~~wordpress~~ + cpe:/a:marcel_brinkkemper:lazyest-gallery:1.1.4::~~~wordpress~~ + cpe:/a:marcel_brinkkemper:lazyest-gallery:1.1.1::~~~wordpress~~ + cpe:/a:marcel_brinkkemper:lazyest-gallery:1.1.3.1::~~~wordpress~~ + cpe:/a:marcel_brinkkemper:lazyest-gallery:1.1.7.1::~~~wordpress~~ + cpe:/a:marcel_brinkkemper:lazyest-gallery:1.1.3.3::~~~wordpress~~ + cpe:/a:marcel_brinkkemper:lazyest-gallery:1.1.8.1::~~~wordpress~~ + cpe:/a:marcel_brinkkemper:lazyest-gallery:1.1.3.2::~~~wordpress~~ + cpe:/a:marcel_brinkkemper:lazyest-gallery:1.1::~~~wordpress~~ + cpe:/a:marcel_brinkkemper:lazyest-gallery:1.1.10.1::~~~wordpress~~ + cpe:/a:marcel_brinkkemper:lazyest-gallery:1.1.2.1::~~~wordpress~~ + cpe:/a:marcel_brinkkemper:lazyest-gallery:1.1.16::~~~wordpress~~ + cpe:/a:marcel_brinkkemper:lazyest-gallery:1.1.17.1::~~~wordpress~~ + cpe:/a:marcel_brinkkemper:lazyest-gallery:1.1.1.1::~~~wordpress~~ + cpe:/a:marcel_brinkkemper:lazyest-gallery:1.1.17.2::~~~wordpress~~ + cpe:/a:marcel_brinkkemper:lazyest-gallery:1.1.14::~~~wordpress~~ + cpe:/a:marcel_brinkkemper:lazyest-gallery:1.1.15::~~~wordpress~~ + cpe:/a:marcel_brinkkemper:lazyest-gallery:1.1.12::~~~wordpress~~ + cpe:/a:marcel_brinkkemper:lazyest-gallery:1.1.13::~~~wordpress~~ + cpe:/a:marcel_brinkkemper:lazyest-gallery:1.1.10::~~~wordpress~~ + cpe:/a:marcel_brinkkemper:lazyest-gallery:1.1.17.4::~~~wordpress~~ + cpe:/a:marcel_brinkkemper:lazyest-gallery:1.1.11::~~~wordpress~~ + + CVE-2014-2333 + 2014-04-11T10:55:05.710-04:00 + 2014-04-14T10:17:42.417-04:00 + + + 2.6 + NETWORK + HIGH + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-14T10:17:42.150-04:00 + + + + + BID + 66756 + + + CONFIRM + http://wordpress.org/plugins/lazyest-gallery/changelog + + + SECUNIA + 57746 + + Cross-site scripting (XSS) vulnerability in the Lazyest Gallery plugin before 1.1.21 for WordPress allows remote attackers to inject arbitrary web script or HTML via an EXIF tag. NOTE: some of these details are obtained from third party information. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:strongswan:strongswan:4.1.9 + cpe:/a:strongswan:strongswan:4.1.8 + cpe:/a:strongswan:strongswan:4.1.7 + cpe:/a:strongswan:strongswan:4.1.6 + cpe:/a:strongswan:strongswan:4.1.3 + cpe:/a:strongswan:strongswan:4.1.10 + cpe:/a:strongswan:strongswan:4.0.7 + cpe:/a:strongswan:strongswan:4.1.2 + cpe:/a:strongswan:strongswan:4.1.5 + cpe:/a:strongswan:strongswan:4.1.4 + cpe:/a:strongswan:strongswan:4.1.1 + cpe:/a:strongswan:strongswan:4.1.0 + cpe:/a:strongswan:strongswan:4.6.1 + cpe:/a:strongswan:strongswan:4.6.0 + cpe:/a:strongswan:strongswan:4.2.16 + cpe:/a:strongswan:strongswan:4.2.13 + cpe:/a:strongswan:strongswan:4.2.15 + cpe:/a:strongswan:strongswan:4.2.14 + cpe:/a:strongswan:strongswan:4.4.0 + cpe:/a:strongswan:strongswan:4.2.11 + cpe:/a:strongswan:strongswan:4.4.1 + cpe:/a:strongswan:strongswan:4.2.10 + cpe:/a:strongswan:strongswan:4.1.11 + cpe:/a:strongswan:strongswan:4.2.9 + cpe:/a:strongswan:strongswan:4.2.6 + cpe:/a:strongswan:strongswan:4.5.1 + cpe:/a:strongswan:strongswan:4.2.8 + cpe:/a:strongswan:strongswan:4.5.0 + cpe:/a:strongswan:strongswan:4.2.7 + cpe:/a:strongswan:strongswan:4.3.5 + cpe:/a:strongswan:strongswan:4.5.2 + cpe:/a:strongswan:strongswan:4.3.7 + cpe:/a:strongswan:strongswan:4.3.6 + cpe:/a:strongswan:strongswan:5.1.0 + cpe:/a:strongswan:strongswan:5.1.1 + cpe:/a:strongswan:strongswan:5.1.2 + cpe:/a:strongswan:strongswan:5.0.2 + cpe:/a:strongswan:strongswan:5.0.3 + cpe:/a:strongswan:strongswan:5.0.4 + cpe:/a:strongswan:strongswan:5.0.0 + cpe:/a:strongswan:strongswan:5.0.1 + cpe:/a:strongswan:strongswan:4.2.2 + cpe:/a:strongswan:strongswan:4.3.4 + cpe:/a:strongswan:strongswan:4.2.1 + cpe:/a:strongswan:strongswan:4.5.3 + cpe:/a:strongswan:strongswan:4.2.4 + cpe:/a:strongswan:strongswan:4.2.3 + cpe:/a:strongswan:strongswan:4.6.3 + cpe:/a:strongswan:strongswan:4.6.4 + cpe:/a:strongswan:strongswan:4.2.0 + cpe:/a:strongswan:strongswan:4.2.12 + cpe:/a:strongswan:strongswan:4.6.2 + cpe:/a:strongswan:strongswan:4.3.1 + cpe:/a:strongswan:strongswan:4.3.0 + cpe:/a:strongswan:strongswan:4.2.5 + cpe:/a:strongswan:strongswan:4.3.3 + cpe:/a:strongswan:strongswan:4.3.2 + + CVE-2014-2338 + 2014-04-16T14:37:14.240-04:00 + 2014-04-24T01:06:04.343-04:00 + + + 6.4 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-17T10:48:51.017-04:00 + + + + + CONFIRM + http://www.strongswan.org/blog/2014/04/14/strongswan-authentication-bypass-vulnerability-%28cve-2014-2338%29.html + + + DEBIAN + DSA-2903 + + + SECUNIA + 57823 + + + SUSE + SUSE-SU-2014:0529 + + IKEv2 in strongSwan 4.0.7 before 5.1.3 allows remote attackers to bypass authentication by rekeying an IKE_SA during (1) initiation or (2) re-authentication, which triggers the IKE_SA state to be set to established. + + + + + + + + + + + + + + cpe:/a:sir:gnuboard:4.34.21 + cpe:/a:sir:gnuboard:4.34.20 + cpe:/a:sir:gnuboard:4.33.2 + cpe:/a:sir:gnuboard:5.0 + cpe:/a:sir:gnuboard:4.31.3 + cpe:/a:sir:gnuboard:4.31.4 + + CVE-2014-2339 + 2014-03-19T10:17:45.150-04:00 + 2014-03-20T12:46:47.683-04:00 + + + 6.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-20T12:46:38.980-04:00 + + + + + XF + gnuboard-cve20142339-sql-injection(91814) + + + BID + 66228 + + + FULLDISC + 20140317 [CVE-2014-2339] GNUboard SQL Injection Vulnerability + + Multiple SQL injection vulnerabilities in bbs/ajax.autosave.php in GNUboard 5.x and possibly earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) subject or (2) content parameter. + + + + + + + + + + + + + + + + + + + + + cpe:/a:xcloner:xcloner:3.1.0::~~~wordpress~~ + cpe:/a:xcloner:xcloner:2.1::~~~wordpress~~ + cpe:/a:xcloner:xcloner:3.0.7::~~~wordpress~~ + cpe:/a:xcloner:xcloner:3.0.6::~~~wordpress~~ + cpe:/a:xcloner:xcloner:3.0.5::~~~wordpress~~ + cpe:/a:xcloner:xcloner:3.0.4::~~~wordpress~~ + cpe:/a:xcloner:xcloner:3.0.3::~~~wordpress~~ + cpe:/a:xcloner:xcloner:3.0.2::~~~wordpress~~ + cpe:/a:xcloner:xcloner:3.0.1::~~~wordpress~~ + cpe:/a:xcloner:xcloner:3.0.8::~~~wordpress~~ + cpe:/a:xcloner:xcloner:3.0::~~~wordpress~~ + cpe:/a:xcloner:xcloner:2.1.2::~~~wordpress~~ + cpe:/a:xcloner:xcloner:2.2.1::~~~wordpress~~ + + CVE-2014-2340 + 2014-04-03T12:15:44.863-04:00 + 2014-04-19T00:48:28.723-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-03T13:04:22.307-04:00 + + + + + MISC + https://www.htbridge.com/advisory/HTB23206 + + + BID + 66280 + + + BUGTRAQ + 20140402 &ETH;&iexcl;ross-Site Request Forgery (CSRF) in XCloner Wordpress Plugin + + + EXPLOIT-DB + 32701 + + + CONFIRM + http://wordpress.org/plugins/xcloner-backup-and-restore/changelog/ + + + SECUNIA + 57362 + + Cross-site request forgery (CSRF) vulnerability in the XCloner plugin before 3.1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that create website backups via a request to wp-admin/plugins.php. + + + + + + + + + + + + + + + + + cpe:/a:cubecart:cubecart:5.2.5 + cpe:/a:cubecart:cubecart:5.2.6 + cpe:/a:cubecart:cubecart:5.2.7 + cpe:/a:cubecart:cubecart:5.2.8 + cpe:/a:cubecart:cubecart:5.2.4 + cpe:/a:cubecart:cubecart:5.2.1 + cpe:/a:cubecart:cubecart:5.2.0 + cpe:/a:cubecart:cubecart:5.2.3 + cpe:/a:cubecart:cubecart:5.2.2 + + CVE-2014-2341 + 2014-04-22T09:06:29.367-04:00 + 2014-04-22T13:04:20.927-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-22T13:04:20.847-04:00 + + + + + XF + cubecart-cve20142341-session-hijacking(92526) + + + SECTRACK + 1030086 + + + BID + 66805 + + + OSVDB + 105784 + + + EXPLOIT-DB + 32830 + + + SECUNIA + 57856 + + + CONFIRM + http://forums.cubecart.com/topic/48427-cubecart-529-relased/ + + Session fixation vulnerability in CubeCart before 5.2.9 allows remote attackers to hijack web sessions via the PHPSESSID parameter. + + + + + + + + + cpe:/a:dompdf:dompdf:0.6.0:beta3 + + CVE-2014-2383 + 2014-04-28T10:09:06.707-04:00 + 2014-04-29T08:18:44.760-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-29T08:18:44.683-04:00 + + + + + MISC + https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2383/ + + + CONFIRM + https://github.com/dompdf/dompdf/commit/23a693993299e669306929e3d49a4a1f7b3fb028 + + + BUGTRAQ + 20140423 CVE-2014-2383 - Arbitrary file read in dompdf + + + FULLDISC + 20140423 CVE-2014-2383 - Arbitrary file read in dompdf + + dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter. + + + + + + + + + + cpe:/a:vmware:workstation:10.0.1_build_1379776 + cpe:/a:vmware:player:6.0.1_build_1379776 + + CVE-2014-2384 + 2014-04-15T19:13:15.697-04:00 + 2014-04-16T10:23:41.180-04:00 + + + 4.9 + LOCAL + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-16T10:23:41.150-04:00 + + + + + MISC + https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2384/ + + + FULLDISC + 20140411 CVE-2014-2384 - Invalid Pointer Dereference in VMware Workstation and Player + + vmx86.sys in VMware Workstation 10.0.1 build 1379776 and VMware Player 6.0.1 build 1379776 on Windows might allow local users to cause a denial of service (read access violation and system crash) via a crafted buffer in an IOCTL call. NOTE: the researcher reports "Vendor rated issue as non-exploitable." + + + + + + + + + + + + + cpe:/o:novell:opensuse:12.3 + cpe:/o:novell:opensuse:13.1 + cpe:/a:icinga:icinga:1.10.0 + cpe:/a:icinga:icinga:1.10.1 + cpe:/a:icinga:icinga:1.10.2 + + CVE-2014-2386 + 2014-03-25T12:55:28.630-04:00 + 2014-03-25T14:05:53.903-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-03-25T14:05:53.747-04:00 + + + + + CONFIRM + https://git.icinga.org/?p=icinga-core.git;a=commitdiff;h=73285093b71a5551abdaab0a042d3d6bae093b0d + + + CONFIRM + https://dev.icinga.org/issues/5663 + + + SUSE + openSUSE-SU-2014:0420 + + + MLIST + [oss-security] 20140313 CVE request for icinga 1 byte \0 overflows + + Multiple off-by-one errors in Icinga, possibly 1.10.2 and earlier, allow remote attackers to cause a denial of service (crash) via unspecified vectors to the (1) display_nav_table, (2) print_export_link, (3) page_num_selector, or (4) page_limit_selector function in cgi/cgiutils.c or (5) status_page_num_selector function in cgi/status.c, which triggers a stack-based buffer overflow. + + + + + + + + + + + + + + cpe:/h:blackberry:blackberry_z10:- + cpe:/o:blackberry:blackberry_os:10.1.0.2312 + + CVE-2014-2389 + 2014-04-12T00:37:31.907-04:00 + 2014-04-14T14:24:56.873-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-14T14:24:49.747-04:00 + + + + + BUGTRAQ + 20140408 BlackBerry Z 10 - Buffer Overflow in qconnDoor [MZ-13-05] + + Stack-based buffer overflow in a certain decryption function in qconnDoor on Blackberry Z10 devices with software 10.1.0.2312, when developer-mode has been previously enabled, allows remote attackers to execute arbitrary code via a crafted packet in a TCP session on a wireless network. + + + + + + + + + + + + + cpe:/a:open-xchange:open-xchange_appsuite:7.2.2 + cpe:/a:open-xchange:open-xchange_appsuite:7.2.0 + cpe:/a:open-xchange:open-xchange_appsuite:7.2.1 + cpe:/a:open-xchange:open-xchange_appsuite:7.4.1 + cpe:/a:open-xchange:open-xchange_appsuite:7.4.2 + + CVE-2014-2391 + 2014-04-24T01:06:05.530-04:00 + 2014-04-24T14:27:56.437-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-24T14:27:56.390-04:00 + + + + + BUGTRAQ + 20140408 Open-Xchange Security Advisory 2014-04-08 + + The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potentially useful password-pattern information by reading (1) a web-server access log, (2) a web-server Referer log, or (3) browser history that contains this string because of its presence in a GET request. + + + + + + + + + + + + + cpe:/a:open-xchange:open-xchange_appsuite:7.2.2 + cpe:/a:open-xchange:open-xchange_appsuite:7.2.0 + cpe:/a:open-xchange:open-xchange_appsuite:7.2.1 + cpe:/a:open-xchange:open-xchange_appsuite:7.4.1 + cpe:/a:open-xchange:open-xchange_appsuite:7.4.2 + + CVE-2014-2392 + 2014-04-24T01:06:05.623-04:00 + 2014-04-24T14:29:46.537-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-24T14:29:46.487-04:00 + + + + + BUGTRAQ + 20140408 Open-Xchange Security Advisory 2014-04-08 + + The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 places a password in a GET request, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history. + + + + + + + + + + + + + cpe:/a:open-xchange:open-xchange_appsuite:7.2.2 + cpe:/a:open-xchange:open-xchange_appsuite:7.2.0 + cpe:/a:open-xchange:open-xchange_appsuite:7.2.1 + cpe:/a:open-xchange:open-xchange_appsuite:7.4.1 + cpe:/a:open-xchange:open-xchange_appsuite:7.4.2 + + CVE-2014-2393 + 2014-04-24T01:06:05.670-04:00 + 2014-04-24T14:32:17.087-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-24T14:32:17.040-04:00 + + + + + BUGTRAQ + 20140408 Open-Xchange Security Advisory 2014-04-08 + + Cross-site scripting (XSS) vulnerability in Open-Xchange AppSuite 7.4.1 before 7.4.1-rev11 and 7.4.2 before 7.4.2-rev13 allows remote attackers to inject arbitrary web script or HTML via a Drive filename that is not properly handled during use of the composer to add an e-mail attachment. + + + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jdk:1.8.0 + cpe:/a:oracle:jdk:1.7.0:update_51 + cpe:/a:oracle:jre:1.7.0:update_51 + + CVE-2014-2397 + 2014-04-15T21:55:10.273-04:00 + 2014-04-16T12:55:51.300-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-16T12:55:51.253-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jrockit:r27.8.1 + cpe:/a:oracle:jdk:1.8.0 + cpe:/a:oracle:jre:1.5.0:update_61 + cpe:/a:oracle:jrockit:r28.3.1 + cpe:/a:oracle:jdk:1.7.0:update_51 + cpe:/a:oracle:jre:1.6.0:update_71 + cpe:/a:oracle:jre:1.7.0:update_51 + cpe:/a:oracle:jdk:1.6.0:update_71 + cpe:/a:oracle:javafx:2.2.51 + cpe:/a:oracle:jdk:1.5.0:update_61 + + CVE-2014-2398 + 2014-04-15T21:55:10.337-04:00 + 2014-04-16T12:33:16.943-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-16T12:33:16.867-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JavaFX 2.2.51; and JRockit R27.8.1 and R28.3.1 allows remote authenticated users to affect integrity via unknown vectors related to Javadoc. + + + + + + + + + cpe:/a:oracle:fusion_middleware:2.2.2 + + CVE-2014-2399 + 2014-04-15T21:55:10.400-04:00 + 2014-04-16T13:04:10.833-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-16T13:04:10.817-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 2.2.2 allows remote attackers to affect integrity via unknown vectors related to Oracle Endeca Information Discovery (Formerly Latitude), a different vulnerability than CVE-2014-2400. + + + + + + + + + cpe:/a:oracle:fusion_middleware:2.2.2 + + CVE-2014-2400 + 2014-04-15T21:55:10.447-04:00 + 2014-04-16T13:12:06.303-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-16T13:12:05.083-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 2.2.2 allows remote attackers to affect integrity via unknown vectors related to Oracle Endeca Information Discovery (Formerly Latitude), a different vulnerability than CVE-2014-2399. + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jdk:1.8.0 + cpe:/a:oracle:jre:1.5.0:update_61 + cpe:/a:oracle:jdk:1.7.0:update_51 + cpe:/a:oracle:jre:1.6.0:update_71 + cpe:/a:oracle:jre:1.7.0:update_51 + cpe:/a:oracle:jdk:1.6.0:update_71 + cpe:/a:oracle:javafx:2.2.51 + cpe:/a:oracle:jdk:1.5.0:update_61 + + CVE-2014-2401 + 2014-04-15T21:55:10.510-04:00 + 2014-04-16T12:38:34.453-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-16T12:38:34.297-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JavaFX 2.2.51; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality via unknown vectors related to 2D. + + + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jdk:1.8.0 + cpe:/a:oracle:jdk:1.7.0:update_51 + cpe:/a:oracle:jre:1.7.0:update_51 + + CVE-2014-2402 + 2014-04-15T21:55:10.557-04:00 + 2014-04-16T12:57:36.243-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-16T12:57:36.147-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-0432 and CVE-2014-0455. + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jdk:1.8.0 + cpe:/a:oracle:jdk:1.7.0:update_51 + cpe:/a:oracle:jre:1.6.0:update_71 + cpe:/a:oracle:jre:1.7.0:update_51 + cpe:/a:oracle:jdk:1.6.0:update_71 + + CVE-2014-2403 + 2014-04-15T21:55:10.617-04:00 + 2014-04-16T13:07:46.777-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-16T13:07:46.670-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality via vectors related to JAXP. + + + + + + + + + + + + + + + cpe:/a:oracle:fusion_middleware:11.1.2.2.0 + cpe:/a:oracle:fusion_middleware:11.1.2.1.0 + cpe:/a:oracle:fusion_middleware:10.1.4.3 + cpe:/a:oracle:fusion_middleware:11.1.1.5.0 + cpe:/a:oracle:fusion_middleware:11.1.1.7.0 + cpe:/a:oracle:fusion_middleware:11.1.2.0 + cpe:/a:oracle:fusion_middleware:11.1.1.3.0 + + CVE-2014-2404 + 2014-04-15T21:55:10.680-04:00 + 2014-04-16T13:18:50.143-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-16T13:18:49.987-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 10.1.4.3, 11.1.1.3.0, 11.1.1.5.0, 11.1.1.7.0, 11.1.2.0.0, 11.1.2.1.0, and 11.1.2.2.0 allows remote authenticated users to affect confidentiality via unknown vectors related to WebGate. + + + + + + + + + + + + cpe:/a:oracle:database_server:11.1.0.7 + cpe:/a:oracle:database_server:11.2.0.4 + cpe:/a:oracle:database_server:11.2.0.3 + cpe:/a:oracle:database_server:12.1.0.1 + + CVE-2014-2406 + 2014-04-15T21:55:10.743-04:00 + 2014-04-16T13:22:08.120-04:00 + + + 8.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-16T13:22:07.870-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, and 12.1.0.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to "Advisor" and "Select Any Dictionary" privileges. + + + + + + + + + cpe:/a:oracle:fusion_middleware:11.1.1.3.0 + + CVE-2014-2407 + 2014-04-15T21:55:10.790-04:00 + 2014-04-16T12:07:32.487-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-16T12:07:32.377-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect availability via unknown vectors related to Data Quality, a different vulnerability than CVE-2014-2415, CVE-2014-2416, CVE-2014-2417, and CVE-2014-2418. + + + + + + + + + + + + cpe:/a:oracle:database_server:11.1.0.7 + cpe:/a:oracle:database_server:11.2.0.4 + cpe:/a:oracle:database_server:11.2.0.3 + cpe:/a:oracle:database_server:12.1.0.1 + + CVE-2014-2408 + 2014-04-15T21:55:10.837-04:00 + 2014-04-16T13:56:25.047-04:00 + + + 6.6 + NETWORK + HIGH + SINGLE_INSTANCE + COMPLETE + COMPLETE + NONE + http://nvd.nist.gov + 2014-04-16T13:56:24.957-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, and 12.1.0.1 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to the "Grant Any Object Privilege." + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jdk:1.8.0 + cpe:/a:oracle:jdk:1.7.0:update_51 + cpe:/a:oracle:jre:1.6.0:update_71 + cpe:/a:oracle:jre:1.7.0:update_51 + cpe:/a:oracle:jdk:1.6.0:update_71 + + CVE-2014-2409 + 2014-04-15T21:55:10.900-04:00 + 2014-04-16T12:58:50.073-04:00 + + + 6.4 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-16T12:58:50.027-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Deployment. + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jdk:1.8.0 + + CVE-2014-2410 + 2014-04-15T22:55:14.913-04:00 + 2014-04-16T12:59:17.043-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-16T12:59:17.010-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 8 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX. + + + + + + + + + + cpe:/a:oracle:identity_analytics:11.1.1.5 + cpe:/a:oracle:sun_role_manager:5.0 + + CVE-2014-2411 + 2014-04-15T22:55:14.973-04:00 + 2014-04-16T14:00:41.277-04:00 + + + 6.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-16T14:00:41.213-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Oracle Identity Analytics component in Oracle Fusion Middleware Oracle Identity Analytics 11.1.1.5 and Sun Role Manager 5.0 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Security. + + + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jdk:1.8.0 + cpe:/a:oracle:jre:1.5.0:update_61 + cpe:/a:oracle:jdk:1.7.0:update_51 + cpe:/a:oracle:jre:1.6.0:update_71 + cpe:/a:oracle:jre:1.7.0:update_51 + cpe:/a:oracle:jdk:1.6.0:update_71 + cpe:/a:oracle:jdk:1.5.0:update_61 + + CVE-2014-2412 + 2014-04-15T22:55:15.037-04:00 + 2014-04-16T13:09:35.063-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-16T13:09:34.970-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, SE 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT, a different vulnerability than CVE-2014-0451. + + + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jdk:1.8.0 + cpe:/a:oracle:jdk:1.7.0:update_51 + cpe:/a:oracle:jre:1.7.0:update_51 + + CVE-2014-2413 + 2014-04-15T22:55:15.083-04:00 + 2014-04-16T13:09:23.250-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-16T13:09:23.203-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect integrity via unknown vectors related to Libraries. + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jdk:1.8.0 + cpe:/a:oracle:jdk:1.7.0:update_51 + cpe:/a:oracle:jre:1.6.0:update_71 + cpe:/a:oracle:jre:1.7.0:update_51 + cpe:/a:oracle:jdk:1.6.0:update_71 + + CVE-2014-2414 + 2014-04-15T22:55:15.147-04:00 + 2014-04-16T13:00:41.030-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-16T13:00:40.890-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAXB. + + + + + + + + + cpe:/a:oracle:fusion_middleware:11.1.1.3.0 + + CVE-2014-2415 + 2014-04-15T22:55:15.193-04:00 + 2014-04-16T12:05:38.527-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-16T12:05:38.513-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect availability via unknown vectors related to Data Quality, a different vulnerability than CVE-2014-2407, CVE-2014-2416, CVE-2014-2417, and CVE-2014-2418. + + + + + + + + + cpe:/a:oracle:fusion_middleware:11.1.1.3.0 + + CVE-2014-2416 + 2014-04-15T22:55:15.240-04:00 + 2014-04-16T12:02:15.740-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-16T12:02:15.317-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect availability via unknown vectors related to Data Quality, a different vulnerability than CVE-2014-2407, CVE-2014-2415, CVE-2014-2417, and CVE-2014-2418. + + + + + + + + + cpe:/a:oracle:fusion_middleware:11.1.1.3.0 + + CVE-2014-2417 + 2014-04-15T22:55:15.287-04:00 + 2014-04-16T12:04:17.930-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-16T12:04:17.760-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect availability via unknown vectors related to Data Quality, a different vulnerability than CVE-2014-2407, CVE-2014-2415, CVE-2014-2416, and CVE-2014-2418. + + + + + + + + + cpe:/a:oracle:fusion_middleware:11.1.1.3.0 + + CVE-2014-2418 + 2014-04-15T22:55:15.350-04:00 + 2014-04-16T12:00:59.550-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-16T12:00:59.440-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect availability via unknown vectors related to Data Quality, a different vulnerability than CVE-2014-2407, CVE-2014-2415, CVE-2014-2416, and CVE-2014-2417. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:mysql:5.6.1 + cpe:/a:oracle:mysql:5.6.3 + cpe:/a:oracle:mysql:5.6.2 + cpe:/a:oracle:mysql:5.6.5 + cpe:/a:oracle:mysql:5.6.4 + cpe:/a:oracle:mysql:5.5.16 + cpe:/a:oracle:mysql:5.6.7 + cpe:/a:oracle:mysql:5.6.6 + cpe:/a:oracle:mysql:5.6.9 + cpe:/a:mysql:mysql:5.5.0 + cpe:/a:mysql:mysql:5.5.1 + cpe:/a:mysql:mysql:5.5.7 + cpe:/a:mysql:mysql:5.5.8 + cpe:/a:mysql:mysql:5.5.5 + cpe:/a:mysql:mysql:5.5.6 + cpe:/a:oracle:mysql:5.5.17 + cpe:/a:mysql:mysql:5.5.9 + cpe:/a:oracle:mysql:5.5.18 + cpe:/a:oracle:mysql:5.5.19 + cpe:/a:oracle:mysql:5.5.12 + cpe:/a:oracle:mysql:5.5.13 + cpe:/a:oracle:mysql:5.5.14 + cpe:/a:oracle:mysql:5.5.15 + cpe:/a:mysql:mysql:5.5.3 + cpe:/a:mysql:mysql:5.5.4 + cpe:/a:oracle:mysql:5.5.10 + cpe:/a:mysql:mysql:5.5.2 + cpe:/a:oracle:mysql:5.5.11 + cpe:/a:oracle:mysql:5.5.27 + cpe:/a:oracle:mysql:5.6.10 + cpe:/a:oracle:mysql:5.6.12 + cpe:/a:oracle:mysql:5.6.11 + cpe:/a:oracle:mysql:5.6.14 + cpe:/a:oracle:mysql:5.6.13 + cpe:/a:oracle:mysql:5.6.15 + cpe:/a:oracle:mysql:5.5.29 + cpe:/a:oracle:mysql:5.5.28 + cpe:/a:oracle:mysql:5.5.25 + cpe:/a:oracle:mysql:5.5.26 + cpe:/a:oracle:mysql:5.6.8 + cpe:/a:oracle:mysql:5.5.23 + cpe:/a:oracle:mysql:5.5.24 + cpe:/a:oracle:mysql:5.5.21 + cpe:/a:oracle:mysql:5.5.22 + cpe:/a:oracle:mysql:5.5.20 + cpe:/a:oracle:mysql:5.5.31 + cpe:/a:oracle:mysql:5.5.33 + cpe:/a:oracle:mysql:5.5.32 + cpe:/a:oracle:mysql:5.5.35 + cpe:/a:oracle:mysql:5.5.34 + cpe:/a:oracle:mysql:5.5.30 + cpe:/a:oracle:mysql:5.5.25:a + cpe:/a:oracle:mysql:5.6.0 + + CVE-2014-2419 + 2014-04-15T22:55:15.397-04:00 + 2014-04-16T13:12:54.180-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-16T13:12:53.053-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle MySQL Server 5.5.35 and earlier and 5.6.15 and earlier allows remote authenticated users to affect availability via unknown vectors related to Partition. + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jdk:1.8.0 + cpe:/a:oracle:jdk:1.7.0:update_51 + cpe:/a:oracle:jre:1.6.0:update_71 + cpe:/a:oracle:jre:1.7.0:update_51 + cpe:/a:oracle:jdk:1.6.0:update_71 + + CVE-2014-2420 + 2014-04-15T22:55:15.443-04:00 + 2014-04-16T13:02:28.847-04:00 + + + 2.6 + NETWORK + HIGH + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-16T13:02:28.783-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect integrity via unknown vectors related to Deployment. + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jdk:1.8.0 + cpe:/a:oracle:jre:1.5.0:update_61 + cpe:/a:oracle:jdk:1.7.0:update_51 + cpe:/a:oracle:jre:1.6.0:update_71 + cpe:/a:oracle:jre:1.7.0:update_51 + cpe:/a:oracle:jdk:1.6.0:update_71 + cpe:/a:oracle:javafx:2.2.51 + cpe:/a:oracle:jdk:1.5.0:update_61 + + CVE-2014-2421 + 2014-04-15T22:55:15.490-04:00 + 2014-04-16T12:39:46.220-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-16T12:39:46.173-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JavaFX 2.2.51; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. + + + + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jdk:1.8.0 + cpe:/a:oracle:jdk:1.7.0:update_51 + cpe:/a:oracle:jre:1.7.0:update_51 + cpe:/a:oracle:javafx:2.2.51 + + CVE-2014-2422 + 2014-04-15T22:55:15.553-04:00 + 2014-04-16T12:42:13.570-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-16T12:42:13.523-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 7u51 and 8, and JavaFX 2.2.51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jdk:1.8.0 + cpe:/a:oracle:jdk:1.7.0:update_51 + cpe:/a:oracle:jre:1.6.0:update_71 + cpe:/a:oracle:jre:1.7.0:update_51 + cpe:/a:oracle:jdk:1.6.0:update_71 + + CVE-2014-2423 + 2014-04-15T22:55:15.600-04:00 + 2014-04-16T13:05:30.103-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-16T13:05:30.057-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0452 and CVE-2014-0458. + + + + + + + + + cpe:/a:oracle:fusion_middleware:11.1.1.7.0 + + CVE-2014-2424 + 2014-04-15T22:55:15.663-04:00 + 2014-04-16T13:54:50.437-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-16T13:54:50.327-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Oracle Event Processing component in Oracle Fusion Middleware 11.1.1.7.0 allows remote authenticated users to affect integrity via vectors related to CEP system. + + + + + + + + + cpe:/a:oracle:fusion_middleware:8.0:update2_patch5 + + CVE-2014-2425 + 2014-04-15T22:55:15.710-04:00 + 2014-04-16T13:58:16.207-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-16T13:58:16.177-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Oracle OpenSSO component in Oracle Fusion Middleware 8.0 Update 2 Patch 5 allows remote authenticated users to affect confidentiality via unknown vectors. + + + + + + + + + cpe:/a:oracle:fusion_middleware:8.0:update2_patch5 + + CVE-2014-2426 + 2014-04-15T22:55:15.770-04:00 + 2014-04-16T13:59:09.947-04:00 + + + 4.9 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-16T13:59:09.837-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Oracle OpenSSO component in Oracle Fusion Middleware 8.0 Update 2 Patch 5 allows remote authenticated users to affect integrity and availability via unknown vectors related to Admin Console. + + + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jdk:1.8.0 + cpe:/a:oracle:jre:1.5.0:update_61 + cpe:/a:oracle:jdk:1.7.0:update_51 + cpe:/a:oracle:jre:1.6.0:update_71 + cpe:/a:oracle:jre:1.7.0:update_51 + cpe:/a:oracle:jdk:1.6.0:update_71 + cpe:/a:oracle:jdk:1.5.0:update_61 + + CVE-2014-2427 + 2014-04-15T22:55:15.817-04:00 + 2014-04-16T13:10:48.940-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-16T13:10:48.863-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Sound. + + + + + + + + + + + + + + cpe:/a:oracle:jre:1.8.0 + cpe:/a:oracle:jdk:1.8.0 + cpe:/a:oracle:jdk:1.7.0:update_51 + cpe:/a:oracle:jre:1.6.0:update_71 + cpe:/a:oracle:jre:1.7.0:update_51 + cpe:/a:oracle:jdk:1.6.0:update_71 + + CVE-2014-2428 + 2014-04-15T22:55:15.867-04:00 + 2014-04-16T13:17:26.673-04:00 + + + 7.6 + NETWORK + HIGH + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-16T13:17:26.453-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. + + + + + + + + + cpe:/a:oracle:peoplesoft_products:9.0 + + CVE-2014-2429 + 2014-04-15T22:55:15.913-04:00 + 2014-04-16T14:09:31.637-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-16T14:09:31.607-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the PeopleSoft Enterprise CS Campus Self Service component in Oracle PeopleSoft Products 9.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Campus Mobile. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:mysql:5.6.1 + cpe:/a:oracle:mysql:5.6.3 + cpe:/a:oracle:mysql:5.6.2 + cpe:/a:oracle:mysql:5.6.5 + cpe:/a:oracle:mysql:5.6.4 + cpe:/a:oracle:mysql:5.5.16 + cpe:/a:oracle:mysql:5.6.7 + cpe:/a:oracle:mysql:5.6.6 + cpe:/a:oracle:mysql:5.6.9 + cpe:/a:mysql:mysql:5.5.0 + cpe:/a:mysql:mysql:5.5.1 + cpe:/a:mysql:mysql:5.5.7 + cpe:/a:mysql:mysql:5.5.8 + cpe:/a:mysql:mysql:5.5.5 + cpe:/a:mysql:mysql:5.5.6 + cpe:/a:oracle:mysql:5.5.17 + cpe:/a:mysql:mysql:5.5.9 + cpe:/a:oracle:mysql:5.5.18 + cpe:/a:oracle:mysql:5.5.19 + cpe:/a:oracle:mysql:5.5.12 + cpe:/a:oracle:mysql:5.5.13 + cpe:/a:oracle:mysql:5.5.14 + cpe:/a:oracle:mysql:5.5.15 + cpe:/a:mysql:mysql:5.5.3 + cpe:/a:mysql:mysql:5.5.4 + cpe:/a:oracle:mysql:5.5.10 + cpe:/a:mysql:mysql:5.5.2 + cpe:/a:oracle:mysql:5.5.11 + cpe:/a:oracle:mysql:5.5.27 + cpe:/a:oracle:mysql:5.6.10 + cpe:/a:oracle:mysql:5.6.12 + cpe:/a:oracle:mysql:5.6.11 + cpe:/a:oracle:mysql:5.6.14 + cpe:/a:oracle:mysql:5.6.13 + cpe:/a:oracle:mysql:5.6.16 + cpe:/a:oracle:mysql:5.6.15 + cpe:/a:oracle:mysql:5.5.29 + cpe:/a:oracle:mysql:5.5.28 + cpe:/a:oracle:mysql:5.5.25 + cpe:/a:oracle:mysql:5.5.26 + cpe:/a:oracle:mysql:5.6.8 + cpe:/a:oracle:mysql:5.5.23 + cpe:/a:oracle:mysql:5.5.24 + cpe:/a:oracle:mysql:5.5.21 + cpe:/a:oracle:mysql:5.5.22 + cpe:/a:oracle:mysql:5.5.20 + cpe:/a:oracle:mysql:5.5.31 + cpe:/a:oracle:mysql:5.5.33 + cpe:/a:oracle:mysql:5.5.32 + cpe:/a:oracle:mysql:5.5.35 + cpe:/a:oracle:mysql:5.5.34 + cpe:/a:oracle:mysql:5.5.36 + cpe:/a:oracle:mysql:5.5.30 + cpe:/a:oracle:mysql:5.5.25:a + cpe:/a:oracle:mysql:5.6.0 + + CVE-2014-2430 + 2014-04-15T22:55:15.973-04:00 + 2014-04-16T14:13:48.770-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-16T14:13:46.350-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle MySQL Server 5.5.36 and earlier and 5.6.16 and earlier allows remote authenticated users to affect availability via unknown vectors related to Performance Schema. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:mysql:5.6.1 + cpe:/a:oracle:mysql:5.6.3 + cpe:/a:oracle:mysql:5.6.2 + cpe:/a:oracle:mysql:5.6.5 + cpe:/a:oracle:mysql:5.6.4 + cpe:/a:oracle:mysql:5.5.16 + cpe:/a:oracle:mysql:5.6.7 + cpe:/a:oracle:mysql:5.6.6 + cpe:/a:oracle:mysql:5.6.9 + cpe:/a:mysql:mysql:5.5.0 + cpe:/a:mysql:mysql:5.5.1 + cpe:/a:mysql:mysql:5.5.7 + cpe:/a:mysql:mysql:5.5.8 + cpe:/a:mysql:mysql:5.5.5 + cpe:/a:mysql:mysql:5.5.6 + cpe:/a:oracle:mysql:5.5.17 + cpe:/a:oracle:mysql:5.5.18 + cpe:/a:mysql:mysql:5.5.9 + cpe:/a:oracle:mysql:5.5.19 + cpe:/a:oracle:mysql:5.5.12 + cpe:/a:oracle:mysql:5.5.13 + cpe:/a:oracle:mysql:5.5.14 + cpe:/a:oracle:mysql:5.5.15 + cpe:/a:mysql:mysql:5.5.3 + cpe:/a:mysql:mysql:5.5.4 + cpe:/a:oracle:mysql:5.5.10 + cpe:/a:oracle:mysql:5.5.11 + cpe:/a:mysql:mysql:5.5.2 + cpe:/a:oracle:mysql:5.5.27 + cpe:/a:oracle:mysql:5.6.10 + cpe:/a:oracle:mysql:5.6.12 + cpe:/a:oracle:mysql:5.6.11 + cpe:/a:oracle:mysql:5.6.14 + cpe:/a:oracle:mysql:5.6.13 + cpe:/a:oracle:mysql:5.6.16 + cpe:/a:oracle:mysql:5.6.15 + cpe:/a:oracle:mysql:5.5.29 + cpe:/a:oracle:mysql:5.5.28 + cpe:/a:oracle:mysql:5.5.25 + cpe:/a:oracle:mysql:5.5.26 + cpe:/a:oracle:mysql:5.6.8 + cpe:/a:oracle:mysql:5.5.23 + cpe:/a:oracle:mysql:5.5.24 + cpe:/a:oracle:mysql:5.5.21 + cpe:/a:oracle:mysql:5.5.22 + cpe:/a:oracle:mysql:5.5.20 + cpe:/a:oracle:mysql:5.5.31 + cpe:/a:oracle:mysql:5.5.33 + cpe:/a:oracle:mysql:5.5.32 + cpe:/a:oracle:mysql:5.5.35 + cpe:/a:oracle:mysql:5.5.34 + cpe:/a:oracle:mysql:5.5.36 + cpe:/a:oracle:mysql:5.5.30 + cpe:/a:oracle:mysql:5.5.25:a + cpe:/a:oracle:mysql:5.6.0 + + CVE-2014-2431 + 2014-04-15T22:55:16.037-04:00 + 2014-04-16T14:14:15.397-04:00 + + + 2.6 + NETWORK + HIGH + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-16T14:14:12.677-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle MySQL Server 5.5.36 and earlier and 5.6.16 and earlier allows remote attackers to affect availability via unknown vectors related to Options. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:mysql:5.6.1 + cpe:/a:oracle:mysql:5.6.3 + cpe:/a:oracle:mysql:5.6.2 + cpe:/a:oracle:mysql:5.6.5 + cpe:/a:oracle:mysql:5.5.16 + cpe:/a:oracle:mysql:5.6.4 + cpe:/a:oracle:mysql:5.6.7 + cpe:/a:oracle:mysql:5.6.6 + cpe:/a:oracle:mysql:5.6.9 + cpe:/a:mysql:mysql:5.5.0 + cpe:/a:mysql:mysql:5.5.1 + cpe:/a:mysql:mysql:5.5.7 + cpe:/a:mysql:mysql:5.5.8 + cpe:/a:mysql:mysql:5.5.5 + cpe:/a:mysql:mysql:5.5.6 + cpe:/a:oracle:mysql:5.5.17 + cpe:/a:oracle:mysql:5.5.18 + cpe:/a:mysql:mysql:5.5.9 + cpe:/a:oracle:mysql:5.5.19 + cpe:/a:oracle:mysql:5.5.12 + cpe:/a:oracle:mysql:5.5.13 + cpe:/a:oracle:mysql:5.5.14 + cpe:/a:oracle:mysql:5.5.15 + cpe:/a:mysql:mysql:5.5.3 + cpe:/a:mysql:mysql:5.5.4 + cpe:/a:oracle:mysql:5.5.10 + cpe:/a:mysql:mysql:5.5.2 + cpe:/a:oracle:mysql:5.5.11 + cpe:/a:oracle:mysql:5.5.27 + cpe:/a:oracle:mysql:5.6.10 + cpe:/a:oracle:mysql:5.6.12 + cpe:/a:oracle:mysql:5.6.11 + cpe:/a:oracle:mysql:5.6.14 + cpe:/a:oracle:mysql:5.6.13 + cpe:/a:oracle:mysql:5.6.15 + cpe:/a:oracle:mysql:5.5.29 + cpe:/a:oracle:mysql:5.5.28 + cpe:/a:oracle:mysql:5.5.25 + cpe:/a:oracle:mysql:5.5.26 + cpe:/a:oracle:mysql:5.6.8 + cpe:/a:oracle:mysql:5.5.23 + cpe:/a:oracle:mysql:5.5.24 + cpe:/a:oracle:mysql:5.5.21 + cpe:/a:oracle:mysql:5.5.22 + cpe:/a:oracle:mysql:5.5.20 + cpe:/a:oracle:mysql:5.5.31 + cpe:/a:oracle:mysql:5.5.33 + cpe:/a:oracle:mysql:5.5.32 + cpe:/a:oracle:mysql:5.5.35 + cpe:/a:oracle:mysql:5.5.34 + cpe:/a:oracle:mysql:5.5.30 + cpe:/a:oracle:mysql:5.5.25:a + cpe:/a:oracle:mysql:5.6.0 + + CVE-2014-2432 + 2014-04-15T22:55:16.100-04:00 + 2014-04-16T13:15:11.073-04:00 + + + 2.8 + NETWORK + MEDIUM + MULTIPLE_INSTANCES + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-16T13:15:10.607-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability Oracle the MySQL Server component 5.5.35 and earlier and 5.6.15 and earlier allows remote authenticated users to affect availability via unknown vectors related to Federated. + + + + + + + + + cpe:/a:oracle:peoplesoft_products:8.53 + + CVE-2014-2433 + 2014-04-15T22:55:16.147-04:00 + 2014-04-16T14:10:45.250-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-16T14:10:45.187-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the PeopleSoft Enterprise PT PeopleTools component in Oracle PeopleSoft Products 8.53 allows remote attackers to affect availability via unknown vectors related to Integration Broker. + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:mysql:5.6.1 + cpe:/a:oracle:mysql:5.6.3 + cpe:/a:oracle:mysql:5.6.2 + cpe:/a:oracle:mysql:5.6.5 + cpe:/a:oracle:mysql:5.6.4 + cpe:/a:oracle:mysql:5.6.7 + cpe:/a:oracle:mysql:5.6.6 + cpe:/a:oracle:mysql:5.6.9 + cpe:/a:oracle:mysql:5.6.10 + cpe:/a:oracle:mysql:5.6.12 + cpe:/a:oracle:mysql:5.6.0 + cpe:/a:oracle:mysql:5.6.11 + cpe:/a:oracle:mysql:5.6.14 + cpe:/a:oracle:mysql:5.6.13 + cpe:/a:oracle:mysql:5.6.15 + cpe:/a:oracle:mysql:5.6.8 + + CVE-2014-2434 + 2014-04-15T22:55:16.193-04:00 + 2014-04-16T14:00:05.947-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-16T14:00:05.633-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle MySQL Server 5.6.15 and earlier allows remote authenticated users to affect availability via vectors related to DML. + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:mysql:5.6.1 + cpe:/a:oracle:mysql:5.6.3 + cpe:/a:oracle:mysql:5.6.2 + cpe:/a:oracle:mysql:5.6.5 + cpe:/a:oracle:mysql:5.6.4 + cpe:/a:oracle:mysql:5.6.7 + cpe:/a:oracle:mysql:5.6.6 + cpe:/a:oracle:mysql:5.6.9 + cpe:/a:oracle:mysql:5.6.10 + cpe:/a:oracle:mysql:5.6.12 + cpe:/a:oracle:mysql:5.6.0 + cpe:/a:oracle:mysql:5.6.11 + cpe:/a:oracle:mysql:5.6.14 + cpe:/a:oracle:mysql:5.6.13 + cpe:/a:oracle:mysql:5.6.15 + cpe:/a:oracle:mysql:5.6.8 + + CVE-2014-2435 + 2014-04-15T22:55:16.257-04:00 + 2014-04-16T14:00:50.120-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-16T14:00:50.010-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle MySQL Server 5.6.16 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:mysql:5.6.1 + cpe:/a:oracle:mysql:5.6.3 + cpe:/a:oracle:mysql:5.6.2 + cpe:/a:oracle:mysql:5.6.5 + cpe:/a:oracle:mysql:5.6.4 + cpe:/a:oracle:mysql:5.5.16 + cpe:/a:oracle:mysql:5.6.7 + cpe:/a:oracle:mysql:5.6.6 + cpe:/a:oracle:mysql:5.6.9 + cpe:/a:mysql:mysql:5.5.0 + cpe:/a:mysql:mysql:5.5.1 + cpe:/a:mysql:mysql:5.5.7 + cpe:/a:mysql:mysql:5.5.8 + cpe:/a:mysql:mysql:5.5.5 + cpe:/a:mysql:mysql:5.5.6 + cpe:/a:oracle:mysql:5.5.17 + cpe:/a:oracle:mysql:5.5.18 + cpe:/a:mysql:mysql:5.5.9 + cpe:/a:oracle:mysql:5.5.19 + cpe:/a:oracle:mysql:5.5.12 + cpe:/a:oracle:mysql:5.5.13 + cpe:/a:oracle:mysql:5.5.14 + cpe:/a:oracle:mysql:5.5.15 + cpe:/a:mysql:mysql:5.5.3 + cpe:/a:mysql:mysql:5.5.4 + cpe:/a:oracle:mysql:5.5.10 + cpe:/a:oracle:mysql:5.5.11 + cpe:/a:mysql:mysql:5.5.2 + cpe:/a:oracle:mysql:5.5.27 + cpe:/a:oracle:mysql:5.6.10 + cpe:/a:oracle:mysql:5.6.12 + cpe:/a:oracle:mysql:5.6.11 + cpe:/a:oracle:mysql:5.6.14 + cpe:/a:oracle:mysql:5.6.13 + cpe:/a:oracle:mysql:5.6.16 + cpe:/a:oracle:mysql:5.6.15 + cpe:/a:oracle:mysql:5.5.29 + cpe:/a:oracle:mysql:5.5.28 + cpe:/a:oracle:mysql:5.5.25 + cpe:/a:oracle:mysql:5.5.26 + cpe:/a:oracle:mysql:5.6.8 + cpe:/a:oracle:mysql:5.5.23 + cpe:/a:oracle:mysql:5.5.24 + cpe:/a:oracle:mysql:5.5.21 + cpe:/a:oracle:mysql:5.5.22 + cpe:/a:oracle:mysql:5.5.20 + cpe:/a:oracle:mysql:5.5.31 + cpe:/a:oracle:mysql:5.5.33 + cpe:/a:oracle:mysql:5.5.32 + cpe:/a:oracle:mysql:5.5.35 + cpe:/a:oracle:mysql:5.5.34 + cpe:/a:oracle:mysql:5.5.36 + cpe:/a:oracle:mysql:5.5.30 + cpe:/a:oracle:mysql:5.5.25:a + cpe:/a:oracle:mysql:5.6.0 + + CVE-2014-2436 + 2014-04-15T22:55:16.303-04:00 + 2014-04-16T14:07:20.773-04:00 + + + 6.0 + NETWORK + MEDIUM + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-16T14:07:19.993-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle MySQL Server 5.5.36 and earlier and 5.6.16 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to RBR. + + + + + + + + + + cpe:/a:oracle:peoplesoft_products:8.53 + cpe:/a:oracle:peoplesoft_products:8.52 + + CVE-2014-2437 + 2014-04-15T22:55:16.333-04:00 + 2014-04-16T14:13:10.050-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-16T14:13:10.020-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the PeopleSoft Enterprise PT PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Integration Broker, a different vulnerability than CVE-2014-2447. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:mysql:5.6.1 + cpe:/a:oracle:mysql:5.6.3 + cpe:/a:oracle:mysql:5.6.2 + cpe:/a:oracle:mysql:5.6.5 + cpe:/a:oracle:mysql:5.5.16 + cpe:/a:oracle:mysql:5.6.4 + cpe:/a:oracle:mysql:5.6.7 + cpe:/a:oracle:mysql:5.6.6 + cpe:/a:oracle:mysql:5.6.9 + cpe:/a:mysql:mysql:5.5.0 + cpe:/a:mysql:mysql:5.5.1 + cpe:/a:mysql:mysql:5.5.7 + cpe:/a:mysql:mysql:5.5.8 + cpe:/a:mysql:mysql:5.5.5 + cpe:/a:mysql:mysql:5.5.6 + cpe:/a:oracle:mysql:5.5.17 + cpe:/a:oracle:mysql:5.5.18 + cpe:/a:mysql:mysql:5.5.9 + cpe:/a:oracle:mysql:5.5.19 + cpe:/a:oracle:mysql:5.5.12 + cpe:/a:oracle:mysql:5.5.13 + cpe:/a:oracle:mysql:5.5.14 + cpe:/a:oracle:mysql:5.5.15 + cpe:/a:mysql:mysql:5.5.3 + cpe:/a:mysql:mysql:5.5.4 + cpe:/a:oracle:mysql:5.5.10 + cpe:/a:mysql:mysql:5.5.2 + cpe:/a:oracle:mysql:5.5.11 + cpe:/a:oracle:mysql:5.5.27 + cpe:/a:oracle:mysql:5.6.10 + cpe:/a:oracle:mysql:5.6.12 + cpe:/a:oracle:mysql:5.6.11 + cpe:/a:oracle:mysql:5.6.14 + cpe:/a:oracle:mysql:5.6.13 + cpe:/a:oracle:mysql:5.6.15 + cpe:/a:oracle:mysql:5.5.29 + cpe:/a:oracle:mysql:5.5.28 + cpe:/a:oracle:mysql:5.5.25 + cpe:/a:oracle:mysql:5.5.26 + cpe:/a:oracle:mysql:5.6.8 + cpe:/a:oracle:mysql:5.5.23 + cpe:/a:oracle:mysql:5.5.24 + cpe:/a:oracle:mysql:5.5.21 + cpe:/a:oracle:mysql:5.5.22 + cpe:/a:oracle:mysql:5.5.20 + cpe:/a:oracle:mysql:5.5.31 + cpe:/a:oracle:mysql:5.5.33 + cpe:/a:oracle:mysql:5.5.32 + cpe:/a:oracle:mysql:5.5.35 + cpe:/a:oracle:mysql:5.5.34 + cpe:/a:oracle:mysql:5.5.30 + cpe:/a:oracle:mysql:5.5.25:a + cpe:/a:oracle:mysql:5.6.0 + + CVE-2014-2438 + 2014-04-15T22:55:16.367-04:00 + 2014-04-16T13:17:24.517-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-16T13:17:23.593-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle MySQL Server 5.5.35 and earlier and 5.6.15 and earlier allows remote authenticated users to affect availability via unknown vectors related to Replication. + + + + + + + + + + cpe:/a:oracle:virtualization:5.1 + cpe:/a:oracle:virtualization:5.0 + + CVE-2014-2439 + 2014-04-15T22:55:16.397-04:00 + 2014-04-16T14:15:54.633-04:00 + + + 6.4 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-16T14:15:54.603-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Oracle Secure Global Desktop (SGD) component in Oracle Virtualization 5.0 and 5.1 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Workspace Web Application. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:mysql:5.6.1 + cpe:/a:oracle:mysql:5.6.3 + cpe:/a:oracle:mysql:5.6.2 + cpe:/a:oracle:mysql:5.6.5 + cpe:/a:oracle:mysql:5.6.4 + cpe:/a:oracle:mysql:5.5.16 + cpe:/a:oracle:mysql:5.6.7 + cpe:/a:oracle:mysql:5.6.6 + cpe:/a:oracle:mysql:5.6.9 + cpe:/a:mysql:mysql:5.5.0 + cpe:/a:mysql:mysql:5.5.1 + cpe:/a:mysql:mysql:5.5.7 + cpe:/a:mysql:mysql:5.5.8 + cpe:/a:mysql:mysql:5.5.5 + cpe:/a:mysql:mysql:5.5.6 + cpe:/a:oracle:mysql:5.5.17 + cpe:/a:oracle:mysql:5.5.18 + cpe:/a:mysql:mysql:5.5.9 + cpe:/a:oracle:mysql:5.5.19 + cpe:/a:oracle:mysql:5.5.12 + cpe:/a:oracle:mysql:5.5.13 + cpe:/a:oracle:mysql:5.5.14 + cpe:/a:oracle:mysql:5.5.15 + cpe:/a:mysql:mysql:5.5.3 + cpe:/a:mysql:mysql:5.5.4 + cpe:/a:oracle:mysql:5.5.10 + cpe:/a:oracle:mysql:5.5.11 + cpe:/a:mysql:mysql:5.5.2 + cpe:/a:oracle:mysql:5.5.27 + cpe:/a:oracle:mysql:5.6.10 + cpe:/a:oracle:mysql:5.6.12 + cpe:/a:oracle:mysql:5.6.11 + cpe:/a:oracle:mysql:5.6.14 + cpe:/a:oracle:mysql:5.6.13 + cpe:/a:oracle:mysql:5.6.16 + cpe:/a:oracle:mysql:5.6.15 + cpe:/a:oracle:mysql:5.5.29 + cpe:/a:oracle:mysql:5.5.28 + cpe:/a:oracle:mysql:5.5.25 + cpe:/a:oracle:mysql:5.5.26 + cpe:/a:oracle:mysql:5.6.8 + cpe:/a:oracle:mysql:5.5.23 + cpe:/a:oracle:mysql:5.5.24 + cpe:/a:oracle:mysql:5.5.21 + cpe:/a:oracle:mysql:5.5.22 + cpe:/a:oracle:mysql:5.5.20 + cpe:/a:oracle:mysql:5.5.31 + cpe:/a:oracle:mysql:5.5.33 + cpe:/a:oracle:mysql:5.5.32 + cpe:/a:oracle:mysql:5.5.35 + cpe:/a:oracle:mysql:5.5.34 + cpe:/a:oracle:mysql:5.5.36 + cpe:/a:oracle:mysql:5.5.30 + cpe:/a:oracle:mysql:5.5.25:a + cpe:/a:oracle:mysql:5.6.0 + + CVE-2014-2440 + 2014-04-15T22:55:16.427-04:00 + 2014-04-16T14:12:51.440-04:00 + + + 5.1 + NETWORK + HIGH + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-16T14:12:50.987-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the MySQL Client component in Oracle MySQL 5.5.36 and earlier and 5.6.16 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:vm_virtualbox:4.1.16 + cpe:/a:oracle:vm_virtualbox:4.1.20 + cpe:/a:oracle:vm_virtualbox:4.1.14 + cpe:/a:oracle:vm_virtualbox:4.1.22 + cpe:/a:oracle:vm_virtualbox:4.1.8 + cpe:/a:oracle:vm_virtualbox:4.1.12 + cpe:/a:oracle:vm_virtualbox:4.1.2 + cpe:/a:oracle:vm_virtualbox:4.1.0 + cpe:/a:oracle:vm_virtualbox:4.1.28 + cpe:/a:oracle:vm_virtualbox:4.1.30 + cpe:/a:oracle:vm_virtualbox:4.1.10 + cpe:/a:oracle:vm_virtualbox:4.1.26 + cpe:/a:oracle:vm_virtualbox:4.1.24 + cpe:/a:oracle:vm_virtualbox:4.1.18 + cpe:/a:oracle:vm_virtualbox:4.1.4 + cpe:/a:oracle:vm_virtualbox:4.1.6 + + CVE-2014-2441 + 2014-04-15T22:55:16.460-04:00 + 2014-04-16T14:23:49.120-04:00 + + + 4.4 + LOCAL + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-16T14:23:48.993-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.1.32, 4.2.24, and 4.3.10 allows local users to affect confidentiality, integrity, and availability via vectors related to Graphics driver (WDDM) for Windows guests. + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:mysql:5.6.1 + cpe:/a:oracle:mysql:5.6.3 + cpe:/a:oracle:mysql:5.6.2 + cpe:/a:oracle:mysql:5.6.5 + cpe:/a:oracle:mysql:5.6.4 + cpe:/a:oracle:mysql:5.6.7 + cpe:/a:oracle:mysql:5.6.6 + cpe:/a:oracle:mysql:5.6.9 + cpe:/a:oracle:mysql:5.6.10 + cpe:/a:oracle:mysql:5.6.12 + cpe:/a:oracle:mysql:5.6.0 + cpe:/a:oracle:mysql:5.6.11 + cpe:/a:oracle:mysql:5.6.14 + cpe:/a:oracle:mysql:5.6.13 + cpe:/a:oracle:mysql:5.6.15 + cpe:/a:oracle:mysql:5.6.8 + + CVE-2014-2442 + 2014-04-15T22:55:16.473-04:00 + 2014-04-16T13:20:33.773-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-16T13:20:33.663-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle MySQL Server 5.6.15 and earlier allows remote authenticated users to affect availability via vectors related to MyISAM. + + + + + + + + + + cpe:/a:oracle:peoplesoft_products:8.53 + cpe:/a:oracle:peoplesoft_products:8.52 + + CVE-2014-2443 + 2014-04-15T22:55:16.507-04:00 + 2014-04-16T14:19:14.577-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-16T14:19:14.500-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the PeopleSoft Enterprise PT PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect integrity via vectors related to PIA Core Technology. + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:mysql:5.6.1 + cpe:/a:oracle:mysql:5.6.3 + cpe:/a:oracle:mysql:5.6.2 + cpe:/a:oracle:mysql:5.6.5 + cpe:/a:oracle:mysql:5.6.4 + cpe:/a:oracle:mysql:5.6.7 + cpe:/a:oracle:mysql:5.6.6 + cpe:/a:oracle:mysql:5.6.9 + cpe:/a:oracle:mysql:5.6.10 + cpe:/a:oracle:mysql:5.6.12 + cpe:/a:oracle:mysql:5.6.0 + cpe:/a:oracle:mysql:5.6.11 + cpe:/a:oracle:mysql:5.6.14 + cpe:/a:oracle:mysql:5.6.13 + cpe:/a:oracle:mysql:5.6.15 + cpe:/a:oracle:mysql:5.6.8 + + CVE-2014-2444 + 2014-04-15T22:55:16.537-04:00 + 2014-04-16T13:21:27.367-04:00 + + + 6.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-16T13:21:27.057-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle MySQL Server 5.6.15 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to InnoDB. + + + + + + + + + cpe:/a:oracle:supply_chain_products_suite:9.3.3 + + CVE-2014-2445 + 2014-04-15T22:55:16.567-04:00 + 2014-04-16T14:23:21.820-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-16T14:23:21.790-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.3 allows remote authenticated users to affect integrity via unknown vectors related to Security, a different vulnerability than CVE-2014-2467. + + + + + + + + + + cpe:/a:oracle:peoplesoft_products:8.53 + cpe:/a:oracle:peoplesoft_products:8.52 + + CVE-2014-2446 + 2014-04-15T22:55:16.583-04:00 + 2014-04-16T14:18:49.250-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-16T14:18:49.217-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the PeopleSoft Enterprise PT PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote authenticated users to affect confidentiality via vectors related to QAS. + + + + + + + + + + cpe:/a:oracle:peoplesoft_products:8.53 + cpe:/a:oracle:peoplesoft_products:8.52 + + CVE-2014-2447 + 2014-04-15T22:55:16.617-04:00 + 2014-04-16T14:18:24.483-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-16T14:18:24.453-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the PeopleSoft Enterprise PT PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Integration Broker, a different vulnerability than CVE-2014-2437. + + + + + + + + + + cpe:/a:oracle:peoplesoft_products:8.53 + cpe:/a:oracle:peoplesoft_products:8.52 + + CVE-2014-2448 + 2014-04-15T22:55:16.647-04:00 + 2014-04-16T14:17:57.857-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-16T14:17:57.827-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the PeopleSoft Enterprise PT PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Install and Packaging. + + + + + + + + + + + cpe:/a:oracle:peoplesoft_products:9.2 + cpe:/a:oracle:peoplesoft_products:9.1 + cpe:/a:oracle:peoplesoft_products:9.0 + + CVE-2014-2449 + 2014-04-15T22:55:16.677-04:00 + 2014-04-24T13:59:14.013-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-16T14:22:16.600-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the PeopleSoft Enterprise HRMS Talent Acquisition Manager component in Oracle PeopleSoft Products 9.0, 9.1, and 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Security. + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:mysql:5.6.1 + cpe:/a:oracle:mysql:5.6.3 + cpe:/a:oracle:mysql:5.6.2 + cpe:/a:oracle:mysql:5.6.5 + cpe:/a:oracle:mysql:5.6.4 + cpe:/a:oracle:mysql:5.6.7 + cpe:/a:oracle:mysql:5.6.6 + cpe:/a:oracle:mysql:5.6.9 + cpe:/a:oracle:mysql:5.6.10 + cpe:/a:oracle:mysql:5.6.12 + cpe:/a:oracle:mysql:5.6.0 + cpe:/a:oracle:mysql:5.6.11 + cpe:/a:oracle:mysql:5.6.14 + cpe:/a:oracle:mysql:5.6.13 + cpe:/a:oracle:mysql:5.6.15 + cpe:/a:oracle:mysql:5.6.8 + + CVE-2014-2450 + 2014-04-15T22:55:16.693-04:00 + 2014-04-16T13:53:24.107-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-16T13:53:23.950-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle MySQL Server 5.6.15 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:oracle:mysql:5.6.1 + cpe:/a:oracle:mysql:5.6.3 + cpe:/a:oracle:mysql:5.6.2 + cpe:/a:oracle:mysql:5.6.5 + cpe:/a:oracle:mysql:5.6.4 + cpe:/a:oracle:mysql:5.6.7 + cpe:/a:oracle:mysql:5.6.6 + cpe:/a:oracle:mysql:5.6.9 + cpe:/a:oracle:mysql:5.6.10 + cpe:/a:oracle:mysql:5.6.12 + cpe:/a:oracle:mysql:5.6.0 + cpe:/a:oracle:mysql:5.6.11 + cpe:/a:oracle:mysql:5.6.14 + cpe:/a:oracle:mysql:5.6.13 + cpe:/a:oracle:mysql:5.6.15 + cpe:/a:oracle:mysql:5.6.8 + + CVE-2014-2451 + 2014-04-15T22:55:16.723-04:00 + 2014-04-16T13:19:39.723-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-16T13:19:39.630-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in Oracle MySQL Server 5.6.15 and earlier allows remote authenticated users to affect availability via unknown vectors related to Privileges. + + + + + + + + + cpe:/a:oracle:fusion_middleware:11.1.1.5.0 + + CVE-2014-2452 + 2014-04-15T22:55:16.757-04:00 + 2014-04-16T14:22:38.820-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-16T14:22:37.913-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.1.5 allows remote authenticated users to affect availability via unknown vectors related to Webserver Plugin. + + + + + + + + + + cpe:/a:oracle:hyperion:11.1.2.3 + cpe:/a:oracle:hyperion:11.1.2.2 + + CVE-2014-2453 + 2014-04-15T22:55:16.787-04:00 + 2014-04-16T12:32:31.520-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-16T12:32:31.317-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Hyperion Common Admin component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows remote attackers to affect integrity via unknown vectors related to User Interface. + + + + + + + + + + cpe:/a:oracle:hyperion:11.1.2.3 + cpe:/a:oracle:hyperion:11.1.2.2 + + CVE-2014-2454 + 2014-04-15T22:55:16.817-04:00 + 2014-04-16T12:33:44.663-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-16T12:33:44.630-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Hyperion Common Admin component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows remote attackers to affect confidentiality via unknown vectors related to User Interface. + + + + + + + + + + cpe:/a:oracle:hyperion:11.1.2.3 + cpe:/a:oracle:hyperion:11.1.2.2 + + CVE-2014-2455 + 2014-04-15T22:55:16.850-04:00 + 2014-04-16T12:34:37.507-04:00 + + + 6.0 + NETWORK + MEDIUM + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-16T12:34:37.493-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Hyperion Common Admin component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to User Interface. + + + + + + + + + + cpe:/a:oracle:supply_chain_products_suite:6.0.0 + cpe:/a:oracle:supply_chain_products_suite:6.1.0 + + CVE-2014-2457 + 2014-04-15T22:55:16.867-04:00 + 2014-04-16T14:24:34.543-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-16T14:24:34.510-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Oracle Agile Product Lifecycle component in Oracle Supply Chain Products Suite 6.0 and 6.1.0 allows remote attackers to affect integrity via unknown vectors related to Install. + + + + + + + + + + cpe:/a:oracle:supply_chain_products_suite:6.1.1.3 + cpe:/a:oracle:supply_chain_products_suite:6.1.0.3 + + CVE-2014-2458 + 2014-04-15T22:55:16.897-04:00 + 2014-04-16T14:34:57.203-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-16T14:34:57.127-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Oracle Agile Product Lifecycle component in Oracle Supply Chain Products Suite 6.1.0.3 and 6.1.1.3 allows remote attackers to affect integrity via unknown vectors related to Install. + + + + + + + + + + cpe:/a:oracle:supply_chain_products_suite:6.3.3 + cpe:/a:oracle:supply_chain_products_suite:6.3.2 + + CVE-2014-2459 + 2014-04-15T22:55:16.927-04:00 + 2014-04-16T14:31:04.930-04:00 + + + 3.7 + LOCAL + HIGH + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-16T14:31:04.853-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.3.2 and 6.3.3 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Security. + + + + + + + + + + + + + + + + cpe:/a:oracle:supply_chain_products_suite:6.1.2.0 + cpe:/a:oracle:supply_chain_products_suite:6.3.3 + cpe:/a:oracle:supply_chain_products_suite:6.3.1 + cpe:/a:oracle:supply_chain_products_suite:6.0.0 + cpe:/a:oracle:supply_chain_products_suite:5.5.06 + cpe:/a:oracle:supply_chain_products_suite:6.3.2 + cpe:/a:oracle:supply_chain_products_suite:6.1.0 + cpe:/a:oracle:supply_chain_products_suite:6.3.0 + + CVE-2014-2460 + 2014-04-15T22:55:16.960-04:00 + 2014-04-16T14:33:40.107-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-16T14:33:40.047-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 5.5.06, 6.0, 6.1, 6.2, 6.3, 6.3.1, 6.3.2, and 6.3.3 allows remote authenticated users to affect confidentiality via vectors related to CSV Management. + + + + + + + + + + + + + + + + cpe:/a:oracle:supply_chain_products_suite:6.1.2.0 + cpe:/a:oracle:supply_chain_products_suite:6.3.3 + cpe:/a:oracle:supply_chain_products_suite:6.3.1 + cpe:/a:oracle:supply_chain_products_suite:6.0.0 + cpe:/a:oracle:supply_chain_products_suite:5.5.06 + cpe:/a:oracle:supply_chain_products_suite:6.3.2 + cpe:/a:oracle:supply_chain_products_suite:6.1.0 + cpe:/a:oracle:supply_chain_products_suite:6.3.0 + + CVE-2014-2461 + 2014-04-15T22:55:16.990-04:00 + 2014-04-16T14:34:44.283-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-16T14:34:44.220-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 5.5.06, 6.0, 6.1, 6.2, 6.3, 6.3.1, 6.3.2, and 6.3.3 allows remote attackers to affect confidentiality via unknown vectors related to Security. + + + + + + + + + + + + cpe:/a:oracle:virtualization:4.63 + cpe:/a:oracle:virtualization:5.1 + cpe:/a:oracle:virtualization:5.0 + cpe:/a:oracle:virtualization:4.71 + + CVE-2014-2463 + 2014-04-15T22:55:17.037-04:00 + 2014-04-16T14:37:40.163-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-16T14:37:40.053-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Oracle Secure Global Desktop (SGD) component in Oracle Virtualization 4.63, 4.71, 5.0, and 5.1 allows remote attackers to affect integrity via unknown vectors related to Workspace Web Application. + + + + + + + + + cpe:/a:oracle:supply_chain_products_suite:9.3.3 + + CVE-2014-2464 + 2014-04-15T22:55:17.067-04:00 + 2014-04-16T14:15:16.570-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-16T14:15:16.507-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.3.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Security. + + + + + + + + + cpe:/a:oracle:supply_chain_products_suite:9.3.3 + + CVE-2014-2465 + 2014-04-15T22:55:17.100-04:00 + 2014-04-16T14:17:36.387-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-16T14:17:36.357-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.3 allows remote attackers to affect integrity via unknown vectors related to Security. + + + + + + + + + cpe:/a:oracle:supply_chain_products_suite:9.3.3 + + CVE-2014-2466 + 2014-04-15T22:55:17.130-04:00 + 2014-04-16T14:19:17.110-04:00 + + + 2.1 + NETWORK + HIGH + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-16T14:19:17.047-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.3 allows remote authenticated users to affect confidentiality via unknown vectors related to Security. + + + + + + + + + cpe:/a:oracle:supply_chain_products_suite:9.3.3 + + CVE-2014-2467 + 2014-04-15T22:55:17.163-04:00 + 2014-04-16T14:21:01.097-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-16T14:21:00.987-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.3 allows remote authenticated users to affect integrity via unknown vectors related to Security, a different vulnerability than CVE-2014-2445. + + + + + + + + + + cpe:/a:oracle:siebel_crm:8.1.1 + cpe:/a:oracle:siebel_crm:8.2.2 + + CVE-2014-2468 + 2014-04-15T22:55:17.193-04:00 + 2014-04-16T14:32:31.153-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-16T14:32:30.887-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via vectors related to Open_UI. + + + + + + + + + cpe:/o:oracle:sunos:5.11.1 + + CVE-2014-2469 + 2014-04-17T10:55:11.277-04:00 + 2014-04-18T11:53:55.363-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-18T11:53:55.317-04:00 + + + + CONFIRM + https://blogs.oracle.com/sunsecurity/entry/cve_2014_2469_denial_of + + + BID + 66599 + + + OSVDB + 105298 + + + SECTRACK + 1029999 + + Unspecified vulnerability in Lighthttpd in Oracle Solaris 11.1 allows attackers to cause a denial of service via unknown vectors. + + + + + + + + + + + + cpe:/a:oracle:fusion_middleware:10.0.2 + cpe:/a:oracle:fusion_middleware:12.1.2.0.0 + cpe:/a:oracle:fusion_middleware:10.3.6 + cpe:/a:oracle:fusion_middleware:12.1.1 + + CVE-2014-2470 + 2014-04-15T22:55:17.223-04:00 + 2014-04-16T11:49:24.587-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-16T11:49:24.433-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0, 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Security. + + + + + + + + + + cpe:/a:oracle:ilearning:6.1 + cpe:/a:oracle:ilearning:6.0 + + CVE-2014-2471 + 2014-04-15T22:55:17.257-04:00 + 2014-04-16T14:26:30.687-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-16T14:26:30.607-04:00 + + + + CONFIRM + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + Unspecified vulnerability in the Oracle iLearning component in Oracle iLearning 6.0 and 6.1 allows remote attackers to affect integrity via unknown vectors related to Learner Pages. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:php:php:5.3.5 + cpe:/a:php:php:5.0.0:rc2 + cpe:/a:php:php:5.3.6 + cpe:/a:php:php:5.0.0:rc1 + cpe:/a:php:php:5.3.4 + cpe:/a:php:php:5.3.9 + cpe:/a:php:php:5.3.7 + cpe:/a:php:php:5.3.14 + cpe:/a:php:php:5.3.8 + cpe:/a:php:php:5.0.0:rc3 + cpe:/a:php:php:5.4.26 + cpe:/a:php:php:5.4.19 + cpe:/a:php:php:5.4.17 + cpe:/a:php:php:5.4.18 + cpe:/a:php:php:5.4.11 + cpe:/a:php:php:5.4.12 + cpe:/a:php:php:5.4.13 + cpe:/a:php:php:5.4.14 + cpe:/a:php:php:5.4.10 + cpe:/a:php:php:5.1.5 + cpe:/a:php:php:5.3.25 + cpe:/a:php:php:5.4.16:rc1 + cpe:/a:php:php:5.4.13:rc1 + cpe:/a:php:php:5.4.12:rc1 + cpe:/a:php:php:5.4.12:rc2 + cpe:/a:php:php:5.1.0 + cpe:/a:php:php:5.1.6 + cpe:/a:php:php:5.1.2 + cpe:/a:php:php:5.1.1 + cpe:/a:php:php:5.1.4 + cpe:/a:php:php:5.1.3 + cpe:/a:php:php:5.3.19 + cpe:/a:php:php:5.0.3 + cpe:/a:php:php:5.4.25 + cpe:/a:php:php:5.3.18 + cpe:/a:php:php:5.0.2 + cpe:/a:php:php:5.4.24 + cpe:/a:php:php:5.4.23 + cpe:/a:php:php:5.0.5 + cpe:/a:php:php:5.4.22 + cpe:/a:php:php:5.0.4 + cpe:/a:php:php:5.4.21 + cpe:/a:php:php:5.3.15 + cpe:/a:php:php:5.2.10 + cpe:/a:php:php:5.4.20 + cpe:/a:php:php:5.4.14:rc1 + cpe:/a:php:php:5.3.17 + cpe:/a:php:php:5.0.1 + cpe:/a:php:php:5.2.12 + cpe:/a:php:php:5.4.15:rc1 + cpe:/a:php:php:5.3.16 + cpe:/a:php:php:5.0.0 + cpe:/a:php:php:5.2.11 + cpe:/a:php:php:5.2.14 + cpe:/a:php:php:5.3.11 + cpe:/a:php:php:5.3.10 + cpe:/a:php:php:5.2.16 + cpe:/a:php:php:5.3.13 + cpe:/a:php:php:5.2.15 + cpe:/a:php:php:5.3.12 + cpe:/a:php:php:5.2.17 + cpe:/a:php:php:5.3.2 + cpe:/a:php:php:5.0.0:beta4 + cpe:/a:php:php:5.3.1 + cpe:/a:php:php:5.3.0 + cpe:/a:php:php:5.2.4 + cpe:/a:php:php:5.2.3 + cpe:/a:php:php:5.2.2 + cpe:/a:php:php:5.2.1 + cpe:/a:php:php:5.2.13 + cpe:/a:php:php:5.3.3 + cpe:/a:php:php:5.2.0 + cpe:/a:php:php:5.3.27 + cpe:/a:php:php:5.3.26 + cpe:/a:php:php:5.4.0 + cpe:/a:php:php:5.4.1 + cpe:/a:php:php:5.4.2 + cpe:/a:php:php:5.3.20 + cpe:/a:php:php:5.3.24 + cpe:/a:php:php:5.3.23 + cpe:/a:php:php:5.3.22 + cpe:/a:php:php:5.3.21 + cpe:/a:php:php:5.4.3 + cpe:/a:php:php:5.4.4 + cpe:/a:php:php:5.4.5 + cpe:/a:php:php:5.4.6 + cpe:/a:php:php:5.4.7 + cpe:/a:php:php:5.4.8 + cpe:/a:php:php:5.4.9 + cpe:/a:php:php:5.0.0:beta3 + cpe:/a:php:php:5.2.5 + cpe:/a:php:php:5.0.0:beta2 + cpe:/a:php:php:5.2.7 + cpe:/a:php:php:5.2.6 + cpe:/a:php:php:5.2.9 + cpe:/a:php:php:5.2.8 + cpe:/a:php:php:5.0.0:beta1 + + CVE-2014-2497 + 2014-03-21T10:55:12.567-04:00 + 2014-03-27T17:57:45.100-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-03-21T07:04:50.000-04:00 + + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1076676 + + + CONFIRM + https://bugs.php.net/bug.php?id=66901 + + The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:haxx:curl:7.27.0 + cpe:/a:haxx:curl:7.28.1 + cpe:/a:haxx:libcurl:7.27.0 + cpe:/a:haxx:libcurl:7.30.0 + cpe:/a:haxx:curl:7.30.0 + cpe:/a:haxx:libcurl:7.28.0 + cpe:/a:haxx:libcurl:7.29.0 + cpe:/a:haxx:curl:7.32.0 + cpe:/a:haxx:libcurl:7.32.0 + cpe:/a:haxx:curl:7.35.0 + cpe:/a:haxx:libcurl:7.36.0 + cpe:/a:haxx:libcurl:7.33.0 + cpe:/a:haxx:libcurl:7.35.0 + cpe:/a:haxx:curl:7.29.0 + cpe:/a:haxx:curl:7.28.0 + cpe:/a:haxx:curl:7.33.0 + cpe:/a:haxx:libcurl:7.34.0 + cpe:/a:haxx:curl:7.34.0 + cpe:/a:haxx:curl:7.31.0 + cpe:/a:haxx:libcurl:7.28.1 + cpe:/a:haxx:libcurl:7.31.0 + + CVE-2014-2522 + 2014-04-18T18:14:38.587-04:00 + 2014-04-21T14:11:41.500-04:00 + + + 4.0 + NETWORK + HIGH + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-21T14:11:38.857-04:00 + + + + + CONFIRM + http://curl.haxx.se/docs/adv_20140326D.html + + + BID + 66296 + + + CONFIRM + http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/ + + + CONFIRM + http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/ + + + CONFIRM + http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/ + + + SECUNIA + 57968 + + + SECUNIA + 57966 + + + SECUNIA + 57836 + + + MLIST + [oss-security] 20140317 Re: CVE request: flaw in curl's Windows SSL backend + + + MLIST + [oss-security] 20140317 CVE request: flaw in curl's Windows SSL backend + + curl and libcurl 7.27.0 through 7.35.0, when runnning on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:linux:linux_kernel:3.0.48 + cpe:/o:linux:linux_kernel:3.0.49 + cpe:/o:linux:linux_kernel:3.0.46 + cpe:/o:linux:linux_kernel:3.0.47 + cpe:/o:linux:linux_kernel:3.0.44 + cpe:/o:linux:linux_kernel:3.0.45 + cpe:/o:linux:linux_kernel:3.0.42 + cpe:/o:linux:linux_kernel:3.4.70 + cpe:/o:linux:linux_kernel:3.4.71 + cpe:/o:linux:linux_kernel:3.0.40 + cpe:/o:linux:linux_kernel:3.0.41 + cpe:/o:linux:linux_kernel:3.4.45 + cpe:/o:linux:linux_kernel:3.4.44 + cpe:/o:linux:linux_kernel:3.4.46 + cpe:/o:linux:linux_kernel:3.4.41 + cpe:/o:linux:linux_kernel:3.4.40 + cpe:/o:linux:linux_kernel:3.4.43 + cpe:/o:linux:linux_kernel:3.4.42 + cpe:/o:linux:linux_kernel:3.4.49 + cpe:/o:linux:linux_kernel:3.4.48 + cpe:/o:linux:linux_kernel:3.0.59 + cpe:/o:linux:linux_kernel:3.4.47 + cpe:/o:linux:linux_kernel:3.0.55 + cpe:/o:linux:linux_kernel:3.0.56 + cpe:/o:linux:linux_kernel:3.0.57 + cpe:/o:linux:linux_kernel:3.0.58 + cpe:/o:linux:linux_kernel:3.0.51 + cpe:/o:linux:linux_kernel:3.0.52 + cpe:/o:linux:linux_kernel:3.0.53 + cpe:/o:linux:linux_kernel:3.11.10 + cpe:/o:linux:linux_kernel:3.0.50 + cpe:/o:linux:linux_kernel:3.4.57 + cpe:/o:linux:linux_kernel:3.4.56 + cpe:/o:linux:linux_kernel:3.4.55 + cpe:/o:linux:linux_kernel:3.4.54 + cpe:/o:linux:linux_kernel:3.4.53 + cpe:/o:linux:linux_kernel:3.4.52 + cpe:/o:linux:linux_kernel:3.4.51 + cpe:/o:linux:linux_kernel:3.4.50 + cpe:/o:linux:linux_kernel:3.0.43 + cpe:/o:linux:linux_kernel:3.10.26 + cpe:/o:linux:linux_kernel:3.4.59 + cpe:/o:linux:linux_kernel:3.0.24 + cpe:/o:linux:linux_kernel:3.0.25 + cpe:/o:linux:linux_kernel:3.0.22 + cpe:/o:linux:linux_kernel:3.1.9 + cpe:/o:linux:linux_kernel:3.0.23 + cpe:/o:linux:linux_kernel:3.10.28 + cpe:/o:linux:linux_kernel:3.0.28 + cpe:/o:linux:linux_kernel:3.10.27 + cpe:/o:linux:linux_kernel:3.0.26 + cpe:/o:linux:linux_kernel:3.10.29 + cpe:/o:linux:linux_kernel:3.4.58 + cpe:/o:linux:linux_kernel:3.0.27 + cpe:/o:linux:linux_kernel:3.10.24 + cpe:/o:linux:linux_kernel:3.10.23 + cpe:/o:linux:linux_kernel:3.10.25 + cpe:/o:linux:linux_kernel:3.10.20 + cpe:/o:linux:linux_kernel:3.1.8 + cpe:/o:linux:linux_kernel:3.0.20 + cpe:/o:linux:linux_kernel:3.10.22 + cpe:/o:linux:linux_kernel:3.10.21 + cpe:/o:linux:linux_kernel:3.4.21 + cpe:/o:linux:linux_kernel:3.4.20 + cpe:/o:linux:linux_kernel:3.4.23 + cpe:/o:linux:linux_kernel:3.4.22 + cpe:/o:linux:linux_kernel:3.4.24 + cpe:/o:linux:linux_kernel:3.4.27 + cpe:/o:linux:linux_kernel:3.4.26 + cpe:/o:linux:linux_kernel:3.4.29 + cpe:/o:linux:linux_kernel:3.10.15 + cpe:/o:linux:linux_kernel:3.4.28 + cpe:/o:linux:linux_kernel:3.0.54 + cpe:/o:linux:linux_kernel:3.0.33 + cpe:/o:linux:linux_kernel:3.0.34 + cpe:/o:linux:linux_kernel:3.0.35 + cpe:/o:linux:linux_kernel:3.0.36 + cpe:/o:linux:linux_kernel:3.10.19 + cpe:/o:linux:linux_kernel:3.0.37 + cpe:/o:linux:linux_kernel:3.10.18 + cpe:/o:linux:linux_kernel:3.0.38 + cpe:/o:linux:linux_kernel:3.4.25 + cpe:/o:linux:linux_kernel:3.10.17 + cpe:/o:linux:linux_kernel:3.0.39 + cpe:/o:linux:linux_kernel:3.10.16 + cpe:/o:linux:linux_kernel:3.10.14 + cpe:/o:linux:linux_kernel:3.10.13 + cpe:/o:linux:linux_kernel:3.10.12 + cpe:/o:linux:linux_kernel:3.10.11 + cpe:/o:linux:linux_kernel:3.10.10 + cpe:/o:linux:linux_kernel:3.0.30 + cpe:/o:linux:linux_kernel:3.0.31 + cpe:/o:linux:linux_kernel:3.9.8 + cpe:/o:linux:linux_kernel:3.5.5 + cpe:/o:linux:linux_kernel:3.4.32 + cpe:/o:linux:linux_kernel:3.9.9 + cpe:/o:linux:linux_kernel:3.5.6 + cpe:/o:linux:linux_kernel:3.4.31 + cpe:/o:linux:linux_kernel:3.5.7 + cpe:/o:linux:linux_kernel:3.4.30 + cpe:/o:linux:linux_kernel:3.7.1 + cpe:/o:linux:linux_kernel:3.4.35 + cpe:/o:linux:linux_kernel:3.9.0 + cpe:/o:linux:linux_kernel:3.0.18 + cpe:/o:linux:linux_kernel:3.4.34 + cpe:/o:linux:linux_kernel:3.4.33 + cpe:/o:linux:linux_kernel:3.9.2 + cpe:/o:linux:linux_kernel:3.9.1 + cpe:/o:linux:linux_kernel:3.0.19 + cpe:/o:linux:linux_kernel:3.4.39 + cpe:/o:linux:linux_kernel:3.9.4 + cpe:/o:linux:linux_kernel:3.4.38 + cpe:/o:linux:linux_kernel:3.9.3 + cpe:/o:linux:linux_kernel:3.4.37 + cpe:/o:linux:linux_kernel:3.9.6 + cpe:/o:linux:linux_kernel:3.9.5 + cpe:/o:linux:linux_kernel:3.0.21 + cpe:/o:linux:linux_kernel:3.9.7 + cpe:/o:linux:linux_kernel:3.5.4 + cpe:/o:linux:linux_kernel:3.0.4 + cpe:/o:linux:linux_kernel:3.0.5 + cpe:/o:linux:linux_kernel:3.0.2 + cpe:/o:linux:linux_kernel:3.0.3 + cpe:/o:linux:linux_kernel:3.0.8 + cpe:/o:linux:linux_kernel:3.0.6 + cpe:/o:linux:linux_kernel:3.0.7 + cpe:/o:linux:linux_kernel:3.4.36 + cpe:/o:linux:linux_kernel:3.13.1 + cpe:/o:linux:linux_kernel:3.6.10 + cpe:/o:linux:linux_kernel:3.6.11 + cpe:/o:linux:linux_kernel:3.13.6 + cpe:/o:linux:linux_kernel:3.13.4 + cpe:/o:linux:linux_kernel:3.13.5 + cpe:/o:linux:linux_kernel:3.13.2 + cpe:/o:linux:linux_kernel:3.13.3 + cpe:/o:linux:linux_kernel:3.4.1 + cpe:/o:linux:linux_kernel:3.4.19 + cpe:/o:linux:linux_kernel:3.4.17 + cpe:/o:linux:linux_kernel:3.4.3 + cpe:/o:linux:linux_kernel:3.4.18 + cpe:/o:linux:linux_kernel:3.4.2 + cpe:/o:linux:linux_kernel:3.2.9 + cpe:/o:linux:linux_kernel:3.4.15 + cpe:/o:linux:linux_kernel:3.2.8 + cpe:/o:linux:linux_kernel:3.4.16 + cpe:/o:linux:linux_kernel:3.4.4 + cpe:/o:linux:linux_kernel:3.12.12 + cpe:/o:linux:linux_kernel:3.2.7 + cpe:/o:linux:linux_kernel:3.4.13 + cpe:/o:linux:linux_kernel:3.12.13 + cpe:/o:linux:linux_kernel:3.12.10 + cpe:/o:linux:linux_kernel:3.4.11 + cpe:/o:linux:linux_kernel:3.12.11 + cpe:/o:linux:linux_kernel:3.4.12 + cpe:/o:linux:linux_kernel:3.4.10 + cpe:/o:linux:linux_kernel:3.0.61 + cpe:/o:linux:linux_kernel:3.3:rc2 + cpe:/o:linux:linux_kernel:3.4:rc7 + cpe:/o:linux:linux_kernel:3.0.60 + cpe:/o:linux:linux_kernel:3.3:rc7 + cpe:/o:linux:linux_kernel:3.4:rc5 + cpe:/o:linux:linux_kernel:3.3:rc5 + cpe:/o:linux:linux_kernel:3.4:rc6 + cpe:/o:linux:linux_kernel:3.3:rc6 + cpe:/o:linux:linux_kernel:3.0.64 + cpe:/o:linux:linux_kernel:3.0.63 + cpe:/o:linux:linux_kernel:3.0.62 + cpe:/o:linux:linux_kernel:3.12.1 + cpe:/o:linux:linux_kernel:3.0.68 + cpe:/o:linux:linux_kernel:3.0.67 + cpe:/o:linux:linux_kernel:3.0.66 + cpe:/o:linux:linux_kernel:3.4.14 + cpe:/o:linux:linux_kernel:3.12.7 + cpe:/o:linux:linux_kernel:3.2:rc2 + cpe:/o:linux:linux_kernel:3.1:rc1 + cpe:/o:linux:linux_kernel:3.0.9 + cpe:/o:linux:linux_kernel:3.0:rc4 + cpe:/o:linux:linux_kernel:3.12.8 + cpe:/o:linux:linux_kernel:3.1:rc4 + cpe:/o:linux:linux_kernel:3.0:rc3 + cpe:/o:linux:linux_kernel:3.12.9 + cpe:/o:linux:linux_kernel:3.0:rc2 + cpe:/o:linux:linux_kernel:3.1:rc2 + cpe:/o:linux:linux_kernel:3.0:rc1 + cpe:/o:linux:linux_kernel:3.2:rc7 + cpe:/o:linux:linux_kernel:3.12.3 + cpe:/o:linux:linux_kernel:3.1.10 + cpe:/o:linux:linux_kernel:3.2:rc6 + cpe:/o:linux:linux_kernel:3.12.4 + cpe:/o:linux:linux_kernel:3.0:rc7 + cpe:/o:linux:linux_kernel:3.2:rc5 + cpe:/o:linux:linux_kernel:3.12.5 + cpe:/o:linux:linux_kernel:3.9:rc3 + cpe:/o:linux:linux_kernel:3.0:rc6 + cpe:/o:linux:linux_kernel:3.12.6 + cpe:/o:linux:linux_kernel:3.0:rc5 + cpe:/o:linux:linux_kernel:3.9:rc1 + cpe:/o:linux:linux_kernel:3.9:rc4 + cpe:/o:linux:linux_kernel:3.9:rc7 + cpe:/o:linux:linux_kernel:3.12.2 + cpe:/o:linux:linux_kernel:3.9:rc2 + cpe:/o:linux:linux_kernel:3.9:rc5 + cpe:/o:linux:linux_kernel:3.3:rc3 + cpe:/o:linux:linux_kernel:3.4:rc4 + cpe:/o:linux:linux_kernel:3.4:rc3 + cpe:/o:linux:linux_kernel:3.3:rc1 + cpe:/o:linux:linux_kernel:3.4:rc2 + cpe:/o:linux:linux_kernel:3.9:rc6 + cpe:/o:linux:linux_kernel:3.3:rc4 + cpe:/o:linux:linux_kernel:3.4:rc1 + cpe:/o:linux:linux_kernel:3.4.5 + cpe:/o:linux:linux_kernel:3.2.2 + cpe:/o:linux:linux_kernel:3.2.3 + cpe:/o:linux:linux_kernel:3.2.1 + cpe:/o:linux:linux_kernel:3.4.6 + cpe:/o:linux:linux_kernel:3.2:rc3 + cpe:/o:linux:linux_kernel:3.2.6 + cpe:/o:linux:linux_kernel:3.4.7 + cpe:/o:linux:linux_kernel:3.2:rc4 + cpe:/o:linux:linux_kernel:3.1:rc3 + cpe:/o:linux:linux_kernel:3.4.8 + cpe:/o:linux:linux_kernel:3.2.4 + cpe:/o:linux:linux_kernel:3.4.9 + cpe:/o:linux:linux_kernel:3.2.5 + cpe:/o:linux:linux_kernel:3.0.65 + cpe:/o:linux:linux_kernel:3.2.12 + cpe:/o:linux:linux_kernel:3.8.10 + cpe:/o:linux:linux_kernel:3.8.12 + cpe:/o:linux:linux_kernel:3.8.11 + cpe:/o:linux:linux_kernel:3.8.13 + cpe:/o:linux:linux_kernel:3.7.9 + cpe:/o:linux:linux_kernel:3.7.8 + cpe:/o:linux:linux_kernel:3.7.7 + cpe:/o:linux:linux_kernel:3.7.6 + cpe:/o:linux:linux_kernel:3.6.3 + cpe:/o:linux:linux_kernel:3.7.5 + cpe:/o:linux:linux_kernel:3.7.4 + cpe:/o:linux:linux_kernel:3.7.3 + cpe:/o:linux:linux_kernel:3.7.2 + cpe:/o:linux:linux_kernel:3.6.7 + cpe:/o:linux:linux_kernel:3.6.6 + cpe:/o:linux:linux_kernel:3.6.5 + cpe:/o:linux:linux_kernel:3.6.4 + cpe:/o:linux:linux_kernel:3.6.9 + cpe:/o:linux:linux_kernel:3.6.8 + cpe:/o:linux:linux_kernel:3.10 + cpe:/o:linux:linux_kernel:3.11 + cpe:/o:linux:linux_kernel:3.12 + cpe:/o:linux:linux_kernel:3.13 + cpe:/o:linux:linux_kernel:3.10.1 + cpe:/o:linux:linux_kernel:3.10.2 + cpe:/o:linux:linux_kernel:3.10.3 + cpe:/o:linux:linux_kernel:3.6.2 + cpe:/o:linux:linux_kernel:3.6.1 + cpe:/o:linux:linux_kernel:3.3.6 + cpe:/o:linux:linux_kernel:3.3.7 + cpe:/o:linux:linux_kernel:3.3.8 + cpe:/o:linux:linux_kernel:3.0.1 + cpe:/o:linux:linux_kernel:3.2 + cpe:/o:linux:linux_kernel:3.1 + cpe:/o:linux:linux_kernel:3.7 + cpe:/o:linux:linux_kernel:3.6 + cpe:/o:linux:linux_kernel:3.4 + cpe:/o:linux:linux_kernel:3.1.6 + cpe:/o:linux:linux_kernel:3.1.5 + cpe:/o:linux:linux_kernel:3.1.7 + cpe:/o:linux:linux_kernel:3.0.32 + cpe:/o:linux:linux_kernel:3.8.9 + cpe:/o:linux:linux_kernel:3.1.2 + cpe:/o:linux:linux_kernel:3.1.1 + cpe:/o:linux:linux_kernel:3.1.4 + cpe:/o:linux:linux_kernel:3.1.3 + cpe:/o:linux:linux_kernel:3.9.10 + cpe:/o:linux:linux_kernel:3.0.29 + cpe:/o:linux:linux_kernel:3.3 + cpe:/o:linux:linux_kernel:3.8.4 + cpe:/o:linux:linux_kernel:3.2.26 + cpe:/o:linux:linux_kernel:3.8.5 + cpe:/o:linux:linux_kernel:3.2.27 + cpe:/o:linux:linux_kernel:3.8.2 + cpe:/o:linux:linux_kernel:3.2.24 + cpe:/o:linux:linux_kernel:3.8.3 + cpe:/o:linux:linux_kernel:3.2.25 + cpe:/o:linux:linux_kernel:3.8.8 + cpe:/o:linux:linux_kernel:3.8.6 + cpe:/o:linux:linux_kernel:3.2.28 + cpe:/o:linux:linux_kernel:3.8.7 + cpe:/o:linux:linux_kernel:3.2.29 + cpe:/o:linux:linux_kernel:3.3.3 + cpe:/o:linux:linux_kernel:3.3.4 + cpe:/o:linux:linux_kernel:3.3.5 + cpe:/o:linux:linux_kernel:3.2.22 + cpe:/o:linux:linux_kernel:3.8.1 + cpe:/o:linux:linux_kernel:3.2.20 + cpe:/o:linux:linux_kernel:3.3.1 + cpe:/o:linux:linux_kernel:3.2.21 + cpe:/o:linux:linux_kernel:3.3.2 + cpe:/o:linux:linux_kernel:3.11.1 + cpe:/o:linux:linux_kernel:3.11.2 + cpe:/o:linux:linux_kernel:3.2.23 + cpe:/o:linux:linux_kernel:3.0.17 + cpe:/o:linux:linux_kernel:3.9.11 + cpe:/o:linux:linux_kernel:3.0.16 + cpe:/o:linux:linux_kernel:3.0.15 + cpe:/o:linux:linux_kernel:3.2.30 + cpe:/o:linux:linux_kernel:3.0.14 + cpe:/o:linux:linux_kernel:3.0.13 + cpe:/o:linux:linux_kernel:3.0.12 + cpe:/o:linux:linux_kernel:3.0.11 + cpe:/o:linux:linux_kernel:3.4.61 + cpe:/o:linux:linux_kernel:3.0.10 + cpe:/o:linux:linux_kernel:3.4.64 + cpe:/o:linux:linux_kernel:3.8.0 + cpe:/o:linux:linux_kernel:3.4.65 + cpe:/o:linux:linux_kernel:3.4.62 + cpe:/o:linux:linux_kernel:3.4.63 + cpe:/o:linux:linux_kernel:3.4.68 + cpe:/o:linux:linux_kernel:3.4.66 + cpe:/o:linux:linux_kernel:3.4.67 + cpe:/o:linux:linux_kernel:3.5.3 + cpe:/o:linux:linux_kernel:3.5.1 + cpe:/o:linux:linux_kernel:3.5.2 + cpe:/o:linux:linux_kernel:3.10.4 + cpe:/o:linux:linux_kernel:3.4.72 + cpe:/o:linux:linux_kernel:3.10.9 + cpe:/o:linux:linux_kernel:3.4.73 + cpe:/o:linux:linux_kernel:3.4.74 + cpe:/o:linux:linux_kernel:3.4.75 + cpe:/o:linux:linux_kernel:3.4.76 + cpe:/o:linux:linux_kernel:3.10.5 + cpe:/o:linux:linux_kernel:3.4.77 + cpe:/o:linux:linux_kernel:3.10.6 + cpe:/o:linux:linux_kernel:3.4.78 + cpe:/o:linux:linux_kernel:3.10.7 + cpe:/o:linux:linux_kernel:3.4.79 + cpe:/o:linux:linux_kernel:3.10.8 + cpe:/o:linux:linux_kernel:3.7.10 + cpe:/o:linux:linux_kernel:3.2.17 + cpe:/o:linux:linux_kernel:3.2.18 + cpe:/o:linux:linux_kernel:3.2.19 + cpe:/o:linux:linux_kernel:3.2.13 + cpe:/o:linux:linux_kernel:3.2.14 + cpe:/o:linux:linux_kernel:3.11.3 + cpe:/o:linux:linux_kernel:3.2.15 + cpe:/o:linux:linux_kernel:3.4.60 + cpe:/o:linux:linux_kernel:3.2.16 + cpe:/o:linux:linux_kernel:3.11.5 + cpe:/o:linux:linux_kernel:3.11.4 + cpe:/o:linux:linux_kernel:3.2.10 + cpe:/o:linux:linux_kernel:3.11.7 + cpe:/o:linux:linux_kernel:3.2.11 + cpe:/o:linux:linux_kernel:3.11.6 + cpe:/o:linux:linux_kernel:3.11.9 + cpe:/o:linux:linux_kernel:3.11.8 + cpe:/o:linux:linux_kernel:3.4.69 + + CVE-2014-2523 + 2014-03-24T12:40:48.140-04:00 + 2014-04-01T02:29:36.423-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-24T09:44:43.000-04:00 + + + + + CONFIRM + https://github.com/torvalds/linux/commit/b22f5126a24b3b2f15448c3f2a254fc10cbc2b92 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1077343 + + + XF + linux-kernel-cve20142523-code-exec(91910) + + + SECTRACK + 1029945 + + + BID + 66279 + + + MLIST + [oss-security] 20140317 Re: CVE Request: netfilter: remote memory corruption in nf_conntrack_proto_dccp.c + + + MISC + http://twitter.com/grsecurity/statuses/445496197399461888 + + + SECUNIA + 57446 + + + CONFIRM + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b22f5126a24b3b2f15448c3f2a254fc10cbc2b92 + + net/netfilter/nf_conntrack_proto_dccp.c in the Linux kernel through 3.13.6 uses a DCCP header pointer incorrectly, which allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a DCCP packet that triggers a call to the (1) dccp_new, (2) dccp_packet, or (3) dccp_error function. + + + + + + + + + + + + + + cpe:/a:pyyaml:libyaml:0.1.1 + cpe:/a:pyyaml:libyaml:0.1.4 + cpe:/a:pyyaml:libyaml:0.1.5 + cpe:/a:pyyaml:libyaml:0.0.1 + cpe:/a:pyyaml:libyaml:0.1.2 + cpe:/a:pyyaml:libyaml:0.1.3 + + CVE-2014-2525 + 2014-03-28T11:55:08.670-04:00 + 2014-04-24T01:06:17.750-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-31T11:10:18.953-04:00 + + + + + MISC + http://www.ocert.org/advisories/ocert-2014-003.html + + + CONFIRM + https://bitbucket.org/xi/libyaml/commits/bce8b60f0b9af69fa9fab3093d0a41ba243de048 + + + UBUNTU + USN-2160-1 + + + CONFIRM + http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/ + + + CONFIRM + http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/ + + + CONFIRM + http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/ + + + DEBIAN + DSA-2885 + + + DEBIAN + DSA-2884 + + + SECUNIA + 57968 + + + SECUNIA + 57966 + + + SECUNIA + 57836 + + + REDHAT + RHSA-2014:0355 + + + REDHAT + RHSA-2014:0354 + + + REDHAT + RHSA-2014:0353 + + + SUSE + openSUSE-SU-2014:0500 + + Heap-based buffer overflow in the yaml_parser_scan_uri_escapes function in LibYAML before 0.1.6 allows context-dependent attackers to execute arbitrary code via a long sequence of percent-encoded characters in a URI in a YAML file. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:barracudadrive:barracudadrive:4.0.2 + cpe:/a:barracudadrive:barracudadrive:4.0.1 + cpe:/a:barracudadrive:barracudadrive:4.6.1 + cpe:/a:barracudadrive:barracudadrive:4.1 + cpe:/a:barracudadrive:barracudadrive:4.5.2 + cpe:/a:barracudadrive:barracudadrive:4.4.1 + cpe:/a:barracudadrive:barracudadrive:4.4.2 + cpe:/a:barracudadrive:barracudadrive:3.8 + cpe:/a:barracudadrive:barracudadrive:4.4.3 + cpe:/a:barracudadrive:barracudadrive:6.3 + cpe:/a:barracudadrive:barracudadrive:3.9 + cpe:/a:barracudadrive:barracudadrive:6.4 + cpe:/a:barracudadrive:barracudadrive:3.6 + cpe:/a:barracudadrive:barracudadrive:4.9.2 + cpe:/a:barracudadrive:barracudadrive:6.5 + cpe:/a:barracudadrive:barracudadrive:3.7 + cpe:/a:barracudadrive:barracudadrive:6.6 + cpe:/a:barracudadrive:barracudadrive:4.5.1 + cpe:/a:barracudadrive:barracudadrive:3.4 + cpe:/a:barracudadrive:barracudadrive:4.5.5 + cpe:/a:barracudadrive:barracudadrive:3.5 + cpe:/a:barracudadrive:barracudadrive:4.9.1 + cpe:/a:barracudadrive:barracudadrive:6.0 + cpe:/a:barracudadrive:barracudadrive:4.5.4 + cpe:/a:barracudadrive:barracudadrive:6.1 + cpe:/a:barracudadrive:barracudadrive:4.5.3 + cpe:/a:barracudadrive:barracudadrive:6.2 + cpe:/a:barracudadrive:barracudadrive:4.4.5 + cpe:/a:barracudadrive:barracudadrive:4.4.6 + cpe:/a:barracudadrive:barracudadrive:4.4.4 + cpe:/a:barracudadrive:barracudadrive:4.8.4 + cpe:/a:barracudadrive:barracudadrive:4.4.7 + cpe:/a:barracudadrive:barracudadrive:4.4.8 + cpe:/a:barracudadrive:barracudadrive:3.7.2 + cpe:/a:barracudadrive:barracudadrive:4.2 + cpe:/a:barracudadrive:barracudadrive:5.1 + cpe:/a:barracudadrive:barracudadrive:4.4 + cpe:/a:barracudadrive:barracudadrive:5.3 + cpe:/a:barracudadrive:barracudadrive:4.3 + cpe:/a:barracudadrive:barracudadrive:5.2 + cpe:/a:barracudadrive:barracudadrive:4.6 + cpe:/a:barracudadrive:barracudadrive:4.5 + cpe:/a:barracudadrive:barracudadrive:4.8 + cpe:/a:barracudadrive:barracudadrive:4.7 + cpe:/a:barracudadrive:barracudadrive:5.0 + cpe:/a:barracudadrive:barracudadrive:4.9 + cpe:/a:barracudadrive:barracudadrive:4.0 + + CVE-2014-2526 + 2014-03-25T14:21:48.263-04:00 + 2014-03-26T10:53:17.300-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-26T10:53:16.643-04:00 + + + + + XF + barracudadrive-multiple-scripts-xss(91920) + + + SECUNIA + 57451 + + + MISC + http://secpod.org/blog/?p=2158 + + + MISC + http://secpod.org/advisories/SecPod_BarracudaDrive_Mult_XSS_Vuln.txt + + + MISC + http://packetstormsecurity.com/files/125766 + + + CONFIRM + http://barracudadrive.com/readme.txt + + Multiple cross-site scripting (XSS) vulnerabilities in BarracudaDrive before 6.7 allow remote attackers to inject arbitrary web script or HTML via the (1) sForumName or (2) sDescription parameter to Forum/manage/ForumManager.lsp; (3) sHint, (4) sWord, or (5) nId parameter to Forum/manage/hangman.lsp; (6) user parameter to rtl/protected/admin/wizard/setuser.lsp; (7) name or (8) email parameter to feedback.lsp; (9) lname or (10) url parameter to private/manage/PageManager.lsp; (11) cmd parameter to fs; (12) newname, (13) description, (14) firstname, (15) lastname, or (16) id parameter to rtl/protected/mail/manage/list.lsp; or (17) PATH_INFO to fs/. + + + + + + + + + + + + + + cpe:/a:openbsd:openssh:6.4 + cpe:/a:openbsd:openssh:6.5 + cpe:/a:openbsd:openssh:6.0 + cpe:/a:openbsd:openssh:6.1 + cpe:/a:openbsd:openssh:6.2 + cpe:/a:openbsd:openssh:6.3 + + CVE-2014-2532 + 2014-03-18T01:18:19.000-04:00 + 2014-04-19T00:48:38.693-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-18T14:35:14.743-04:00 + + + + + XF + openssh-cve20142532-sec-bypass(91986) + + + UBUNTU + USN-2155-1 + + + SECTRACK + 1029925 + + + BID + 66355 + + + DEBIAN + DSA-2894 + + + SECUNIA + 57574 + + + SECUNIA + 57488 + + + MLIST + [security-announce] 20140315 Announce: OpenSSH 6.6 released + + sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config, which allows remote attackers to bypass intended environment restrictions by using a substring located before a wildcard character. + + + + + + + + + + + cpe:/o:blackberry:qnx_neutrino_rtos:6.4.1 + cpe:/o:blackberry:qnx_neutrino_rtos:6.5.0:sp1 + cpe:/o:blackberry:qnx_neutrino_rtos:6.5.0 + + CVE-2014-2533 + 2014-03-18T01:18:19.143-04:00 + 2014-04-01T02:29:37.047-04:00 + + + 7.2 + LOCAL + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-03-18T15:25:04.803-04:00 + + + + + EXPLOIT-DB + 32153 + + + FULLDISC + 20140312 Medium severity flaw in BlackBerry QNX Neutrino RTOS + + + FULLDISC + 20140313 Re: Medium severity flaw in BlackBerry QNX Neutrino RTOS + + + BUGTRAQ + 20140313 Re: Medium severity flaw in BlackBerry QNX Neutrino RTOS + + + BUGTRAQ + 20140311 Medium severity flaw in BlackBerry QNX Neutrino RTOS + + /sbin/ifwatchd in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to gain privileges by providing an arbitrary program name as a command-line argument. + + + + + + + + + + + cpe:/o:blackberry:qnx_neutrino_rtos:6.4.1 + cpe:/o:blackberry:qnx_neutrino_rtos:6.5.0:sp1 + cpe:/o:blackberry:qnx_neutrino_rtos:6.5.0 + + CVE-2014-2534 + 2014-03-18T01:18:19.157-04:00 + 2014-04-01T02:29:37.140-04:00 + + + 4.9 + LOCAL + LOW + NONE + COMPLETE + NONE + NONE + http://nvd.nist.gov + 2014-03-18T15:36:23.023-04:00 + + + + + EXPLOIT-DB + 32156 + + + FULLDISC + 20140312 Medium severity flaw in BlackBerry QNX Neutrino RTOS + + + FULLDISC + 20140313 Re: Medium severity flaw in BlackBerry QNX Neutrino RTOS + + + BUGTRAQ + 20140313 Re: Medium severity flaw in BlackBerry QNX Neutrino RTOS + + + BUGTRAQ + 20140311 Medium severity flaw in BlackBerry QNX Neutrino RTOS + + /sbin/pppoectl in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to obtain sensitive information by reading "bad parameter" lines in error messages, as demonstrated by reading the root password hash in /etc/shadow. + + + + + + + + + + + cpe:/a:mcafee:web_gateway:7.2.0.9 + cpe:/a:mcafee:web_gateway:7.3.2.4 + cpe:/a:mcafee:web_gateway:7.4.0 + + CVE-2014-2535 + 2014-03-18T13:04:18.407-04:00 + 2014-04-01T02:29:37.220-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-03-19T11:01:43.510-04:00 + + + + + CONFIRM + https://kc.mcafee.com/corporate/index?page=content&id=SB10063 + + + XF + mcafee-gateway-filtering-dir-traversal(91772) + + + BID + 66193 + + + SECUNIA + 56958 + + Directory traversal vulnerability in McAfee Web Gateway (MWG) 7.4.x before 7.4.1, 7.3.x before 7.3.2.6, and 7.2.0.9 and earlier allows remote authenticated users to read arbitrary files via a crafted request to the web filtering port. + + + + + + + + + + + + + + cpe:/a:mcafee:cloud_identity_manager:3.1 + cpe:/a:mcafee:cloud_identity_manager:3.5.1 + cpe:/a:intel:expressway_cloud_access_360:2.1 + cpe:/a:mcafee:cloud_single_sign_on:4.0.0 + cpe:/a:intel:expressway_cloud_access_360:2.5 + cpe:/a:mcafee:cloud_identity_manager:3.0 + + CVE-2014-2536 + 2014-03-18T13:04:18.467-04:00 + 2014-04-01T02:29:37.313-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-03-19T11:19:34.600-04:00 + + + + + CONFIRM + https://kc.mcafee.com/corporate/index?page=content&id=SB10066 + + + BID + 66181 + + + SECUNIA + 57381 + + + SECUNIA + 57368 + + Directory traversal vulnerability in McAfee Cloud Identity Manager 3.0, 3.1, and 3.5.1, McAfee Cloud Single Sign On (MCSSO) before 4.0.1, and Intel Expressway Cloud Access 360-SSO 2.1 and 2.5 allows remote authenticated users to read an unspecified file containing a hash of the administrator password via unknown vectors. + + + + + + + + + + + + + + + + + + + + + + + cpe:/h:sophos:unified_threat_management:425 + cpe:/h:sophos:unified_threat_management:120 + cpe:/a:sophos:unified_threat_management_software:9.108 + cpe:/h:sophos:unified_threat_management:220 + cpe:/a:sophos:unified_threat_management_software:9.107 + cpe:/h:sophos:unified_threat_management:625 + cpe:/h:sophos:unified_threat_management:110 + cpe:/a:sophos:unified_threat_management_software:9.007 + cpe:/h:sophos:unified_threat_management:525 + cpe:/h:sophos:unified_threat_management:320 + cpe:/a:sophos:unified_threat_management_software:8.3 + + CVE-2014-2537 + 2014-03-18T13:04:18.813-04:00 + 2014-04-01T02:29:37.407-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-03-19T14:23:43.637-04:00 + + + + + CONFIRM + http://blogs.sophos.com/2014/02/20/utm-up2date-9-109/ + + + SECTRACK + 1029920 + + + BID + 66231 + + + SECUNIA + 57344 + + Memory leak in the TCP stack in the kernel in Sophos UTM before 9.109 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors. + + + + + + + + + + + + + + + + cpe:/a:joshua_peek:rack-ssl:1.2.0::~~~ruby~~ + cpe:/a:joshua_peek:rack-ssl:1.3.1::~~~ruby~~ + cpe:/a:joshua_peek:rack-ssl:1.3.0::~~~ruby~~ + cpe:/a:joshua_peek:rack-ssl:1.0.0::~~~ruby~~ + cpe:/a:joshua_peek:rack-ssl:1.3.3::~~~ruby~~ + cpe:/a:joshua_peek:rack-ssl:1.3.2::~~~ruby~~ + cpe:/a:joshua_peek:rack-ssl:1.3.4::~~~ruby~~ + cpe:/a:joshua_peek:rack-ssl:1.1.0::~~~ruby~~ + + CVE-2014-2538 + 2014-03-25T14:21:48.357-04:00 + 2014-04-19T00:48:39.317-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-26T11:04:22.103-04:00 + + + + + CONFIRM + https://github.com/josh/rack-ssl/commit/9d7d7300b907e496db68d89d07fbc2e0df0b487b + + + MLIST + [oss-security] 20140319 Re: CVE Request: rack-ssl rubygem: XSS in error page + + + SECUNIA + 57466 + + + SUSE + openSUSE-SU-2014:0515 + + Cross-site scripting (XSS) vulnerability in lib/rack/ssl.rb in the rack-ssl gem before 1.4.0 for Ruby allows remote attackers to inject arbitrary web script or HTML via a URI, which might not be properly handled by third-party adapters such as JRuby-Rack. + + + + + + + + + cpe:/a:orbitscripts:orbit_open_ad_server:1.1.0 + + CVE-2014-2540 + 2014-04-11T10:55:05.803-04:00 + 2014-04-14T10:27:34.500-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-14T10:27:34.453-04:00 + + + + + MISC + https://www.htbridge.com/advisory/HTB23208 + + + BID + 66667 + + + BUGTRAQ + 20140409 SQL Injection in Orbit Open Ad Server + + + EXPLOIT-DB + 32792 + + SQL injection vulnerability in OrbitScripts Orbit Open Ad Server before 1.1.1 allows remote attackers to execute arbitrary SQL commands via the site_directory_sort_field parameter to guest/site_directory. + + + + + + + + + + + + + + + + + + + + cpe:/a:tibco:rendezvous:8.10 + cpe:/a:tibco:rendezvous:8.3.0 + cpe:/a:tibco:rendezvous:7.4.11 + cpe:/h:tibco:messaging_appliance:8.7.0 + cpe:/a:tibco:rendezvous:7.5.4 + cpe:/a:tibco:rendezvous:7.5.3 + cpe:/a:tibco:rendezvous:7.5.2 + cpe:/a:tibco:rendezvous:7.5.1 + cpe:/a:tibco:rendezvous:8.4.1 + cpe:/a:tibco:substantiation_es:2.8.0 + cpe:/a:tibco:rendezvous:8.3.1 + cpe:/a:tibco:rendezvous:8.2.1 + + CVE-2014-2541 + 2014-04-08T19:47:28.667-04:00 + 2014-04-09T10:13:38.093-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-09T10:13:32.703-04:00 + + + + + CONFIRM + http://www.tibco.com/multimedia/rendezvous_advisory_20140408_tcm8-20763.txt + + + CONFIRM + http://www.tibco.com/mk/advisory.jsp + + The Rendezvous Daemon (rvd), Rendezvous Routing Daemon (rvrd), Rendezvous Secure Daemon (rvsd), and Rendezvous Secure Routing Daemon (rvsrd) in TIBCO Rendezvous before 8.4.2, Messaging Appliance before 8.7.1, and Substation ES before 2.8.1 do not properly implement access control, which allows remote attackers to obtain sensitive information or modify transmitted information via unspecified vectors. + + + + + + + + + + + + + + + + + + + + cpe:/a:tibco:rendezvous:8.10 + cpe:/a:tibco:rendezvous:8.3.0 + cpe:/a:tibco:rendezvous:7.4.11 + cpe:/h:tibco:messaging_appliance:8.7.0 + cpe:/a:tibco:rendezvous:7.5.4 + cpe:/a:tibco:rendezvous:7.5.3 + cpe:/a:tibco:rendezvous:7.5.2 + cpe:/a:tibco:rendezvous:7.5.1 + cpe:/a:tibco:rendezvous:8.4.1 + cpe:/a:tibco:substantiation_es:2.8.0 + cpe:/a:tibco:rendezvous:8.3.1 + cpe:/a:tibco:rendezvous:8.2.1 + + CVE-2014-2542 + 2014-04-08T19:47:28.697-04:00 + 2014-04-09T10:14:13.127-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-09T10:14:12.987-04:00 + + + + + CONFIRM + http://www.tibco.com/multimedia/rendezvous_advisory_20140408_tcm8-20763.txt + + + CONFIRM + http://www.tibco.com/mk/advisory.jsp + + Cross-site scripting (XSS) vulnerability in the Rendezvous Daemon (rvd), Rendezvous Routing Daemon (rvrd), Rendezvous Secure Daemon (rvsd), and Rendezvous Secure Routing Daemon (rvsrd) in TIBCO Rendezvous before 8.4.2, Messaging Appliance before 8.7.1, and Substation ES before 2.8.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + + + + + + + + + + + cpe:/a:tibco:rendezvous:8.10 + cpe:/a:tibco:rendezvous:8.3.0 + cpe:/a:tibco:rendezvous:7.4.11 + cpe:/h:tibco:messaging_appliance:8.7.0 + cpe:/a:tibco:rendezvous:7.5.4 + cpe:/a:tibco:rendezvous:7.5.3 + cpe:/a:tibco:rendezvous:7.5.2 + cpe:/a:tibco:rendezvous:7.5.1 + cpe:/a:tibco:rendezvous:8.4.1 + cpe:/a:tibco:substantiation_es:2.8.0 + cpe:/a:tibco:rendezvous:8.3.1 + cpe:/a:tibco:rendezvous:8.2.1 + + CVE-2014-2543 + 2014-04-08T19:47:28.727-04:00 + 2014-04-09T10:15:57.147-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-09T10:14:50.643-04:00 + + + + + CONFIRM + http://www.tibco.com/multimedia/rendezvous_advisory_20140408_tcm8-20763.txt + + + CONFIRM + http://www.tibco.com/mk/advisory.jsp + + Buffer overflow in the Rendezvous Daemon (rvd), Rendezvous Routing Daemon (rvrd), Rendezvous Secure Daemon (rvsd), and Rendezvous Secure Routing Daemon (rvsrd) in TIBCO Rendezvous before 8.4.2, Messaging Appliance before 8.7.1, and Substation ES before 2.8.1 allows remote attackers to execute arbitrary code by leveraging access to a directly connected client and transmitting crafted data. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:tibco:spotfire_professional:5.5.0 + cpe:/a:tibco:web_player:6.0.0 + cpe:/a:tibco:automation_services:4.5.1 + cpe:/a:tibco:web_player:5.0.0 + cpe:/a:tibco:spotfire_server:3.3.3 + cpe:/a:tibco:automation_services:4.5.0 + cpe:/a:tibco:web_player:4.5.1 + cpe:/a:tibco:spotfire_server:5.5.0 + cpe:/a:tibco:web_player:5.0.1 + cpe:/a:tibco:analyst:6.0.0 + cpe:/a:tibco:web_player:4.0.3 + cpe:/a:tibco:web_player:4.5.0 + cpe:/a:tibco:deployment_kit:6.0.0 + cpe:/a:tibco:spotfire_server:4.5.0 + cpe:/a:tibco:spotfire_server:5.0.1 + cpe:/a:tibco:desktop:6.0.0 + cpe:/a:tibco:spotfire_server:5.0.0 + cpe:/a:tibco:automation_services:4.0.3 + cpe:/a:tibco:deployment_kit:5.5.0 + cpe:/a:tibco:spotfire_professional:5.0.0 + cpe:/a:tibco:spotfire_professional:5.0.1 + cpe:/a:tibco:spotfire_server:6.0.1 + cpe:/a:tibco:spotfire_server:6.0.0 + cpe:/a:tibco:spotfire_professional:4.0.3 + cpe:/a:tibco:deployment_kit:4.0.3 + cpe:/a:tibco:deployment_kit:5.0.1 + cpe:/a:tibco:deployment_kit:5.0.0 + cpe:/a:tibco:automation_services:5.0.1 + cpe:/a:tibco:automation_services:5.0.0 + cpe:/a:tibco:spotfire_professional:6.0.0 + cpe:/a:tibco:automation_services:5.5.0 + cpe:/a:tibco:automation_services:6.0.0 + cpe:/a:tibco:web_player:5.5.0 + cpe:/a:tibco:deployment_kit:4.5.0 + cpe:/a:tibco:deployment_kit:4.5.1 + cpe:/a:tibco:spotfire_professional:4.5.0 + cpe:/a:tibco:spotfire_professional:4.5.1 + + CVE-2014-2544 + 2014-04-09T20:55:09.937-04:00 + 2014-04-10T11:13:37.177-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-10T11:13:36.880-04:00 + + + + CONFIRM + http://www.tibco.com/multimedia/spotfire_advisory_20140409_tcm8-20764.txt + + + CONFIRM + http://www.tibco.com/mk/advisory.jsp + + Unspecified vulnerability in Spotfire Web Player Engine, Spotfire Desktop, and Spotfire Server Authentication Module in TIBCO Spotfire Server 3.3.x before 3.3.4, 4.5.x before 4.5.1, 5.0.x before 5.0.2, 5.5.x before 5.5.1, and 6.x before 6.0.2; Spotfire Professional 4.0.x before 4.0.4, 4.5.x before 4.5.2, 5.0.x before 5.0.2, 5.5.x before 5.5.1, and 6.x before 6.0.1; Spotfire Web Player 4.0.x before 4.0.4, 4.5.x before 4.5.2, 5.0.x before 5.0.2, 5.5.x before 5.5.1, and 6.x before 6.0.1; Spotfire Automation Services 4.0.x before 4.0.4, 4.5.x before 4.5.2, 5.0.x before 5.0.2, 5.5.x before 5.5.1, and 6.x before 6.0.1; Spotfire Deployment Kit 4.0.x before 4.0.4, 4.5.x before 4.5.2, 5.0.x before 5.0.2, 5.5.x before 5.5.1, and 6.x before 6.0.1; Spotfire Desktop 6.x before 6.0.1; and Spotfire Analyst 6.x before 6.0.1 allows remote attackers to execute arbitrary code via unknown vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:tibco:managed_file_transfer_internet_server:7.0 + cpe:/a:tibco:slingshot:1.9.0 + cpe:/a:tibco:managed_file_transfer_command_center:6.7 + cpe:/a:tibco:managed_file_transfer_command_center:7.2.0 + cpe:/a:tibco:managed_file_transfer_command_center:7.2.1 + cpe:/a:tibco:slingshot:1.7.0 + cpe:/a:tibco:vault:1.0.0 + cpe:/a:tibco:managed_file_transfer_command_center:7.1.0 + cpe:/a:tibco:managed_file_transfer_internet_server:7.0.1 + cpe:/a:tibco:managed_file_transfer_internet_server:7.1.0 + cpe:/a:tibco:managed_file_transfer_internet_server:7.2.0 + cpe:/a:tibco:managed_file_transfer_internet_server:7.2.1 + cpe:/a:tibco:managed_file_transfer_internet_server:6.7 + cpe:/a:tibco:managed_file_transfer_command_center:7.0 + cpe:/a:tibco:slingshot:1.8.0 + cpe:/a:tibco:slingshot:1.8.1 + cpe:/a:tibco:managed_file_transfer_command_center:7.0.1 + + CVE-2014-2545 + 2014-04-30T06:49:05.380-04:00 + 2014-05-01T15:15:07.567-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-30T14:17:44.543-04:00 + + + + + CONFIRM + http://www.tibco.com/multimedia/mft_advisory_20140429_tcm8-21013.txt + + + CONFIRM + http://www.tibco.com/mk/advisory.jsp + + TIBCO Managed File Transfer Internet Server before 7.2.2, Managed File Transfer Command Center before 7.2.2, Slingshot before 1.9.1, and Vault before 1.0.1 allow remote attackers to obtain sensitive information via a crafted HTTP request. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:otrs:otrs:3.3.0 + cpe:/a:otrs:otrs:3.2.0 + cpe:/a:otrs:otrs:3.2.1 + cpe:/a:otrs:otrs:3.2.7 + cpe:/a:otrs:otrs:3.1.9 + cpe:/a:otrs:otrs:3.1.19 + cpe:/a:otrs:otrs:3.1.8 + cpe:/a:otrs:otrs:3.2.9 + cpe:/a:otrs:otrs:3.2.8 + cpe:/a:otrs:otrs:3.1.1 + cpe:/a:otrs:otrs:3.2.12 + cpe:/a:otrs:otrs:3.1.2 + cpe:/a:otrs:otrs:3.2.13 + cpe:/a:otrs:otrs:3.2.14 + cpe:/a:otrs:otrs:3.1.0 + cpe:/a:otrs:otrs:3.1.4 + cpe:/a:otrs:otrs:3.2.10 + cpe:/a:otrs:otrs:3.1.13 + cpe:/a:otrs:otrs:3.1.3 + cpe:/a:otrs:otrs:3.1.6 + cpe:/a:otrs:otrs:3.1.5 + cpe:/a:otrs:otrs:3.1.11 + cpe:/a:otrs:otrs:3.1.7 + cpe:/a:otrs:otrs:3.2.11 + cpe:/a:otrs:otrs:3.2.15 + cpe:/a:otrs:otrs:3.2.0:beta4 + cpe:/a:otrs:otrs:3.2.0:beta5 + cpe:/a:otrs:otrs:3.3.0:beta3 + cpe:/a:otrs:otrs:3.3.0:beta2 + cpe:/a:otrs:otrs:3.2.0:beta1 + cpe:/a:otrs:otrs:3.2.0:beta3 + cpe:/a:otrs:otrs:3.2.0:beta2 + cpe:/a:otrs:otrs:3.3.0:beta4 + cpe:/a:otrs:otrs:3.3.0:beta1 + cpe:/a:otrs:otrs:3.1.20 + cpe:/a:otrs:otrs:3.3.0:beta5 + cpe:/a:otrs:otrs:3.1.10 + cpe:/a:otrs:otrs:3.2.0:rc1 + cpe:/a:otrs:otrs:3.2.6 + cpe:/a:otrs:otrs:3.3.2 + cpe:/a:otrs:otrs:3.3.1 + cpe:/a:otrs:otrs:3.1.18 + cpe:/a:otrs:otrs:3.3.4 + cpe:/a:otrs:otrs:3.3.3 + cpe:/a:otrs:otrs:3.2.2 + cpe:/a:otrs:otrs:3.1.15 + cpe:/a:otrs:otrs:3.3.5 + cpe:/a:otrs:otrs:3.2.3 + cpe:/a:otrs:otrs:3.1.14 + cpe:/a:otrs:otrs:3.2.4 + cpe:/a:otrs:otrs:3.1.17 + cpe:/a:otrs:otrs:3.2.5 + cpe:/a:otrs:otrs:3.3.0:rc1 + cpe:/a:otrs:otrs:3.1.16 + + CVE-2014-2553 + 2014-04-02T12:05:57.207-04:00 + 2014-04-02T15:08:55.373-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-02T15:08:47.200-04:00 + + + + + CONFIRM + https://www.otrs.com/security-advisory-2014-04-xss-issue + + + SECUNIA + 57616 + + Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to dynamic fields. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:otrs:otrs:3.3.0 + cpe:/a:otrs:otrs:3.2.0 + cpe:/a:otrs:otrs:3.2.1 + cpe:/a:otrs:otrs:3.1.19 + cpe:/a:otrs:otrs:3.1.8 + cpe:/a:otrs:otrs:3.1.1 + cpe:/a:otrs:otrs:3.1.2 + cpe:/a:otrs:otrs:3.2.12 + cpe:/a:otrs:otrs:3.2.13 + cpe:/a:otrs:otrs:3.1.0 + cpe:/a:otrs:otrs:3.2.14 + cpe:/a:otrs:otrs:3.1.4 + cpe:/a:otrs:otrs:3.1.3 + cpe:/a:otrs:otrs:3.1.13 + cpe:/a:otrs:otrs:3.2.10 + cpe:/a:otrs:otrs:3.1.6 + cpe:/a:otrs:otrs:3.1.5 + cpe:/a:otrs:otrs:3.1.11 + cpe:/a:otrs:otrs:3.1.7 + cpe:/o:novell:opensuse:13.1 + cpe:/a:otrs:otrs:3.2.11 + cpe:/a:otrs:otrs:3.2.0:beta4 + cpe:/a:otrs:otrs:3.2.15 + cpe:/a:otrs:otrs:3.2.0:beta5 + cpe:/a:otrs:otrs:3.3.0:beta3 + cpe:/a:otrs:otrs:3.3.0:beta2 + cpe:/a:otrs:otrs:3.2.0:beta1 + cpe:/a:otrs:otrs:3.2.0:beta3 + cpe:/a:otrs:otrs:3.2.0:beta2 + cpe:/a:otrs:otrs:3.3.0:beta4 + cpe:/a:otrs:otrs:3.3.0:beta1 + cpe:/a:otrs:otrs:3.1.20 + cpe:/a:otrs:otrs:3.3.0:beta5 + cpe:/o:novell:opensuse:12.3 + cpe:/a:otrs:otrs:3.1.10 + cpe:/a:otrs:otrs:3.2.0:rc1 + cpe:/a:otrs:otrs:3.3.2 + cpe:/a:otrs:otrs:3.2.6 + cpe:/a:otrs:otrs:3.1.18 + cpe:/a:otrs:otrs:3.3.1 + cpe:/a:otrs:otrs:3.3.4 + cpe:/a:otrs:otrs:3.3.3 + cpe:/a:otrs:otrs:3.1.15 + cpe:/a:otrs:otrs:3.2.2 + cpe:/a:otrs:otrs:3.3.5 + cpe:/a:otrs:otrs:3.1.14 + cpe:/a:otrs:otrs:3.2.3 + cpe:/a:otrs:otrs:3.1.17 + cpe:/a:otrs:otrs:3.2.4 + cpe:/a:otrs:otrs:3.1.16 + cpe:/a:otrs:otrs:3.2.5 + cpe:/a:otrs:otrs:3.3.0:rc1 + + CVE-2014-2554 + 2014-04-23T11:55:04.017-04:00 + 2014-04-24T11:19:28.307-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-24T11:19:28.027-04:00 + + + + + CONFIRM + http://www.otrs.com/security-advisory-2014-05-clickjacking-issue/ + + + SUSE + openSUSE-SU-2014:0561 + + OTRS 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote attackers to conduct clickjacking attacks via an IFRAME element. + + + + + + + + + + + + + + + + cpe:/a:bluecoat:content_analysis_system_software:1.1.2.1 + cpe:/h:bluecoat:content_analysis_system:- + cpe:/a:bluecoat:content_analysis_system_software:1.1 + cpe:/a:bluecoat:content_analysis_system_software:1.1.1.1 + + CVE-2014-2565 + 2014-04-30T10:22:06.377-04:00 + 2014-05-01T09:49:31.517-04:00 + + + 6.5 + ADJACENT_NETWORK + HIGH + SINGLE_INSTANCE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-05-01T09:49:31.437-04:00 + + + + + CONFIRM + https://kb.bluecoat.com/index?page=content&id=SA78&actp=LIST + + The commandline interface in Blue Coat Content Analysis System (CAS) 1.1 before 1.1.4.2 allows remote administrators to execute arbitrary commands via unspecified vectors, related to "command injection." + + + + + + + + + + + + + + + + + + + + + + cpe:/a:trojita_project:trojita:0.3.96 + cpe:/a:trojita_project:trojita:0.3.91 + cpe:/a:trojita_project:trojita:0.3.92 + cpe:/a:trojita_project:trojita:0.3.93 + cpe:/a:trojita_project:trojita:0.3.90 + cpe:/a:trojita_project:trojita:0.3 + cpe:/a:trojita_project:trojita:0.2.9.3 + cpe:/a:trojita_project:trojita:0.4 + cpe:/a:trojita_project:trojita:0.2.9.2 + cpe:/a:trojita_project:trojita:0.2.9.1 + cpe:/a:trojita_project:trojita:0.2.9 + cpe:/a:trojita_project:trojita:0.1 + cpe:/a:trojita_project:trojita:0.2 + cpe:/a:trojita_project:trojita:0.2.9.4 + + CVE-2014-2567 + 2014-03-21T06:55:05.580-04:00 + 2014-03-25T20:20:34.740-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-21T08:50:48.000-04:00 + + + + + CONFIRM + https://github.com/jktjkt/trojita/commit/25fffa3e25cbad85bbca804193ad336b090a9ce1 + + + CONFIRM + http://jkt.flaska.net/blog/Trojita_0_4_1__a_security_update_for_CVE_2014_2567.html + + The OpenConnectionTask::handleStateHelper function in Imap/Tasks/OpenConnectionTask.cpp in Trojita before 0.4.1 allows man-in-the-middle attackers to trigger use of cleartext for saving a message into a (1) sent or (2) draft folder via a PREAUTH response that prevents later use of the STARTTLS command. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:linux:linux_kernel:3.0.48 + cpe:/o:linux:linux_kernel:3.0.49 + cpe:/o:linux:linux_kernel:3.0.46 + cpe:/o:linux:linux_kernel:3.0.47 + cpe:/o:linux:linux_kernel:3.0.44 + cpe:/o:linux:linux_kernel:3.0.45 + cpe:/o:linux:linux_kernel:3.0.42 + cpe:/o:linux:linux_kernel:3.4.70 + cpe:/o:linux:linux_kernel:3.4.71 + cpe:/o:linux:linux_kernel:3.0.40 + cpe:/o:linux:linux_kernel:3.0.41 + cpe:/o:linux:linux_kernel:3.4.45 + cpe:/o:linux:linux_kernel:3.4.44 + cpe:/o:linux:linux_kernel:3.4.46 + cpe:/o:linux:linux_kernel:3.4.41 + cpe:/o:linux:linux_kernel:3.4.40 + cpe:/o:linux:linux_kernel:3.4.43 + cpe:/o:linux:linux_kernel:3.4.42 + cpe:/o:linux:linux_kernel:3.4.49 + cpe:/o:linux:linux_kernel:3.4.48 + cpe:/o:linux:linux_kernel:3.0.59 + cpe:/o:linux:linux_kernel:3.4.47 + cpe:/o:linux:linux_kernel:3.0.55 + cpe:/o:linux:linux_kernel:3.0.56 + cpe:/o:linux:linux_kernel:3.0.57 + cpe:/o:linux:linux_kernel:3.0.58 + cpe:/o:linux:linux_kernel:3.0.51 + cpe:/o:linux:linux_kernel:3.0.52 + cpe:/o:linux:linux_kernel:3.0.53 + cpe:/o:linux:linux_kernel:3.11.10 + cpe:/o:linux:linux_kernel:3.0.50 + cpe:/o:linux:linux_kernel:3.4.57 + cpe:/o:linux:linux_kernel:3.4.56 + cpe:/o:linux:linux_kernel:3.4.55 + cpe:/o:linux:linux_kernel:3.4.54 + cpe:/o:linux:linux_kernel:3.4.53 + cpe:/o:linux:linux_kernel:3.4.52 + cpe:/o:linux:linux_kernel:3.4.51 + cpe:/o:linux:linux_kernel:3.4.50 + cpe:/o:linux:linux_kernel:3.0.43 + cpe:/o:linux:linux_kernel:3.10.26 + cpe:/o:linux:linux_kernel:3.4.59 + cpe:/o:linux:linux_kernel:3.0.24 + cpe:/o:linux:linux_kernel:3.0.25 + cpe:/o:linux:linux_kernel:3.0.22 + cpe:/o:linux:linux_kernel:3.1.9 + cpe:/o:linux:linux_kernel:3.0.23 + cpe:/o:linux:linux_kernel:3.10.28 + cpe:/o:linux:linux_kernel:3.0.28 + cpe:/o:linux:linux_kernel:3.10.27 + cpe:/o:linux:linux_kernel:3.0.26 + cpe:/o:linux:linux_kernel:3.10.29 + cpe:/o:linux:linux_kernel:3.4.58 + cpe:/o:linux:linux_kernel:3.0.27 + cpe:/o:linux:linux_kernel:3.10.24 + cpe:/o:linux:linux_kernel:3.10.23 + cpe:/o:linux:linux_kernel:3.10.25 + cpe:/o:linux:linux_kernel:3.10.20 + cpe:/o:linux:linux_kernel:3.1.8 + cpe:/o:linux:linux_kernel:3.0.20 + cpe:/o:linux:linux_kernel:3.10.22 + cpe:/o:linux:linux_kernel:3.10.21 + cpe:/o:linux:linux_kernel:3.4.21 + cpe:/o:linux:linux_kernel:3.4.20 + cpe:/o:linux:linux_kernel:3.4.23 + cpe:/o:linux:linux_kernel:3.4.22 + cpe:/o:linux:linux_kernel:3.4.24 + cpe:/o:linux:linux_kernel:3.4.27 + cpe:/o:linux:linux_kernel:3.4.26 + cpe:/o:linux:linux_kernel:3.4.29 + cpe:/o:linux:linux_kernel:3.10.15 + cpe:/o:linux:linux_kernel:3.4.28 + cpe:/o:linux:linux_kernel:3.0.54 + cpe:/o:linux:linux_kernel:3.0.33 + cpe:/o:linux:linux_kernel:3.0.34 + cpe:/o:linux:linux_kernel:3.0.35 + cpe:/o:linux:linux_kernel:3.0.36 + cpe:/o:linux:linux_kernel:3.10.19 + cpe:/o:linux:linux_kernel:3.0.37 + cpe:/o:linux:linux_kernel:3.10.18 + cpe:/o:linux:linux_kernel:3.0.38 + cpe:/o:linux:linux_kernel:3.4.25 + cpe:/o:linux:linux_kernel:3.10.17 + cpe:/o:linux:linux_kernel:3.0.39 + cpe:/o:linux:linux_kernel:3.10.16 + cpe:/o:linux:linux_kernel:3.10.14 + cpe:/o:linux:linux_kernel:3.10.13 + cpe:/o:linux:linux_kernel:3.10.12 + cpe:/o:linux:linux_kernel:3.10.11 + cpe:/o:linux:linux_kernel:3.10.10 + cpe:/o:linux:linux_kernel:3.0.30 + cpe:/o:linux:linux_kernel:3.0.31 + cpe:/o:linux:linux_kernel:3.9.8 + cpe:/o:linux:linux_kernel:3.5.5 + cpe:/o:linux:linux_kernel:3.4.32 + cpe:/o:linux:linux_kernel:3.9.9 + cpe:/o:linux:linux_kernel:3.5.6 + cpe:/o:linux:linux_kernel:3.4.31 + cpe:/o:linux:linux_kernel:3.5.7 + cpe:/o:linux:linux_kernel:3.4.30 + cpe:/o:linux:linux_kernel:3.7.1 + cpe:/o:linux:linux_kernel:3.4.35 + cpe:/o:linux:linux_kernel:3.9.0 + cpe:/o:linux:linux_kernel:3.0.18 + cpe:/o:linux:linux_kernel:3.4.34 + cpe:/o:linux:linux_kernel:3.4.33 + cpe:/o:linux:linux_kernel:3.9.2 + cpe:/o:linux:linux_kernel:3.9.1 + cpe:/o:linux:linux_kernel:3.0.19 + cpe:/o:linux:linux_kernel:3.4.39 + cpe:/o:linux:linux_kernel:3.9.4 + cpe:/o:linux:linux_kernel:3.4.38 + cpe:/o:linux:linux_kernel:3.9.3 + cpe:/o:linux:linux_kernel:3.4.37 + cpe:/o:linux:linux_kernel:3.9.6 + cpe:/o:linux:linux_kernel:3.9.5 + cpe:/o:linux:linux_kernel:3.0.21 + cpe:/o:linux:linux_kernel:3.9.7 + cpe:/o:linux:linux_kernel:3.5.4 + cpe:/o:linux:linux_kernel:3.0.4 + cpe:/o:linux:linux_kernel:3.0.5 + cpe:/o:linux:linux_kernel:3.0.2 + cpe:/o:linux:linux_kernel:3.0.3 + cpe:/o:linux:linux_kernel:3.0.8 + cpe:/o:linux:linux_kernel:3.0.6 + cpe:/o:linux:linux_kernel:3.0.7 + cpe:/o:linux:linux_kernel:3.4.36 + cpe:/o:linux:linux_kernel:3.13.1 + cpe:/o:linux:linux_kernel:3.6.10 + cpe:/o:linux:linux_kernel:3.6.11 + cpe:/o:linux:linux_kernel:3.13.6 + cpe:/o:linux:linux_kernel:3.13.4 + cpe:/o:linux:linux_kernel:3.13.5 + cpe:/o:linux:linux_kernel:3.13.2 + cpe:/o:linux:linux_kernel:3.13.3 + cpe:/o:linux:linux_kernel:3.4.1 + cpe:/o:linux:linux_kernel:3.4.19 + cpe:/o:linux:linux_kernel:3.4.17 + cpe:/o:linux:linux_kernel:3.4.3 + cpe:/o:linux:linux_kernel:3.4.18 + cpe:/o:linux:linux_kernel:3.4.2 + cpe:/o:linux:linux_kernel:3.2.9 + cpe:/o:linux:linux_kernel:3.4.15 + cpe:/o:linux:linux_kernel:3.2.8 + cpe:/o:linux:linux_kernel:3.4.16 + cpe:/o:linux:linux_kernel:3.4.4 + cpe:/o:linux:linux_kernel:3.12.12 + cpe:/o:linux:linux_kernel:3.2.7 + cpe:/o:linux:linux_kernel:3.4.13 + cpe:/o:linux:linux_kernel:3.12.13 + cpe:/o:linux:linux_kernel:3.12.10 + cpe:/o:linux:linux_kernel:3.4.11 + cpe:/o:linux:linux_kernel:3.12.11 + cpe:/o:linux:linux_kernel:3.4.12 + cpe:/o:linux:linux_kernel:3.4.10 + cpe:/o:linux:linux_kernel:3.0.61 + cpe:/o:linux:linux_kernel:3.3:rc2 + cpe:/o:linux:linux_kernel:3.4:rc7 + cpe:/o:linux:linux_kernel:3.0.60 + cpe:/o:linux:linux_kernel:3.3:rc7 + cpe:/o:linux:linux_kernel:3.4:rc5 + cpe:/o:linux:linux_kernel:3.3:rc5 + cpe:/o:linux:linux_kernel:3.4:rc6 + cpe:/o:linux:linux_kernel:3.3:rc6 + cpe:/o:linux:linux_kernel:3.0.64 + cpe:/o:linux:linux_kernel:3.0.63 + cpe:/o:linux:linux_kernel:3.0.62 + cpe:/o:linux:linux_kernel:3.12.1 + cpe:/o:linux:linux_kernel:3.0.68 + cpe:/o:linux:linux_kernel:3.0.67 + cpe:/o:linux:linux_kernel:3.0.66 + cpe:/o:linux:linux_kernel:3.4.14 + cpe:/o:linux:linux_kernel:3.12.7 + cpe:/o:linux:linux_kernel:3.2:rc2 + cpe:/o:linux:linux_kernel:3.1:rc1 + cpe:/o:linux:linux_kernel:3.0.9 + cpe:/o:linux:linux_kernel:3.0:rc4 + cpe:/o:linux:linux_kernel:3.12.8 + cpe:/o:linux:linux_kernel:3.1:rc4 + cpe:/o:linux:linux_kernel:3.0:rc3 + cpe:/o:linux:linux_kernel:3.12.9 + cpe:/o:linux:linux_kernel:3.0:rc2 + cpe:/o:linux:linux_kernel:3.1:rc2 + cpe:/o:linux:linux_kernel:3.0:rc1 + cpe:/o:linux:linux_kernel:3.2:rc7 + cpe:/o:linux:linux_kernel:3.12.3 + cpe:/o:linux:linux_kernel:3.1.10 + cpe:/o:linux:linux_kernel:3.2:rc6 + cpe:/o:linux:linux_kernel:3.12.4 + cpe:/o:linux:linux_kernel:3.0:rc7 + cpe:/o:linux:linux_kernel:3.2:rc5 + cpe:/o:linux:linux_kernel:3.12.5 + cpe:/o:linux:linux_kernel:3.9:rc3 + cpe:/o:linux:linux_kernel:3.0:rc6 + cpe:/o:linux:linux_kernel:3.12.6 + cpe:/o:linux:linux_kernel:3.0:rc5 + cpe:/o:linux:linux_kernel:3.9:rc1 + cpe:/o:linux:linux_kernel:3.9:rc4 + cpe:/o:linux:linux_kernel:3.9:rc7 + cpe:/o:linux:linux_kernel:3.12.2 + cpe:/o:linux:linux_kernel:3.9:rc2 + cpe:/o:linux:linux_kernel:3.9:rc5 + cpe:/o:linux:linux_kernel:3.3:rc3 + cpe:/o:linux:linux_kernel:3.4:rc4 + cpe:/o:linux:linux_kernel:3.4:rc3 + cpe:/o:linux:linux_kernel:3.3:rc1 + cpe:/o:linux:linux_kernel:3.4:rc2 + cpe:/o:linux:linux_kernel:3.9:rc6 + cpe:/o:linux:linux_kernel:3.3:rc4 + cpe:/o:linux:linux_kernel:3.4:rc1 + cpe:/o:linux:linux_kernel:3.4.5 + cpe:/o:linux:linux_kernel:3.2.2 + cpe:/o:linux:linux_kernel:3.2.3 + cpe:/o:linux:linux_kernel:3.2.1 + cpe:/o:linux:linux_kernel:3.4.6 + cpe:/o:linux:linux_kernel:3.2:rc3 + cpe:/o:linux:linux_kernel:3.2.6 + cpe:/o:linux:linux_kernel:3.4.7 + cpe:/o:linux:linux_kernel:3.2:rc4 + cpe:/o:linux:linux_kernel:3.1:rc3 + cpe:/o:linux:linux_kernel:3.4.8 + cpe:/o:linux:linux_kernel:3.2.4 + cpe:/o:linux:linux_kernel:3.4.9 + cpe:/o:linux:linux_kernel:3.2.5 + cpe:/o:linux:linux_kernel:3.0.65 + cpe:/o:linux:linux_kernel:3.2.12 + cpe:/o:linux:linux_kernel:3.8.10 + cpe:/o:linux:linux_kernel:3.8.12 + cpe:/o:linux:linux_kernel:3.8.11 + cpe:/o:linux:linux_kernel:3.8.13 + cpe:/o:linux:linux_kernel:3.7.9 + cpe:/o:linux:linux_kernel:3.7.8 + cpe:/o:linux:linux_kernel:3.7.7 + cpe:/o:linux:linux_kernel:3.7.6 + cpe:/o:linux:linux_kernel:3.6.3 + cpe:/o:linux:linux_kernel:3.7.5 + cpe:/o:linux:linux_kernel:3.7.4 + cpe:/o:linux:linux_kernel:3.7.3 + cpe:/o:linux:linux_kernel:3.7.2 + cpe:/o:linux:linux_kernel:3.6.7 + cpe:/o:linux:linux_kernel:3.6.6 + cpe:/o:linux:linux_kernel:3.6.5 + cpe:/o:linux:linux_kernel:3.6.4 + cpe:/o:linux:linux_kernel:3.6.9 + cpe:/o:linux:linux_kernel:3.6.8 + cpe:/o:linux:linux_kernel:3.10 + cpe:/o:linux:linux_kernel:3.11 + cpe:/o:linux:linux_kernel:3.12 + cpe:/o:linux:linux_kernel:3.13 + cpe:/o:linux:linux_kernel:3.10.1 + cpe:/o:linux:linux_kernel:3.10.2 + cpe:/o:linux:linux_kernel:3.10.3 + cpe:/o:linux:linux_kernel:3.6.2 + cpe:/o:linux:linux_kernel:3.6.1 + cpe:/o:linux:linux_kernel:3.3.6 + cpe:/o:linux:linux_kernel:3.3.7 + cpe:/o:linux:linux_kernel:3.3.8 + cpe:/o:linux:linux_kernel:3.0.1 + cpe:/o:linux:linux_kernel:3.2 + cpe:/o:linux:linux_kernel:3.1 + cpe:/o:linux:linux_kernel:3.7 + cpe:/o:linux:linux_kernel:3.6 + cpe:/o:linux:linux_kernel:3.4 + cpe:/o:linux:linux_kernel:3.1.6 + cpe:/o:linux:linux_kernel:3.1.5 + cpe:/o:linux:linux_kernel:3.1.7 + cpe:/o:linux:linux_kernel:3.0.32 + cpe:/o:linux:linux_kernel:3.8.9 + cpe:/o:linux:linux_kernel:3.1.2 + cpe:/o:linux:linux_kernel:3.1.1 + cpe:/o:linux:linux_kernel:3.1.4 + cpe:/o:linux:linux_kernel:3.1.3 + cpe:/o:linux:linux_kernel:3.9.10 + cpe:/o:linux:linux_kernel:3.0.29 + cpe:/o:linux:linux_kernel:3.3 + cpe:/o:linux:linux_kernel:3.8.4 + cpe:/o:linux:linux_kernel:3.2.26 + cpe:/o:linux:linux_kernel:3.8.5 + cpe:/o:linux:linux_kernel:3.2.27 + cpe:/o:linux:linux_kernel:3.8.2 + cpe:/o:linux:linux_kernel:3.2.24 + cpe:/o:linux:linux_kernel:3.8.3 + cpe:/o:linux:linux_kernel:3.2.25 + cpe:/o:linux:linux_kernel:3.8.8 + cpe:/o:linux:linux_kernel:3.8.6 + cpe:/o:linux:linux_kernel:3.2.28 + cpe:/o:linux:linux_kernel:3.8.7 + cpe:/o:linux:linux_kernel:3.2.29 + cpe:/o:linux:linux_kernel:3.3.3 + cpe:/o:linux:linux_kernel:3.3.4 + cpe:/o:linux:linux_kernel:3.3.5 + cpe:/o:linux:linux_kernel:3.2.22 + cpe:/o:linux:linux_kernel:3.8.1 + cpe:/o:linux:linux_kernel:3.2.20 + cpe:/o:linux:linux_kernel:3.3.1 + cpe:/o:linux:linux_kernel:3.2.21 + cpe:/o:linux:linux_kernel:3.3.2 + cpe:/o:linux:linux_kernel:3.11.1 + cpe:/o:linux:linux_kernel:3.11.2 + cpe:/o:linux:linux_kernel:3.2.23 + cpe:/o:linux:linux_kernel:3.0.17 + cpe:/o:linux:linux_kernel:3.9.11 + cpe:/o:linux:linux_kernel:3.0.16 + cpe:/o:linux:linux_kernel:3.0.15 + cpe:/o:linux:linux_kernel:3.2.30 + cpe:/o:linux:linux_kernel:3.0.14 + cpe:/o:linux:linux_kernel:3.0.13 + cpe:/o:linux:linux_kernel:3.0.12 + cpe:/o:linux:linux_kernel:3.0.11 + cpe:/o:linux:linux_kernel:3.4.61 + cpe:/o:linux:linux_kernel:3.0.10 + cpe:/o:linux:linux_kernel:3.4.64 + cpe:/o:linux:linux_kernel:3.8.0 + cpe:/o:linux:linux_kernel:3.4.65 + cpe:/o:linux:linux_kernel:3.4.62 + cpe:/o:linux:linux_kernel:3.4.63 + cpe:/o:linux:linux_kernel:3.4.68 + cpe:/o:linux:linux_kernel:3.4.66 + cpe:/o:linux:linux_kernel:3.4.67 + cpe:/o:linux:linux_kernel:3.5.3 + cpe:/o:linux:linux_kernel:3.5.1 + cpe:/o:linux:linux_kernel:3.5.2 + cpe:/o:linux:linux_kernel:3.10.4 + cpe:/o:linux:linux_kernel:3.4.72 + cpe:/o:linux:linux_kernel:3.10.9 + cpe:/o:linux:linux_kernel:3.4.73 + cpe:/o:linux:linux_kernel:3.4.74 + cpe:/o:linux:linux_kernel:3.4.75 + cpe:/o:linux:linux_kernel:3.4.76 + cpe:/o:linux:linux_kernel:3.10.5 + cpe:/o:linux:linux_kernel:3.4.77 + cpe:/o:linux:linux_kernel:3.10.6 + cpe:/o:linux:linux_kernel:3.4.78 + cpe:/o:linux:linux_kernel:3.10.7 + cpe:/o:linux:linux_kernel:3.4.79 + cpe:/o:linux:linux_kernel:3.10.8 + cpe:/o:linux:linux_kernel:3.7.10 + cpe:/o:linux:linux_kernel:3.2.17 + cpe:/o:linux:linux_kernel:3.2.18 + cpe:/o:linux:linux_kernel:3.2.19 + cpe:/o:linux:linux_kernel:3.2.13 + cpe:/o:linux:linux_kernel:3.2.14 + cpe:/o:linux:linux_kernel:3.11.3 + cpe:/o:linux:linux_kernel:3.2.15 + cpe:/o:linux:linux_kernel:3.4.60 + cpe:/o:linux:linux_kernel:3.2.16 + cpe:/o:linux:linux_kernel:3.11.5 + cpe:/o:linux:linux_kernel:3.11.4 + cpe:/o:linux:linux_kernel:3.2.10 + cpe:/o:linux:linux_kernel:3.11.7 + cpe:/o:linux:linux_kernel:3.2.11 + cpe:/o:linux:linux_kernel:3.11.6 + cpe:/o:linux:linux_kernel:3.11.9 + cpe:/o:linux:linux_kernel:3.11.8 + cpe:/o:linux:linux_kernel:3.4.69 + + CVE-2014-2568 + 2014-03-24T12:40:48.403-04:00 + 2014-04-01T02:29:38.720-04:00 + + + 2.9 + ADJACENT_NETWORK + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-03-24T13:35:35.553-04:00 + + + + + MLIST + [oss-security] 20140320 Re: CVE request -- kernel: net: potential information leak when ubuf backed skbs are skb_zerocopy()ied + + + MLIST + [linux-kernel] 20140320 [PATCH v3] core, nfqueue, openvswitch: Orphan frags in skb_zerocopy and handle errors + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1079012 + + + XF + linux-kernel-cve20142568-info-disclosure(91922) + + + BID + 66348 + + + MLIST + [oss-sec] 20140320 CVE request -- kernel: net: potential information leak when ubuf backed skbs are skb_zerocopy()ied + + Use-after-free vulnerability in the nfqnl_zcopy function in net/netfilter/nfnetlink_queue_core.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation. NOTE: the affected code was moved to the skb_zerocopy function in net/core/skbuff.c before the vulnerability was announced. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:moodle:moodle:2.1.6 + cpe:/a:moodle:moodle:2.0.4 + cpe:/a:moodle:moodle:2.5.4 + cpe:/a:moodle:moodle:2.1.7 + cpe:/a:moodle:moodle:2.0.3 + cpe:/a:moodle:moodle:2.1.4 + cpe:/a:moodle:moodle:2.0.2 + cpe:/a:moodle:moodle:2.1.5 + cpe:/a:moodle:moodle:2.1.2 + cpe:/a:moodle:moodle:2.0.8 + cpe:/a:moodle:moodle:2.1.3 + cpe:/a:moodle:moodle:2.0.7 + cpe:/a:moodle:moodle:2.4.5 + cpe:/a:moodle:moodle:2.0.6 + cpe:/a:moodle:moodle:2.0.5 + cpe:/a:moodle:moodle:2.1.1 + cpe:/a:moodle:moodle:2.4.2 + cpe:/a:moodle:moodle:2.4.1 + cpe:/a:moodle:moodle:2.4.4 + cpe:/a:moodle:moodle:2.0.9 + cpe:/a:moodle:moodle:2.4.3 + cpe:/a:moodle:moodle:2.5.1 + cpe:/a:moodle:moodle:2.1.8 + cpe:/a:moodle:moodle:2.5.2 + cpe:/a:moodle:moodle:2.5.3 + cpe:/a:moodle:moodle:2.3.7 + cpe:/a:moodle:moodle:2.3.8 + cpe:/a:moodle:moodle:2.0.1 + cpe:/a:moodle:moodle:2.3.9 + cpe:/a:moodle:moodle:2.2.8 + cpe:/a:moodle:moodle:2.2.9 + cpe:/a:moodle:moodle:2.3.1 + cpe:/a:moodle:moodle:2.1.10 + cpe:/a:moodle:moodle:2.3.4 + cpe:/a:moodle:moodle:2.3.5 + cpe:/a:moodle:moodle:2.3.2 + cpe:/a:moodle:moodle:2.3.3 + cpe:/a:moodle:moodle:2.3.6 + cpe:/a:moodle:moodle:2.2.2 + cpe:/a:moodle:moodle:2.2.1 + cpe:/a:moodle:moodle:2.2.11 + cpe:/a:moodle:moodle:2.2.4 + cpe:/a:moodle:moodle:2.3.11 + cpe:/a:moodle:moodle:2.2.3 + cpe:/a:moodle:moodle:2.2.6 + cpe:/a:moodle:moodle:2.2.5 + cpe:/a:moodle:moodle:2.2.7 + cpe:/a:moodle:moodle:2.3 + cpe:/a:moodle:moodle:2.0 + cpe:/a:moodle:moodle:2.6.1 + cpe:/a:moodle:moodle:2.4.6 + cpe:/a:moodle:moodle:2.2 + cpe:/a:moodle:moodle:2.4.7 + cpe:/a:moodle:moodle:2.4.8 + cpe:/a:moodle:moodle:2.1.9 + cpe:/a:moodle:moodle:2.1 + cpe:/a:moodle:moodle:2.2.10 + cpe:/a:moodle:moodle:2.3.10 + cpe:/a:moodle:moodle:2.4 + cpe:/a:moodle:moodle:2.6 + cpe:/a:moodle:moodle:2.5 + + CVE-2014-2571 + 2014-03-24T10:20:39.620-04:00 + 2014-03-24T18:24:29.983-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-24T11:55:41.627-04:00 + + + + + CONFIRM + https://moodle.org/mod/forum/discuss.php?d=256416 + + + MLIST + [oss-security] 20140317 Moodle security notifications public + + + CONFIRM + http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43690 + + Cross-site scripting (XSS) vulnerability in the quiz_question_tostring function in mod/quiz/editlib.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote authenticated users to inject arbitrary web script or HTML via a quiz question. + + + + + + + + + + cpe:/a:moodle:moodle:2.6.1 + cpe:/a:moodle:moodle:2.6 + + CVE-2014-2572 + 2014-03-24T10:20:39.650-04:00 + 2014-03-24T18:29:58.227-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-24T12:00:29.167-04:00 + + + + + CONFIRM + https://moodle.org/mod/forum/discuss.php?d=256425 + + + MLIST + [oss-security] 20140317 Moodle security notifications public + + + CONFIRM + http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43468 + + mod/assign/externallib.php in Moodle 2.6.x before 2.6.2 does not properly handle assignment web-service parameters, which might allow remote authenticated users to modify grade metadata via unspecified vectors. + + + + + + + + + + + cpe:/a:openstack:compute:2013.2 + cpe:/a:openstack:compute:2013.2.1 + cpe:/a:openstack:compute:2013.2.2 + + CVE-2014-2573 + 2014-03-25T12:55:28.677-04:00 + 2014-03-26T09:41:06.717-04:00 + + + 2.3 + ADJACENT_NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-03-26T09:41:05.607-04:00 + + + + + CONFIRM + https://bugs.launchpad.net/nova/+bug/1269418 + + + MLIST + [oss-security] 20140321 Re: CVE request for vulnerability in OpenStack Nova + + + MLIST + [oss-security] 20140321 CVE request for vulnerability in OpenStack Nova + + + SECUNIA + 57498 + + The VMWare driver in OpenStack Compute (Nova) 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by requesting the VM be put into rescue and then deleting the image. + + + + + + + + + + + + + + + + cpe:/a:splunk:splunk:5.0.6 + cpe:/a:splunk:splunk:5.0.7 + cpe:/a:splunk:splunk:5.0.2 + cpe:/a:splunk:splunk:5.0.3 + cpe:/a:splunk:splunk:5.0 + cpe:/a:splunk:splunk:5.0.4 + cpe:/a:splunk:splunk:5.0.5 + cpe:/a:splunk:splunk:5.0.1 + + CVE-2014-2578 + 2014-04-02T12:06:02.190-04:00 + 2014-04-02T14:19:07.710-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-02T14:19:07.647-04:00 + + + + + XF + splunk-cve20142578-xss(92126) + + + CONFIRM + http://www.splunk.com/view/SP-CAAAKQX + + + SECTRACK + 1029966 + + + SECUNIA + 57554 + + Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk before 5.0.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + cpe:/a:xcloner:xcloner:3.5::standalone + + CVE-2014-2579 + 2014-04-25T16:55:03.007-04:00 + 2014-04-28T08:01:35.070-04:00 + + + 7.6 + NETWORK + HIGH + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-28T08:01:34.070-04:00 + + + + + MISC + https://www.htbridge.com/advisory/HTB23207 + + + BUGTRAQ + 20140409 &ETH;&iexcl;ross-Site Request Forgery (CSRF) in XCloner Standalone + + + EXPLOIT-DB + 32790 + + Multiple cross-site request forgery (CSRF) vulnerabilities in XCloner Standalone 3.5 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) change the administrator password via the config task to index2.php or (2) when the enable_db_backup and sql_mem options are enabled, access the database backup functionality via the dbbackup_comp parameter in the generate action to index2.php. NOTE: vector 2 might be a duplicate of CVE-2014-2340, which is for the XCloner Wordpress plugin. NOTE: remote attackers can leverage CVE-2014-2996 with vector 2 to execute arbitrary commands. + + + + + + + + + cpe:/o:xen:xen:- + + CVE-2014-2580 + 2014-04-15T19:13:13.337-04:00 + 2014-04-16T09:57:39.067-04:00 + + + 4.4 + LOCAL + MEDIUM + SINGLE_INSTANCE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-16T09:57:38.987-04:00 + + + + + CONFIRM + http://xenbits.xen.org/xsa/advisory-90.html + + + SECTRACK + 1029949 + + + BID + 66386 + + + MLIST + [oss-security] 20140324 Re: Xen Security Advisory 90 - Linux netback crash trying to disable due to malformed packet + + + MLIST + [oss-security] 20140324 Xen Security Advisory 90 - Linux netback crash trying to disable due to malformed packet + + The netback driver in Xen, when using certain Linux versions that do not allow sleeping in softirq context, allows local guest administrators to cause a denial of service ("scheduling while atomic" error and host crash) via a malformed packet, which causes a mutex to be taken when trying to disable the interface. + + + + + + + + + cpe:/a:kernel:linux-pam:1.1.8 + + CVE-2014-2583 + 2014-04-10T16:29:20.707-04:00 + 2014-04-11T11:51:15.167-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-11T11:50:40.357-04:00 + + + + + CONFIRM + https://git.fedorahosted.org/cgit/linux-pam.git/commit/?id=Linux-PAM-1_1_8-32-g9dcead8 + + + BID + 66493 + + + MLIST + [oss-security] 20140331 Re: pam_timestamp internals + + + MLIST + [oss-security] 20140326 Re: pam_timestamp internals + + + MLIST + [oss-security] 20140324 pam_timestamp internals + + + SECUNIA + 57317 + + Multiple directory traversal vulnerabilities in pam_timestamp.c in the pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to create aribitrary files or possibly bypass authentication via a .. (dot dot) in the (1) PAM_RUSER value to the get_ruser function or (2) PAM_TTY value to the check_tty funtion, which is used by the format_timestamp_name function. + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:owncloud:owncloud:6.0.1 + cpe:/a:owncloud:owncloud:5.0.13 + cpe:/a:owncloud:owncloud:5.0.14 + cpe:/a:owncloud:owncloud:5.0.12 + cpe:/a:owncloud:owncloud:5.0.0 + cpe:/a:owncloud:owncloud:5.0.1 + cpe:/a:owncloud:owncloud:5.0.14:a + cpe:/a:owncloud:owncloud:5.0.10 + cpe:/a:owncloud:owncloud:5.0.6 + cpe:/a:owncloud:owncloud:5.0.9 + cpe:/a:owncloud:owncloud:5.0.5 + cpe:/a:owncloud:owncloud:5.0.8 + cpe:/a:owncloud:owncloud:5.0.4 + cpe:/a:owncloud:owncloud:5.0.7 + cpe:/a:owncloud:owncloud:5.0.3 + cpe:/a:owncloud:owncloud:5.0.11 + cpe:/a:owncloud:owncloud:5.0.2 + cpe:/a:owncloud:owncloud:6.0.0 + + CVE-2014-2585 + 2014-03-24T12:35:49.380-04:00 + 2014-03-24T13:10:35.567-04:00 + + + 4.9 + NETWORK + MEDIUM + SINGLE_INSTANCE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-24T13:10:16.630-04:00 + + + + + CONFIRM + http://owncloud.org/about/security/advisories/oC-SA-2014-008/ + + ownCloud before 5.0.15 and 6.x before 6.0.2, when the file_external app is enabled, allows remote authenticated users to mount the local filesystem in the user's ownCloud via the mount configuration. + + + + + + + + + cpe:/a:mcafee:cloud_single_sign_on:- + + CVE-2014-2586 + 2014-03-24T12:38:59.713-04:00 + 2014-03-24T18:15:40.043-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-24T13:20:15.733-04:00 + + + + + MISC + https://twitter.com/BrandonPrry/status/445969380656943104 + + + BID + 66302 + + + EXPLOIT-DB + 32368 + + + FULLDISC + 20140318 McAfee Cloud SSO and McAfee Asset Manager vulns + + + MISC + http://packetstormsecurity.com/files/125775/McAfee-Cloud-SSO-Asset-Manager-Issues.html + + Cross-site scripting (XSS) vulnerability in the login audit form in McAfee Cloud Single Sign On (SSO) allows remote attackers to inject arbitrary web script or HTML via a crafted password. + + + + + + + + + cpe:/a:mcafee:asset_manager:6.6 + + CVE-2014-2587 + 2014-03-24T12:38:59.947-04:00 + 2014-04-01T02:29:39.203-04:00 + + + 6.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-24T13:17:08.823-04:00 + + + + + XF + mcafee-asset-reportsaudit-sql-injection(91929) + + + SECTRACK + 1029927 + + + BID + 66302 + + + OSVDB + 104634 + + + EXPLOIT-DB + 32368 + + + FULLDISC + 20140318 McAfee Cloud SSO and McAfee Asset Manager vulns + + + MISC + http://packetstormsecurity.com/files/125775/McAfee-Cloud-SSO-Asset-Manager-Issues.html + + SQL injection vulnerability in jsp/reports/ReportsAudit.jsp in McAfee Asset Manager 6.6 allows remote authenticated users to execute arbitrary SQL commands via the username of an audit report (aka user parameter). + + + + + + + + + cpe:/a:mcafee:asset_manager:6.6 + + CVE-2014-2588 + 2014-03-24T12:38:59.963-04:00 + 2014-04-01T02:29:39.283-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-03-24T13:19:18.983-04:00 + + + + + XF + mcafee-asset-dir-traversal(91930) + + + SECTRACK + 1029927 + + + BID + 66302 + + + OSVDB + 104633 + + + EXPLOIT-DB + 32368 + + + FULLDISC + 20140318 McAfee Cloud SSO and McAfee Asset Manager vulns + + + MISC + http://packetstormsecurity.com/files/125775/McAfee-Cloud-SSO-Asset-Manager-Issues.html + + Directory traversal vulnerability in servlet/downloadReport in McAfee Asset Manager 6.6 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the reportFileName parameter. + + + + + + + + + cpe:/h:dell:sonicwall_network_security_appliance_2400:- + + CVE-2014-2589 + 2014-03-24T12:39:00.353-04:00 + 2014-03-24T13:40:13.407-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-24T13:40:01.640-04:00 + + + + + XF + sonicwall-nsa-dashboard-xss(91766) + + + MISC + http://www.vulnerability-lab.com/get_content.php?id=1100 + + + SECTRACK + 1029884 + + + BID + 66042 + + + BUGTRAQ + 20140306 SonicWall Dashboard Backend Server - Client Side Cross Site Scripting Web Vulnerability + + + OSVDB + 104089 + + + SECUNIA + 57275 + + Cross-site scripting (XSS) vulnerability in the Dashboard Backend service (stats/dashboard.jsp) in SonicWall Network Security Appliance (NSA) 2400 allows remote attackers to inject arbitrary web script or HTML via the sn parameter. + + + + + + + + + + + + + + + + + + + + cpe:/o:siemens:ruggedcom_rugged_operating_system:3.3.6 + cpe:/o:siemens:ruggedcom_rugged_operating_system:4.0::~~~~rsg2488~ + cpe:/o:siemens:ruggedcom_rugged_operating_system:3.7.9 + cpe:/o:siemens:ruggedcom_rugged_operating_system:3.5.4 + cpe:/o:siemens:ruggedcom_rugged_operating_system:3.4.9 + cpe:/o:siemens:ruggedcom_rugged_operating_system:3.8.5 + cpe:/o:siemens:ruggedcom_rugged_operating_system:3.10.1 + cpe:/o:siemens:ruggedcom_rugged_operating_system:3.9.3 + cpe:/o:siemens:ruggedcom_rugged_operating_system:3.12 + cpe:/o:siemens:ruggedcom_rugged_operating_system:3.6.6 + cpe:/o:siemens:ruggedcom_rugged_operating_system:3.11::~~~~rs950g~ + cpe:/o:siemens:ruggedcom_rugged_operating_system:3.2.5 + + CVE-2014-2590 + 2014-04-01T02:29:39.423-04:00 + 2014-04-01T10:25:17.387-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-01T10:25:14.103-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-087-01 + + + CONFIRM + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-831997.pdf + + The web management interface in Siemens RuggedCom ROS before 3.11, ROS 3.11 before 3.11.5 for RS950G, ROS 3.12, and ROS 4.0 for RSG2488 allows remote attackers to cause a denial of service (interface outage) via crafted HTTP packets. + + + + + + + + + + cpe:/a:remote-rac:rac_server:4.0.4 + cpe:/a:remote-rac:rac_server:4.0.5 + + CVE-2014-2597 + 2014-04-18T18:14:38.730-04:00 + 2014-04-21T14:15:30.817-04:00 + + + 4.9 + LOCAL + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-21T14:15:30.770-04:00 + + + + + MISC + https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2597/ + + + SECUNIA + 58090 + + + FULLDISC + 20140416 CVE-2014-2597 - Denial of Service in PCNetSoftware RAC Server + + PCNetSoftware RAC Server 4.0.4 and 4.0.5 allows local users to cause a denial of service (disabled keyboard or crash) via a large input buffer to unspecified IOCTL requests in RACDriver.sys, which triggers a buffer over-read. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:xen:xen:4.1.5 + cpe:/o:xen:xen:4.1.4 + cpe:/o:xen:xen:4.3.2 + cpe:/o:xen:xen:4.2.3 + cpe:/o:xen:xen:4.2.1 + cpe:/o:xen:xen:4.2.2 + cpe:/o:xen:xen:4.1.6.1 + cpe:/o:xen:xen:4.2.0 + cpe:/o:xen:xen:4.3.0 + cpe:/o:xen:xen:4.3.1 + cpe:/o:xen:xen:4.1.6.1::~~x86~~~ + cpe:/o:xen:xen:4.4.0 + cpe:/o:xen:xen:4.1.5::~~x86~~~ + cpe:/o:xen:xen:4.1.3::~~x86~~~ + cpe:/o:xen:xen:4.1.4::~~x86~~~ + cpe:/o:xen:xen:4.1.1::~~x86~~~ + cpe:/o:xen:xen:4.1.2 + cpe:/o:xen:xen:4.1.2::~~x86~~~ + cpe:/o:xen:xen:4.1.3 + cpe:/o:xen:xen:4.1.0 + cpe:/o:xen:xen:4.1.0::~~x86~~~ + cpe:/o:xen:xen:4.1.1 + + CVE-2014-2599 + 2014-03-28T11:55:08.890-04:00 + 2014-03-31T11:49:18.393-04:00 + + + 4.9 + LOCAL + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-03-31T11:49:18.250-04:00 + + + + + CONFIRM + http://xenbits.xen.org/xsa/advisory-89.html + + + SECTRACK + 1029956 + + + BID + 66407 + + + MLIST + [oss-security] 20140325 Re: Xen Security Advisory 89 - HVMOP_set_mem_access is not preemptible + + + MLIST + [oss-security] 20140325 Xen Security Advisory 89 - HVMOP_set_mem_access is not preemptible + + The HVMOP_set_mem_access HVM control operations in Xen 4.1.x for 32-bit and 4.1.x through 4.4.x for 64-bit allow local guest administrators to cause a denial of service (CPU consumption) by leveraging access to certain service domains for HVM guests and a large input. + + + + + + + + + + + + cpe:/a:hp:icewall_identity_manager:5.0 + cpe:/a:hp:icewall_identity_manager:4.0:sp1 + cpe:/a:hp:icewall_identity_manager:4.0 + cpe:/a:hp:icewall_sso_password_reset_option:10.0 + + CVE-2014-2600 + 2014-04-05T10:55:03.823-04:00 + 2014-04-07T10:57:43.837-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-07T10:57:43.773-04:00 + + + + HP + SSRT101450 + + + HP + HPSBGN02986 + + Unspecified vulnerability in HP IceWall Identity Manager 4.0 through SP1 and 5.0 and IceWall SSO 10.0 Password Reset Option, when Apache Commons FileUpload is used, allows remote authenticated users to cause a denial of service via unknown vectors. + + + + + + + + + + + + + + + + + + + cpe:/o:hp:integrated_lights-out_2_firmware:1.75 + cpe:/o:hp:integrated_lights-out_2_firmware:1.30 + cpe:/o:hp:integrated_lights-out_2_firmware:1.20 + cpe:/o:hp:integrated_lights-out_2_firmware:1.00 + cpe:/o:hp:integrated_lights-out_2_firmware:1.10 + cpe:/o:hp:integrated_lights-out_2_firmware:2.22 + cpe:/o:hp:integrated_lights-out_2_firmware:2.23 + cpe:/o:hp:integrated_lights-out_2_firmware:2.20 + cpe:/o:hp:integrated_lights-out_2_firmware:2.12 + cpe:/o:hp:integrated_lights-out_2_firmware:2.15 + cpe:/o:hp:integrated_lights-out_2_firmware:1.70 + + CVE-2014-2601 + 2014-04-24T19:55:05.580-04:00 + 2014-04-25T09:20:31.153-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-25T09:20:31.043-04:00 + + + + HP + SSRT101509 + + + HP + HPSBHF03006 + + The server in HP Integrated Lights-Out 2 (aka iLO 2) 2.23 and earlier allows remote attackers to cause a denial of service via crafted HTTPS traffic, as demonstrated by traffic from a CVE-2014-0160 vulnerability-assessment tool. + + + + + + + + + + + + + + + cpe:/a:openbsd:openssh:6.4 + cpe:/a:openbsd:openssh:6.5 + cpe:/a:openbsd:openssh:6.6 + cpe:/a:openbsd:openssh:6.0 + cpe:/a:openbsd:openssh:6.1 + cpe:/a:openbsd:openssh:6.2 + cpe:/a:openbsd:openssh:6.3 + + CVE-2014-2653 + 2014-03-27T06:55:04.513-04:00 + 2014-04-19T00:48:42.270-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-27T11:42:34.657-04:00 + + + + + CONFIRM + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742513 + + + UBUNTU + USN-2164-1 + + + DEBIAN + DSA-2894 + + + MLIST + [oss-security] 20140326 CVE request: openssh client does not check SSHFP if server offers certificate + + The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate. + + + + + + + + + cpe:/a:mobfox:madserve:2.0 + + CVE-2014-2654 + 2014-04-22T10:23:35.440-04:00 + 2014-04-23T08:41:39.547-04:00 + + + 6.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-23T08:41:39.500-04:00 + + + + + MISC + https://www.htbridge.com/advisory/HTB23209 + + + XF + madserve-cve20142654-sql-injection(92545) + + + BID + 66661 + + + BUGTRAQ + 20140416 SQL Injection in mAdserve + + + SECUNIA + 58003 + + Multiple SQL injection vulnerabilities in MobFox mAdserve 2.0 and earlier allow remote authenticated users to execute arbitrary SQL commands via the id parameter to (1) edit_ad_unit.php, (2) view_adunits.php, or (3) edit_campaign.php in www/cp/. + + + + + + + + + + + + + + + + cpe:/a:postfix_admin_project:postfix_admin:2.2.1.1 + cpe:/a:postfix_admin_project:postfix_admin:2.3 + cpe:/a:postfix_admin_project:postfix_admin:2.3.1 + cpe:/a:postfix_admin_project:postfix_admin:2.3.3 + cpe:/a:postfix_admin_project:postfix_admin:2.3.2 + cpe:/a:postfix_admin_project:postfix_admin:2.3.5 + cpe:/a:postfix_admin_project:postfix_admin:2.3.4 + cpe:/a:postfix_admin_project:postfix_admin:2.3.6 + + CVE-2014-2655 + 2014-04-02T12:06:02.253-04:00 + 2014-04-19T00:48:42.380-04:00 + + + 6.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-03T10:12:09.657-04:00 + + + + + CONFIRM + http://sourceforge.net/p/postfixadmin/code/1650 + + + BID + 66455 + + + MLIST + [oss-security] 20140326 CVE request: postfixadmin SQL injection vulnerability + + + MLIST + [oss-security] 20140326 Re: CVE request: postfixadmin SQL injection vulnerability + + + DEBIAN + DSA-2889 + + SQL injection vulnerability in the gen_show_status function in functions.inc.php in Postfix Admin (aka postfixadmin) before 2.3.7 allows remote authenticated users to execute arbitrary SQL commands via a new alias. + + + + + + + + + cpe:/a:papercut:papercut_mf:14.1 + + CVE-2014-2657 + 2014-04-28T10:09:07.080-04:00 + 2014-04-29T09:08:14.863-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-29T09:08:14.817-04:00 + + + + XF + papercut-cve20142657-unspec(92650) + + + CONFIRM + http://www.papercut-mf.com/release-history/ + + Unspecified vulnerability in the print release functionality in PaperCut MF 14.1 (Build 26983) has unknown impact and remote vectors, related to embedded MFPs. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:papercut:papercut_mf:14.0 + cpe:/a:papercut:papercut_mf:14.1 + cpe:/a:papercut:papercut_mf:13.0 + cpe:/a:papercut:papercut_ng:13.5 + cpe:/a:papercut:papercut_mf:13.2 + cpe:/a:papercut:papercut_ng:13.4 + cpe:/a:papercut:papercut_ng:12.4 + cpe:/a:papercut:papercut_mf:13.1 + cpe:/a:papercut:papercut_ng:12.2 + cpe:/a:papercut:papercut_ng:12.3 + cpe:/a:papercut:papercut_mf:13.3 + cpe:/a:papercut:papercut_ng:12.0 + cpe:/a:papercut:papercut_ng:12.1 + cpe:/a:papercut:papercut_mf:12.5 + cpe:/a:papercut:papercut_ng:14.0 + cpe:/a:papercut:papercut_ng:14.1 + cpe:/a:papercut:papercut_ng:13.2 + cpe:/a:papercut:papercut_mf:12.4 + cpe:/a:papercut:papercut_ng:13.1 + cpe:/a:papercut:papercut_ng:13.0 + cpe:/a:papercut:papercut_mf:12.0 + cpe:/a:papercut:papercut_mf:12.1 + cpe:/a:papercut:papercut_mf:12.2 + cpe:/a:papercut:papercut_ng:13.3 + cpe:/a:papercut:papercut_mf:12.3 + cpe:/a:papercut:papercut_ng:12.5 + cpe:/a:papercut:papercut_mf:13.5 + cpe:/a:papercut:papercut_mf:13.4 + + CVE-2014-2658 + 2014-04-28T10:09:07.517-04:00 + 2014-04-29T09:03:33.383-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-29T09:03:33.070-04:00 + + + + XF + papercut-cve20142658-dos(92649) + + + CONFIRM + http://www.papercut.com/release-history/ + + + CONFIRM + http://www.papercut-mf.com/release-history/ + + + SECUNIA + 58037 + + Unspecified vulnerability in Papercut MF and NG before 14.1 (Build 26983) allows attacker to cause a denial of service via unknown vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:papercut:papercut_mf:14.0 + cpe:/a:papercut:papercut_mf:14.1 + cpe:/a:papercut:papercut_mf:13.0 + cpe:/a:papercut:papercut_ng:13.5 + cpe:/a:papercut:papercut_mf:13.2 + cpe:/a:papercut:papercut_ng:13.4 + cpe:/a:papercut:papercut_ng:12.4 + cpe:/a:papercut:papercut_mf:13.1 + cpe:/a:papercut:papercut_ng:12.2 + cpe:/a:papercut:papercut_ng:12.3 + cpe:/a:papercut:papercut_mf:13.3 + cpe:/a:papercut:papercut_ng:12.0 + cpe:/a:papercut:papercut_ng:12.1 + cpe:/a:papercut:papercut_mf:12.5 + cpe:/a:papercut:papercut_ng:14.0 + cpe:/a:papercut:papercut_ng:14.1 + cpe:/a:papercut:papercut_ng:13.2 + cpe:/a:papercut:papercut_mf:12.4 + cpe:/a:papercut:papercut_ng:13.1 + cpe:/a:papercut:papercut_ng:13.0 + cpe:/a:papercut:papercut_mf:12.0 + cpe:/a:papercut:papercut_mf:12.1 + cpe:/a:papercut:papercut_mf:12.2 + cpe:/a:papercut:papercut_ng:13.3 + cpe:/a:papercut:papercut_mf:12.3 + cpe:/a:papercut:papercut_ng:12.5 + cpe:/a:papercut:papercut_mf:13.5 + cpe:/a:papercut:papercut_mf:13.4 + + CVE-2014-2659 + 2014-04-22T10:23:35.910-04:00 + 2014-04-23T08:55:54.260-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-23T08:55:53.790-04:00 + + + + + XF + papercut-cve20142659-csrf(92648) + + + CONFIRM + http://www.papercut.com/release-history/ + + + CONFIRM + http://www.papercut-mf.com/release-history/ + + + SECUNIA + 58037 + + Cross-site request forgery (CSRF) vulnerability in the admin UI in Papercut MF and NG before 14.1 (Build 26983) allows remote attackers to hijack the authentication of administrators via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mediawiki:mediawiki:1.19 + cpe:/a:mediawiki:mediawiki:1.20.4 + cpe:/a:mediawiki:mediawiki:1.20.5 + cpe:/a:mediawiki:mediawiki:1.20.3 + cpe:/a:mediawiki:mediawiki:1.20.8 + cpe:/a:mediawiki:mediawiki:1.19.0 + cpe:/a:mediawiki:mediawiki:1.20.6 + cpe:/a:mediawiki:mediawiki:1.20.7 + cpe:/a:mediawiki:mediawiki:1.21.1 + cpe:/a:mediawiki:mediawiki:1.19.9 + cpe:/a:mediawiki:mediawiki:1.20.1 + cpe:/a:mediawiki:mediawiki:1.19:beta_2 + cpe:/a:mediawiki:mediawiki:1.19:beta_1 + cpe:/a:mediawiki:mediawiki:1.19.10 + cpe:/a:mediawiki:mediawiki:1.21.7 + cpe:/a:mediawiki:mediawiki:1.22.4 + cpe:/a:mediawiki:mediawiki:1.21.5 + cpe:/a:mediawiki:mediawiki:1.19.12 + cpe:/a:mediawiki:mediawiki:1.19.11 + cpe:/a:mediawiki:mediawiki:1.21.6 + cpe:/a:mediawiki:mediawiki:1.21.3 + cpe:/a:mediawiki:mediawiki:1.22.1 + cpe:/a:mediawiki:mediawiki:1.21.4 + cpe:/a:mediawiki:mediawiki:1.19.13 + cpe:/a:mediawiki:mediawiki:1.22.2 + cpe:/a:mediawiki:mediawiki:1.20.2 + cpe:/a:mediawiki:mediawiki:1.21.2 + cpe:/a:mediawiki:mediawiki:1.22.3 + cpe:/a:mediawiki:mediawiki:1.19.5 + cpe:/a:mediawiki:mediawiki:1.19.4 + cpe:/a:mediawiki:mediawiki:1.19.7 + cpe:/a:mediawiki:mediawiki:1.19.6 + cpe:/a:mediawiki:mediawiki:1.19.1 + cpe:/a:mediawiki:mediawiki:1.19.3 + cpe:/a:mediawiki:mediawiki:1.22.0 + cpe:/a:mediawiki:mediawiki:1.19.2 + cpe:/a:mediawiki:mediawiki:1.21 + cpe:/a:mediawiki:mediawiki:1.20 + cpe:/a:mediawiki:mediawiki:1.19.8 + + CVE-2014-2665 + 2014-04-19T21:55:06.987-04:00 + 2014-04-24T01:06:23.157-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-21T19:23:37.350-04:00 + + + + + CONFIRM + https://gerrit.wikimedia.org/r/#/c/121517/1/includes/specials/SpecialChangePassword.php + + + MLIST + [mediawiki-announce] 20140328 MediaWiki Security and Maintenance Releases: 1.22.5, 1.21.8 and 1.19.14 + + + CONFIRM + https://bugzilla.wikimedia.org/show_bug.cgi?id=62497 + + + MLIST + [oss-security] 20140401 Re: CVE request: MediaWiki 1.22.5 login csrf + + + MLIST + [oss-security] 20140327 CVE request: MediaWiki 1.22.5 login csrf + + includes/specials/SpecialChangePassword.php in MediaWiki before 1.19.14, 1.20.x and 1.21.x before 1.21.8, and 1.22.x before 1.22.5 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account, as demonstrated by tracking the victim's activity, related to a "login CSRF" issue. + + + + + + + + + cpe:/a:apache:couchdb:1.5.0 + + CVE-2014-2668 + 2014-03-28T12:51:06.127-04:00 + 2014-04-19T00:48:42.490-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-03-31T11:16:39.827-04:00 + + + + + XF + apache-couchdb-cve20142668-dos(92161) + + + SECTRACK + 1029967 + + + BID + 66474 + + + EXPLOIT-DB + 32519 + + + SECUNIA + 57572 + + + MISC + http://packetstormsecurity.com/files/125889 + + Apache CouchDB 1.5.0 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via the count parameter to /_uuids. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:postgresql:postgresql:9.2.3 + cpe:/a:postgresql:postgresql:9.2.2 + cpe:/a:postgresql:postgresql:9.2.1 + cpe:/a:postgresql:postgresql:9.2.5 + cpe:/a:postgresql:postgresql:9.2.4 + cpe:/a:postgresql:postgresql:9.0.15 + cpe:/a:postgresql:postgresql:9.1.1 + cpe:/a:postgresql:postgresql:9.0.10 + cpe:/a:postgresql:postgresql:9.1.9 + cpe:/a:postgresql:postgresql:9.0.11 + cpe:/a:postgresql:postgresql:9.0.12 + cpe:/a:postgresql:postgresql:9.0.13 + cpe:/a:postgresql:postgresql:9.0.14 + cpe:/a:postgresql:postgresql:9.3 + cpe:/a:postgresql:postgresql:9.2 + cpe:/a:postgresql:postgresql:9.1 + cpe:/a:postgresql:postgresql:9.0 + cpe:/a:postgresql:postgresql:9.0.1 + cpe:/a:postgresql:postgresql:9.3.1 + cpe:/a:postgresql:postgresql:9.3.2 + cpe:/a:postgresql:postgresql:9.1.2 + cpe:/a:postgresql:postgresql:9.1.3 + cpe:/a:postgresql:postgresql:9.1.4 + cpe:/a:postgresql:postgresql:9.1.5 + cpe:/a:postgresql:postgresql:9.1.6 + cpe:/a:postgresql:postgresql:9.1.7 + cpe:/a:postgresql:postgresql:9.0.2 + cpe:/a:postgresql:postgresql:9.1.8 + cpe:/a:postgresql:postgresql:9.0.4 + cpe:/a:postgresql:postgresql:9.0.5 + cpe:/a:postgresql:postgresql:9.1.11 + cpe:/a:postgresql:postgresql:9.0.3 + cpe:/a:postgresql:postgresql:9.1.10 + cpe:/a:postgresql:postgresql:9.0.8 + cpe:/a:postgresql:postgresql:9.0.9 + cpe:/a:postgresql:postgresql:9.0.6 + cpe:/a:postgresql:postgresql:9.0.7 + + CVE-2014-2669 + 2014-03-31T10:58:19.600-04:00 + 2014-03-31T14:02:04.160-04:00 + + + 6.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-03-31T14:01:51.693-04:00 + + + + + CONFIRM + https://github.com/postgres/postgres/commit/31400a673325147e1205326008e32135a78b4d8a + + + CONFIRM + http://www.postgresql.org/support/security/ + + + CONFIRM + http://www.postgresql.org/about/news/1506/ + + + DEBIAN + DSA-2865 + + + DEBIAN + DSA-2864 + + + CONFIRM + http://wiki.postgresql.org/wiki/20140220securityrelease + + Multiple integer overflows in contrib/hstore/hstore_io.c in PostgreSQL 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact via vectors related to the (1) hstore_recv, (2) hstore_from_arrays, and (3) hstore_from_array functions in contrib/hstore/hstore_io.c; and the (4) hstoreArrayToPairs function in contrib/hstore/hstore_op.c, which triggers a buffer overflow. NOTE: this issue was SPLIT from CVE-2014-0064 because it has a different set of affected versions. + + + + + + + + + cpe:/a:zohocorp:manageengine_opstor:8.3 + + CVE-2014-2670 + 2014-03-29T16:55:04.157-04:00 + 2014-03-31T13:36:05.170-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-03-31T13:36:03.360-04:00 + + + + + CERT-VN + VU#140886 + + Cross-site scripting (XSS) vulnerability in Properties.do in ZOHO ManageEngine OpStor before build 8500 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter, a different vulnerability than CVE-2014-0344. + + + + + + + + + cpe:/a:microsoft:windows_media_player:11.0.5721.5230 + + CVE-2014-2671 + 2014-03-31T10:58:57.977-04:00 + 2014-04-14T10:29:09.940-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-14T10:29:08.973-04:00 + + + + + XF + ms-media-player-wav-code-exec(92080) + + + BID + 66403 + + + EXPLOIT-DB + 32477 + + + MISC + http://packetstormsecurity.com/files/125834 + + Microsoft Windows Media Player (WMP) 11.0.5721.5230 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted WAV file. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:linux:linux_kernel:3.0.48 + cpe:/o:linux:linux_kernel:3.0.49 + cpe:/o:linux:linux_kernel:3.0.46 + cpe:/o:linux:linux_kernel:3.0.47 + cpe:/o:linux:linux_kernel:3.0.44 + cpe:/o:linux:linux_kernel:3.0.45 + cpe:/o:linux:linux_kernel:3.0.42 + cpe:/o:linux:linux_kernel:3.4.70 + cpe:/o:linux:linux_kernel:3.4.71 + cpe:/o:linux:linux_kernel:3.0.40 + cpe:/o:linux:linux_kernel:3.0.41 + cpe:/o:linux:linux_kernel:3.4.45 + cpe:/o:linux:linux_kernel:3.4.44 + cpe:/o:linux:linux_kernel:3.4.46 + cpe:/o:linux:linux_kernel:3.4.41 + cpe:/o:linux:linux_kernel:3.4.40 + cpe:/o:linux:linux_kernel:3.4.43 + cpe:/o:linux:linux_kernel:3.4.42 + cpe:/o:linux:linux_kernel:3.4.49 + cpe:/o:linux:linux_kernel:3.4.48 + cpe:/o:linux:linux_kernel:3.0.59 + cpe:/o:linux:linux_kernel:3.4.47 + cpe:/o:linux:linux_kernel:3.0.55 + cpe:/o:linux:linux_kernel:3.0.56 + cpe:/o:linux:linux_kernel:3.0.57 + cpe:/o:linux:linux_kernel:3.0.58 + cpe:/o:linux:linux_kernel:3.0.51 + cpe:/o:linux:linux_kernel:3.0.52 + cpe:/o:linux:linux_kernel:3.0.53 + cpe:/o:linux:linux_kernel:3.11.10 + cpe:/o:linux:linux_kernel:3.0.50 + cpe:/o:linux:linux_kernel:3.4.57 + cpe:/o:linux:linux_kernel:3.4.56 + cpe:/o:linux:linux_kernel:3.4.55 + cpe:/o:linux:linux_kernel:3.4.54 + cpe:/o:linux:linux_kernel:3.4.53 + cpe:/o:linux:linux_kernel:3.4.52 + cpe:/o:linux:linux_kernel:3.4.51 + cpe:/o:linux:linux_kernel:3.4.50 + cpe:/o:linux:linux_kernel:3.0.43 + cpe:/o:linux:linux_kernel:3.10.26 + cpe:/o:linux:linux_kernel:3.4.59 + cpe:/o:linux:linux_kernel:3.0.24 + cpe:/o:linux:linux_kernel:3.0.25 + cpe:/o:linux:linux_kernel:3.0.22 + cpe:/o:linux:linux_kernel:3.1.9 + cpe:/o:linux:linux_kernel:3.0.23 + cpe:/o:linux:linux_kernel:3.10.28 + cpe:/o:linux:linux_kernel:3.0.28 + cpe:/o:linux:linux_kernel:3.10.27 + cpe:/o:linux:linux_kernel:3.0.26 + cpe:/o:linux:linux_kernel:3.10.29 + cpe:/o:linux:linux_kernel:3.4.58 + cpe:/o:linux:linux_kernel:3.0.27 + cpe:/o:linux:linux_kernel:3.10.24 + cpe:/o:linux:linux_kernel:3.10.23 + cpe:/o:linux:linux_kernel:3.10.25 + cpe:/o:linux:linux_kernel:3.10.20 + cpe:/o:linux:linux_kernel:3.1.8 + cpe:/o:linux:linux_kernel:3.0.20 + cpe:/o:linux:linux_kernel:3.10.22 + cpe:/o:linux:linux_kernel:3.10.21 + cpe:/o:linux:linux_kernel:3.4.21 + cpe:/o:linux:linux_kernel:3.4.20 + cpe:/o:linux:linux_kernel:3.4.23 + cpe:/o:linux:linux_kernel:3.4.22 + cpe:/o:linux:linux_kernel:3.4.24 + cpe:/o:linux:linux_kernel:3.4.27 + cpe:/o:linux:linux_kernel:3.4.26 + cpe:/o:linux:linux_kernel:3.4.29 + cpe:/o:linux:linux_kernel:3.10.15 + cpe:/o:linux:linux_kernel:3.4.28 + cpe:/o:linux:linux_kernel:3.0.54 + cpe:/o:linux:linux_kernel:3.0.33 + cpe:/o:linux:linux_kernel:3.0.34 + cpe:/o:linux:linux_kernel:3.0.35 + cpe:/o:linux:linux_kernel:3.0.36 + cpe:/o:linux:linux_kernel:3.10.19 + cpe:/o:linux:linux_kernel:3.0.37 + cpe:/o:linux:linux_kernel:3.10.18 + cpe:/o:linux:linux_kernel:3.0.38 + cpe:/o:linux:linux_kernel:3.4.25 + cpe:/o:linux:linux_kernel:3.10.17 + cpe:/o:linux:linux_kernel:3.0.39 + cpe:/o:linux:linux_kernel:3.10.16 + cpe:/o:linux:linux_kernel:3.10.14 + cpe:/o:linux:linux_kernel:3.10.13 + cpe:/o:linux:linux_kernel:3.10.12 + cpe:/o:linux:linux_kernel:3.10.11 + cpe:/o:linux:linux_kernel:3.10.10 + cpe:/o:linux:linux_kernel:3.0.30 + cpe:/o:linux:linux_kernel:3.0.31 + cpe:/o:linux:linux_kernel:3.9.8 + cpe:/o:linux:linux_kernel:3.5.5 + cpe:/o:linux:linux_kernel:3.4.32 + cpe:/o:linux:linux_kernel:3.9.9 + cpe:/o:linux:linux_kernel:3.5.6 + cpe:/o:linux:linux_kernel:3.4.31 + cpe:/o:linux:linux_kernel:3.5.7 + cpe:/o:linux:linux_kernel:3.4.30 + cpe:/o:linux:linux_kernel:3.7.1 + cpe:/o:linux:linux_kernel:3.4.35 + cpe:/o:linux:linux_kernel:3.9.0 + cpe:/o:linux:linux_kernel:3.0.18 + cpe:/o:linux:linux_kernel:3.4.34 + cpe:/o:linux:linux_kernel:3.4.33 + cpe:/o:linux:linux_kernel:3.9.2 + cpe:/o:linux:linux_kernel:3.9.1 + cpe:/o:linux:linux_kernel:3.0.19 + cpe:/o:linux:linux_kernel:3.4.39 + cpe:/o:linux:linux_kernel:3.9.4 + cpe:/o:linux:linux_kernel:3.4.38 + cpe:/o:linux:linux_kernel:3.9.3 + cpe:/o:linux:linux_kernel:3.4.37 + cpe:/o:linux:linux_kernel:3.9.6 + cpe:/o:linux:linux_kernel:3.9.5 + cpe:/o:linux:linux_kernel:3.0.21 + cpe:/o:linux:linux_kernel:3.9.7 + cpe:/o:linux:linux_kernel:3.5.4 + cpe:/o:linux:linux_kernel:3.0.4 + cpe:/o:linux:linux_kernel:3.0.5 + cpe:/o:linux:linux_kernel:3.0.2 + cpe:/o:linux:linux_kernel:3.0.3 + cpe:/o:linux:linux_kernel:3.0.8 + cpe:/o:linux:linux_kernel:3.0.6 + cpe:/o:linux:linux_kernel:3.0.7 + cpe:/o:linux:linux_kernel:3.4.36 + cpe:/o:linux:linux_kernel:3.13.1 + cpe:/o:linux:linux_kernel:3.6.10 + cpe:/o:linux:linux_kernel:3.6.11 + cpe:/o:linux:linux_kernel:3.13.6 + cpe:/o:linux:linux_kernel:3.13.4 + cpe:/o:linux:linux_kernel:3.13.5 + cpe:/o:linux:linux_kernel:3.13.2 + cpe:/o:linux:linux_kernel:3.13.3 + cpe:/o:linux:linux_kernel:3.4.1 + cpe:/o:linux:linux_kernel:3.4.19 + cpe:/o:linux:linux_kernel:3.4.17 + cpe:/o:linux:linux_kernel:3.4.3 + cpe:/o:linux:linux_kernel:3.4.18 + cpe:/o:linux:linux_kernel:3.4.2 + cpe:/o:linux:linux_kernel:3.2.9 + cpe:/o:linux:linux_kernel:3.4.15 + cpe:/o:linux:linux_kernel:3.2.8 + cpe:/o:linux:linux_kernel:3.4.16 + cpe:/o:linux:linux_kernel:3.4.4 + cpe:/o:linux:linux_kernel:3.12.12 + cpe:/o:linux:linux_kernel:3.2.7 + cpe:/o:linux:linux_kernel:3.4.13 + cpe:/o:linux:linux_kernel:3.12.13 + cpe:/o:linux:linux_kernel:3.12.10 + cpe:/o:linux:linux_kernel:3.4.11 + cpe:/o:linux:linux_kernel:3.12.11 + cpe:/o:linux:linux_kernel:3.4.12 + cpe:/o:linux:linux_kernel:3.4.10 + cpe:/o:linux:linux_kernel:3.0.61 + cpe:/o:linux:linux_kernel:3.3:rc2 + cpe:/o:linux:linux_kernel:3.4:rc7 + cpe:/o:linux:linux_kernel:3.0.60 + cpe:/o:linux:linux_kernel:3.3:rc7 + cpe:/o:linux:linux_kernel:3.4:rc5 + cpe:/o:linux:linux_kernel:3.3:rc5 + cpe:/o:linux:linux_kernel:3.4:rc6 + cpe:/o:linux:linux_kernel:3.3:rc6 + cpe:/o:linux:linux_kernel:3.0.64 + cpe:/o:linux:linux_kernel:3.0.63 + cpe:/o:linux:linux_kernel:3.0.62 + cpe:/o:linux:linux_kernel:3.12.1 + cpe:/o:linux:linux_kernel:3.0.68 + cpe:/o:linux:linux_kernel:3.0.67 + cpe:/o:linux:linux_kernel:3.0.66 + cpe:/o:linux:linux_kernel:3.4.14 + cpe:/o:linux:linux_kernel:3.12.7 + cpe:/o:linux:linux_kernel:3.2:rc2 + cpe:/o:linux:linux_kernel:3.1:rc1 + cpe:/o:linux:linux_kernel:3.0.9 + cpe:/o:linux:linux_kernel:3.0:rc4 + cpe:/o:linux:linux_kernel:3.12.8 + cpe:/o:linux:linux_kernel:3.1:rc4 + cpe:/o:linux:linux_kernel:3.0:rc3 + cpe:/o:linux:linux_kernel:3.12.9 + cpe:/o:linux:linux_kernel:3.0:rc2 + cpe:/o:linux:linux_kernel:3.1:rc2 + cpe:/o:linux:linux_kernel:3.0:rc1 + cpe:/o:linux:linux_kernel:3.2:rc7 + cpe:/o:linux:linux_kernel:3.12.3 + cpe:/o:linux:linux_kernel:3.1.10 + cpe:/o:linux:linux_kernel:3.2:rc6 + cpe:/o:linux:linux_kernel:3.12.4 + cpe:/o:linux:linux_kernel:3.0:rc7 + cpe:/o:linux:linux_kernel:3.2:rc5 + cpe:/o:linux:linux_kernel:3.12.5 + cpe:/o:linux:linux_kernel:3.9:rc3 + cpe:/o:linux:linux_kernel:3.0:rc6 + cpe:/o:linux:linux_kernel:3.12.6 + cpe:/o:linux:linux_kernel:3.0:rc5 + cpe:/o:linux:linux_kernel:3.9:rc1 + cpe:/o:linux:linux_kernel:3.9:rc4 + cpe:/o:linux:linux_kernel:3.9:rc7 + cpe:/o:linux:linux_kernel:3.12.2 + cpe:/o:linux:linux_kernel:3.9:rc2 + cpe:/o:linux:linux_kernel:3.9:rc5 + cpe:/o:linux:linux_kernel:3.3:rc3 + cpe:/o:linux:linux_kernel:3.4:rc4 + cpe:/o:linux:linux_kernel:3.4:rc3 + cpe:/o:linux:linux_kernel:3.3:rc1 + cpe:/o:linux:linux_kernel:3.4:rc2 + cpe:/o:linux:linux_kernel:3.9:rc6 + cpe:/o:linux:linux_kernel:3.3:rc4 + cpe:/o:linux:linux_kernel:3.4:rc1 + cpe:/o:linux:linux_kernel:3.4.5 + cpe:/o:linux:linux_kernel:3.2.2 + cpe:/o:linux:linux_kernel:3.2.3 + cpe:/o:linux:linux_kernel:3.2.1 + cpe:/o:linux:linux_kernel:3.4.6 + cpe:/o:linux:linux_kernel:3.2:rc3 + cpe:/o:linux:linux_kernel:3.2.6 + cpe:/o:linux:linux_kernel:3.4.7 + cpe:/o:linux:linux_kernel:3.2:rc4 + cpe:/o:linux:linux_kernel:3.1:rc3 + cpe:/o:linux:linux_kernel:3.4.8 + cpe:/o:linux:linux_kernel:3.2.4 + cpe:/o:linux:linux_kernel:3.4.9 + cpe:/o:linux:linux_kernel:3.2.5 + cpe:/o:linux:linux_kernel:3.0.65 + cpe:/o:linux:linux_kernel:3.2.12 + cpe:/o:linux:linux_kernel:3.8.10 + cpe:/o:linux:linux_kernel:3.8.12 + cpe:/o:linux:linux_kernel:3.8.11 + cpe:/o:linux:linux_kernel:3.8.13 + cpe:/o:linux:linux_kernel:3.7.9 + cpe:/o:linux:linux_kernel:3.7.8 + cpe:/o:linux:linux_kernel:3.7.7 + cpe:/o:linux:linux_kernel:3.7.6 + cpe:/o:linux:linux_kernel:3.6.3 + cpe:/o:linux:linux_kernel:3.7.5 + cpe:/o:linux:linux_kernel:3.7.4 + cpe:/o:linux:linux_kernel:3.7.3 + cpe:/o:linux:linux_kernel:3.7.2 + cpe:/o:linux:linux_kernel:3.6.7 + cpe:/o:linux:linux_kernel:3.6.6 + cpe:/o:linux:linux_kernel:3.6.5 + cpe:/o:linux:linux_kernel:3.6.4 + cpe:/o:linux:linux_kernel:3.6.9 + cpe:/o:linux:linux_kernel:3.6.8 + cpe:/o:linux:linux_kernel:3.10 + cpe:/o:linux:linux_kernel:3.11 + cpe:/o:linux:linux_kernel:3.12 + cpe:/o:linux:linux_kernel:3.13 + cpe:/o:linux:linux_kernel:3.10.1 + cpe:/o:linux:linux_kernel:3.10.2 + cpe:/o:linux:linux_kernel:3.10.3 + cpe:/o:linux:linux_kernel:3.6.2 + cpe:/o:linux:linux_kernel:3.6.1 + cpe:/o:linux:linux_kernel:3.3.6 + cpe:/o:linux:linux_kernel:3.3.7 + cpe:/o:linux:linux_kernel:3.3.8 + cpe:/o:linux:linux_kernel:3.0.1 + cpe:/o:linux:linux_kernel:3.2 + cpe:/o:linux:linux_kernel:3.1 + cpe:/o:linux:linux_kernel:3.7 + cpe:/o:linux:linux_kernel:3.6 + cpe:/o:linux:linux_kernel:3.4 + cpe:/o:linux:linux_kernel:3.1.6 + cpe:/o:linux:linux_kernel:3.1.5 + cpe:/o:linux:linux_kernel:3.1.7 + cpe:/o:linux:linux_kernel:3.0.32 + cpe:/o:linux:linux_kernel:3.8.9 + cpe:/o:linux:linux_kernel:3.1.2 + cpe:/o:linux:linux_kernel:3.1.1 + cpe:/o:linux:linux_kernel:3.1.4 + cpe:/o:linux:linux_kernel:3.1.3 + cpe:/o:linux:linux_kernel:3.9.10 + cpe:/o:linux:linux_kernel:3.0.29 + cpe:/o:linux:linux_kernel:3.3 + cpe:/o:linux:linux_kernel:3.8.4 + cpe:/o:linux:linux_kernel:3.2.26 + cpe:/o:linux:linux_kernel:3.8.5 + cpe:/o:linux:linux_kernel:3.2.27 + cpe:/o:linux:linux_kernel:3.8.2 + cpe:/o:linux:linux_kernel:3.2.24 + cpe:/o:linux:linux_kernel:3.8.3 + cpe:/o:linux:linux_kernel:3.2.25 + cpe:/o:linux:linux_kernel:3.8.8 + cpe:/o:linux:linux_kernel:3.8.6 + cpe:/o:linux:linux_kernel:3.2.28 + cpe:/o:linux:linux_kernel:3.8.7 + cpe:/o:linux:linux_kernel:3.2.29 + cpe:/o:linux:linux_kernel:3.3.3 + cpe:/o:linux:linux_kernel:3.3.4 + cpe:/o:linux:linux_kernel:3.3.5 + cpe:/o:linux:linux_kernel:3.2.22 + cpe:/o:linux:linux_kernel:3.8.1 + cpe:/o:linux:linux_kernel:3.2.20 + cpe:/o:linux:linux_kernel:3.3.1 + cpe:/o:linux:linux_kernel:3.2.21 + cpe:/o:linux:linux_kernel:3.3.2 + cpe:/o:linux:linux_kernel:3.11.1 + cpe:/o:linux:linux_kernel:3.11.2 + cpe:/o:linux:linux_kernel:3.2.23 + cpe:/o:linux:linux_kernel:3.0.17 + cpe:/o:linux:linux_kernel:3.9.11 + cpe:/o:linux:linux_kernel:3.0.16 + cpe:/o:linux:linux_kernel:3.0.15 + cpe:/o:linux:linux_kernel:3.2.30 + cpe:/o:linux:linux_kernel:3.0.14 + cpe:/o:linux:linux_kernel:3.0.13 + cpe:/o:linux:linux_kernel:3.0.12 + cpe:/o:linux:linux_kernel:3.0.11 + cpe:/o:linux:linux_kernel:3.4.61 + cpe:/o:linux:linux_kernel:3.0.10 + cpe:/o:linux:linux_kernel:3.4.64 + cpe:/o:linux:linux_kernel:3.8.0 + cpe:/o:linux:linux_kernel:3.4.65 + cpe:/o:linux:linux_kernel:3.4.62 + cpe:/o:linux:linux_kernel:3.4.63 + cpe:/o:linux:linux_kernel:3.4.68 + cpe:/o:linux:linux_kernel:3.4.66 + cpe:/o:linux:linux_kernel:3.4.67 + cpe:/o:linux:linux_kernel:3.5.3 + cpe:/o:linux:linux_kernel:3.5.1 + cpe:/o:linux:linux_kernel:3.5.2 + cpe:/o:linux:linux_kernel:3.10.4 + cpe:/o:linux:linux_kernel:3.4.72 + cpe:/o:linux:linux_kernel:3.10.9 + cpe:/o:linux:linux_kernel:3.4.73 + cpe:/o:linux:linux_kernel:3.4.74 + cpe:/o:linux:linux_kernel:3.4.75 + cpe:/o:linux:linux_kernel:3.4.76 + cpe:/o:linux:linux_kernel:3.10.5 + cpe:/o:linux:linux_kernel:3.4.77 + cpe:/o:linux:linux_kernel:3.10.6 + cpe:/o:linux:linux_kernel:3.4.78 + cpe:/o:linux:linux_kernel:3.10.7 + cpe:/o:linux:linux_kernel:3.4.79 + cpe:/o:linux:linux_kernel:3.10.8 + cpe:/o:linux:linux_kernel:3.7.10 + cpe:/o:linux:linux_kernel:3.2.17 + cpe:/o:linux:linux_kernel:3.2.18 + cpe:/o:linux:linux_kernel:3.2.19 + cpe:/o:linux:linux_kernel:3.2.13 + cpe:/o:linux:linux_kernel:3.2.14 + cpe:/o:linux:linux_kernel:3.11.3 + cpe:/o:linux:linux_kernel:3.2.15 + cpe:/o:linux:linux_kernel:3.4.60 + cpe:/o:linux:linux_kernel:3.2.16 + cpe:/o:linux:linux_kernel:3.11.5 + cpe:/o:linux:linux_kernel:3.11.4 + cpe:/o:linux:linux_kernel:3.2.10 + cpe:/o:linux:linux_kernel:3.11.7 + cpe:/o:linux:linux_kernel:3.2.11 + cpe:/o:linux:linux_kernel:3.11.6 + cpe:/o:linux:linux_kernel:3.11.9 + cpe:/o:linux:linux_kernel:3.11.8 + cpe:/o:linux:linux_kernel:3.4.69 + + CVE-2014-2672 + 2014-04-01T02:35:53.747-04:00 + 2014-04-19T00:48:43.037-04:00 + + + 7.1 + NETWORK + MEDIUM + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-01T15:15:34.473-04:00 + + + + + CONFIRM + https://github.com/torvalds/linux/commit/21f8aaee0c62708654988ce092838aa7df4d25d8 + + + CONFIRM + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=21f8aaee0c62708654988ce092838aa7df4d25d8 + + + CONFIRM + https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.15 + + + CONFIRM + https://bugzilla.kernel.org/show_bug.cgi?id=70551 + + + BID + 66492 + + + MLIST + [oss-security] 20140330 Re: CVE request: Linux Kernel, two security issues + + + CONFIRM + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.7 + + + SECUNIA + 57468 + + Race condition in the ath_tx_aggr_sleep function in drivers/net/wireless/ath/ath9k/xmit.c in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via a large amount of network traffic that triggers certain list deletions. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:linux:linux_kernel:3.0.48 + cpe:/o:linux:linux_kernel:3.0.49 + cpe:/o:linux:linux_kernel:3.0.46 + cpe:/o:linux:linux_kernel:3.0.47 + cpe:/o:linux:linux_kernel:3.0.44 + cpe:/o:linux:linux_kernel:3.0.45 + cpe:/o:linux:linux_kernel:3.0.42 + cpe:/o:linux:linux_kernel:3.4.70 + cpe:/o:linux:linux_kernel:3.4.71 + cpe:/o:linux:linux_kernel:3.0.40 + cpe:/o:linux:linux_kernel:3.0.41 + cpe:/o:linux:linux_kernel:3.4.45 + cpe:/o:linux:linux_kernel:3.4.44 + cpe:/o:linux:linux_kernel:3.4.46 + cpe:/o:linux:linux_kernel:3.4.41 + cpe:/o:linux:linux_kernel:3.4.40 + cpe:/o:linux:linux_kernel:3.4.43 + cpe:/o:linux:linux_kernel:3.4.42 + cpe:/o:linux:linux_kernel:3.4.49 + cpe:/o:linux:linux_kernel:3.4.48 + cpe:/o:linux:linux_kernel:3.0.59 + cpe:/o:linux:linux_kernel:3.4.47 + cpe:/o:linux:linux_kernel:3.0.55 + cpe:/o:linux:linux_kernel:3.0.56 + cpe:/o:linux:linux_kernel:3.0.57 + cpe:/o:linux:linux_kernel:3.0.58 + cpe:/o:linux:linux_kernel:3.0.51 + cpe:/o:linux:linux_kernel:3.0.52 + cpe:/o:linux:linux_kernel:3.0.53 + cpe:/o:linux:linux_kernel:3.11.10 + cpe:/o:linux:linux_kernel:3.0.50 + cpe:/o:linux:linux_kernel:3.4.57 + cpe:/o:linux:linux_kernel:3.4.56 + cpe:/o:linux:linux_kernel:3.4.55 + cpe:/o:linux:linux_kernel:3.4.54 + cpe:/o:linux:linux_kernel:3.4.53 + cpe:/o:linux:linux_kernel:3.4.52 + cpe:/o:linux:linux_kernel:3.4.51 + cpe:/o:linux:linux_kernel:3.4.50 + cpe:/o:linux:linux_kernel:3.0.43 + cpe:/o:linux:linux_kernel:3.10.26 + cpe:/o:linux:linux_kernel:3.4.59 + cpe:/o:linux:linux_kernel:3.0.24 + cpe:/o:linux:linux_kernel:3.0.25 + cpe:/o:linux:linux_kernel:3.0.22 + cpe:/o:linux:linux_kernel:3.1.9 + cpe:/o:linux:linux_kernel:3.0.23 + cpe:/o:linux:linux_kernel:3.10.28 + cpe:/o:linux:linux_kernel:3.0.28 + cpe:/o:linux:linux_kernel:3.10.27 + cpe:/o:linux:linux_kernel:3.0.26 + cpe:/o:linux:linux_kernel:3.10.29 + cpe:/o:linux:linux_kernel:3.4.58 + cpe:/o:linux:linux_kernel:3.0.27 + cpe:/o:linux:linux_kernel:3.10.24 + cpe:/o:linux:linux_kernel:3.10.23 + cpe:/o:linux:linux_kernel:3.10.25 + cpe:/o:linux:linux_kernel:3.10.20 + cpe:/o:linux:linux_kernel:3.1.8 + cpe:/o:linux:linux_kernel:3.0.20 + cpe:/o:linux:linux_kernel:3.10.22 + cpe:/o:linux:linux_kernel:3.10.21 + cpe:/o:linux:linux_kernel:3.4.21 + cpe:/o:linux:linux_kernel:3.4.20 + cpe:/o:linux:linux_kernel:3.4.23 + cpe:/o:linux:linux_kernel:3.4.22 + cpe:/o:linux:linux_kernel:3.4.24 + cpe:/o:linux:linux_kernel:3.4.27 + cpe:/o:linux:linux_kernel:3.4.26 + cpe:/o:linux:linux_kernel:3.4.29 + cpe:/o:linux:linux_kernel:3.10.15 + cpe:/o:linux:linux_kernel:3.4.28 + cpe:/o:linux:linux_kernel:3.0.54 + cpe:/o:linux:linux_kernel:3.0.33 + cpe:/o:linux:linux_kernel:3.0.34 + cpe:/o:linux:linux_kernel:3.0.35 + cpe:/o:linux:linux_kernel:3.0.36 + cpe:/o:linux:linux_kernel:3.10.19 + cpe:/o:linux:linux_kernel:3.0.37 + cpe:/o:linux:linux_kernel:3.10.18 + cpe:/o:linux:linux_kernel:3.0.38 + cpe:/o:linux:linux_kernel:3.4.25 + cpe:/o:linux:linux_kernel:3.10.17 + cpe:/o:linux:linux_kernel:3.0.39 + cpe:/o:linux:linux_kernel:3.10.16 + cpe:/o:linux:linux_kernel:3.10.14 + cpe:/o:linux:linux_kernel:3.10.13 + cpe:/o:linux:linux_kernel:3.10.12 + cpe:/o:linux:linux_kernel:3.10.11 + cpe:/o:linux:linux_kernel:3.10.10 + cpe:/o:linux:linux_kernel:3.0.30 + cpe:/o:linux:linux_kernel:3.0.31 + cpe:/o:linux:linux_kernel:3.9.8 + cpe:/o:linux:linux_kernel:3.5.5 + cpe:/o:linux:linux_kernel:3.4.32 + cpe:/o:linux:linux_kernel:3.9.9 + cpe:/o:linux:linux_kernel:3.5.6 + cpe:/o:linux:linux_kernel:3.4.31 + cpe:/o:linux:linux_kernel:3.5.7 + cpe:/o:linux:linux_kernel:3.4.30 + cpe:/o:linux:linux_kernel:3.7.1 + cpe:/o:linux:linux_kernel:3.4.35 + cpe:/o:linux:linux_kernel:3.9.0 + cpe:/o:linux:linux_kernel:3.0.18 + cpe:/o:linux:linux_kernel:3.4.34 + cpe:/o:linux:linux_kernel:3.4.33 + cpe:/o:linux:linux_kernel:3.9.2 + cpe:/o:linux:linux_kernel:3.9.1 + cpe:/o:linux:linux_kernel:3.0.19 + cpe:/o:linux:linux_kernel:3.4.39 + cpe:/o:linux:linux_kernel:3.9.4 + cpe:/o:linux:linux_kernel:3.4.38 + cpe:/o:linux:linux_kernel:3.9.3 + cpe:/o:linux:linux_kernel:3.4.37 + cpe:/o:linux:linux_kernel:3.9.6 + cpe:/o:linux:linux_kernel:3.9.5 + cpe:/o:linux:linux_kernel:3.0.21 + cpe:/o:linux:linux_kernel:3.9.7 + cpe:/o:linux:linux_kernel:3.5.4 + cpe:/o:linux:linux_kernel:3.0.4 + cpe:/o:linux:linux_kernel:3.0.5 + cpe:/o:linux:linux_kernel:3.0.2 + cpe:/o:linux:linux_kernel:3.0.3 + cpe:/o:linux:linux_kernel:3.0.8 + cpe:/o:linux:linux_kernel:3.0.6 + cpe:/o:linux:linux_kernel:3.0.7 + cpe:/o:linux:linux_kernel:3.4.36 + cpe:/o:linux:linux_kernel:3.13.1 + cpe:/o:linux:linux_kernel:3.6.10 + cpe:/o:linux:linux_kernel:3.6.11 + cpe:/o:linux:linux_kernel:3.13.6 + cpe:/o:linux:linux_kernel:3.13.4 + cpe:/o:linux:linux_kernel:3.13.5 + cpe:/o:linux:linux_kernel:3.13.2 + cpe:/o:linux:linux_kernel:3.13.3 + cpe:/o:linux:linux_kernel:3.4.1 + cpe:/o:linux:linux_kernel:3.4.19 + cpe:/o:linux:linux_kernel:3.4.17 + cpe:/o:linux:linux_kernel:3.4.3 + cpe:/o:linux:linux_kernel:3.4.18 + cpe:/o:linux:linux_kernel:3.4.2 + cpe:/o:linux:linux_kernel:3.2.9 + cpe:/o:linux:linux_kernel:3.4.15 + cpe:/o:linux:linux_kernel:3.2.8 + cpe:/o:linux:linux_kernel:3.4.16 + cpe:/o:linux:linux_kernel:3.4.4 + cpe:/o:linux:linux_kernel:3.12.12 + cpe:/o:linux:linux_kernel:3.2.7 + cpe:/o:linux:linux_kernel:3.4.13 + cpe:/o:linux:linux_kernel:3.12.13 + cpe:/o:linux:linux_kernel:3.12.10 + cpe:/o:linux:linux_kernel:3.4.11 + cpe:/o:linux:linux_kernel:3.12.11 + cpe:/o:linux:linux_kernel:3.4.12 + cpe:/o:linux:linux_kernel:3.4.10 + cpe:/o:linux:linux_kernel:3.0.61 + cpe:/o:linux:linux_kernel:3.3:rc2 + cpe:/o:linux:linux_kernel:3.4:rc7 + cpe:/o:linux:linux_kernel:3.0.60 + cpe:/o:linux:linux_kernel:3.3:rc7 + cpe:/o:linux:linux_kernel:3.4:rc5 + cpe:/o:linux:linux_kernel:3.3:rc5 + cpe:/o:linux:linux_kernel:3.4:rc6 + cpe:/o:linux:linux_kernel:3.3:rc6 + cpe:/o:linux:linux_kernel:3.0.64 + cpe:/o:linux:linux_kernel:3.0.63 + cpe:/o:linux:linux_kernel:3.0.62 + cpe:/o:linux:linux_kernel:3.12.1 + cpe:/o:linux:linux_kernel:3.0.68 + cpe:/o:linux:linux_kernel:3.0.67 + cpe:/o:linux:linux_kernel:3.0.66 + cpe:/o:linux:linux_kernel:3.4.14 + cpe:/o:linux:linux_kernel:3.12.7 + cpe:/o:linux:linux_kernel:3.2:rc2 + cpe:/o:linux:linux_kernel:3.1:rc1 + cpe:/o:linux:linux_kernel:3.0.9 + cpe:/o:linux:linux_kernel:3.0:rc4 + cpe:/o:linux:linux_kernel:3.12.8 + cpe:/o:linux:linux_kernel:3.1:rc4 + cpe:/o:linux:linux_kernel:3.0:rc3 + cpe:/o:linux:linux_kernel:3.12.9 + cpe:/o:linux:linux_kernel:3.0:rc2 + cpe:/o:linux:linux_kernel:3.1:rc2 + cpe:/o:linux:linux_kernel:3.0:rc1 + cpe:/o:linux:linux_kernel:3.2:rc7 + cpe:/o:linux:linux_kernel:3.12.3 + cpe:/o:linux:linux_kernel:3.1.10 + cpe:/o:linux:linux_kernel:3.2:rc6 + cpe:/o:linux:linux_kernel:3.12.4 + cpe:/o:linux:linux_kernel:3.0:rc7 + cpe:/o:linux:linux_kernel:3.2:rc5 + cpe:/o:linux:linux_kernel:3.12.5 + cpe:/o:linux:linux_kernel:3.9:rc3 + cpe:/o:linux:linux_kernel:3.0:rc6 + cpe:/o:linux:linux_kernel:3.12.6 + cpe:/o:linux:linux_kernel:3.0:rc5 + cpe:/o:linux:linux_kernel:3.9:rc1 + cpe:/o:linux:linux_kernel:3.9:rc4 + cpe:/o:linux:linux_kernel:3.9:rc7 + cpe:/o:linux:linux_kernel:3.12.2 + cpe:/o:linux:linux_kernel:3.9:rc2 + cpe:/o:linux:linux_kernel:3.9:rc5 + cpe:/o:linux:linux_kernel:3.3:rc3 + cpe:/o:linux:linux_kernel:3.4:rc4 + cpe:/o:linux:linux_kernel:3.4:rc3 + cpe:/o:linux:linux_kernel:3.3:rc1 + cpe:/o:linux:linux_kernel:3.4:rc2 + cpe:/o:linux:linux_kernel:3.9:rc6 + cpe:/o:linux:linux_kernel:3.3:rc4 + cpe:/o:linux:linux_kernel:3.4:rc1 + cpe:/o:linux:linux_kernel:3.4.5 + cpe:/o:linux:linux_kernel:3.2.2 + cpe:/o:linux:linux_kernel:3.2.3 + cpe:/o:linux:linux_kernel:3.2.1 + cpe:/o:linux:linux_kernel:3.4.6 + cpe:/o:linux:linux_kernel:3.2:rc3 + cpe:/o:linux:linux_kernel:3.2.6 + cpe:/o:linux:linux_kernel:3.4.7 + cpe:/o:linux:linux_kernel:3.2:rc4 + cpe:/o:linux:linux_kernel:3.1:rc3 + cpe:/o:linux:linux_kernel:3.4.8 + cpe:/o:linux:linux_kernel:3.2.4 + cpe:/o:linux:linux_kernel:3.4.9 + cpe:/o:linux:linux_kernel:3.2.5 + cpe:/o:linux:linux_kernel:3.0.65 + cpe:/o:linux:linux_kernel:3.2.12 + cpe:/o:linux:linux_kernel:3.8.10 + cpe:/o:linux:linux_kernel:3.8.12 + cpe:/o:linux:linux_kernel:3.8.11 + cpe:/o:linux:linux_kernel:3.8.13 + cpe:/o:linux:linux_kernel:3.7.9 + cpe:/o:linux:linux_kernel:3.7.8 + cpe:/o:linux:linux_kernel:3.7.7 + cpe:/o:linux:linux_kernel:3.7.6 + cpe:/o:linux:linux_kernel:3.6.3 + cpe:/o:linux:linux_kernel:3.7.5 + cpe:/o:linux:linux_kernel:3.7.4 + cpe:/o:linux:linux_kernel:3.7.3 + cpe:/o:linux:linux_kernel:3.7.2 + cpe:/o:linux:linux_kernel:3.6.7 + cpe:/o:linux:linux_kernel:3.6.6 + cpe:/o:linux:linux_kernel:3.6.5 + cpe:/o:linux:linux_kernel:3.6.4 + cpe:/o:linux:linux_kernel:3.6.9 + cpe:/o:linux:linux_kernel:3.6.8 + cpe:/o:linux:linux_kernel:3.10 + cpe:/o:linux:linux_kernel:3.11 + cpe:/o:linux:linux_kernel:3.12 + cpe:/o:linux:linux_kernel:3.13 + cpe:/o:linux:linux_kernel:3.10.1 + cpe:/o:linux:linux_kernel:3.10.2 + cpe:/o:linux:linux_kernel:3.10.3 + cpe:/o:linux:linux_kernel:3.6.2 + cpe:/o:linux:linux_kernel:3.6.1 + cpe:/o:linux:linux_kernel:3.3.6 + cpe:/o:linux:linux_kernel:3.3.7 + cpe:/o:linux:linux_kernel:3.3.8 + cpe:/o:linux:linux_kernel:3.0.1 + cpe:/o:linux:linux_kernel:3.2 + cpe:/o:linux:linux_kernel:3.1 + cpe:/o:linux:linux_kernel:3.7 + cpe:/o:linux:linux_kernel:3.6 + cpe:/o:linux:linux_kernel:3.4 + cpe:/o:linux:linux_kernel:3.1.6 + cpe:/o:linux:linux_kernel:3.1.5 + cpe:/o:linux:linux_kernel:3.1.7 + cpe:/o:linux:linux_kernel:3.0.32 + cpe:/o:linux:linux_kernel:3.8.9 + cpe:/o:linux:linux_kernel:3.1.2 + cpe:/o:linux:linux_kernel:3.1.1 + cpe:/o:linux:linux_kernel:3.1.4 + cpe:/o:linux:linux_kernel:3.1.3 + cpe:/o:linux:linux_kernel:3.9.10 + cpe:/o:linux:linux_kernel:3.0.29 + cpe:/o:linux:linux_kernel:3.3 + cpe:/o:linux:linux_kernel:3.8.4 + cpe:/o:linux:linux_kernel:3.2.26 + cpe:/o:linux:linux_kernel:3.8.5 + cpe:/o:linux:linux_kernel:3.2.27 + cpe:/o:linux:linux_kernel:3.8.2 + cpe:/o:linux:linux_kernel:3.2.24 + cpe:/o:linux:linux_kernel:3.8.3 + cpe:/o:linux:linux_kernel:3.2.25 + cpe:/o:linux:linux_kernel:3.8.8 + cpe:/o:linux:linux_kernel:3.8.6 + cpe:/o:linux:linux_kernel:3.2.28 + cpe:/o:linux:linux_kernel:3.8.7 + cpe:/o:linux:linux_kernel:3.2.29 + cpe:/o:linux:linux_kernel:3.3.3 + cpe:/o:linux:linux_kernel:3.3.4 + cpe:/o:linux:linux_kernel:3.3.5 + cpe:/o:linux:linux_kernel:3.2.22 + cpe:/o:linux:linux_kernel:3.8.1 + cpe:/o:linux:linux_kernel:3.2.20 + cpe:/o:linux:linux_kernel:3.3.1 + cpe:/o:linux:linux_kernel:3.2.21 + cpe:/o:linux:linux_kernel:3.3.2 + cpe:/o:linux:linux_kernel:3.11.1 + cpe:/o:linux:linux_kernel:3.11.2 + cpe:/o:linux:linux_kernel:3.2.23 + cpe:/o:linux:linux_kernel:3.0.17 + cpe:/o:linux:linux_kernel:3.9.11 + cpe:/o:linux:linux_kernel:3.0.16 + cpe:/o:linux:linux_kernel:3.0.15 + cpe:/o:linux:linux_kernel:3.2.30 + cpe:/o:linux:linux_kernel:3.0.14 + cpe:/o:linux:linux_kernel:3.0.13 + cpe:/o:linux:linux_kernel:3.0.12 + cpe:/o:linux:linux_kernel:3.0.11 + cpe:/o:linux:linux_kernel:3.4.61 + cpe:/o:linux:linux_kernel:3.0.10 + cpe:/o:linux:linux_kernel:3.4.64 + cpe:/o:linux:linux_kernel:3.8.0 + cpe:/o:linux:linux_kernel:3.4.65 + cpe:/o:linux:linux_kernel:3.4.62 + cpe:/o:linux:linux_kernel:3.4.63 + cpe:/o:linux:linux_kernel:3.4.68 + cpe:/o:linux:linux_kernel:3.4.66 + cpe:/o:linux:linux_kernel:3.4.67 + cpe:/o:linux:linux_kernel:3.5.3 + cpe:/o:linux:linux_kernel:3.5.1 + cpe:/o:linux:linux_kernel:3.5.2 + cpe:/o:linux:linux_kernel:3.10.4 + cpe:/o:linux:linux_kernel:3.4.72 + cpe:/o:linux:linux_kernel:3.10.9 + cpe:/o:linux:linux_kernel:3.4.73 + cpe:/o:linux:linux_kernel:3.4.74 + cpe:/o:linux:linux_kernel:3.4.75 + cpe:/o:linux:linux_kernel:3.4.76 + cpe:/o:linux:linux_kernel:3.10.5 + cpe:/o:linux:linux_kernel:3.4.77 + cpe:/o:linux:linux_kernel:3.10.6 + cpe:/o:linux:linux_kernel:3.4.78 + cpe:/o:linux:linux_kernel:3.10.7 + cpe:/o:linux:linux_kernel:3.4.79 + cpe:/o:linux:linux_kernel:3.10.8 + cpe:/o:linux:linux_kernel:3.7.10 + cpe:/o:linux:linux_kernel:3.2.17 + cpe:/o:linux:linux_kernel:3.2.18 + cpe:/o:linux:linux_kernel:3.2.19 + cpe:/o:linux:linux_kernel:3.2.13 + cpe:/o:linux:linux_kernel:3.2.14 + cpe:/o:linux:linux_kernel:3.11.3 + cpe:/o:linux:linux_kernel:3.2.15 + cpe:/o:linux:linux_kernel:3.4.60 + cpe:/o:linux:linux_kernel:3.2.16 + cpe:/o:linux:linux_kernel:3.11.5 + cpe:/o:linux:linux_kernel:3.11.4 + cpe:/o:linux:linux_kernel:3.2.10 + cpe:/o:linux:linux_kernel:3.11.7 + cpe:/o:linux:linux_kernel:3.2.11 + cpe:/o:linux:linux_kernel:3.11.6 + cpe:/o:linux:linux_kernel:3.11.9 + cpe:/o:linux:linux_kernel:3.11.8 + cpe:/o:linux:linux_kernel:3.4.69 + + CVE-2014-2673 + 2014-04-01T02:35:53.780-04:00 + 2014-04-19T00:48:43.147-04:00 + + + 4.7 + LOCAL + MEDIUM + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-01T15:17:37.303-04:00 + + + + + CONFIRM + https://github.com/torvalds/linux/commit/621b5060e823301d0cba4cb52a7ee3491922d291 + + + CONFIRM + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=621b5060e823301d0cba4cb52a7ee3491922d291 + + + CONFIRM + https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.15 + + + XF + linux-kernel-cve20142673-dos(92113) + + + BID + 66477 + + + MLIST + [oss-security] 20140330 Re: CVE request: Linux Kernel, two security issues + + + CONFIRM + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.7 + + + SECUNIA + 57436 + + The arch_dup_task_struct function in the Transactional Memory (TM) implementation in arch/powerpc/kernel/process.c in the Linux kernel before 3.13.7 on the powerpc platform does not properly interact with the clone and fork system calls, which allows local users to cause a denial of service (Program Check and system crash) via certain instructions that are executed with the processor in the Transactional state. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:linux:linux_kernel:3.0.48 + cpe:/o:linux:linux_kernel:3.0.49 + cpe:/o:linux:linux_kernel:3.0.46 + cpe:/o:linux:linux_kernel:3.0.47 + cpe:/o:linux:linux_kernel:3.0.44 + cpe:/o:linux:linux_kernel:3.0.45 + cpe:/o:linux:linux_kernel:3.0.42 + cpe:/o:linux:linux_kernel:3.4.70 + cpe:/o:linux:linux_kernel:3.4.71 + cpe:/o:linux:linux_kernel:3.0.40 + cpe:/o:linux:linux_kernel:3.0.41 + cpe:/o:linux:linux_kernel:3.4.45 + cpe:/o:linux:linux_kernel:3.4.44 + cpe:/o:linux:linux_kernel:3.4.46 + cpe:/o:linux:linux_kernel:3.4.41 + cpe:/o:linux:linux_kernel:3.4.40 + cpe:/o:linux:linux_kernel:3.4.43 + cpe:/o:linux:linux_kernel:3.4.42 + cpe:/o:linux:linux_kernel:3.4.49 + cpe:/o:linux:linux_kernel:3.4.48 + cpe:/o:linux:linux_kernel:3.0.59 + cpe:/o:linux:linux_kernel:3.4.47 + cpe:/o:linux:linux_kernel:3.0.55 + cpe:/o:linux:linux_kernel:3.0.56 + cpe:/o:linux:linux_kernel:3.0.57 + cpe:/o:linux:linux_kernel:3.0.58 + cpe:/o:linux:linux_kernel:3.0.51 + cpe:/o:linux:linux_kernel:3.0.52 + cpe:/o:linux:linux_kernel:3.0.53 + cpe:/o:linux:linux_kernel:3.11.10 + cpe:/o:linux:linux_kernel:3.0.50 + cpe:/o:linux:linux_kernel:3.4.57 + cpe:/o:linux:linux_kernel:3.4.56 + cpe:/o:linux:linux_kernel:3.4.55 + cpe:/o:linux:linux_kernel:3.4.54 + cpe:/o:linux:linux_kernel:3.4.53 + cpe:/o:linux:linux_kernel:3.4.52 + cpe:/o:linux:linux_kernel:3.4.51 + cpe:/o:linux:linux_kernel:3.4.50 + cpe:/o:linux:linux_kernel:3.0.43 + cpe:/o:linux:linux_kernel:3.10.26 + cpe:/o:linux:linux_kernel:3.4.59 + cpe:/o:linux:linux_kernel:3.0.24 + cpe:/o:linux:linux_kernel:3.0.25 + cpe:/o:linux:linux_kernel:3.0.22 + cpe:/o:linux:linux_kernel:3.1.9 + cpe:/o:linux:linux_kernel:3.0.23 + cpe:/o:linux:linux_kernel:3.10.28 + cpe:/o:linux:linux_kernel:3.0.28 + cpe:/o:linux:linux_kernel:3.10.27 + cpe:/o:linux:linux_kernel:3.0.26 + cpe:/o:linux:linux_kernel:3.10.29 + cpe:/o:linux:linux_kernel:3.4.58 + cpe:/o:linux:linux_kernel:3.0.27 + cpe:/o:linux:linux_kernel:3.10.24 + cpe:/o:linux:linux_kernel:3.10.23 + cpe:/o:linux:linux_kernel:3.10.25 + cpe:/o:linux:linux_kernel:3.10.20 + cpe:/o:linux:linux_kernel:3.1.8 + cpe:/o:linux:linux_kernel:3.0.20 + cpe:/o:linux:linux_kernel:3.10.22 + cpe:/o:linux:linux_kernel:3.10.21 + cpe:/o:linux:linux_kernel:3.4.21 + cpe:/o:linux:linux_kernel:3.4.20 + cpe:/o:linux:linux_kernel:3.4.23 + cpe:/o:linux:linux_kernel:3.4.22 + cpe:/o:linux:linux_kernel:3.4.24 + cpe:/o:linux:linux_kernel:3.4.27 + cpe:/o:linux:linux_kernel:3.4.26 + cpe:/o:linux:linux_kernel:3.4.29 + cpe:/o:linux:linux_kernel:3.10.15 + cpe:/o:linux:linux_kernel:3.4.28 + cpe:/o:linux:linux_kernel:3.0.54 + cpe:/o:linux:linux_kernel:3.0.33 + cpe:/o:linux:linux_kernel:3.0.34 + cpe:/o:linux:linux_kernel:3.0.35 + cpe:/o:linux:linux_kernel:3.0.36 + cpe:/o:linux:linux_kernel:3.10.19 + cpe:/o:linux:linux_kernel:3.0.37 + cpe:/o:linux:linux_kernel:3.10.18 + cpe:/o:linux:linux_kernel:3.0.38 + cpe:/o:linux:linux_kernel:3.4.25 + cpe:/o:linux:linux_kernel:3.10.17 + cpe:/o:linux:linux_kernel:3.0.39 + cpe:/o:linux:linux_kernel:3.10.16 + cpe:/o:linux:linux_kernel:3.10.14 + cpe:/o:linux:linux_kernel:3.10.13 + cpe:/o:linux:linux_kernel:3.10.12 + cpe:/o:linux:linux_kernel:3.10.11 + cpe:/o:linux:linux_kernel:3.10.10 + cpe:/o:linux:linux_kernel:3.0.30 + cpe:/o:linux:linux_kernel:3.0.31 + cpe:/o:linux:linux_kernel:3.9.8 + cpe:/o:linux:linux_kernel:3.5.5 + cpe:/o:linux:linux_kernel:3.4.32 + cpe:/o:linux:linux_kernel:3.9.9 + cpe:/o:linux:linux_kernel:3.5.6 + cpe:/o:linux:linux_kernel:3.4.31 + cpe:/o:linux:linux_kernel:3.5.7 + cpe:/o:linux:linux_kernel:3.4.30 + cpe:/o:linux:linux_kernel:3.7.1 + cpe:/o:linux:linux_kernel:3.4.35 + cpe:/o:linux:linux_kernel:3.9.0 + cpe:/o:linux:linux_kernel:3.0.18 + cpe:/o:linux:linux_kernel:3.4.34 + cpe:/o:linux:linux_kernel:3.4.33 + cpe:/o:linux:linux_kernel:3.9.2 + cpe:/o:linux:linux_kernel:3.9.1 + cpe:/o:linux:linux_kernel:3.0.19 + cpe:/o:linux:linux_kernel:3.4.39 + cpe:/o:linux:linux_kernel:3.9.4 + cpe:/o:linux:linux_kernel:3.4.38 + cpe:/o:linux:linux_kernel:3.9.3 + cpe:/o:linux:linux_kernel:3.4.37 + cpe:/o:linux:linux_kernel:3.9.6 + cpe:/o:linux:linux_kernel:3.9.5 + cpe:/o:linux:linux_kernel:3.0.21 + cpe:/o:linux:linux_kernel:3.9.7 + cpe:/o:linux:linux_kernel:3.5.4 + cpe:/o:linux:linux_kernel:3.0.4 + cpe:/o:linux:linux_kernel:3.0.5 + cpe:/o:linux:linux_kernel:3.0.2 + cpe:/o:linux:linux_kernel:3.0.3 + cpe:/o:linux:linux_kernel:3.0.8 + cpe:/o:linux:linux_kernel:3.0.6 + cpe:/o:linux:linux_kernel:3.0.7 + cpe:/o:linux:linux_kernel:3.4.36 + cpe:/o:linux:linux_kernel:3.13.1 + cpe:/o:linux:linux_kernel:3.6.10 + cpe:/o:linux:linux_kernel:3.6.11 + cpe:/o:linux:linux_kernel:3.13.8 + cpe:/o:linux:linux_kernel:3.13.6 + cpe:/o:linux:linux_kernel:3.13.7 + cpe:/o:linux:linux_kernel:3.13.4 + cpe:/o:linux:linux_kernel:3.13.5 + cpe:/o:linux:linux_kernel:3.13.2 + cpe:/o:linux:linux_kernel:3.13.3 + cpe:/o:linux:linux_kernel:3.4.1 + cpe:/o:linux:linux_kernel:3.4.19 + cpe:/o:linux:linux_kernel:3.4.17 + cpe:/o:linux:linux_kernel:3.4.3 + cpe:/o:linux:linux_kernel:3.4.18 + cpe:/o:linux:linux_kernel:3.4.2 + cpe:/o:linux:linux_kernel:3.2.9 + cpe:/o:linux:linux_kernel:3.4.15 + cpe:/o:linux:linux_kernel:3.2.8 + cpe:/o:linux:linux_kernel:3.4.16 + cpe:/o:linux:linux_kernel:3.4.4 + cpe:/o:linux:linux_kernel:3.12.12 + cpe:/o:linux:linux_kernel:3.2.7 + cpe:/o:linux:linux_kernel:3.4.13 + cpe:/o:linux:linux_kernel:3.12.13 + cpe:/o:linux:linux_kernel:3.12.10 + cpe:/o:linux:linux_kernel:3.4.11 + cpe:/o:linux:linux_kernel:3.12.11 + cpe:/o:linux:linux_kernel:3.4.12 + cpe:/o:linux:linux_kernel:3.4.10 + cpe:/o:linux:linux_kernel:3.0.61 + cpe:/o:linux:linux_kernel:3.3:rc2 + cpe:/o:linux:linux_kernel:3.4:rc7 + cpe:/o:linux:linux_kernel:3.0.60 + cpe:/o:linux:linux_kernel:3.3:rc7 + cpe:/o:linux:linux_kernel:3.4:rc5 + cpe:/o:linux:linux_kernel:3.3:rc5 + cpe:/o:linux:linux_kernel:3.4:rc6 + cpe:/o:linux:linux_kernel:3.3:rc6 + cpe:/o:linux:linux_kernel:3.0.64 + cpe:/o:linux:linux_kernel:3.0.63 + cpe:/o:linux:linux_kernel:3.0.62 + cpe:/o:linux:linux_kernel:3.12.1 + cpe:/o:linux:linux_kernel:3.0.68 + cpe:/o:linux:linux_kernel:3.0.67 + cpe:/o:linux:linux_kernel:3.0.66 + cpe:/o:linux:linux_kernel:3.4.14 + cpe:/o:linux:linux_kernel:3.12.7 + cpe:/o:linux:linux_kernel:3.1:rc1 + cpe:/o:linux:linux_kernel:3.0.9 + cpe:/o:linux:linux_kernel:3.0:rc4 + cpe:/o:linux:linux_kernel:3.2:rc2 + cpe:/o:linux:linux_kernel:3.12.8 + cpe:/o:linux:linux_kernel:3.1:rc4 + cpe:/o:linux:linux_kernel:3.0:rc3 + cpe:/o:linux:linux_kernel:3.12.9 + cpe:/o:linux:linux_kernel:3.0:rc2 + cpe:/o:linux:linux_kernel:3.1:rc2 + cpe:/o:linux:linux_kernel:3.0:rc1 + cpe:/o:linux:linux_kernel:3.2:rc7 + cpe:/o:linux:linux_kernel:3.12.3 + cpe:/o:linux:linux_kernel:3.1.10 + cpe:/o:linux:linux_kernel:3.2:rc6 + cpe:/o:linux:linux_kernel:3.12.4 + cpe:/o:linux:linux_kernel:3.0:rc7 + cpe:/o:linux:linux_kernel:3.2:rc5 + cpe:/o:linux:linux_kernel:3.12.5 + cpe:/o:linux:linux_kernel:3.9:rc3 + cpe:/o:linux:linux_kernel:3.0:rc6 + cpe:/o:linux:linux_kernel:3.12.6 + cpe:/o:linux:linux_kernel:3.0:rc5 + cpe:/o:linux:linux_kernel:3.9:rc1 + cpe:/o:linux:linux_kernel:3.9:rc4 + cpe:/o:linux:linux_kernel:3.9:rc7 + cpe:/o:linux:linux_kernel:3.12.2 + cpe:/o:linux:linux_kernel:3.9:rc2 + cpe:/o:linux:linux_kernel:3.9:rc5 + cpe:/o:linux:linux_kernel:3.3:rc3 + cpe:/o:linux:linux_kernel:3.4:rc4 + cpe:/o:linux:linux_kernel:3.4:rc3 + cpe:/o:linux:linux_kernel:3.3:rc1 + cpe:/o:linux:linux_kernel:3.4:rc2 + cpe:/o:linux:linux_kernel:3.9:rc6 + cpe:/o:linux:linux_kernel:3.3:rc4 + cpe:/o:linux:linux_kernel:3.4:rc1 + cpe:/o:linux:linux_kernel:3.4.5 + cpe:/o:linux:linux_kernel:3.2.2 + cpe:/o:linux:linux_kernel:3.2.3 + cpe:/o:linux:linux_kernel:3.2.1 + cpe:/o:linux:linux_kernel:3.4.6 + cpe:/o:linux:linux_kernel:3.2:rc3 + cpe:/o:linux:linux_kernel:3.2.6 + cpe:/o:linux:linux_kernel:3.4.7 + cpe:/o:linux:linux_kernel:3.1:rc3 + cpe:/o:linux:linux_kernel:3.2:rc4 + cpe:/o:linux:linux_kernel:3.4.8 + cpe:/o:linux:linux_kernel:3.2.4 + cpe:/o:linux:linux_kernel:3.4.9 + cpe:/o:linux:linux_kernel:3.2.5 + cpe:/o:linux:linux_kernel:3.0.65 + cpe:/o:linux:linux_kernel:3.2.12 + cpe:/o:linux:linux_kernel:3.8.10 + cpe:/o:linux:linux_kernel:3.8.12 + cpe:/o:linux:linux_kernel:3.8.11 + cpe:/o:linux:linux_kernel:3.8.13 + cpe:/o:linux:linux_kernel:3.7.9 + cpe:/o:linux:linux_kernel:3.7.8 + cpe:/o:linux:linux_kernel:3.7.7 + cpe:/o:linux:linux_kernel:3.7.6 + cpe:/o:linux:linux_kernel:3.6.3 + cpe:/o:linux:linux_kernel:3.7.5 + cpe:/o:linux:linux_kernel:3.7.4 + cpe:/o:linux:linux_kernel:3.7.3 + cpe:/o:linux:linux_kernel:3.7.2 + cpe:/o:linux:linux_kernel:3.6.7 + cpe:/o:linux:linux_kernel:3.6.6 + cpe:/o:linux:linux_kernel:3.6.5 + cpe:/o:linux:linux_kernel:3.6.4 + cpe:/o:linux:linux_kernel:3.6.9 + cpe:/o:linux:linux_kernel:3.6.8 + cpe:/o:linux:linux_kernel:3.10 + cpe:/o:linux:linux_kernel:3.11 + cpe:/o:linux:linux_kernel:3.12 + cpe:/o:linux:linux_kernel:3.13 + cpe:/o:linux:linux_kernel:3.10.1 + cpe:/o:linux:linux_kernel:3.10.2 + cpe:/o:linux:linux_kernel:3.14 + cpe:/o:linux:linux_kernel:3.10.3 + cpe:/o:linux:linux_kernel:3.6.2 + cpe:/o:linux:linux_kernel:3.6.1 + cpe:/o:linux:linux_kernel:3.3.6 + cpe:/o:linux:linux_kernel:3.3.7 + cpe:/o:linux:linux_kernel:3.3.8 + cpe:/o:linux:linux_kernel:3.0.1 + cpe:/o:linux:linux_kernel:3.2 + cpe:/o:linux:linux_kernel:3.1 + cpe:/o:linux:linux_kernel:3.7 + cpe:/o:linux:linux_kernel:3.6 + cpe:/o:linux:linux_kernel:3.4 + cpe:/o:linux:linux_kernel:3.1.6 + cpe:/o:linux:linux_kernel:3.1.5 + cpe:/o:linux:linux_kernel:3.1.7 + cpe:/o:linux:linux_kernel:3.0.32 + cpe:/o:linux:linux_kernel:3.8.9 + cpe:/o:linux:linux_kernel:3.1.2 + cpe:/o:linux:linux_kernel:3.1.1 + cpe:/o:linux:linux_kernel:3.1.4 + cpe:/o:linux:linux_kernel:3.1.3 + cpe:/o:linux:linux_kernel:3.9.10 + cpe:/o:linux:linux_kernel:3.0.29 + cpe:/o:linux:linux_kernel:3.3 + cpe:/o:linux:linux_kernel:3.8.4 + cpe:/o:linux:linux_kernel:3.2.26 + cpe:/o:linux:linux_kernel:3.8.5 + cpe:/o:linux:linux_kernel:3.2.27 + cpe:/o:linux:linux_kernel:3.8.2 + cpe:/o:linux:linux_kernel:3.2.24 + cpe:/o:linux:linux_kernel:3.8.3 + cpe:/o:linux:linux_kernel:3.2.25 + cpe:/o:linux:linux_kernel:3.8.8 + cpe:/o:linux:linux_kernel:3.8.6 + cpe:/o:linux:linux_kernel:3.2.28 + cpe:/o:linux:linux_kernel:3.8.7 + cpe:/o:linux:linux_kernel:3.2.29 + cpe:/o:linux:linux_kernel:3.3.3 + cpe:/o:linux:linux_kernel:3.3.4 + cpe:/o:linux:linux_kernel:3.3.5 + cpe:/o:linux:linux_kernel:3.2.22 + cpe:/o:linux:linux_kernel:3.8.1 + cpe:/o:linux:linux_kernel:3.2.20 + cpe:/o:linux:linux_kernel:3.3.1 + cpe:/o:linux:linux_kernel:3.2.21 + cpe:/o:linux:linux_kernel:3.3.2 + cpe:/o:linux:linux_kernel:3.11.1 + cpe:/o:linux:linux_kernel:3.11.2 + cpe:/o:linux:linux_kernel:3.2.23 + cpe:/o:linux:linux_kernel:3.0.17 + cpe:/o:linux:linux_kernel:3.9.11 + cpe:/o:linux:linux_kernel:3.0.16 + cpe:/o:linux:linux_kernel:3.0.15 + cpe:/o:linux:linux_kernel:3.2.30 + cpe:/o:linux:linux_kernel:3.0.14 + cpe:/o:linux:linux_kernel:3.0.13 + cpe:/o:linux:linux_kernel:3.0.12 + cpe:/o:linux:linux_kernel:3.0.11 + cpe:/o:linux:linux_kernel:3.4.61 + cpe:/o:linux:linux_kernel:3.0.10 + cpe:/o:linux:linux_kernel:3.4.64 + cpe:/o:linux:linux_kernel:3.8.0 + cpe:/o:linux:linux_kernel:3.4.65 + cpe:/o:linux:linux_kernel:3.4.62 + cpe:/o:linux:linux_kernel:3.4.63 + cpe:/o:linux:linux_kernel:3.4.68 + cpe:/o:linux:linux_kernel:3.4.66 + cpe:/o:linux:linux_kernel:3.4.67 + cpe:/o:linux:linux_kernel:3.5.3 + cpe:/o:linux:linux_kernel:3.5.1 + cpe:/o:linux:linux_kernel:3.5.2 + cpe:/o:linux:linux_kernel:3.10.4 + cpe:/o:linux:linux_kernel:3.4.72 + cpe:/o:linux:linux_kernel:3.10.9 + cpe:/o:linux:linux_kernel:3.4.73 + cpe:/o:linux:linux_kernel:3.4.74 + cpe:/o:linux:linux_kernel:3.4.75 + cpe:/o:linux:linux_kernel:3.4.76 + cpe:/o:linux:linux_kernel:3.10.5 + cpe:/o:linux:linux_kernel:3.4.77 + cpe:/o:linux:linux_kernel:3.10.6 + cpe:/o:linux:linux_kernel:3.4.78 + cpe:/o:linux:linux_kernel:3.10.7 + cpe:/o:linux:linux_kernel:3.4.79 + cpe:/o:linux:linux_kernel:3.10.8 + cpe:/o:linux:linux_kernel:3.7.10 + cpe:/o:linux:linux_kernel:3.2.17 + cpe:/o:linux:linux_kernel:3.2.18 + cpe:/o:linux:linux_kernel:3.2.19 + cpe:/o:linux:linux_kernel:3.2.13 + cpe:/o:linux:linux_kernel:3.2.14 + cpe:/o:linux:linux_kernel:3.11.3 + cpe:/o:linux:linux_kernel:3.2.15 + cpe:/o:linux:linux_kernel:3.4.60 + cpe:/o:linux:linux_kernel:3.2.16 + cpe:/o:linux:linux_kernel:3.11.5 + cpe:/o:linux:linux_kernel:3.11.4 + cpe:/o:linux:linux_kernel:3.2.10 + cpe:/o:linux:linux_kernel:3.11.7 + cpe:/o:linux:linux_kernel:3.2.11 + cpe:/o:linux:linux_kernel:3.11.6 + cpe:/o:linux:linux_kernel:3.11.9 + cpe:/o:linux:linux_kernel:3.11.8 + cpe:/o:linux:linux_kernel:3.4.69 + + CVE-2014-2678 + 2014-04-01T02:35:53.810-04:00 + 2014-04-19T00:48:43.270-04:00 + + + 4.7 + LOCAL + MEDIUM + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-01T19:47:21.940-04:00 + + + + MLIST + [linux-kernel] 20140329 [PATCH v2] rds: prevent dereference of a NULL device in rds_iw_laddr_check + + + BID + 66543 + + + MLIST + [oss-security] 20140331 CVE-2013-7348 CVE-2014-2678 Linux kernel aio and rds issues + + + FEDORA + FEDORA-2014-4844 + + The rds_iw_laddr_check function in net/rds/iw.c in the Linux kernel through 3.14 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports. + + + + + + + + + + + + + + + + + cpe:/a:citrix:vdi-in-a-box:5.3.5 + cpe:/a:citrix:vdi-in-a-box:5.3.4 + cpe:/a:citrix:vdi-in-a-box:5.4.2 + cpe:/a:citrix:vdi-in-a-box:5.3.0 + cpe:/a:citrix:vdi-in-a-box:5.4.1 + cpe:/a:citrix:vdi-in-a-box:5.4.0 + cpe:/a:citrix:vdi-in-a-box:5.3.3 + cpe:/a:citrix:vdi-in-a-box:5.3.1 + cpe:/a:citrix:vdi-in-a-box:5.3.2 + + CVE-2014-2690 + 2014-04-15T10:55:04.827-04:00 + 2014-04-16T09:07:38.793-04:00 + + + 2.1 + LOCAL + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-16T09:07:38.590-04:00 + + + + + SECTRACK + 1030068 + + + CONFIRM + http://support.citrix.com/article/CTX140106 + + + SECUNIA + 57734 + + Citrix VDI-in-a-Box 5.3.x before 5.3.6 and 5.4.x before 5.4.3 allows local users to obtain administrator credentials by reading the log. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:linux:linux_kernel:3.0.48 + cpe:/o:linux:linux_kernel:3.0.49 + cpe:/o:linux:linux_kernel:3.0.46 + cpe:/o:linux:linux_kernel:3.0.47 + cpe:/o:linux:linux_kernel:3.0.44 + cpe:/o:linux:linux_kernel:3.0.45 + cpe:/o:linux:linux_kernel:3.0.42 + cpe:/o:linux:linux_kernel:3.4.70 + cpe:/o:linux:linux_kernel:3.4.71 + cpe:/o:linux:linux_kernel:3.0.40 + cpe:/o:linux:linux_kernel:3.0.41 + cpe:/o:linux:linux_kernel:3.4.45 + cpe:/o:linux:linux_kernel:3.4.44 + cpe:/o:linux:linux_kernel:3.4.46 + cpe:/o:linux:linux_kernel:3.4.41 + cpe:/o:linux:linux_kernel:3.4.40 + cpe:/o:linux:linux_kernel:3.4.43 + cpe:/o:linux:linux_kernel:3.4.42 + cpe:/o:linux:linux_kernel:3.4.49 + cpe:/o:linux:linux_kernel:3.4.48 + cpe:/o:linux:linux_kernel:3.0.59 + cpe:/o:linux:linux_kernel:3.4.47 + cpe:/o:linux:linux_kernel:3.0.55 + cpe:/o:linux:linux_kernel:3.0.56 + cpe:/o:linux:linux_kernel:3.0.57 + cpe:/o:linux:linux_kernel:3.0.58 + cpe:/o:linux:linux_kernel:3.0.51 + cpe:/o:linux:linux_kernel:3.0.52 + cpe:/o:linux:linux_kernel:3.0.53 + cpe:/o:linux:linux_kernel:3.11.10 + cpe:/o:linux:linux_kernel:3.0.50 + cpe:/o:linux:linux_kernel:3.4.57 + cpe:/o:linux:linux_kernel:3.4.56 + cpe:/o:linux:linux_kernel:3.4.55 + cpe:/o:linux:linux_kernel:3.4.54 + cpe:/o:linux:linux_kernel:3.4.53 + cpe:/o:linux:linux_kernel:3.4.52 + cpe:/o:linux:linux_kernel:3.4.51 + cpe:/o:linux:linux_kernel:3.4.50 + cpe:/o:linux:linux_kernel:3.0.43 + cpe:/o:linux:linux_kernel:3.10.26 + cpe:/o:linux:linux_kernel:3.4.59 + cpe:/o:linux:linux_kernel:3.0.24 + cpe:/o:linux:linux_kernel:3.0.25 + cpe:/o:linux:linux_kernel:3.0.22 + cpe:/o:linux:linux_kernel:3.1.9 + cpe:/o:linux:linux_kernel:3.0.23 + cpe:/o:linux:linux_kernel:3.10.28 + cpe:/o:linux:linux_kernel:3.0.28 + cpe:/o:linux:linux_kernel:3.10.27 + cpe:/o:linux:linux_kernel:3.0.26 + cpe:/o:linux:linux_kernel:3.10.29 + cpe:/o:linux:linux_kernel:3.4.58 + cpe:/o:linux:linux_kernel:3.0.27 + cpe:/o:linux:linux_kernel:3.10.24 + cpe:/o:linux:linux_kernel:3.10.23 + cpe:/o:linux:linux_kernel:3.10.25 + cpe:/o:linux:linux_kernel:3.10.20 + cpe:/o:linux:linux_kernel:3.1.8 + cpe:/o:linux:linux_kernel:3.0.20 + cpe:/o:linux:linux_kernel:3.10.22 + cpe:/o:linux:linux_kernel:3.10.21 + cpe:/o:linux:linux_kernel:3.4.21 + cpe:/o:linux:linux_kernel:3.4.20 + cpe:/o:linux:linux_kernel:3.4.23 + cpe:/o:linux:linux_kernel:3.4.22 + cpe:/o:linux:linux_kernel:3.4.24 + cpe:/o:linux:linux_kernel:3.4.27 + cpe:/o:linux:linux_kernel:3.4.26 + cpe:/o:linux:linux_kernel:3.4.29 + cpe:/o:linux:linux_kernel:3.10.15 + cpe:/o:linux:linux_kernel:3.4.28 + cpe:/o:linux:linux_kernel:3.0.54 + cpe:/o:linux:linux_kernel:3.0.33 + cpe:/o:linux:linux_kernel:3.0.34 + cpe:/o:linux:linux_kernel:3.0.35 + cpe:/o:linux:linux_kernel:3.0.36 + cpe:/o:linux:linux_kernel:3.10.19 + cpe:/o:linux:linux_kernel:3.0.37 + cpe:/o:linux:linux_kernel:3.10.18 + cpe:/o:linux:linux_kernel:3.0.38 + cpe:/o:linux:linux_kernel:3.4.25 + cpe:/o:linux:linux_kernel:3.10.17 + cpe:/o:linux:linux_kernel:3.0.39 + cpe:/o:linux:linux_kernel:3.10.16 + cpe:/o:linux:linux_kernel:3.10.14 + cpe:/o:linux:linux_kernel:3.10.13 + cpe:/o:linux:linux_kernel:3.10.12 + cpe:/o:linux:linux_kernel:3.10.11 + cpe:/o:linux:linux_kernel:3.10.10 + cpe:/o:linux:linux_kernel:3.0.30 + cpe:/o:linux:linux_kernel:3.0.31 + cpe:/o:linux:linux_kernel:3.9.8 + cpe:/o:linux:linux_kernel:3.5.5 + cpe:/o:linux:linux_kernel:3.4.32 + cpe:/o:linux:linux_kernel:3.9.9 + cpe:/o:linux:linux_kernel:3.5.6 + cpe:/o:linux:linux_kernel:3.4.31 + cpe:/o:linux:linux_kernel:3.5.7 + cpe:/o:linux:linux_kernel:3.4.30 + cpe:/o:linux:linux_kernel:3.7.1 + cpe:/o:linux:linux_kernel:3.4.35 + cpe:/o:linux:linux_kernel:3.9.0 + cpe:/o:linux:linux_kernel:3.0.18 + cpe:/o:linux:linux_kernel:3.4.34 + cpe:/o:linux:linux_kernel:3.4.33 + cpe:/o:linux:linux_kernel:3.9.2 + cpe:/o:linux:linux_kernel:3.9.1 + cpe:/o:linux:linux_kernel:3.0.19 + cpe:/o:linux:linux_kernel:3.4.39 + cpe:/o:linux:linux_kernel:3.9.4 + cpe:/o:linux:linux_kernel:3.4.38 + cpe:/o:linux:linux_kernel:3.9.3 + cpe:/o:linux:linux_kernel:3.4.37 + cpe:/o:linux:linux_kernel:3.9.6 + cpe:/o:linux:linux_kernel:3.9.5 + cpe:/o:linux:linux_kernel:3.0.21 + cpe:/o:linux:linux_kernel:3.9.7 + cpe:/o:linux:linux_kernel:3.5.4 + cpe:/o:linux:linux_kernel:3.0.4 + cpe:/o:linux:linux_kernel:3.0.5 + cpe:/o:linux:linux_kernel:3.0.2 + cpe:/o:linux:linux_kernel:3.0.3 + cpe:/o:linux:linux_kernel:3.0.8 + cpe:/o:linux:linux_kernel:3.0.6 + cpe:/o:linux:linux_kernel:3.0.7 + cpe:/o:linux:linux_kernel:3.4.36 + cpe:/o:linux:linux_kernel:3.12.17 + cpe:/o:linux:linux_kernel:3.13.1 + cpe:/o:linux:linux_kernel:3.6.10 + cpe:/o:linux:linux_kernel:3.6.11 + cpe:/o:linux:linux_kernel:3.13.6 + cpe:/o:linux:linux_kernel:3.13.4 + cpe:/o:linux:linux_kernel:3.13.5 + cpe:/o:linux:linux_kernel:3.13.2 + cpe:/o:linux:linux_kernel:3.13.3 + cpe:/o:linux:linux_kernel:3.4.1 + cpe:/o:linux:linux_kernel:3.4.19 + cpe:/o:linux:linux_kernel:3.4.17 + cpe:/o:linux:linux_kernel:3.4.3 + cpe:/o:linux:linux_kernel:3.4.18 + cpe:/o:linux:linux_kernel:3.4.2 + cpe:/o:linux:linux_kernel:3.2.9 + cpe:/o:linux:linux_kernel:3.4.15 + cpe:/o:linux:linux_kernel:3.2.8 + cpe:/o:linux:linux_kernel:3.4.16 + cpe:/o:linux:linux_kernel:3.4.4 + cpe:/o:linux:linux_kernel:3.12.12 + cpe:/o:linux:linux_kernel:3.2.7 + cpe:/o:linux:linux_kernel:3.4.13 + cpe:/o:linux:linux_kernel:3.12.13 + cpe:/o:linux:linux_kernel:3.12.10 + cpe:/o:linux:linux_kernel:3.4.11 + cpe:/o:linux:linux_kernel:3.12.11 + cpe:/o:linux:linux_kernel:3.4.12 + cpe:/o:linux:linux_kernel:3.12.16 + cpe:/o:linux:linux_kernel:3.4.10 + cpe:/o:linux:linux_kernel:3.12.14 + cpe:/o:linux:linux_kernel:3.12.15 + cpe:/o:linux:linux_kernel:3.0.61 + cpe:/o:linux:linux_kernel:3.3:rc2 + cpe:/o:linux:linux_kernel:3.4:rc7 + cpe:/o:linux:linux_kernel:3.0.60 + cpe:/o:linux:linux_kernel:3.3:rc7 + cpe:/o:linux:linux_kernel:3.4:rc5 + cpe:/o:linux:linux_kernel:3.3:rc5 + cpe:/o:linux:linux_kernel:3.4:rc6 + cpe:/o:linux:linux_kernel:3.3:rc6 + cpe:/o:linux:linux_kernel:3.0.64 + cpe:/o:linux:linux_kernel:3.0.63 + cpe:/o:linux:linux_kernel:3.0.62 + cpe:/o:linux:linux_kernel:3.12.1 + cpe:/o:linux:linux_kernel:3.0.68 + cpe:/o:linux:linux_kernel:3.0.67 + cpe:/o:linux:linux_kernel:3.0.66 + cpe:/o:linux:linux_kernel:3.4.14 + cpe:/o:linux:linux_kernel:3.12.7 + cpe:/o:linux:linux_kernel:3.2:rc2 + cpe:/o:linux:linux_kernel:3.1:rc1 + cpe:/o:linux:linux_kernel:3.0.9 + cpe:/o:linux:linux_kernel:3.0:rc4 + cpe:/o:linux:linux_kernel:3.12.8 + cpe:/o:linux:linux_kernel:3.1:rc4 + cpe:/o:linux:linux_kernel:3.0:rc3 + cpe:/o:linux:linux_kernel:3.12.9 + cpe:/o:linux:linux_kernel:3.0:rc2 + cpe:/o:linux:linux_kernel:3.1:rc2 + cpe:/o:linux:linux_kernel:3.0:rc1 + cpe:/o:linux:linux_kernel:3.2:rc7 + cpe:/o:linux:linux_kernel:3.12.3 + cpe:/o:linux:linux_kernel:3.2:rc6 + cpe:/o:linux:linux_kernel:3.1.10 + cpe:/o:linux:linux_kernel:3.12.4 + cpe:/o:linux:linux_kernel:3.2:rc5 + cpe:/o:linux:linux_kernel:3.0:rc7 + cpe:/o:linux:linux_kernel:3.12.5 + cpe:/o:linux:linux_kernel:3.9:rc3 + cpe:/o:linux:linux_kernel:3.0:rc6 + cpe:/o:linux:linux_kernel:3.12.6 + cpe:/o:linux:linux_kernel:3.0:rc5 + cpe:/o:linux:linux_kernel:3.9:rc1 + cpe:/o:linux:linux_kernel:3.9:rc4 + cpe:/o:linux:linux_kernel:3.9:rc7 + cpe:/o:linux:linux_kernel:3.12.2 + cpe:/o:linux:linux_kernel:3.9:rc2 + cpe:/o:linux:linux_kernel:3.9:rc5 + cpe:/o:linux:linux_kernel:3.3:rc3 + cpe:/o:linux:linux_kernel:3.4:rc4 + cpe:/o:linux:linux_kernel:3.4:rc3 + cpe:/o:linux:linux_kernel:3.3:rc1 + cpe:/o:linux:linux_kernel:3.4:rc2 + cpe:/o:linux:linux_kernel:3.9:rc6 + cpe:/o:linux:linux_kernel:3.3:rc4 + cpe:/o:linux:linux_kernel:3.4:rc1 + cpe:/o:linux:linux_kernel:3.4.5 + cpe:/o:linux:linux_kernel:3.2.2 + cpe:/o:linux:linux_kernel:3.2.3 + cpe:/o:linux:linux_kernel:3.2.1 + cpe:/o:linux:linux_kernel:3.4.6 + cpe:/o:linux:linux_kernel:3.2:rc3 + cpe:/o:linux:linux_kernel:3.2.6 + cpe:/o:linux:linux_kernel:3.4.7 + cpe:/o:linux:linux_kernel:3.2:rc4 + cpe:/o:linux:linux_kernel:3.1:rc3 + cpe:/o:linux:linux_kernel:3.4.8 + cpe:/o:linux:linux_kernel:3.2.4 + cpe:/o:linux:linux_kernel:3.4.9 + cpe:/o:linux:linux_kernel:3.2.5 + cpe:/o:linux:linux_kernel:3.0.65 + cpe:/o:linux:linux_kernel:3.2.12 + cpe:/o:linux:linux_kernel:3.8.10 + cpe:/o:linux:linux_kernel:3.8.12 + cpe:/o:linux:linux_kernel:3.8.11 + cpe:/o:linux:linux_kernel:3.8.13 + cpe:/o:linux:linux_kernel:3.7.9 + cpe:/o:linux:linux_kernel:3.7.8 + cpe:/o:linux:linux_kernel:3.7.7 + cpe:/o:linux:linux_kernel:3.7.6 + cpe:/o:linux:linux_kernel:3.6.3 + cpe:/o:linux:linux_kernel:3.7.5 + cpe:/o:linux:linux_kernel:3.7.4 + cpe:/o:linux:linux_kernel:3.7.3 + cpe:/o:linux:linux_kernel:3.7.2 + cpe:/o:linux:linux_kernel:3.6.7 + cpe:/o:linux:linux_kernel:3.6.6 + cpe:/o:linux:linux_kernel:3.6.5 + cpe:/o:linux:linux_kernel:3.6.4 + cpe:/o:linux:linux_kernel:3.6.9 + cpe:/o:linux:linux_kernel:3.6.8 + cpe:/o:linux:linux_kernel:3.10 + cpe:/o:linux:linux_kernel:3.11 + cpe:/o:linux:linux_kernel:3.12 + cpe:/o:linux:linux_kernel:3.13 + cpe:/o:linux:linux_kernel:3.10.1 + cpe:/o:linux:linux_kernel:3.10.2 + cpe:/o:linux:linux_kernel:3.10.3 + cpe:/o:linux:linux_kernel:3.6.2 + cpe:/o:linux:linux_kernel:3.6.1 + cpe:/o:linux:linux_kernel:3.3.6 + cpe:/o:linux:linux_kernel:3.3.7 + cpe:/o:linux:linux_kernel:3.3.8 + cpe:/o:linux:linux_kernel:3.0.1 + cpe:/o:linux:linux_kernel:3.2 + cpe:/o:linux:linux_kernel:3.1 + cpe:/o:linux:linux_kernel:3.7 + cpe:/o:linux:linux_kernel:3.6 + cpe:/o:linux:linux_kernel:3.4 + cpe:/o:linux:linux_kernel:3.1.6 + cpe:/o:linux:linux_kernel:3.1.5 + cpe:/o:linux:linux_kernel:3.1.7 + cpe:/o:linux:linux_kernel:3.0.32 + cpe:/o:linux:linux_kernel:3.8.9 + cpe:/o:linux:linux_kernel:3.1.2 + cpe:/o:linux:linux_kernel:3.1.1 + cpe:/o:linux:linux_kernel:3.1.4 + cpe:/o:linux:linux_kernel:3.1.3 + cpe:/o:linux:linux_kernel:3.9.10 + cpe:/o:linux:linux_kernel:3.0.29 + cpe:/o:linux:linux_kernel:3.3 + cpe:/o:linux:linux_kernel:3.8.4 + cpe:/o:linux:linux_kernel:3.2.26 + cpe:/o:linux:linux_kernel:3.8.5 + cpe:/o:linux:linux_kernel:3.2.27 + cpe:/o:linux:linux_kernel:3.8.2 + cpe:/o:linux:linux_kernel:3.2.24 + cpe:/o:linux:linux_kernel:3.8.3 + cpe:/o:linux:linux_kernel:3.2.25 + cpe:/o:linux:linux_kernel:3.8.8 + cpe:/o:linux:linux_kernel:3.8.6 + cpe:/o:linux:linux_kernel:3.2.28 + cpe:/o:linux:linux_kernel:3.8.7 + cpe:/o:linux:linux_kernel:3.2.29 + cpe:/o:linux:linux_kernel:3.3.3 + cpe:/o:linux:linux_kernel:3.3.4 + cpe:/o:linux:linux_kernel:3.3.5 + cpe:/o:linux:linux_kernel:3.2.22 + cpe:/o:linux:linux_kernel:3.8.1 + cpe:/o:linux:linux_kernel:3.2.20 + cpe:/o:linux:linux_kernel:3.3.1 + cpe:/o:linux:linux_kernel:3.2.21 + cpe:/o:linux:linux_kernel:3.3.2 + cpe:/o:linux:linux_kernel:3.11.1 + cpe:/o:linux:linux_kernel:3.11.2 + cpe:/o:linux:linux_kernel:3.2.23 + cpe:/o:linux:linux_kernel:3.0.17 + cpe:/o:linux:linux_kernel:3.9.11 + cpe:/o:linux:linux_kernel:3.0.16 + cpe:/o:linux:linux_kernel:3.0.15 + cpe:/o:linux:linux_kernel:3.2.30 + cpe:/o:linux:linux_kernel:3.0.14 + cpe:/o:linux:linux_kernel:3.0.13 + cpe:/o:linux:linux_kernel:3.0.12 + cpe:/o:linux:linux_kernel:3.0.11 + cpe:/o:linux:linux_kernel:3.4.61 + cpe:/o:linux:linux_kernel:3.0.10 + cpe:/o:linux:linux_kernel:3.4.64 + cpe:/o:linux:linux_kernel:3.8.0 + cpe:/o:linux:linux_kernel:3.4.65 + cpe:/o:linux:linux_kernel:3.4.62 + cpe:/o:linux:linux_kernel:3.4.63 + cpe:/o:linux:linux_kernel:3.4.68 + cpe:/o:linux:linux_kernel:3.4.66 + cpe:/o:linux:linux_kernel:3.4.67 + cpe:/o:linux:linux_kernel:3.5.3 + cpe:/o:linux:linux_kernel:3.5.1 + cpe:/o:linux:linux_kernel:3.5.2 + cpe:/o:linux:linux_kernel:3.10.4 + cpe:/o:linux:linux_kernel:3.4.72 + cpe:/o:linux:linux_kernel:3.10.9 + cpe:/o:linux:linux_kernel:3.4.73 + cpe:/o:linux:linux_kernel:3.4.74 + cpe:/o:linux:linux_kernel:3.4.75 + cpe:/o:linux:linux_kernel:3.4.76 + cpe:/o:linux:linux_kernel:3.10.5 + cpe:/o:linux:linux_kernel:3.4.77 + cpe:/o:linux:linux_kernel:3.10.6 + cpe:/o:linux:linux_kernel:3.4.78 + cpe:/o:linux:linux_kernel:3.10.7 + cpe:/o:linux:linux_kernel:3.4.79 + cpe:/o:linux:linux_kernel:3.10.8 + cpe:/o:linux:linux_kernel:3.7.10 + cpe:/o:linux:linux_kernel:3.2.17 + cpe:/o:linux:linux_kernel:3.2.18 + cpe:/o:linux:linux_kernel:3.2.19 + cpe:/o:linux:linux_kernel:3.2.13 + cpe:/o:linux:linux_kernel:3.2.14 + cpe:/o:linux:linux_kernel:3.11.3 + cpe:/o:linux:linux_kernel:3.2.15 + cpe:/o:linux:linux_kernel:3.4.60 + cpe:/o:linux:linux_kernel:3.2.16 + cpe:/o:linux:linux_kernel:3.11.5 + cpe:/o:linux:linux_kernel:3.11.4 + cpe:/o:linux:linux_kernel:3.2.10 + cpe:/o:linux:linux_kernel:3.11.7 + cpe:/o:linux:linux_kernel:3.2.11 + cpe:/o:linux:linux_kernel:3.11.6 + cpe:/o:linux:linux_kernel:3.11.9 + cpe:/o:linux:linux_kernel:3.11.8 + cpe:/o:linux:linux_kernel:3.4.69 + + CVE-2014-2706 + 2014-04-14T19:55:07.700-04:00 + 2014-04-15T11:12:39.970-04:00 + + + 7.1 + NETWORK + MEDIUM + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-15T11:12:37.143-04:00 + + + + + CONFIRM + https://github.com/torvalds/linux/commit/1d147bfa64293b2723c4fec50922168658e613ba + + + CONFIRM + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1d147bfa64293b2723c4fec50922168658e613ba + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1083512 + + + CONFIRM + https://bugzilla.kernel.org/show_bug.cgi?id=70551#c18 + + + MLIST + [oss-security] 20140401 Re: CVE request: Linux Kernel, two security issues + + + CONFIRM + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.7 + + Race condition in the mac80211 subsystem in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via network traffic that improperly interacts with the WLAN_STA_PS_STA state (aka power-save mode), related to sta_info.c and tx.c. + + + + + + + + + + + + + + + + + + cpe:/a:linuxfoundation:cups-filters:1.0.41 + cpe:/a:linuxfoundation:cups-filters:1.0.42 + cpe:/a:linuxfoundation:cups-filters:1.0.43 + cpe:/a:linuxfoundation:cups-filters:1.0.44 + cpe:/a:linuxfoundation:cups-filters:1.0.45 + cpe:/a:linuxfoundation:cups-filters:1.0.46 + cpe:/a:linuxfoundation:cups-filters:1.0.49 + cpe:/a:linuxfoundation:cups-filters:1.0.47 + cpe:/a:linuxfoundation:cups-filters:1.0.48 + cpe:/a:linuxfoundation:cups-filters:1.0.50 + + CVE-2014-2707 + 2014-04-17T10:55:11.700-04:00 + 2014-04-18T13:40:13.767-04:00 + + + 5.8 + ADJACENT_NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-18T13:40:13.673-04:00 + + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1083326 + + + SECUNIA + 57530 + + + MLIST + [oss-security] 20140402 Re: cups-browsed remote exploit + + + FEDORA + FEDORA-2014-4708 + + + CONFIRM + http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7188#NEWS + + cups-browsed in cups-filters 1.0.41 before 1.0.51 in allows remote IPP printers to execute arbitrary commands via shell metacharacters in the (1) model or (2) PDL, related to "System V interface scripts generated for queues." + + + + + + + + + cpe:/a:cacti:cacti:0.8.8b + + CVE-2014-2708 + 2014-04-10T16:29:21.050-04:00 + 2014-04-11T12:05:53.480-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-11T12:05:49.713-04:00 + + + + + CONFIRM + http://svn.cacti.net/viewvc?view=rev&revision=7439 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1084258 + + + XF + cacti-cve20142708-sql-injection(92278) + + + BID + 66555 + + + MLIST + [oss-security] 20140401 CVE request: cacti "bug#0002405: SQL injection in graph_xport.php" + + + MLIST + [oss-security] 20140403 Re: CVE request: cacti "bug#0002405: SQL injection in graph_xport.php" + + SQL injection vulnerability in graph_xport.php in Cacti 0.8.8b allows remote attackers to execute arbitrary SQL commands via unspecified vectors. + + + + + + + + + + + + + + + + + + + cpe:/a:cacti:cacti:0.8.7f + cpe:/a:cacti:cacti:0.8.7 + cpe:/a:cacti:cacti:0.8.7g + cpe:/a:cacti:cacti:0.8.8 + cpe:/a:cacti:cacti:0.8.7b + cpe:/a:cacti:cacti:0.8.8b + cpe:/a:cacti:cacti:0.8.8a + cpe:/a:cacti:cacti:0.8.7c + cpe:/a:cacti:cacti:0.8.7d + cpe:/a:cacti:cacti:0.8.7a + cpe:/a:cacti:cacti:0.8.7e + + CVE-2014-2709 + 2014-04-23T11:55:04.360-04:00 + 2014-04-24T11:24:00.673-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-24T11:24:00.610-04:00 + + + + CONFIRM + http://svn.cacti.net/viewvc?view=rev&revision=7439 + + + CONFIRM + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768 + + + BID + 66630 + + + SECUNIA + 57647 + + + MLIST + [oss-security] 20140403 Re: CVE request: cacti "bug#0002405: SQL injection in graph_xport.php" + + + FEDORA + FEDORA-2014-4892 + + + FEDORA + FEDORA-2014-4928 + + lib/rrd.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified parameters. + + + + + + + + + + + + + + + + + + + cpe:/o:juniper:junos:12.3 + cpe:/o:juniper:junos:12.2 + cpe:/o:juniper:junos:12.1x44 + cpe:/o:juniper:junos:12.1x46 + cpe:/o:juniper:junos:11.4 + cpe:/o:juniper:junos:12.1x45 + cpe:/o:juniper:junos:12.1 + cpe:/o:juniper:junos:11.4x27 + cpe:/o:juniper:junos:13.2 + cpe:/o:juniper:junos:13.1 + cpe:/o:juniper:junos:13.3 + + CVE-2014-2711 + 2014-04-14T11:09:06.333-04:00 + 2014-04-19T00:48:43.723-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-15T09:34:06.177-04:00 + + + + + CONFIRM + http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10619 + + Cross-site scripting (XSS) vulnerability in J-Web in Juniper Junos before 11.4R11, 11.4X27 before 11.4X27.62 (BBE), 12.1 before 12.1R9, 12.1X44 before 12.1X44-D35, 12.1X45 before 12.1X45-D25, 12.1X46 before 12.1X46-D20, 12.2 before 12.2R7, 12.3 before 12.3R6, 13.1 before 13.1R4, 13.2 before 13.2R3, and 13.3 before 13.3R1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + + + + + + + cpe:/o:juniper:junos:12.2 + cpe:/o:juniper:junos:12.1x44 + cpe:/o:juniper:junos:12.1x46 + cpe:/o:juniper:junos:11.4 + cpe:/o:juniper:junos:12.1x45 + cpe:/o:juniper:junos:12.1 + cpe:/o:juniper:junos:10.4 + cpe:/o:juniper:junos:10.0 + + CVE-2014-2712 + 2014-04-14T11:09:06.367-04:00 + 2014-04-19T00:48:43.833-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-15T09:37:15.950-04:00 + + + + + CONFIRM + http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10521 + + Cross-site scripting (XSS) vulnerability in J-Web in Juniper Junos before 10.0S25, 10.4 before 10.4R10, 11.4 before 11.4R11, 12.1 before 12.1R9, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, 12.1X46 before 12.1X46-D10, and 12.2 before 12.2R1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to index.php. + + + + + + + + + + + + + + + cpe:/o:juniper:junos:12.3 + cpe:/o:juniper:junos:12.2 + cpe:/o:juniper:junos:11.4 + cpe:/o:juniper:junos:12.1 + cpe:/o:juniper:junos:13.2 + cpe:/o:juniper:junos:13.1 + cpe:/o:juniper:junos:13.3 + + CVE-2014-2713 + 2014-04-14T11:09:06.397-04:00 + 2014-04-15T09:52:50.513-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-15T09:52:50.027-04:00 + + + + CONFIRM + http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10621 + + Juniper Junos before 11.4R11, 12.1 before 12.1R9, 12.2 before 12.2R7, 12.3R4 before 12.3R4-S3, 13.1 before 13.1R4, 13.2 before 13.2R2, and 13.3 before 13.3R1, as used in MX Series and T4000 routers, allows remote attackers to cause a denial of service (PFE restart) via a crafted IP packet to certain (1) Trio or (2) Cassis-based Packet Forwarding Engine (PFE) modules. + + + + + + + + + + + + + + cpe:/o:juniper:junos:12.1x44 + cpe:/o:juniper:junos:12.1x46 + cpe:/o:juniper:junos:11.4 + cpe:/o:juniper:junos:12.1x45 + cpe:/o:juniper:junos:12.1 + cpe:/o:juniper:junos:10.4 + + CVE-2014-2714 + 2014-04-14T11:09:06.413-04:00 + 2014-04-15T10:06:06.460-04:00 + + + 7.1 + NETWORK + MEDIUM + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-15T10:06:06.397-04:00 + + + + + BID + 66760 + + + SECTRACK + 1030060 + + + SECUNIA + 57835 + + + CONFIRM + http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10622 + + The Enhanced Web Filtering (EWF) in Juniper Junos before 10.4R15, 11.4 before 11.4R9, 12.1 before 12.1R7, 12.1X44 before 12.1X44-D20, 12.1X45 before 12.1X45-D10, and 12.1X46 before 12.1X46-D10, as used in the SRX Series services gateways, allows remote attackers to cause a denial of service (flow daemon crash and restart) via a crafted URL. + + + + + + + + + + + + cpe:/a:videowhisper:videowhisper:7.x-1.3::~~~drupal~~ + cpe:/a:videowhisper:videowhisper:7.x-1.0::~~~drupal~~ + cpe:/a:videowhisper:videowhisper:7.x-1.1::~~~drupal~~ + cpe:/a:videowhisper:videowhisper:7.x-1.x:dev:~~~drupal~~ + + CVE-2014-2715 + 2014-04-28T10:09:07.643-04:00 + 2014-04-29T08:57:40.247-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-29T08:57:40.170-04:00 + + + + + BUGTRAQ + 20140425 [CVE-2014-2715] Cross-site scripting (XSS) vulnerability in Videowhisper + + Multiple cross-site scripting (XSS) vulnerabilities in vwrooms\templates\logout.tpl.php in the VideoWhisper Webcam plugins for Drupal 7.x allow remote attackers to inject arbitrary web script or HTML via the (1) module or (2) message parameter to index.php. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:asus:rt-ac66u_firmware:3.0.0.4.220 + cpe:/o:asus:rt-n16_firmware:3.0.0.4.354 + cpe:/o:asus:rt-n16_firmware:1.0.2.3 + cpe:/o:asus:rt-n10e_firmware:2.0.0.16 + cpe:/o:asus:rt-n16_firmware:3.0.0.3.178 + cpe:/o:asus:rt-n56u_firmware:1.0.1.4o + cpe:/o:asus:rt-n10e_firmware:2.0.0.10 + cpe:/o:asus:rt-n16_firmware:3.0.0.4.260 + cpe:/o:asus:rt-ac66u_firmware:3.0.0.4.354 + cpe:/o:asus:rt-n56u_firmware:1.0.1.7c + cpe:/o:asus:rt-n56u_firmware:1.0.1.4 + cpe:/o:asus:rt-n65u_firmware:3.0.0.3.134 + cpe:/o:asus:rt-n56u_firmware:7.0.1.21 + cpe:/o:asus:rt-ac66u_firmware:3.0.0.4.246 + cpe:/o:asus:rt-n16_firmware:3.0.0.3.108 + cpe:/o:asus:rt-n10e_firmware:2.0.0.20 + cpe:/o:asus:rt-n56u_firmware:3.0.0.4.318 + cpe:/o:asus:rt-ac68u_firmware:3.0.0.4.374.4755 + cpe:/o:asus:rt-n56u_firmware:1.0.1.7f + cpe:/h:asus:rt-ac68u:- + cpe:/o:asus:rt-n16_firmware:1.0.1.9 + cpe:/o:asus:rt-n66u_firmware:3.0.0.4.272 + cpe:/o:asus:rt-n16_firmware:3.0.0.3.162 + cpe:/o:asus:rt-n56u_firmware:8.1.1.4 + cpe:/o:asus:rt-ac66u_firmware:3.0.0.4.270 + cpe:/o:asus:rt-n14u_firmware:3.0.0.4.356 + cpe:/o:asus:rt-n10e_firmware:2.0.0.7 + cpe:/o:asus:rt-n10e_firmware:2.0.0.19 + cpe:/o:asus:rt-n66u_firmware:3.0.0.4.370 + cpe:/o:asus:rt-ac66u_firmware:3.0.0.4.140 + cpe:/o:asus:rt-n10e_firmware:2.0.0.24 + cpe:/o:asus:rt-n10e_firmware:2.0.0.25 + cpe:/o:asus:rt-n65u_firmware:3.0.0.4.334 + cpe:/o:asus:rt-n56u_firmware:3.0.0.4.342 + cpe:/o:asus:rt-n65u_firmware:3.0.0.3.176 + cpe:/o:asus:rt-n56u_firmware:1.0.1.8l + cpe:/o:asus:rt-n65u_firmware:3.0.0.4.260 + cpe:/o:asus:rt-n56u_firmware:1.0.1.8j + cpe:/o:asus:rt-n16_firmware:3.0.0.4.246 + cpe:/o:asus:rt-n56u_firmware:1.0.1.8n + cpe:/o:asus:rt-n14u_firmware:3.0.0.4.322 + cpe:/o:asus:rt-n56u_firmware:7.0.1.32 + cpe:/o:asus:rt-ac68u_firmware:3.0.0.4.374_4561 + cpe:/o:asus:rt-ac66u_firmware:3.0.0.4.260 + cpe:/o:asus:rt-n16_firmware:7.0.2.38b + cpe:/o:asus:rt-n65u_firmware:3.0.0.4.342 + cpe:/o:asus:rt-n56u_firmware:3.0.0.4.334 + cpe:/o:asus:rt-n65u_firmware:3.0.0.4.346 + cpe:/o:asus:rt-ac68u_firmware:3.0.0.4.374_4887 + cpe:/o:asus:rt-n16_firmware:3.0.0.4.220 + cpe:/o:asus:rt-n56u_firmware:3.0.0.4.360 + + CVE-2014-2719 + 2014-04-22T09:06:29.493-04:00 + 2014-04-22T15:20:09.963-04:00 + + + 6.3 + NETWORK + MEDIUM + SINGLE_INSTANCE + COMPLETE + NONE + NONE + http://nvd.nist.gov + 2014-04-22T15:20:09.587-04:00 + + + + + CONFIRM + http://support.asus.com/download.aspx?m=RT-N66U+%28VER.B1%29 + + + FULLDISC + 20140416 ASUS RT-XXXX SOHO routers expose admin password, fixed in 3.0.0.4.374.5517 + + + MISC + http://dnlongen.blogspot.com/2014/04/CVE-2014-2719-Asus-RT-Password-Disclosure.html + + Advanced_System_Content.asp in the ASUS RT series routers with firmware before 3.0.0.4.374.5517, when an administrator session is active, allows remote authenticated users to obtain the administrator user name and password by reading the source code. + + + + + + + + + cpe:/a:ektron:ektron_content_management_system:8.7.0 + + CVE-2014-2729 + 2014-04-25T10:15:30.517-04:00 + 2014-04-25T13:51:50.370-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-25T13:51:50.260-04:00 + + + + + BUGTRAQ + 20140416 [SECURITY] Stored Cross Site Scripting in Ektron CMS 8.7 + + + BUGTRAQ + 20140416 [Security Advisory] Stored Cross Site Scripting in Ektron CMS 8.7 + + + MISC + http://packetstormsecurity.com/files/126187/Ektron-CMS-8.7-Cross-Site-Scripting.html + + Cross-site scripting (XSS) vulnerability in content.aspx in Ektron CMS 8.7 before 8.7.0.055 allows remote authenticated users to inject arbitrary web script or HTML via the category0 parameter, which is not properly handled when displaying the Subjects tab in the View Properties menu option. + + + + + + + + + + + + + + + + cpe:/a:microsoft:office:2013:-:~-~-~-~x64~ + cpe:/a:microsoft:office:2010:sp1:x64 + cpe:/a:microsoft:office:2013:-:~-~-~-~x86~ + cpe:/a:microsoft:office:2010:sp2:x64 + cpe:/a:microsoft:office:2011::mac + cpe:/a:microsoft:office:2010:sp2:x86 + cpe:/a:microsoft:office:2007:sp3 + cpe:/a:microsoft:office:2010:sp1:x86 + + CVE-2014-2730 + 2014-04-05T10:55:04.993-04:00 + 2014-04-07T11:16:02.327-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-07T11:16:02.093-04:00 + + + + + BUGTRAQ + 20140403 [softScheck] Denial of Service in Microsoft Office 2007-2013 + + The XML parser in Microsoft Office 2007 SP3, 2010 SP1 and SP2, and 2013, and Office for Mac 2011, does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory consumption and persistent application hang) via a crafted XML document containing a large number of nested entity references, as demonstrated by a crafted text/plain e-mail message to Outlook, a similar issue to CVE-2003-1564. + + + + + + + + + cpe:/a:siemens:sinema_server:12.0:- + + CVE-2014-2731 + 2014-04-19T15:55:07.763-04:00 + 2014-04-21T15:28:08.697-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-21T15:28:08.650-04:00 + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-107-01 + + + CONFIRM + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-364879.pdf + + Multiple unspecified vulnerabilities in the integrated web server in Siemens SINEMA Server before 12 SP1 allow remote attackers to execute arbitrary code via HTTP traffic to port (1) 4999 or (2) 80. + + + + + + + + + cpe:/a:siemens:sinema_server:12.0:- + + CVE-2014-2732 + 2014-04-19T15:55:07.797-04:00 + 2014-04-21T15:29:42.513-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-21T15:29:42.497-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-107-01 + + + CONFIRM + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-364879.pdf + + Multiple directory traversal vulnerabilities in the integrated web server in Siemens SINEMA Server before 12 SP1 allow remote attackers to access arbitrary files via HTTP traffic to port (1) 4999 or (2) 80. + + + + + + + + + cpe:/a:siemens:sinema_server:12.0:- + + CVE-2014-2733 + 2014-04-19T15:55:07.810-04:00 + 2014-04-21T15:31:57.517-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-21T15:31:57.203-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-107-01 + + + CONFIRM + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-364879.pdf + + Siemens SINEMA Server before 12 SP1 allows remote attackers to cause a denial of service (web-interface outage) via crafted HTTP requests to port (1) 4999 or (2) 80. + + + + + + + + + + + + + + + + + + + + cpe:/a:ruby-lang:ruby:2.0.0:rc2 + cpe:/a:ruby-lang:ruby:2.0.0:p247 + cpe:/a:ruby-lang:ruby:2.1:preview1 + cpe:/a:ruby-lang:ruby:2.0.0:rc1 + cpe:/a:ruby-lang:ruby:2.0.0:p195 + cpe:/a:ruby-lang:ruby:2.0.0:p0 + cpe:/a:ruby-lang:ruby:2.0.0:preview2 + cpe:/a:ruby-lang:ruby:2.0.0:preview1 + cpe:/a:ruby-lang:ruby:2.1.1 + cpe:/a:ruby-lang:ruby:2.1:- + cpe:/a:ruby-lang:ruby:2.0 + cpe:/a:ruby-lang:ruby:2.0.0 + + CVE-2014-2734 + 2014-04-24T19:55:05.707-04:00 + 2014-04-25T09:30:18.403-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-25T09:30:13.623-04:00 + + + + + MISC + https://gist.github.com/10446549 + + + FULLDISC + 20140416 Ruby OpenSSL private key spoofing ~ CVE-2014-2734 with PoC + + + MISC + http://packetstormsecurity.com/files/126218/Ruby-OpenSSL-Private-Key-Spoofing.html + + The openssl extension in Ruby 2.x does not properly maintain the state of process memory after a file is reopened, which allows remote attackers to spoof signatures within the context of a Ruby script that attempts signature verification after performing a certain sequence of filesystem operations. + + + + + + + + + + + cpe:/a:winscp:winscp:5.5.2 + cpe:/a:winscp:winscp:5.5.1 + cpe:/a:winscp:winscp:5.5 + + CVE-2014-2735 + 2014-04-22T09:06:29.853-04:00 + 2014-04-22T15:25:03.607-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-22T15:25:03.500-04:00 + + + + + BUGTRAQ + 20140416 CVE-2014-2735 - WinSCP: missing X.509 validation + + + CONFIRM + http://winscp.net/tracker/show_bug.cgi?id=1152 + + + CONFIRM + http://winscp.net/eng/docs/history + + WinSCP before 5.5.3, when FTP with TLS is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:modx:modx_revolution:2.0.2:pl1 + cpe:/a:modx:modx_revolution:2.2.9 + cpe:/a:modx:modx_revolution:2.2.8 + cpe:/a:modx:modx_revolution:2.2.10 + cpe:/a:modx:modx_revolution:2.0.4 + cpe:/a:modx:modx_revolution:2.0.3 + cpe:/a:modx:modx_revolution:2.0.6 + cpe:/a:modx:modx_revolution:2.0.5 + cpe:/a:modx:modx_revolution:2.0.8 + cpe:/a:modx:modx_revolution:2.2.7 + cpe:/a:modx:modx_revolution:2.0.7 + cpe:/a:modx:modx_revolution:2.0.0 + cpe:/a:modx:modx_revolution:2.2.0 + cpe:/a:modx:modx_revolution:2.2.1 + cpe:/a:modx:modx_revolution:2.2.2 + cpe:/a:modx:modx_revolution:2.2.3 + cpe:/a:modx:modx_revolution:2.2.4 + cpe:/a:modx:modx_revolution:2.2.5 + cpe:/a:modx:modx_revolution:2.2.6 + cpe:/a:modx:modx_revolution:2.0.1 + cpe:/a:modx:modx_revolution:2.1.2 + cpe:/a:modx:modx_revolution:2.1.3 + cpe:/a:modx:modx_revolution:2.1.0 + cpe:/a:modx:modx_revolution:2.1.1 + cpe:/a:modx:modx_revolution:2.1.4 + cpe:/a:modx:modx_revolution:2.1.5 + cpe:/a:modx:modx_revolution:2.2.11 + cpe:/a:modx:modx_revolution:2.2.13 + cpe:/a:modx:modx_revolution:2.2.12 + + CVE-2014-2736 + 2014-04-24T10:55:04.387-04:00 + 2014-04-24T15:09:30.747-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-24T15:09:30.323-04:00 + + + + + BID + 66990 + + + SECUNIA + 58036 + + + CONFIRM + http://forums.modx.com/thread/90173/modx-revolution-2-2-13-and-prior-blind-sql-injection + + + BUGTRAQ + 20140419 Multiple Vulnerabilities in MODX Revolution < = MODX 2.2.13-pl + + Multiple SQL injection vulnerabilities in MODX Revolution before 2.2.14 allow remote attackers to execute arbitrary SQL commands via the (1) session ID (PHPSESSID) to index.php or remote authenticated users to execute arbitrary SQL commands via the (2) user parameter to connectors/security/message.php or (3) id parameter to manager/index.php. + + + + + + + + + + + cpe:/a:knowledgetree:knowledgetree:3.7 + cpe:/a:knowledgetree:knowledgetree:3.7.0.1 + cpe:/a:knowledgetree:knowledgetree:3.7.0.2 + + CVE-2014-2737 + 2014-04-22T10:23:35.923-04:00 + 2014-04-23T09:31:20.493-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-23T09:31:20.370-04:00 + + + + + BUGTRAQ + 20140419 Blind SQL Injection Vulnerability in KnowledgeTree <= 3.7.0.2 + + SQL injection vulnerability in the get_active_session function in the KTAPI_UserSession class in webservice/clienttools/services/mdownload.php in KnowledgeTree 3.7.0.2 and earlier allows remote attackers to execute arbitrary SQL commands via the u parameter, related to the getFileName function. + + + + + + + + + + + + + + + + + cpe:/o:linux:linux_kernel:3.14:rc2 + cpe:/o:linux:linux_kernel:3.14:rc7 + cpe:/o:linux:linux_kernel:3.14:rc4 + cpe:/o:linux:linux_kernel:3.14:rc1 + cpe:/o:linux:linux_kernel:3.14:rc6 + cpe:/o:linux:linux_kernel:3.14.1 + cpe:/o:linux:linux_kernel:3.14:rc8 + cpe:/o:linux:linux_kernel:3.14:rc5 + cpe:/o:linux:linux_kernel:3.14:rc3 + + CVE-2014-2739 + 2014-04-14T19:55:07.747-04:00 + 2014-04-24T01:06:26.623-04:00 + + + 4.6 + ADJACENT_NETWORK + HIGH + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-15T11:29:33.177-04:00 + + + + + MLIST + [oss-security] 20140410 Re: CVE request Linux kernel: IB/core: crash while resolving passive side RoCE L2 address in cma_req_handler + + + CONFIRM + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b2853fd6c2d0f383dbdf7427e263eb576a633867 + + + CONFIRM + https://github.com/torvalds/linux/commit/b2853fd6c2d0f383dbdf7427e263eb576a633867 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1085415 + + + BID + 66716 + + The cma_req_handler function in drivers/infiniband/core/cma.c in the Linux kernel 3.14.x through 3.14.1 attempts to resolve an RDMA over Converged Ethernet (aka RoCE) address that is properly resolved within a different module, which allows remote attackers to cause a denial of service (incorrect pointer dereference and system crash) via crafted network traffic. + + + + + + + + + cpe:/a:igniterealtime:openfire:3.9.1 + + CVE-2014-2741 + 2014-04-10T21:55:05.473-04:00 + 2014-04-11T15:26:44.920-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-11T15:26:44.857-04:00 + + + + + MISC + http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/ + + + MLIST + [oss-security] 20140408 Re: (Openfire M-Link Metronome Prosody Tigase) Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression + + + MLIST + [oss-security] 20140407 Re: Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression + + Ignite Realtime Openfire before 3.9.2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack. + + + + + + + + + + + + + cpe:/a:isode:m-link:16.0 + cpe:/a:isode:m-link:15.1.10 + cpe:/a:isode:m-link:15.1 + cpe:/a:isode:m-link:14.6 + cpe:/a:isode:m-link:14.6.14 + + CVE-2014-2742 + 2014-04-10T21:55:05.520-04:00 + 2014-04-11T15:49:44.030-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-11T15:49:39.343-04:00 + + + + + MISC + http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/ + + + MLIST + [oss-security] 20140408 Re: (Openfire M-Link Metronome Prosody Tigase) Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression + + + MLIST + [oss-security] 20140407 Re: Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression + + Isode M-Link before 16.0v7 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack. + + + + + + + + + cpe:/a:lightwitch:metronome:3.4 + + CVE-2014-2743 + 2014-04-10T21:55:06.413-04:00 + 2014-04-11T15:36:08.330-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-11T15:36:08.267-04:00 + + + + + CONFIRM + http://code.lightwitch.org/metronome/rev/49f47277a411 + + + MISC + http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/ + + + MLIST + [oss-security] 20140408 Re: (Openfire M-Link Metronome Prosody Tigase) Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression + + + MLIST + [oss-security] 20140407 Re: Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression + + plugins/mod_compression.lua in Lightwitch Metronome through 3.4 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:prosody:prosody:0.7.0 + cpe:/a:lightwitch:metronome:3.4 + cpe:/a:prosody:prosody:0.9.3 + cpe:/a:prosody:prosody:0.5.2 + cpe:/a:prosody:prosody:0.6.1 + cpe:/a:prosody:prosody:0.6.2 + cpe:/a:prosody:prosody:0.6.0 + cpe:/a:prosody:prosody:0.2.0 + cpe:/a:prosody:prosody:0.1.0 + cpe:/a:prosody:prosody:0.8.0 + cpe:/a:prosody:prosody:0.8.1 + cpe:/a:prosody:prosody:0.5.0 + cpe:/a:prosody:prosody:0.8.2 + cpe:/a:prosody:prosody:0.5.1 + cpe:/a:prosody:prosody:0.4.0 + cpe:/a:prosody:prosody:0.9.0 + cpe:/a:prosody:prosody:0.4.1 + cpe:/a:prosody:prosody:0.9.1 + cpe:/a:prosody:prosody:0.4.2 + cpe:/a:prosody:prosody:0.9.2 + cpe:/a:prosody:prosody:0.3.0 + + CVE-2014-2744 + 2014-04-10T21:55:06.663-04:00 + 2014-04-19T00:48:47.833-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-11T15:34:03.467-04:00 + + + + + CONFIRM + http://hg.prosody.im/0.9/rev/b3b1c9da38fb + + + CONFIRM + http://code.lightwitch.org/metronome/rev/49f47277a411 + + + MISC + http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/ + + + DEBIAN + DSA-2895 + + + SECUNIA + 57710 + + + MLIST + [oss-security] 20140408 Re: (Openfire M-Link Metronome Prosody Tigase) Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression + + + MLIST + [oss-security] 20140407 Re: Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression + + + CONFIRM + http://blog.prosody.im/prosody-0-9-4-released/ + + plugins/mod_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticated, which allows remote attackers to cause a denial of service (resource consumption) via compressed XML elements in an XMPP stream, aka an "xmppbomb" attack. + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:prosody:prosody:0.7.0 + cpe:/a:prosody:prosody:0.9.3 + cpe:/a:prosody:prosody:0.5.2 + cpe:/a:prosody:prosody:0.6.1 + cpe:/a:prosody:prosody:0.6.2 + cpe:/a:prosody:prosody:0.6.0 + cpe:/a:prosody:prosody:0.2.0 + cpe:/a:prosody:prosody:0.1.0 + cpe:/a:prosody:prosody:0.8.0 + cpe:/a:prosody:prosody:0.8.1 + cpe:/a:prosody:prosody:0.5.0 + cpe:/a:prosody:prosody:0.8.2 + cpe:/a:prosody:prosody:0.5.1 + cpe:/a:prosody:prosody:0.4.0 + cpe:/a:prosody:prosody:0.9.0 + cpe:/a:prosody:prosody:0.4.1 + cpe:/a:prosody:prosody:0.9.1 + cpe:/a:prosody:prosody:0.4.2 + cpe:/a:prosody:prosody:0.9.2 + cpe:/a:prosody:prosody:0.3.0 + + CVE-2014-2745 + 2014-04-10T21:55:06.693-04:00 + 2014-04-19T00:48:47.973-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-11T15:31:12.227-04:00 + + + + + MISC + http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/ + + + DEBIAN + DSA-2895 + + + SECUNIA + 57710 + + + MLIST + [oss-security] 20140408 Re: (Openfire M-Link Metronome Prosody Tigase) Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression + + + MLIST + [oss-security] 20140407 Re: Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression + + + CONFIRM + http://hg.prosody.im/0.9/rev/a97591d2e1ad + + + CONFIRM + http://hg.prosody.im/0.9/rev/1107d66d2ab2 + + + CONFIRM + http://blog.prosody.im/prosody-0-9-4-released/ + + Prosody before 0.9.4 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack, related to core/portmanager.lua and util/xmppstream.lua. + + + + + + + + + cpe:/a:tigase:tigase:5.2.0 + + CVE-2014-2746 + 2014-04-10T21:55:07.007-04:00 + 2014-04-11T15:39:45.337-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-11T15:39:45.150-04:00 + + + + + CONFIRM + https://projects.tigase.org/projects/tigase-server/repository/revisions/7f5af2f8c5b97bbf9def66fbb9dd47746a7ac292 + + + CONFIRM + https://projects.tigase.org/issues/1780 + + + MISC + http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/ + + + CONFIRM + http://www.tigase.org/content/uncontrolled-resource-consumption-highly-compressed-xmpp-messages + + + MLIST + [oss-security] 20140408 Re: (Openfire M-Link Metronome Prosody Tigase) Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression + + + MLIST + [oss-security] 20140407 Re: Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression + + net/IOService.java in Tigase before 5.2.1 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack. + + + + + + + + + + + + + + cpe:/a:sap:enhancement_package:6.0 + + CVE-2014-2748 + 2014-04-10T16:55:06.307-04:00 + 2014-04-24T01:06:31.030-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-11T14:27:48.520-04:00 + + + + + MISC + https://service.sap.com/sap/support/notes/1926485 + + + XF + sap-ehp-log-sec-bypass(92334) + + + MISC + http://www.onapsis.com/research-advisories.php + + + MISC + http://www.onapsis.com/get.php?resid=adv_onapsis-2014-002 + + + SECUNIA + 57741 + + The Security Audit Log facility in SAP Enhancement Package (EHP) 6 for SAP ERP 6.0 allows remote attackers to modify or delete arbitrary log classes via unspecified vectors. NOTE: some of these details are obtained from third party information. + + + + + + + + + cpe:/a:sap:hana:- + + CVE-2014-2749 + 2014-04-10T16:55:06.337-04:00 + 2014-04-24T01:06:31.157-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-11T14:31:20.357-04:00 + + + + + MISC + https://service.sap.com/sap/support/notes/1914778 + + + XF + sap-hana-icm-info-disc(92325) + + + BID + 66675 + + + MISC + http://www.onapsis.com/research-advisories.php + + + MISC + http://www.onapsis.com/get.php?resid=adv_onapsis-2014-001 + + + SECUNIA + 57443 + + The HANA ICM process in SAP HANA allows remote attackers to obtain the platform version, host name, instance number, and possibly other sensitive information via a malformed HTTP GET request. + + + CVE-2014-2750 + 2014-04-10T16:55:06.773-04:00 + 2014-04-19T00:48:48.863-04:00 + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-2744, CVE-2014-2745. Reason: This candidate is a duplicate of CVE-2014-2744 and/or CVE-2014-2745. Notes: All CVE users should reference CVE-2014-2744 and/or CVE-2014-2745 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. + + + + + + + + + cpe:/a:sap:print_and_output_management:- + + CVE-2014-2751 + 2014-04-10T16:55:14.337-04:00 + 2014-04-11T14:56:30.047-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-11T14:56:29.967-04:00 + + + + + MISC + http://www.onapsis.com/research-advisories.php + + + MISC + http://www.onapsis.com/get.php?resid=adv_onapsis-2014-004 + + SAP Print and Output Management has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors. + + + + + + + + + cpe:/a:sap:business_object_processing_framework_for_abap:- + + CVE-2014-2752 + 2014-04-10T16:55:14.367-04:00 + 2014-04-11T15:09:08.213-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-11T15:09:08.150-04:00 + + + + + MISC + http://www.onapsis.com/research-advisories.php + + + MISC + http://www.onapsis.com/get.php?resid=adv_onapsis-2014-003 + + SAP Business Object Processing Framework (BOPF) for ABAP has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors. + + + + + + + + + + + + + + + + cpe:/a:openstack:keystone:2013.1.2 + cpe:/a:openstack:keystone:2013.1.3 + cpe:/a:openstack:keystone:2013.2 + cpe:/a:openstack:keystone:2013.1 + cpe:/a:openstack:keystone:2013.1.1 + cpe:/a:openstack:keystone:2013.2.1 + cpe:/a:openstack:keystone:2013.2.2 + cpe:/a:openstack:keystone:2013.2.3 + + CVE-2014-2828 + 2014-04-15T10:55:04.857-04:00 + 2014-04-16T09:21:02.553-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-16T09:21:02.477-04:00 + + + + + CONFIRM + https://bugs.launchpad.net/keystone/+bug/1300274 + + + MLIST + [oss-security] 20140410 [OSSA 2014-013] Keystone DoS through V3 API authentication chaining (CVE-2014-2828) + + The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to cause a denial of service (CPU consumption) via a large number of the same authentication method in a request, aka "authentication chaining." + + + + + + + + + + + + + cpe:/a:erlang-solutions:mongooseim:1.2.2 + cpe:/a:erlang-solutions:mongooseim:1.2.1 + cpe:/a:erlang-solutions:mongooseim:1.3.1:- + cpe:/a:erlang-solutions:mongooseim:1.3.0 + cpe:/a:erlang-solutions:mongooseim:1.3.1:rev2 + + CVE-2014-2829 + 2014-04-10T21:55:07.083-04:00 + 2014-04-11T15:45:00.537-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-11T15:45:00.473-04:00 + + + + + CONFIRM + https://github.com/esl/MongooseIM/commit/586d96cc12ef218243a3466354b4d208b5472a6c + + + MISC + http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/ + + Erlang Solutions MongooseIM through 1.3.1 rev. 2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack. + + + + + + + + + + + + + cpe:/o:juniper:screenos:6.3.0 + cpe:/o:juniper:screenos:6.2.0 + cpe:/o:juniper:screenos:5.4.0 + cpe:/o:juniper:screenos:6.1.0 + cpe:/o:juniper:screenos:6.0.0 + + CVE-2014-2842 + 2014-04-15T10:55:05.047-04:00 + 2014-04-16T09:28:58.163-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-16T09:28:58.117-04:00 + + + + + CONFIRM + https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10624 + + + BID + 66802 + + + SECUNIA + 57910 + + Juniper ScreenOS 6.3 and earlier allows remote attackers to cause a denial of service (crash and restart or failover) via a malformed SSL/TLS packet. + + + + + + + + + cpe:/a:f-secure:secure_messaging_secure_gateway:7.5.0 + + CVE-2014-2844 + 2014-04-18T10:55:25.977-04:00 + 2014-04-21T11:08:53.003-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-21T11:08:52.957-04:00 + + + + + CONFIRM + http://www.f-secure.com/en/web/labs_global/fsc-2014-2 + + + SECUNIA + 58038 + + + FULLDISC + 20140416 Reflected XSS Attacks vulnerabilities F-Secure Messaging Security Gateway V7.5.0.892 (CVE-2014-2844) + + Cross-site scripting (XSS) vulnerability in F-Secure Messaging Secure Gateway 7.5.0 before Patch 1862 allows remote authenticated administrators to inject arbitrary web script or HTML via the new parameter in the SysUser module to admin. + + + + + + + + + + + + + + cpe:/a:wdc:arkeia_virtual_appliance:- + cpe:/o:wdc:arkeia_virtual_appliance_firmware:10.2.7 + + CVE-2014-2846 + 2014-04-28T10:09:07.877-04:00 + 2014-04-29T09:07:44.203-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-29T09:07:44.127-04:00 + + + + + BUGTRAQ + 20140423 SEC Consult SA-20140423-0 :: Path Traversal/Remote Code Execution in WD Arkeia Network Backup Appliances + + + FULLDISC + 20140423 SEC Consult SA-20140423-0 :: Path Traversal/Remote Code Execution in WD Arkeia Network Backup Appliances + + Directory traversal vulnerability in opt/arkeia/wui/htdocs/index.php in the WD Arkeia virtual appliance (AVA) with firmware before 10.2.9 allows remote attackers to read arbitrary files and execute arbitrary PHP code via a ..././ (dot dot dot slash dot slash) in the lang Cookie parameter, as demonstrated by a request to login/doLogin. + + + + + + + + + cpe:/a:construtiva:cis_manager_cms:- + + CVE-2014-2847 + 2014-04-11T11:55:22.160-04:00 + 2014-04-14T11:15:59.880-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-14T11:15:59.847-04:00 + + + + + BID + 66590 + + + OSVDB + 105364 + + + EXPLOIT-DB + 32660 + + SQL injection vulnerability in default.asp in CIS Manager CMS allows remote attackers to execute arbitrary SQL commands via the TroncoID parameter. + + + + + + + + + + cpe:/a:tenable:nessus:5.2.1 + cpe:/a:tenable:plugin-set:201402092115 + + CVE-2014-2848 + 2014-04-11T11:55:22.257-04:00 + 2014-04-14T11:21:17.733-04:00 + + + 6.9 + LOCAL + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-14T11:21:09.733-04:00 + + + + + MISC + https://www.nccgroup.com/en/learning-and-research-centre/technical-advisories/nessus-authenticated-scan-local-privilege-escalation/ + + + CONFIRM + https://discussions.nessus.org/thread/7195 + + + SECTRACK + 1029946 + + + SECUNIA + 57403 + + A race condition in the wmi_malware_scan.nbin plugin before 201402262215 for Nessus 5.2.1 allows local users to gain privileges by replacing the dissolvable agent executable in the Windows temp directory with a Trojan horse program. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:sophos:web_appliance_firmware:3.3.5.1 + cpe:/o:sophos:web_appliance_firmware:3.6.1.1 + cpe:/o:sophos:web_appliance_firmware:3.2.2 + cpe:/o:sophos:web_appliance_firmware:3.2.3 + cpe:/o:sophos:web_appliance_firmware:3.2.1 + cpe:/o:sophos:web_appliance_firmware:3.7.8.1 + cpe:/o:sophos:web_appliance_firmware:3.2.6 + cpe:/o:sophos:web_appliance_firmware:3.7.8.2 + cpe:/o:sophos:web_appliance_firmware:3.2.5 + cpe:/o:sophos:web_appliance_firmware:3.2.4 + cpe:/o:sophos:web_appliance_firmware:3.3.3.1 + cpe:/o:sophos:web_appliance_firmware:3.2.2.1 + cpe:/o:sophos:web_appliance_firmware:3.7.7 + cpe:/o:sophos:web_appliance_firmware:3.0.0 + cpe:/o:sophos:web_appliance_firmware:3.6.1 + cpe:/o:sophos:web_appliance_firmware:3.7.9 + cpe:/o:sophos:web_appliance_firmware:3.6.2 + cpe:/o:sophos:web_appliance_firmware:3.6.2.3 + cpe:/o:sophos:web_appliance_firmware:3.8.0 + cpe:/o:sophos:web_appliance_firmware:3.6.2.1 + cpe:/a:sophos:web_appliance_firmware:3.7.8 + cpe:/o:sophos:web_appliance_firmware:3.1.3 + cpe:/o:sophos:web_appliance_firmware:3.1.4 + cpe:/o:sophos:web_appliance_firmware:3.1.1 + cpe:/o:sophos:web_appliance_firmware:3.1.2 + cpe:/o:sophos:web_appliance_firmware:3.7.2 + cpe:/o:sophos:web_appliance_firmware:3.3.5 + cpe:/o:sophos:web_appliance_firmware:3.7.3 + cpe:/o:sophos:web_appliance_firmware:3.1.0 + cpe:/o:sophos:web_appliance_firmware:3.7.0 + cpe:/o:sophos:web_appliance_firmware:3.7.4 + cpe:/o:sophos:web_appliance_firmware:3.3.3 + cpe:/o:sophos:web_appliance_firmware:3.7.1 + cpe:/o:sophos:web_appliance_firmware:3.7.5 + cpe:/o:sophos:web_appliance_firmware:3.3.4 + cpe:/o:sophos:web_appliance_firmware:3.7.6 + cpe:/o:sophos:web_appliance_firmware:3.3.2 + cpe:/o:sophos:web_appliance_firmware:3.4.8 + cpe:/o:sophos:web_appliance_firmware:3.0.1 + cpe:/o:sophos:web_appliance_firmware:3.3.1 + cpe:/o:sophos:web_appliance_firmware:3.3.0 + cpe:/o:sophos:web_appliance_firmware:3.8.1.1 + cpe:/o:sophos:web_appliance_firmware:3.5.4 + cpe:/o:sophos:web_appliance_firmware:3.4.6 + cpe:/o:sophos:web_appliance_firmware:3.4.7 + cpe:/o:sophos:web_appliance_firmware:3.0.4 + cpe:/o:sophos:web_appliance_firmware:3.5.6 + cpe:/o:sophos:web_appliance_firmware:3.0.5 + cpe:/o:sophos:web_appliance_firmware:3.5.5 + cpe:/o:sophos:web_appliance_firmware:3.4.5 + cpe:/o:sophos:web_appliance_firmware:3.0.2 + cpe:/o:sophos:web_appliance_firmware:3.0.3 + cpe:/o:sophos:web_appliance_firmware:3.0.5.1 + cpe:/o:sophos:web_appliance_firmware:3.5.3 + cpe:/o:sophos:web_appliance_firmware:3.4.1 + cpe:/o:sophos:web_appliance_firmware:3.4.0 + cpe:/o:sophos:web_appliance_firmware:3.5.1 + cpe:/o:sophos:web_appliance_firmware:3.5.2 + cpe:/o:sophos:web_appliance_firmware:3.6.2.4.0 + cpe:/h:sophos:web_appliance:- + cpe:/o:sophos:web_appliance_firmware:3.8.1 + cpe:/o:sophos:web_appliance_firmware:3.5.0 + cpe:/o:sophos:web_appliance_firmware:3.4.4 + cpe:/o:sophos:web_appliance_firmware:3.4.3.1 + cpe:/o:sophos:web_appliance_firmware:3.6.4 + cpe:/o:sophos:web_appliance_firmware:3.4.2 + cpe:/o:sophos:web_appliance_firmware:3.3.6 + cpe:/o:sophos:web_appliance_firmware:3.4.3 + cpe:/o:sophos:web_appliance_firmware:3.0.1.1 + cpe:/o:sophos:web_appliance_firmware:3.6.3 + cpe:/o:sophos:web_appliance_firmware:3.7.9.1 + cpe:/o:sophos:web_appliance_firmware:3.3.6.1 + cpe:/o:sophos:web_appliance_firmware:3.1.0.1 + cpe:/o:sophos:web_appliance_firmware:3.2.7 + cpe:/o:sophos:web_appliance_firmware:3.5.1.1 + cpe:/o:sophos:web_appliance_firmware:3.6.4.2 + cpe:/o:sophos:web_appliance_firmware:3.5.1.2 + cpe:/o:sophos:web_appliance_firmware:3.6.2.4.1 + cpe:/o:sophos:web_appliance_firmware:3.6.4.1 + + CVE-2014-2849 + 2014-04-11T11:55:27.660-04:00 + 2014-04-14T11:38:12.317-04:00 + + + 8.5 + NETWORK + LOW + SINGLE_INSTANCE + NONE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-14T11:38:11.597-04:00 + + + + + MISC + http://www.zerodayinitiative.com/advisories/ZDI-14-069/ + + + CONFIRM + http://www.sophos.com/en-us/support/knowledgebase/120230.aspx + + + BID + 66734 + + + EXPLOIT-DB + 32789 + + + SECUNIA + 57706 + + The Change Password dialog box (change_password) in Sophos Web Appliance before 3.8.2 allows remote authenticated users to change the admin user password via a crafted request. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:sophos:web_appliance_firmware:3.3.5.1 + cpe:/o:sophos:web_appliance_firmware:3.6.1.1 + cpe:/o:sophos:web_appliance_firmware:3.2.2 + cpe:/o:sophos:web_appliance_firmware:3.2.3 + cpe:/o:sophos:web_appliance_firmware:3.2.1 + cpe:/o:sophos:web_appliance_firmware:3.7.8.1 + cpe:/o:sophos:web_appliance_firmware:3.2.6 + cpe:/o:sophos:web_appliance_firmware:3.7.8.2 + cpe:/o:sophos:web_appliance_firmware:3.2.5 + cpe:/o:sophos:web_appliance_firmware:3.2.4 + cpe:/o:sophos:web_appliance_firmware:3.3.3.1 + cpe:/o:sophos:web_appliance_firmware:3.2.2.1 + cpe:/o:sophos:web_appliance_firmware:3.7.7 + cpe:/o:sophos:web_appliance_firmware:3.0.0 + cpe:/o:sophos:web_appliance_firmware:3.6.1 + cpe:/o:sophos:web_appliance_firmware:3.7.9 + cpe:/o:sophos:web_appliance_firmware:3.6.2 + cpe:/o:sophos:web_appliance_firmware:3.6.2.3 + cpe:/o:sophos:web_appliance_firmware:3.8.0 + cpe:/o:sophos:web_appliance_firmware:3.6.2.1 + cpe:/a:sophos:web_appliance_firmware:3.7.8 + cpe:/o:sophos:web_appliance_firmware:3.1.3 + cpe:/o:sophos:web_appliance_firmware:3.1.4 + cpe:/o:sophos:web_appliance_firmware:3.1.1 + cpe:/o:sophos:web_appliance_firmware:3.1.2 + cpe:/o:sophos:web_appliance_firmware:3.7.2 + cpe:/o:sophos:web_appliance_firmware:3.3.5 + cpe:/o:sophos:web_appliance_firmware:3.7.3 + cpe:/o:sophos:web_appliance_firmware:3.1.0 + cpe:/o:sophos:web_appliance_firmware:3.7.0 + cpe:/o:sophos:web_appliance_firmware:3.7.4 + cpe:/o:sophos:web_appliance_firmware:3.3.3 + cpe:/o:sophos:web_appliance_firmware:3.7.1 + cpe:/o:sophos:web_appliance_firmware:3.7.5 + cpe:/o:sophos:web_appliance_firmware:3.3.4 + cpe:/o:sophos:web_appliance_firmware:3.7.6 + cpe:/o:sophos:web_appliance_firmware:3.3.2 + cpe:/o:sophos:web_appliance_firmware:3.4.8 + cpe:/o:sophos:web_appliance_firmware:3.0.1 + cpe:/o:sophos:web_appliance_firmware:3.3.1 + cpe:/o:sophos:web_appliance_firmware:3.3.0 + cpe:/o:sophos:web_appliance_firmware:3.8.1.1 + cpe:/o:sophos:web_appliance_firmware:3.5.4 + cpe:/o:sophos:web_appliance_firmware:3.4.6 + cpe:/o:sophos:web_appliance_firmware:3.4.7 + cpe:/o:sophos:web_appliance_firmware:3.0.4 + cpe:/o:sophos:web_appliance_firmware:3.5.6 + cpe:/o:sophos:web_appliance_firmware:3.0.5 + cpe:/o:sophos:web_appliance_firmware:3.5.5 + cpe:/o:sophos:web_appliance_firmware:3.4.5 + cpe:/o:sophos:web_appliance_firmware:3.0.2 + cpe:/o:sophos:web_appliance_firmware:3.0.3 + cpe:/o:sophos:web_appliance_firmware:3.0.5.1 + cpe:/o:sophos:web_appliance_firmware:3.5.3 + cpe:/o:sophos:web_appliance_firmware:3.4.1 + cpe:/o:sophos:web_appliance_firmware:3.4.0 + cpe:/o:sophos:web_appliance_firmware:3.5.1 + cpe:/o:sophos:web_appliance_firmware:3.5.2 + cpe:/o:sophos:web_appliance_firmware:3.6.2.4.0 + cpe:/h:sophos:web_appliance:- + cpe:/o:sophos:web_appliance_firmware:3.8.1 + cpe:/o:sophos:web_appliance_firmware:3.5.0 + cpe:/o:sophos:web_appliance_firmware:3.4.4 + cpe:/o:sophos:web_appliance_firmware:3.4.3.1 + cpe:/o:sophos:web_appliance_firmware:3.6.4 + cpe:/o:sophos:web_appliance_firmware:3.4.2 + cpe:/o:sophos:web_appliance_firmware:3.3.6 + cpe:/o:sophos:web_appliance_firmware:3.4.3 + cpe:/o:sophos:web_appliance_firmware:3.0.1.1 + cpe:/o:sophos:web_appliance_firmware:3.6.3 + cpe:/o:sophos:web_appliance_firmware:3.7.9.1 + cpe:/o:sophos:web_appliance_firmware:3.3.6.1 + cpe:/o:sophos:web_appliance_firmware:3.1.0.1 + cpe:/o:sophos:web_appliance_firmware:3.2.7 + cpe:/o:sophos:web_appliance_firmware:3.5.1.1 + cpe:/o:sophos:web_appliance_firmware:3.6.4.2 + cpe:/o:sophos:web_appliance_firmware:3.5.1.2 + cpe:/o:sophos:web_appliance_firmware:3.6.2.4.1 + cpe:/o:sophos:web_appliance_firmware:3.6.4.1 + + CVE-2014-2850 + 2014-04-11T11:55:27.693-04:00 + 2014-04-14T11:38:38.787-04:00 + + + 8.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-14T11:38:35.473-04:00 + + + + + MISC + http://www.zerodayinitiative.com/advisories/ZDI-14-069/ + + + CONFIRM + http://www.sophos.com/en-us/support/knowledgebase/120230.aspx + + + BID + 66734 + + + EXPLOIT-DB + 32789 + + + SECUNIA + 57706 + + The network interface configuration page (netinterface) in Sophos Web Appliance before 3.8.2 allows remote administrators to execute arbitrary commands via shell metacharacters in the address parameter. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:linux:linux_kernel:3.0.48 + cpe:/o:linux:linux_kernel:3.0.49 + cpe:/o:linux:linux_kernel:3.0.46 + cpe:/o:linux:linux_kernel:3.0.47 + cpe:/o:linux:linux_kernel:3.0.44 + cpe:/o:linux:linux_kernel:3.0.45 + cpe:/o:linux:linux_kernel:3.0.42 + cpe:/o:linux:linux_kernel:3.4.70 + cpe:/o:linux:linux_kernel:3.4.71 + cpe:/o:linux:linux_kernel:3.0.40 + cpe:/o:linux:linux_kernel:3.0.41 + cpe:/o:linux:linux_kernel:3.4.45 + cpe:/o:linux:linux_kernel:3.4.44 + cpe:/o:linux:linux_kernel:3.4.46 + cpe:/o:linux:linux_kernel:3.4.41 + cpe:/o:linux:linux_kernel:3.4.40 + cpe:/o:linux:linux_kernel:3.4.43 + cpe:/o:linux:linux_kernel:3.4.42 + cpe:/o:linux:linux_kernel:3.4.49 + cpe:/o:linux:linux_kernel:3.4.48 + cpe:/o:linux:linux_kernel:3.0.59 + cpe:/o:linux:linux_kernel:3.4.47 + cpe:/o:linux:linux_kernel:3.0.55 + cpe:/o:linux:linux_kernel:3.0.56 + cpe:/o:linux:linux_kernel:3.0.57 + cpe:/o:linux:linux_kernel:3.0.58 + cpe:/o:linux:linux_kernel:3.0.51 + cpe:/o:linux:linux_kernel:3.0.52 + cpe:/o:linux:linux_kernel:3.0.53 + cpe:/o:linux:linux_kernel:3.11.10 + cpe:/o:linux:linux_kernel:3.0.50 + cpe:/o:linux:linux_kernel:3.4.57 + cpe:/o:linux:linux_kernel:3.4.56 + cpe:/o:linux:linux_kernel:3.4.55 + cpe:/o:linux:linux_kernel:3.4.54 + cpe:/o:linux:linux_kernel:3.4.53 + cpe:/o:linux:linux_kernel:3.4.52 + cpe:/o:linux:linux_kernel:3.4.51 + cpe:/o:linux:linux_kernel:3.4.50 + cpe:/o:linux:linux_kernel:3.0.43 + cpe:/o:linux:linux_kernel:3.10.26 + cpe:/o:linux:linux_kernel:3.4.59 + cpe:/o:linux:linux_kernel:3.0.24 + cpe:/o:linux:linux_kernel:3.0.25 + cpe:/o:linux:linux_kernel:3.0.22 + cpe:/o:linux:linux_kernel:3.1.9 + cpe:/o:linux:linux_kernel:3.0.23 + cpe:/o:linux:linux_kernel:3.10.28 + cpe:/o:linux:linux_kernel:3.0.28 + cpe:/o:linux:linux_kernel:3.10.27 + cpe:/o:linux:linux_kernel:3.0.26 + cpe:/o:linux:linux_kernel:3.10.29 + cpe:/o:linux:linux_kernel:3.4.58 + cpe:/o:linux:linux_kernel:3.0.27 + cpe:/o:linux:linux_kernel:3.10.24 + cpe:/o:linux:linux_kernel:3.10.23 + cpe:/o:linux:linux_kernel:3.10.25 + cpe:/o:linux:linux_kernel:3.10.20 + cpe:/o:linux:linux_kernel:3.1.8 + cpe:/o:linux:linux_kernel:3.0.20 + cpe:/o:linux:linux_kernel:3.10.22 + cpe:/o:linux:linux_kernel:3.10.21 + cpe:/o:linux:linux_kernel:3.4.21 + cpe:/o:linux:linux_kernel:3.4.20 + cpe:/o:linux:linux_kernel:3.4.23 + cpe:/o:linux:linux_kernel:3.4.22 + cpe:/o:linux:linux_kernel:3.4.24 + cpe:/o:linux:linux_kernel:3.4.27 + cpe:/o:linux:linux_kernel:3.4.26 + cpe:/o:linux:linux_kernel:3.4.29 + cpe:/o:linux:linux_kernel:3.10.15 + cpe:/o:linux:linux_kernel:3.4.28 + cpe:/o:linux:linux_kernel:3.0.54 + cpe:/o:linux:linux_kernel:3.0.33 + cpe:/o:linux:linux_kernel:3.0.34 + cpe:/o:linux:linux_kernel:3.0.35 + cpe:/o:linux:linux_kernel:3.0.36 + cpe:/o:linux:linux_kernel:3.10.19 + cpe:/o:linux:linux_kernel:3.0.37 + cpe:/o:linux:linux_kernel:3.10.18 + cpe:/o:linux:linux_kernel:3.0.38 + cpe:/o:linux:linux_kernel:3.4.25 + cpe:/o:linux:linux_kernel:3.10.17 + cpe:/o:linux:linux_kernel:3.0.39 + cpe:/o:linux:linux_kernel:3.10.16 + cpe:/o:linux:linux_kernel:3.10.14 + cpe:/o:linux:linux_kernel:3.10.13 + cpe:/o:linux:linux_kernel:3.10.12 + cpe:/o:linux:linux_kernel:3.10.11 + cpe:/o:linux:linux_kernel:3.10.10 + cpe:/o:linux:linux_kernel:3.0.30 + cpe:/o:linux:linux_kernel:3.0.31 + cpe:/o:linux:linux_kernel:3.9.8 + cpe:/o:linux:linux_kernel:3.5.5 + cpe:/o:linux:linux_kernel:3.4.32 + cpe:/o:linux:linux_kernel:3.9.9 + cpe:/o:linux:linux_kernel:3.5.6 + cpe:/o:linux:linux_kernel:3.4.31 + cpe:/o:linux:linux_kernel:3.5.7 + cpe:/o:linux:linux_kernel:3.4.30 + cpe:/o:linux:linux_kernel:3.7.1 + cpe:/o:linux:linux_kernel:3.4.35 + cpe:/o:linux:linux_kernel:3.9.0 + cpe:/o:linux:linux_kernel:3.0.18 + cpe:/o:linux:linux_kernel:3.4.34 + cpe:/o:linux:linux_kernel:3.4.33 + cpe:/o:linux:linux_kernel:3.9.2 + cpe:/o:linux:linux_kernel:3.9.1 + cpe:/o:linux:linux_kernel:3.0.19 + cpe:/o:linux:linux_kernel:3.4.39 + cpe:/o:linux:linux_kernel:3.9.4 + cpe:/o:linux:linux_kernel:3.4.38 + cpe:/o:linux:linux_kernel:3.9.3 + cpe:/o:linux:linux_kernel:3.4.37 + cpe:/o:linux:linux_kernel:3.9.6 + cpe:/o:linux:linux_kernel:3.9.5 + cpe:/o:linux:linux_kernel:3.0.21 + cpe:/o:linux:linux_kernel:3.9.7 + cpe:/o:linux:linux_kernel:3.5.4 + cpe:/o:linux:linux_kernel:3.0.4 + cpe:/o:linux:linux_kernel:3.0.5 + cpe:/o:linux:linux_kernel:3.0.2 + cpe:/o:linux:linux_kernel:3.0.3 + cpe:/o:linux:linux_kernel:3.0.8 + cpe:/o:linux:linux_kernel:3.0.6 + cpe:/o:linux:linux_kernel:3.0.7 + cpe:/o:linux:linux_kernel:3.13.9 + cpe:/o:linux:linux_kernel:3.4.36 + cpe:/o:linux:linux_kernel:3.12.17 + cpe:/o:linux:linux_kernel:3.13.1 + cpe:/o:linux:linux_kernel:3.6.10 + cpe:/o:linux:linux_kernel:3.6.11 + cpe:/o:linux:linux_kernel:3.13.8 + cpe:/o:linux:linux_kernel:3.13.6 + cpe:/o:linux:linux_kernel:3.13.7 + cpe:/o:linux:linux_kernel:3.13.4 + cpe:/o:linux:linux_kernel:3.13.5 + cpe:/o:linux:linux_kernel:3.13.2 + cpe:/o:linux:linux_kernel:3.13.3 + cpe:/o:linux:linux_kernel:3.4.1 + cpe:/o:linux:linux_kernel:3.4.19 + cpe:/o:linux:linux_kernel:3.4.17 + cpe:/o:linux:linux_kernel:3.4.3 + cpe:/o:linux:linux_kernel:3.4.18 + cpe:/o:linux:linux_kernel:3.4.2 + cpe:/o:linux:linux_kernel:3.2.9 + cpe:/o:linux:linux_kernel:3.4.15 + cpe:/o:linux:linux_kernel:3.2.8 + cpe:/o:linux:linux_kernel:3.4.16 + cpe:/o:linux:linux_kernel:3.4.4 + cpe:/o:linux:linux_kernel:3.12.12 + cpe:/o:linux:linux_kernel:3.2.7 + cpe:/o:linux:linux_kernel:3.4.13 + cpe:/o:linux:linux_kernel:3.12.13 + cpe:/o:linux:linux_kernel:3.12.10 + cpe:/o:linux:linux_kernel:3.4.11 + cpe:/o:linux:linux_kernel:3.12.11 + cpe:/o:linux:linux_kernel:3.4.12 + cpe:/o:linux:linux_kernel:3.12.16 + cpe:/o:linux:linux_kernel:3.4.10 + cpe:/o:linux:linux_kernel:3.12.14 + cpe:/o:linux:linux_kernel:3.12.15 + cpe:/o:linux:linux_kernel:3.0.61 + cpe:/o:linux:linux_kernel:3.3:rc2 + cpe:/o:linux:linux_kernel:3.4:rc7 + cpe:/o:linux:linux_kernel:3.0.60 + cpe:/o:linux:linux_kernel:3.3:rc7 + cpe:/o:linux:linux_kernel:3.4:rc5 + cpe:/o:linux:linux_kernel:3.3:rc5 + cpe:/o:linux:linux_kernel:3.4:rc6 + cpe:/o:linux:linux_kernel:3.3:rc6 + cpe:/o:linux:linux_kernel:3.0.64 + cpe:/o:linux:linux_kernel:3.0.63 + cpe:/o:linux:linux_kernel:3.0.62 + cpe:/o:linux:linux_kernel:3.12.1 + cpe:/o:linux:linux_kernel:3.0.68 + cpe:/o:linux:linux_kernel:3.0.67 + cpe:/o:linux:linux_kernel:3.0.66 + cpe:/o:linux:linux_kernel:3.4.14 + cpe:/o:linux:linux_kernel:3.12.7 + cpe:/o:linux:linux_kernel:3.2:rc2 + cpe:/o:linux:linux_kernel:3.1:rc1 + cpe:/o:linux:linux_kernel:3.0.9 + cpe:/o:linux:linux_kernel:3.0:rc4 + cpe:/o:linux:linux_kernel:3.12.8 + cpe:/o:linux:linux_kernel:3.1:rc4 + cpe:/o:linux:linux_kernel:3.0:rc3 + cpe:/o:linux:linux_kernel:3.12.9 + cpe:/o:linux:linux_kernel:3.0:rc2 + cpe:/o:linux:linux_kernel:3.1:rc2 + cpe:/o:linux:linux_kernel:3.0:rc1 + cpe:/o:linux:linux_kernel:3.2:rc7 + cpe:/o:linux:linux_kernel:3.12.3 + cpe:/o:linux:linux_kernel:3.1.10 + cpe:/o:linux:linux_kernel:3.2:rc6 + cpe:/o:linux:linux_kernel:3.12.4 + cpe:/o:linux:linux_kernel:3.2:rc5 + cpe:/o:linux:linux_kernel:3.0:rc7 + cpe:/o:linux:linux_kernel:3.12.5 + cpe:/o:linux:linux_kernel:3.9:rc3 + cpe:/o:linux:linux_kernel:3.0:rc6 + cpe:/o:linux:linux_kernel:3.12.6 + cpe:/o:linux:linux_kernel:3.0:rc5 + cpe:/o:linux:linux_kernel:3.9:rc1 + cpe:/o:linux:linux_kernel:3.9:rc4 + cpe:/o:linux:linux_kernel:3.9:rc7 + cpe:/o:linux:linux_kernel:3.12.2 + cpe:/o:linux:linux_kernel:3.9:rc2 + cpe:/o:linux:linux_kernel:3.9:rc5 + cpe:/o:linux:linux_kernel:3.3:rc3 + cpe:/o:linux:linux_kernel:3.4:rc4 + cpe:/o:linux:linux_kernel:3.4:rc3 + cpe:/o:linux:linux_kernel:3.3:rc1 + cpe:/o:linux:linux_kernel:3.4:rc2 + cpe:/o:linux:linux_kernel:3.9:rc6 + cpe:/o:linux:linux_kernel:3.3:rc4 + cpe:/o:linux:linux_kernel:3.4:rc1 + cpe:/o:linux:linux_kernel:3.4.5 + cpe:/o:linux:linux_kernel:3.2.2 + cpe:/o:linux:linux_kernel:3.2.3 + cpe:/o:linux:linux_kernel:3.2.1 + cpe:/o:linux:linux_kernel:3.4.6 + cpe:/o:linux:linux_kernel:3.2:rc3 + cpe:/o:linux:linux_kernel:3.2.6 + cpe:/o:linux:linux_kernel:3.4.7 + cpe:/o:linux:linux_kernel:3.2:rc4 + cpe:/o:linux:linux_kernel:3.1:rc3 + cpe:/o:linux:linux_kernel:3.4.8 + cpe:/o:linux:linux_kernel:3.2.4 + cpe:/o:linux:linux_kernel:3.4.9 + cpe:/o:linux:linux_kernel:3.2.5 + cpe:/o:linux:linux_kernel:3.0.65 + cpe:/o:linux:linux_kernel:3.2.12 + cpe:/o:linux:linux_kernel:3.8.10 + cpe:/o:linux:linux_kernel:3.8.12 + cpe:/o:linux:linux_kernel:3.8.11 + cpe:/o:linux:linux_kernel:3.8.13 + cpe:/o:linux:linux_kernel:3.7.9 + cpe:/o:linux:linux_kernel:3.7.8 + cpe:/o:linux:linux_kernel:3.7.7 + cpe:/o:linux:linux_kernel:3.7.6 + cpe:/o:linux:linux_kernel:3.6.3 + cpe:/o:linux:linux_kernel:3.7.5 + cpe:/o:linux:linux_kernel:3.7.4 + cpe:/o:linux:linux_kernel:3.7.3 + cpe:/o:linux:linux_kernel:3.7.2 + cpe:/o:linux:linux_kernel:3.6.7 + cpe:/o:linux:linux_kernel:3.6.6 + cpe:/o:linux:linux_kernel:3.6.5 + cpe:/o:linux:linux_kernel:3.6.4 + cpe:/o:linux:linux_kernel:3.6.9 + cpe:/o:linux:linux_kernel:3.6.8 + cpe:/o:linux:linux_kernel:3.10 + cpe:/o:linux:linux_kernel:3.11 + cpe:/o:linux:linux_kernel:3.12 + cpe:/o:linux:linux_kernel:3.13 + cpe:/o:linux:linux_kernel:3.10.1 + cpe:/o:linux:linux_kernel:3.10.2 + cpe:/o:linux:linux_kernel:3.10.3 + cpe:/o:linux:linux_kernel:3.6.2 + cpe:/o:linux:linux_kernel:3.6.1 + cpe:/o:linux:linux_kernel:3.3.6 + cpe:/o:linux:linux_kernel:3.3.7 + cpe:/o:linux:linux_kernel:3.3.8 + cpe:/o:linux:linux_kernel:3.0.1 + cpe:/o:linux:linux_kernel:3.2 + cpe:/o:linux:linux_kernel:3.1 + cpe:/o:linux:linux_kernel:3.7 + cpe:/o:linux:linux_kernel:3.6 + cpe:/o:linux:linux_kernel:3.4 + cpe:/o:linux:linux_kernel:3.1.6 + cpe:/o:linux:linux_kernel:3.1.5 + cpe:/o:linux:linux_kernel:3.1.7 + cpe:/o:linux:linux_kernel:3.0.32 + cpe:/o:linux:linux_kernel:3.8.9 + cpe:/o:linux:linux_kernel:3.1.2 + cpe:/o:linux:linux_kernel:3.1.1 + cpe:/o:linux:linux_kernel:3.1.4 + cpe:/o:linux:linux_kernel:3.1.3 + cpe:/o:linux:linux_kernel:3.9.10 + cpe:/o:linux:linux_kernel:3.0.29 + cpe:/o:linux:linux_kernel:3.3 + cpe:/o:linux:linux_kernel:3.8.4 + cpe:/o:linux:linux_kernel:3.2.26 + cpe:/o:linux:linux_kernel:3.8.5 + cpe:/o:linux:linux_kernel:3.2.27 + cpe:/o:linux:linux_kernel:3.8.2 + cpe:/o:linux:linux_kernel:3.2.24 + cpe:/o:linux:linux_kernel:3.8.3 + cpe:/o:linux:linux_kernel:3.2.25 + cpe:/o:linux:linux_kernel:3.8.8 + cpe:/o:linux:linux_kernel:3.8.6 + cpe:/o:linux:linux_kernel:3.2.28 + cpe:/o:linux:linux_kernel:3.8.7 + cpe:/o:linux:linux_kernel:3.2.29 + cpe:/o:linux:linux_kernel:3.3.3 + cpe:/o:linux:linux_kernel:3.3.4 + cpe:/o:linux:linux_kernel:3.3.5 + cpe:/o:linux:linux_kernel:3.2.22 + cpe:/o:linux:linux_kernel:3.8.1 + cpe:/o:linux:linux_kernel:3.2.20 + cpe:/o:linux:linux_kernel:3.3.1 + cpe:/o:linux:linux_kernel:3.2.21 + cpe:/o:linux:linux_kernel:3.3.2 + cpe:/o:linux:linux_kernel:3.11.1 + cpe:/o:linux:linux_kernel:3.11.2 + cpe:/o:linux:linux_kernel:3.2.23 + cpe:/o:linux:linux_kernel:3.0.17 + cpe:/o:linux:linux_kernel:3.9.11 + cpe:/o:linux:linux_kernel:3.0.16 + cpe:/o:linux:linux_kernel:3.0.15 + cpe:/o:linux:linux_kernel:3.2.30 + cpe:/o:linux:linux_kernel:3.0.14 + cpe:/o:linux:linux_kernel:3.0.13 + cpe:/o:linux:linux_kernel:3.0.12 + cpe:/o:linux:linux_kernel:3.0.11 + cpe:/o:linux:linux_kernel:3.4.61 + cpe:/o:linux:linux_kernel:3.0.10 + cpe:/o:linux:linux_kernel:3.4.64 + cpe:/o:linux:linux_kernel:3.8.0 + cpe:/o:linux:linux_kernel:3.4.65 + cpe:/o:linux:linux_kernel:3.4.62 + cpe:/o:linux:linux_kernel:3.4.63 + cpe:/o:linux:linux_kernel:3.4.68 + cpe:/o:linux:linux_kernel:3.4.66 + cpe:/o:linux:linux_kernel:3.4.67 + cpe:/o:linux:linux_kernel:3.5.3 + cpe:/o:linux:linux_kernel:3.5.1 + cpe:/o:linux:linux_kernel:3.5.2 + cpe:/o:linux:linux_kernel:3.10.4 + cpe:/o:linux:linux_kernel:3.14.1 + cpe:/o:linux:linux_kernel:3.4.72 + cpe:/o:linux:linux_kernel:3.10.9 + cpe:/o:linux:linux_kernel:3.4.73 + cpe:/o:linux:linux_kernel:3.4.74 + cpe:/o:linux:linux_kernel:3.4.75 + cpe:/o:linux:linux_kernel:3.4.76 + cpe:/o:linux:linux_kernel:3.10.5 + cpe:/o:linux:linux_kernel:3.4.77 + cpe:/o:linux:linux_kernel:3.10.6 + cpe:/o:linux:linux_kernel:3.4.78 + cpe:/o:linux:linux_kernel:3.10.7 + cpe:/o:linux:linux_kernel:3.4.79 + cpe:/o:linux:linux_kernel:3.10.8 + cpe:/o:linux:linux_kernel:3.7.10 + cpe:/o:linux:linux_kernel:3.2.17 + cpe:/o:linux:linux_kernel:3.2.18 + cpe:/o:linux:linux_kernel:3.2.19 + cpe:/o:linux:linux_kernel:3.2.13 + cpe:/o:linux:linux_kernel:3.2.14 + cpe:/o:linux:linux_kernel:3.11.3 + cpe:/o:linux:linux_kernel:3.2.15 + cpe:/o:linux:linux_kernel:3.4.60 + cpe:/o:linux:linux_kernel:3.2.16 + cpe:/o:linux:linux_kernel:3.11.5 + cpe:/o:linux:linux_kernel:3.11.4 + cpe:/o:linux:linux_kernel:3.2.10 + cpe:/o:linux:linux_kernel:3.11.7 + cpe:/o:linux:linux_kernel:3.2.11 + cpe:/o:linux:linux_kernel:3.11.6 + cpe:/o:linux:linux_kernel:3.11.9 + cpe:/o:linux:linux_kernel:3.11.8 + cpe:/o:linux:linux_kernel:3.4.69 + + CVE-2014-2851 + 2014-04-14T19:55:07.920-04:00 + 2014-04-15T11:56:13.027-04:00 + + + 6.9 + LOCAL + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-15T11:56:10.607-04:00 + + + + + CONFIRM + https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=b04c46190219a4f845e46a459e3102137b7f6cac + + + MLIST + [oss-security] 20140411 Re: CVE request -- Linux kernel: net: ping: refcount issue in ping_init_sock() function + + + MLIST + [linux-kernel] 20140411 net: ipv4: current group_info should be put after using. + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1086730 + + Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel through 3.14.1 allows local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that leverages an improperly managed reference counter. + + + + + + + + + + + + + + + + + + cpe:/a:openafs:openafs:1.6.2 + cpe:/a:openafs:openafs:1.6.3 + cpe:/a:openafs:openafs:1.6.0 + cpe:/a:openafs:openafs:1.6.5.1 + cpe:/a:openafs:openafs:1.6.1 + cpe:/a:openafs:openafs:1.6.2.1 + cpe:/a:openafs:openafs:1.6.5.2 + cpe:/a:openafs:openafs:1.6.4 + cpe:/a:openafs:openafs:1.6.6 + cpe:/a:openafs:openafs:1.6.5 + + CVE-2014-2852 + 2014-04-14T11:09:06.443-04:00 + 2014-04-15T10:35:42.303-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-15T10:35:42.223-04:00 + + + + + CONFIRM + http://www.openafs.org/frameset/dl/openafs/1.6.7/ChangeLog + + + DEBIAN + DSA-2899 + + OpenAFS before 1.6.7 delays the listen thread when an RXS_CheckResponse fails, which allows remote attackers to cause a denial of service (performance degradation) via an invalid packet. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mediawiki:mediawiki:1.4:beta2 + cpe:/a:mediawiki:mediawiki:1.4:beta3 + cpe:/a:mediawiki:mediawiki:1.17:beta_1 + cpe:/a:mediawiki:mediawiki:1.4:beta1 + cpe:/a:mediawiki:mediawiki:1.14.0:rc1 + cpe:/a:mediawiki:mediawiki:1.21.1 + cpe:/a:mediawiki:mediawiki:1.13.1 + cpe:/a:mediawiki:mediawiki:1.13.0 + cpe:/a:mediawiki:mediawiki:1.20.1 + cpe:/a:mediawiki:mediawiki:1.17.0:rc1 + cpe:/a:mediawiki:mediawiki:1.11 + cpe:/a:mediawiki:mediawiki:1.18:beta_1 + cpe:/a:mediawiki:mediawiki:1.19:beta_2 + cpe:/a:mediawiki:mediawiki:1.13.4 + cpe:/a:mediawiki:mediawiki:1.19:beta_1 + cpe:/a:mediawiki:mediawiki:1.13.3 + cpe:/a:mediawiki:mediawiki:1.13.2 + cpe:/a:mediawiki:mediawiki:1.13.0:rc2 + cpe:/a:mediawiki:mediawiki:1.13.0:rc1 + cpe:/a:mediawiki:mediawiki:1.20.2 + cpe:/a:mediawiki:mediawiki:1.4.11 + cpe:/a:mediawiki:mediawiki:1.5:alpha1 + cpe:/a:mediawiki:mediawiki:1.11.0 + cpe:/a:mediawiki:mediawiki:1.4.12 + cpe:/a:mediawiki:mediawiki:1.4.13 + cpe:/a:mediawiki:mediawiki:1.4.0 + cpe:/a:mediawiki:mediawiki:1.4.14 + cpe:/a:mediawiki:mediawiki:1.4.1 + cpe:/a:mediawiki:mediawiki:1.4.2 + cpe:/a:mediawiki:mediawiki:1.4.3 + cpe:/a:mediawiki:mediawiki:1.4.4 + cpe:/a:mediawiki:mediawiki:1.4.5 + cpe:/a:mediawiki:mediawiki:1.8.4 + cpe:/a:mediawiki:mediawiki:1.4.6 + cpe:/a:mediawiki:mediawiki:1.8.5 + cpe:/a:mediawiki:mediawiki:1.8.3 + cpe:/a:mediawiki:mediawiki:1.4.10 + cpe:/a:mediawiki:mediawiki:1.7.1 + cpe:/a:mediawiki:mediawiki:1.10.0:rc2 + cpe:/a:mediawiki:mediawiki:1.7.2 + cpe:/a:mediawiki:mediawiki:1.7.0 + cpe:/a:mediawiki:mediawiki:1.16.0:beta2 + cpe:/a:mediawiki:mediawiki:1.7.3 + cpe:/a:mediawiki:mediawiki:1.10.0:rc1 + cpe:/a:mediawiki:mediawiki:1.3.10 + cpe:/a:mediawiki:mediawiki:1.5:alpha2 + cpe:/a:mediawiki:mediawiki:1.5.5 + cpe:/a:mediawiki:mediawiki:1.16.0:beta1 + cpe:/a:mediawiki:mediawiki:1.1.0 + cpe:/a:mediawiki:mediawiki:1.16.0:beta3 + cpe:/a:mediawiki:mediawiki:1.5.0 + cpe:/a:mediawiki:mediawiki:1.3.14 + cpe:/a:mediawiki:mediawiki:1.22.4 + cpe:/a:mediawiki:mediawiki:1.21.7 + cpe:/a:mediawiki:mediawiki:1.18.1 + cpe:/a:mediawiki:mediawiki:1.19.10 + cpe:/a:mediawiki:mediawiki:1.3.15 + cpe:/a:mediawiki:mediawiki:1.22.5 + cpe:/a:mediawiki:mediawiki:1.21.8 + cpe:/a:mediawiki:mediawiki:1.21.5 + cpe:/a:mediawiki:mediawiki:1.19.12 + cpe:/a:mediawiki:mediawiki:1.21.6 + cpe:/a:mediawiki:mediawiki:1.19.11 + cpe:/a:mediawiki:mediawiki:1.5.4 + cpe:/a:mediawiki:mediawiki:1.16.2 + cpe:/a:mediawiki:mediawiki:1.19.14 + cpe:/a:mediawiki:mediawiki:1.21.3 + cpe:/a:mediawiki:mediawiki:1.5.3 + cpe:/a:mediawiki:mediawiki:1.3.11 + cpe:/a:mediawiki:mediawiki:1.22.1 + cpe:/a:mediawiki:mediawiki:1.16.1 + cpe:/a:mediawiki:mediawiki:1.19.13 + cpe:/a:mediawiki:mediawiki:1.21.4 + cpe:/a:mediawiki:mediawiki:1.5.2 + cpe:/a:mediawiki:mediawiki:1.3.12 + cpe:/a:mediawiki:mediawiki:1.22.2 + cpe:/a:mediawiki:mediawiki:1.16.0 + cpe:/a:mediawiki:mediawiki:1.5.1 + cpe:/a:mediawiki:mediawiki:1.3.13 + cpe:/a:mediawiki:mediawiki:1.22.3 + cpe:/a:mediawiki:mediawiki:1.21.2 + cpe:/a:mediawiki:mediawiki:1.8.1 + cpe:/a:mediawiki:mediawiki:1.5.6 + cpe:/a:mediawiki:mediawiki:1.3.1 + cpe:/a:mediawiki:mediawiki:1.8.0 + cpe:/a:mediawiki:mediawiki:1.3.2 + cpe:/a:mediawiki:mediawiki:1.5.8 + cpe:/a:mediawiki:mediawiki:1.5.7 + cpe:/a:mediawiki:mediawiki:1.3.0 + cpe:/a:mediawiki:mediawiki:1.3.5 + cpe:/a:mediawiki:mediawiki:1.18.0 + cpe:/a:mediawiki:mediawiki:1.3.6 + cpe:/a:mediawiki:mediawiki:1.3.3 + cpe:/a:mediawiki:mediawiki:1.9.0 + cpe:/a:mediawiki:mediawiki:1.3.4 + cpe:/a:mediawiki:mediawiki:1.9.1 + cpe:/a:mediawiki:mediawiki:1.5:rc4 + cpe:/a:mediawiki:mediawiki:1.18.3 + cpe:/a:mediawiki:mediawiki:1.5:rc2 + cpe:/a:mediawiki:mediawiki:1.3.7 + cpe:/a:mediawiki:mediawiki:1.18.2 + cpe:/a:mediawiki:mediawiki:1.4.7 + cpe:/a:mediawiki:mediawiki:1.4.9 + cpe:/a:mediawiki:mediawiki:1.8.2 + cpe:/a:mediawiki:mediawiki:1.5:rc3 + cpe:/a:mediawiki:mediawiki:1.4.8 + cpe:/a:mediawiki:mediawiki:1.12.0 + cpe:/a:mediawiki:mediawiki:1.12.2 + cpe:/a:mediawiki:mediawiki:1.12.1 + cpe:/a:mediawiki:mediawiki:1.12.4 + cpe:/a:mediawiki:mediawiki:1.12.3 + cpe:/a:mediawiki:mediawiki:1.10.2 + cpe:/a:mediawiki:mediawiki:1.10.4 + cpe:/a:mediawiki:mediawiki:1.10.3 + cpe:/a:mediawiki:mediawiki:1.19.0 + cpe:/a:mediawiki:mediawiki:1.18.0:rc1 + cpe:/a:mediawiki:mediawiki:1.19.9 + cpe:/a:mediawiki:mediawiki:1.14.1 + cpe:/a:mediawiki:mediawiki:1.14.0 + cpe:/a:mediawiki:mediawiki:1.6.12 + cpe:/a:mediawiki:mediawiki:1.6.11 + cpe:/a:mediawiki:mediawiki:1.6.10 + cpe:/a:mediawiki:mediawiki:1.9.5 + cpe:/a:mediawiki:mediawiki:1.9.6 + cpe:/a:mediawiki:mediawiki:1.9.3 + cpe:/a:mediawiki:mediawiki:1.9.4 + cpe:/a:mediawiki:mediawiki:1.9.2 + cpe:/a:mediawiki:mediawiki:1.6.4 + cpe:/a:mediawiki:mediawiki:1.19.5 + cpe:/a:mediawiki:mediawiki:1.19.4 + cpe:/a:mediawiki:mediawiki:1.19.7 + cpe:/a:mediawiki:mediawiki:1.19.6 + cpe:/a:mediawiki:mediawiki:1.3.9 + cpe:/a:mediawiki:mediawiki:1.19.1 + cpe:/a:mediawiki:mediawiki:1.3 + cpe:/a:mediawiki:mediawiki:1.22.0 + cpe:/a:mediawiki:mediawiki:1.19.3 + cpe:/a:mediawiki:mediawiki:1.9.0:rc2 + cpe:/a:mediawiki:mediawiki:1.3.8 + cpe:/a:mediawiki:mediawiki:1.19.2 + cpe:/a:mediawiki:mediawiki:1.6.0 + cpe:/a:mediawiki:mediawiki:1.6.1 + cpe:/a:mediawiki:mediawiki:1.19.8 + cpe:/a:mediawiki:mediawiki:1.6.2 + cpe:/a:mediawiki:mediawiki:1.6.3 + cpe:/a:mediawiki:mediawiki:1.11.2 + cpe:/a:mediawiki:mediawiki:1.19 + cpe:/a:mediawiki:mediawiki:1.20.4 + cpe:/a:mediawiki:mediawiki:1.20.5 + cpe:/a:mediawiki:mediawiki:1.17 + cpe:/a:mediawiki:mediawiki:1.11.1 + cpe:/a:mediawiki:mediawiki:1.18 + cpe:/a:mediawiki:mediawiki:1.20.3 + cpe:/a:mediawiki:mediawiki:1.20.8 + cpe:/a:mediawiki:mediawiki:1.15.5 + cpe:/a:mediawiki:mediawiki:1.20.6 + cpe:/a:mediawiki:mediawiki:1.20.7 + cpe:/a:mediawiki:mediawiki:1.15.0 + cpe:/a:mediawiki:mediawiki:1.15.1 + cpe:/a:mediawiki:mediawiki:1.15.2 + cpe:/a:mediawiki:mediawiki:1.15.3 + cpe:/a:mediawiki:mediawiki:1.10.1 + cpe:/a:mediawiki:mediawiki:1.10.0 + cpe:/a:mediawiki:mediawiki:1.17.2 + cpe:/a:mediawiki:mediawiki:1.6.9 + cpe:/a:mediawiki:mediawiki:1.17.0 + cpe:/a:mediawiki:mediawiki:1.6.8 + cpe:/a:mediawiki:mediawiki:1.17.1 + cpe:/a:mediawiki:mediawiki:1.15.0:rc1 + cpe:/a:mediawiki:mediawiki:1.2.6 + cpe:/a:mediawiki:mediawiki:1.2.5 + cpe:/a:mediawiki:mediawiki:1.2.4 + cpe:/a:mediawiki:mediawiki:1.6.5 + cpe:/a:mediawiki:mediawiki:1.2.3 + cpe:/a:mediawiki:mediawiki:1.2.2 + cpe:/a:mediawiki:mediawiki:1.6.7 + cpe:/a:mediawiki:mediawiki:1.2.1 + cpe:/a:mediawiki:mediawiki:1.6.6 + cpe:/a:mediawiki:mediawiki:1.5:beta4 + cpe:/a:mediawiki:mediawiki:1.17.4 + cpe:/a:mediawiki:mediawiki:1.17.3 + cpe:/a:mediawiki:mediawiki:1.5:beta2 + cpe:/a:mediawiki:mediawiki:1.5:beta1 + cpe:/a:mediawiki:mediawiki:1.5:beta3 + cpe:/a:mediawiki:mediawiki:1.2.0 + cpe:/a:mediawiki:mediawiki:1.15.4 + cpe:/a:mediawiki:mediawiki:1.4:beta4 + cpe:/a:mediawiki:mediawiki:1.21 + cpe:/a:mediawiki:mediawiki:1.4:beta5 + cpe:/a:mediawiki:mediawiki:1.20 + cpe:/a:mediawiki:mediawiki:1.4:beta6 + cpe:/a:mediawiki:mediawiki:1.12.0:rc1 + cpe:/a:mediawiki:mediawiki:1.11.0:rc1 + + CVE-2014-2853 + 2014-04-29T14:55:08.723-04:00 + 2014-04-30T08:44:58.270-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-30T08:44:57.067-04:00 + + + + + CONFIRM + https://www.mediawiki.org/wiki/Release_notes/1.22#Changes_since_1.22.5 + + + CONFIRM + https://www.mediawiki.org/wiki/Release_notes/1.21#Changes_since_1.21.8 + + + MISC + https://github.com/wikimedia/mediawiki-core/commit/0b695ae09aada343ab59be4a3c9963995a1143b6 + + + CONFIRM + https://bugzilla.wikimedia.org/show_bug.cgi?id=63251 + + + MISC + https://bugzilla.redhat.com/show_bug.cgi?id=1091967 + + + BID + 67068 + + + SECUNIA + 58262 + + + MLIST + [MediaWiki-announce] 20140424 MediaWiki Security and Maintenance Releases: 1.22.6 and 1.21.9 + + Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remote attackers to inject arbitrary web script or HTML via the sort key in an info action. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:samba:rsync:3.0.0 + cpe:/a:samba:rsync:3.0.9 + cpe:/a:samba:rsync:3.0.7 + cpe:/a:samba:rsync:3.0.8 + cpe:/a:samba:rsync:2.6.9 + cpe:/a:samba:rsync:3.0.3 + cpe:/a:samba:rsync:3.0.4 + cpe:/a:samba:rsync:3.0.5 + cpe:/a:samba:rsync:3.0.6 + cpe:/a:samba:rsync:3.1.0 + cpe:/a:samba:rsync:2.9.0 + cpe:/a:samba:rsync:2.7.3 + cpe:/a:samba:rsync:2.8.2 + cpe:/a:samba:rsync:2.7.4 + cpe:/a:samba:rsync:2.8.3 + cpe:/a:samba:rsync:3.0.2 + cpe:/a:samba:rsync:3.0.1 + cpe:/a:samba:rsync:2.9.2 + cpe:/a:samba:rsync:2.9.1 + cpe:/a:samba:rsync:2.7.9 + cpe:/a:samba:rsync:2.9.4 + cpe:/a:samba:rsync:2.8.8 + cpe:/a:samba:rsync:2.9.3 + cpe:/a:samba:rsync:2.8.9 + cpe:/a:samba:rsync:2.9.6 + cpe:/a:samba:rsync:2.9.5 + cpe:/a:samba:rsync:2.7.5 + cpe:/a:samba:rsync:2.9.8 + cpe:/a:samba:rsync:2.8.4 + cpe:/a:samba:rsync:2.7.6 + cpe:/a:samba:rsync:2.9.7 + cpe:/a:samba:rsync:2.8.5 + cpe:/a:samba:rsync:2.7.7 + cpe:/a:samba:rsync:2.8.6 + cpe:/a:samba:rsync:2.7.8 + cpe:/a:samba:rsync:2.8.7 + cpe:/a:samba:rsync:2.7.0 + cpe:/a:samba:rsync:2.7.2 + cpe:/a:samba:rsync:2.7.1 + cpe:/a:samba:rsync:2.8.0 + cpe:/a:samba:rsync:2.8.1 + cpe:/a:samba:rsync:2.9.9 + + CVE-2014-2855 + 2014-04-23T11:55:04.593-04:00 + 2014-04-24T11:44:19.740-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-24T11:44:19.507-04:00 + + + + + CONFIRM + https://git.samba.org/?p=rsync.git;a=commit;h=0dedfbce2c1b851684ba658861fe9d620636c56a + + + CONFIRM + https://bugzilla.samba.org/show_bug.cgi?id=10551 + + + CONFIRM + https://bugs.launchpad.net/ubuntu/+source/rsync/+bug/1307230 + + + MLIST + [oss-security] 20140415 Re: CVE Request: rsync denial of service + + + MLIST + [oss-security] 20140414 CVE Request: rsync denial of service + + + SECUNIA + 57948 + + + FEDORA + FEDORA-2014-5315 + + The check_secret function in authenticate.c in rsync 3.1.0 and earlier allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a user name which does not exist in the secrets file. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apple:cups:1.3.2 + cpe:/a:apple:cups:1.3.3 + cpe:/a:apple:cups:1.3.4 + cpe:/a:apple:cups:1.7.1:b1 + cpe:/a:apple:cups:1.3.5 + cpe:/a:apple:cups:1.3.0 + cpe:/a:apple:cups:1.3.1 + cpe:/a:apple:cups:1.3.7 + cpe:/a:apple:cups:1.3.6 + cpe:/a:apple:cups:1.1.16 + cpe:/a:apple:cups:1.2.12 + cpe:/a:apple:cups:1.1.15 + cpe:/a:apple:cups:1.2.10 + cpe:/a:apple:cups:1.2.11 + cpe:/a:apple:cups:1.6.3 + cpe:/a:apple:cups:1.6.4 + cpe:/a:apple:cups:1.1.10-1 + cpe:/a:apple:cups:1.4.6 + cpe:/a:apple:cups:1.4.5 + cpe:/a:apple:cups:1.2.9 + cpe:/a:apple:cups:1.1.23:rc1 + cpe:/a:apple:cups:1.1.22:rc1 + cpe:/a:apple:cups:1.1.20:rc3 + cpe:/a:apple:cups:1.1.22:rc2 + cpe:/a:apple:cups:1.1.21:rc1 + cpe:/a:apple:cups:1.1.20:rc4 + cpe:/a:apple:cups:1.1.21:rc2 + cpe:/a:apple:cups:1.1.20:rc1 + cpe:/a:apple:cups:1.1.20:rc2 + cpe:/a:apple:cups:1.1.20:rc5 + cpe:/a:apple:cups:1.1.19:rc3 + cpe:/a:apple:cups:1.1.20:rc6 + cpe:/a:apple:cups:1.1.19:rc4 + cpe:/a:apple:cups:1.1.19:rc1 + cpe:/a:apple:cups:1.1.19:rc2 + cpe:/a:apple:cups:1.1.19:rc5 + cpe:/a:apple:cups:1.4.3 + cpe:/a:apple:cups:1.4.4 + cpe:/a:apple:cups:1.4.1 + cpe:/a:apple:cups:1.4.2 + cpe:/a:apple:cups:1.4.0 + cpe:/a:apple:cups:1.3.8 + cpe:/a:apple:cups:1.3.9 + cpe:/a:apple:cups:1.6.2 + cpe:/a:apple:cups:1.6.1 + cpe:/a:apple:cups:1.6:b1 + cpe:/a:apple:cups:1.5:b1 + cpe:/a:apple:cups:1.1.5-1 + cpe:/a:apple:cups:1.2.1 + cpe:/a:apple:cups:1.2.2 + cpe:/a:apple:cups:1.2.3 + cpe:/a:apple:cups:1.4:b1 + cpe:/a:apple:cups:1.2.4 + cpe:/a:apple:cups:1.3:b1 + cpe:/a:apple:cups:1.2:b1 + cpe:/a:apple:cups:1.2.5 + cpe:/a:apple:cups:1.2.6 + cpe:/a:apple:cups:1.4.8 + cpe:/a:apple:cups:1.4.7 + cpe:/a:apple:cups:1.5:b2 + cpe:/a:apple:cups:1.4:b3 + cpe:/a:apple:cups:1.2:b2 + cpe:/a:apple:cups:1.4:b2 + cpe:/a:apple:cups:1.2.8 + cpe:/a:apple:cups:1.2.7 + cpe:/a:apple:cups:1.3.10 + cpe:/a:apple:cups:1.2.0 + cpe:/a:apple:cups:1.3.11 + cpe:/a:apple:cups:1.1.14 + cpe:/a:apple:cups:1.1.13 + cpe:/a:apple:cups:1.1.12 + cpe:/a:apple:cups:1.1.11 + cpe:/a:apple:cups:1.1.10 + cpe:/a:apple:cups:1.5.3 + cpe:/a:apple:cups:1.5.2 + cpe:/a:apple:cups:1.5.1 + cpe:/a:apple:cups:1.5.0 + cpe:/a:apple:cups:1.1.4 + cpe:/a:apple:cups:1.1.5 + cpe:/a:apple:cups:1.1.6-2 + cpe:/a:apple:cups:1.1.6 + cpe:/a:apple:cups:1.1.7 + cpe:/a:apple:cups:1.1.6-1 + cpe:/a:apple:cups:1.1.5-2 + cpe:/a:apple:cups:1.1.6-3 + cpe:/a:apple:cups:1.1.2 + cpe:/a:apple:cups:1.1.3 + cpe:/a:apple:cups:1.1.9-1 + cpe:/a:apple:cups:1.1.19 + cpe:/a:apple:cups:1.5:rc1 + cpe:/a:apple:cups:1.7:rc1 + cpe:/a:apple:cups:1.6:rc1 + cpe:/a:apple:cups:1.7.1 + cpe:/a:apple:cups:1.1.9 + cpe:/a:apple:cups:1.1.18 + cpe:/a:apple:cups:1.7.0 + cpe:/a:apple:cups:1.1.8 + cpe:/a:apple:cups:1.1.17 + cpe:/a:apple:cups:1.1.23 + cpe:/a:apple:cups:1.1.22 + cpe:/a:apple:cups:1.1.21 + cpe:/a:apple:cups:1.1.1 + cpe:/a:apple:cups:1.1.20 + cpe:/a:apple:cups:1.1 + cpe:/a:apple:cups:1.2:rc1 + cpe:/a:apple:cups:1.3:rc2 + cpe:/a:apple:cups:1.5.4 + cpe:/a:apple:cups:1.3:rc1 + cpe:/a:apple:cups:1.2:rc3 + cpe:/a:apple:cups:1.4:rc1 + cpe:/a:apple:cups:1.2:rc2 + + CVE-2014-2856 + 2014-04-18T10:55:26.040-04:00 + 2014-04-21T11:20:41.407-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-21T11:20:39.923-04:00 + + + + + MLIST + [oss-security] 20140415 Re: CVE request: cross-site scripting issue fixed in CUPS 1.7.2 + + + MLIST + [oss-security] 20140414 CVE request: cross-site scripting issue fixed in CUPS 1.7.2 + + + CONFIRM + http://www.cups.org/str.php?L4356 + + + CONFIRM + http://www.cups.org/documentation.php/relnotes.html + + + SECUNIA + 57880 + + Cross-site scripting (XSS) vulnerability in scheduler/client.c in Common Unix Printing System (CUPS) before 1.7.2 allows remote attackers to inject arbitrary web script or HTML via the URL path, related to the is_path_absolute function. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:gopivotal:grails:2.0.4 + cpe:/a:gopivotal:grails:2.0.3 + cpe:/a:gopivotal:grails:2.1.5 + cpe:/a:gopivotal:grails-resources:1.2.5 + cpe:/a:gopivotal:grails:2.0.2 + cpe:/a:gopivotal:grails:2.1.4 + cpe:/a:gopivotal:grails:2.1.3 + cpe:/a:gopivotal:grails:2.1.2 + cpe:/a:gopivotal:grails:2.1.1 + cpe:/a:gopivotal:grails-resources:1.2.0 + cpe:/a:gopivotal:grails-resources:1.1.5 + cpe:/a:gopivotal:grails-resources:1.1.4 + cpe:/a:gopivotal:grails-resources:1.1.2 + cpe:/a:gopivotal:grails:2.0.0 + cpe:/a:gopivotal:grails:2.0.1 + cpe:/a:gopivotal:grails-resources:1.1.6 + cpe:/a:gopivotal:grails-resources:1.0.2 + cpe:/a:gopivotal:grails-resources:1.0.0 + cpe:/a:gopivotal:grails-resources:1.2.3 + cpe:/a:gopivotal:grails-resources:1.1.0 + cpe:/a:gopivotal:grails-resources:1.1.1 + cpe:/a:gopivotal:grails-resources:1.2.4 + cpe:/a:gopivotal:grails-resources:1.2.1 + cpe:/a:gopivotal:grails-resources:1.2.2 + cpe:/a:gopivotal:grails:2.1.0 + cpe:/a:gopivotal:grails:2.2.4 + cpe:/a:gopivotal:grails:2.2.5 + cpe:/a:gopivotal:grails:2.2.2 + cpe:/a:gopivotal:grails:2.2.3 + cpe:/a:gopivotal:grails:2.2.0 + cpe:/a:gopivotal:grails:2.2.1 + cpe:/a:gopivotal:grails:2.3.1 + cpe:/a:gopivotal:grails:2.3.2 + cpe:/a:gopivotal:grails:2.3.0 + cpe:/a:gopivotal:grails:2.3.5 + cpe:/a:gopivotal:grails:2.3.6 + cpe:/a:gopivotal:grails:2.3.3 + cpe:/a:gopivotal:grails:2.3.4 + + CVE-2014-2857 + 2014-04-15T19:55:08.720-04:00 + 2014-04-22T13:54:17.127-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-16T07:41:10.000-04:00 + + + + + BUGTRAQ + 20140227 Update: CVE-2014-0053 Information Disclosure when using Grails + + + CONFIRM + http://www.gopivotal.com/security/cve-2014-0053 + + + FULLDISC + 20140227 Update: CVE-2014-0053 Information Disclosure when using Grails + + The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 does not properly restrict access to files in the META-INF directory, which allows remote attackers to obtain sensitive information via a direct request. NOTE: this issue was SPLIT from CVE-2014-0053 due to different researchers per ADT5. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:gopivotal:grails:2.0.4 + cpe:/a:gopivotal:grails:2.0.3 + cpe:/a:gopivotal:grails:2.1.5 + cpe:/a:gopivotal:grails-resources:1.2.5 + cpe:/a:gopivotal:grails:2.0.2 + cpe:/a:gopivotal:grails:2.1.4 + cpe:/a:gopivotal:grails:2.1.3 + cpe:/a:gopivotal:grails:2.1.2 + cpe:/a:gopivotal:grails:2.1.1 + cpe:/a:gopivotal:grails-resources:1.2.0 + cpe:/a:gopivotal:grails-resources:1.1.5 + cpe:/a:gopivotal:grails-resources:1.1.4 + cpe:/a:gopivotal:grails-resources:1.1.2 + cpe:/a:gopivotal:grails:2.0.0 + cpe:/a:gopivotal:grails:2.0.1 + cpe:/a:gopivotal:grails-resources:1.1.6 + cpe:/a:gopivotal:grails-resources:1.0.2 + cpe:/a:gopivotal:grails-resources:1.0.0 + cpe:/a:gopivotal:grails-resources:1.2.3 + cpe:/a:gopivotal:grails-resources:1.1.0 + cpe:/a:gopivotal:grails-resources:1.1.1 + cpe:/a:gopivotal:grails-resources:1.2.4 + cpe:/a:gopivotal:grails-resources:1.2.1 + cpe:/a:gopivotal:grails-resources:1.2.2 + cpe:/a:gopivotal:grails:2.1.0 + cpe:/a:gopivotal:grails:2.2.4 + cpe:/a:gopivotal:grails:2.2.5 + cpe:/a:gopivotal:grails:2.2.2 + cpe:/a:gopivotal:grails:2.2.3 + cpe:/a:gopivotal:grails:2.2.0 + cpe:/a:gopivotal:grails:2.2.1 + cpe:/a:gopivotal:grails:2.3.1 + cpe:/a:gopivotal:grails:2.3.2 + cpe:/a:gopivotal:grails:2.3.0 + cpe:/a:gopivotal:grails:2.3.5 + cpe:/a:gopivotal:grails:2.3.6 + cpe:/a:gopivotal:grails:2.3.3 + cpe:/a:gopivotal:grails:2.3.4 + + CVE-2014-2858 + 2014-04-15T19:55:08.780-04:00 + 2014-04-22T13:53:35.503-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-16T07:42:10.000-04:00 + + + + + BUGTRAQ + 20140227 Update: CVE-2014-0053 Information Disclosure when using Grails + + + CONFIRM + http://www.gopivotal.com/security/cve-2014-0053 + + + FULLDISC + 20140227 Update: CVE-2014-0053 Information Disclosure when using Grails + + Directory traversal vulnerability in the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 allows remote attackers to obtain sensitive information via unspecified vectors related to a "configured block." NOTE: this issue was SPLIT from CVE-2014-0053 per ADT2 due to different vulnerability types. + + + + + + + + + + + + cpe:/a:paperthin:commonspot_content_server:8.0.0 + cpe:/a:paperthin:commonspot_content_server:8.0.2 + cpe:/a:paperthin:commonspot_content_server:7.0.1 + cpe:/a:paperthin:commonspot_content_server:8.0.1 + + CVE-2014-2859 + 2014-04-15T19:13:17.290-04:00 + 2014-04-16T09:58:02.410-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-16T09:58:02.347-04:00 + + + + + CERT-VN + VU#437385 + + PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to bypass intended access restrictions via a direct request. + + + + + + + + + + + + cpe:/a:paperthin:commonspot_content_server:8.0.0 + cpe:/a:paperthin:commonspot_content_server:8.0.2 + cpe:/a:paperthin:commonspot_content_server:7.0.1 + cpe:/a:paperthin:commonspot_content_server:8.0.1 + + CVE-2014-2860 + 2014-04-15T19:13:17.320-04:00 + 2014-04-16T09:58:48.520-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-16T09:58:48.427-04:00 + + + + + CERT-VN + VU#437385 + + Multiple cross-site scripting (XSS) vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to inject arbitrary web script or HTML via a crafted HTTP request to a (1) ColdFusion or (2) JavaScript component. + + + + + + + + + + + + cpe:/a:paperthin:commonspot_content_server:8.0.0 + cpe:/a:paperthin:commonspot_content_server:8.0.2 + cpe:/a:paperthin:commonspot_content_server:7.0.1 + cpe:/a:paperthin:commonspot_content_server:8.0.1 + + CVE-2014-2861 + 2014-04-15T19:13:17.353-04:00 + 2014-04-16T10:08:34.570-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-16T10:08:34.527-04:00 + + + + CERT-VN + VU#437385 + + Incomplete blacklist vulnerability in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted string, as demonstrated by bypassing a protection mechanism that removes only the "alert" string. + + + + + + + + + + + + cpe:/a:paperthin:commonspot_content_server:8.0.0 + cpe:/a:paperthin:commonspot_content_server:8.0.2 + cpe:/a:paperthin:commonspot_content_server:7.0.1 + cpe:/a:paperthin:commonspot_content_server:8.0.1 + + CVE-2014-2862 + 2014-04-15T19:13:17.367-04:00 + 2014-04-16T10:14:08.223-04:00 + + + 6.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-16T10:14:08.177-04:00 + + + + + CERT-VN + VU#437385 + + PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 does not check authorization in unspecified situations, which allows remote authenticated users to perform actions via unknown vectors. + + + + + + + + + + + + cpe:/a:paperthin:commonspot_content_server:8.0.0 + cpe:/a:paperthin:commonspot_content_server:8.0.2 + cpe:/a:paperthin:commonspot_content_server:7.0.1 + cpe:/a:paperthin:commonspot_content_server:8.0.1 + + CVE-2014-2863 + 2014-04-15T19:13:17.400-04:00 + 2014-04-16T10:16:32.620-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-16T10:16:32.573-04:00 + + + + + CERT-VN + VU#437385 + + Multiple absolute path traversal vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to have an unspecified impact via a full pathname in a parameter. + + + + + + + + + + + + cpe:/a:paperthin:commonspot_content_server:8.0.0 + cpe:/a:paperthin:commonspot_content_server:8.0.2 + cpe:/a:paperthin:commonspot_content_server:7.0.1 + cpe:/a:paperthin:commonspot_content_server:8.0.1 + + CVE-2014-2864 + 2014-04-15T19:13:17.430-04:00 + 2014-04-16T10:18:06.887-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-16T10:18:06.827-04:00 + + + + + CERT-VN + VU#437385 + + Multiple directory traversal vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to have an unspecified impact via a filename parameter containing directory traversal sequences. + + + + + + + + + + + + cpe:/a:paperthin:commonspot_content_server:8.0.0 + cpe:/a:paperthin:commonspot_content_server:8.0.2 + cpe:/a:paperthin:commonspot_content_server:7.0.1 + cpe:/a:paperthin:commonspot_content_server:8.0.1 + + CVE-2014-2865 + 2014-04-15T19:13:17.447-04:00 + 2014-04-16T10:20:16.377-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-16T10:20:16.330-04:00 + + + + + CERT-VN + VU#437385 + + PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to bypass intended access restrictions via a '\0' character, as demonstrated by using this character within a pathname on the drive containing the web root directory of a ColdFusion installation. + + + + + + + + + + + + cpe:/a:paperthin:commonspot_content_server:8.0.0 + cpe:/a:paperthin:commonspot_content_server:8.0.2 + cpe:/a:paperthin:commonspot_content_server:7.0.1 + cpe:/a:paperthin:commonspot_content_server:8.0.1 + + CVE-2014-2866 + 2014-04-15T19:13:17.477-04:00 + 2014-04-16T10:22:52.837-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-16T10:22:52.803-04:00 + + + + + CERT-VN + VU#437385 + + PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 relies on client JavaScript code for access restrictions, which allows remote attackers to perform unspecified operations by modifying this code. + + + + + + + + + + + + cpe:/a:paperthin:commonspot_content_server:8.0.0 + cpe:/a:paperthin:commonspot_content_server:8.0.2 + cpe:/a:paperthin:commonspot_content_server:7.0.1 + cpe:/a:paperthin:commonspot_content_server:8.0.1 + + CVE-2014-2867 + 2014-04-15T19:13:17.507-04:00 + 2014-04-16T10:26:37.170-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-16T10:26:36.920-04:00 + + + + CERT-VN + VU#437385 + + Unrestricted file upload vulnerability in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to execute arbitrary code by uploading a ColdFusion page, and then accessing it via unspecified vectors. + + + + + + + + + + + + cpe:/a:paperthin:commonspot_content_server:8.0.0 + cpe:/a:paperthin:commonspot_content_server:8.0.2 + cpe:/a:paperthin:commonspot_content_server:7.0.1 + cpe:/a:paperthin:commonspot_content_server:8.0.1 + + CVE-2014-2868 + 2014-04-15T19:13:17.540-04:00 + 2014-04-16T10:35:23.470-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-16T10:35:23.360-04:00 + + + + CERT-VN + VU#437385 + + PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to modify the flow of execution of ColdFusion code by using an HTTP GET request to set a ColdFusion variable. + + + + + + + + + + + + cpe:/a:paperthin:commonspot_content_server:8.0.0 + cpe:/a:paperthin:commonspot_content_server:8.0.2 + cpe:/a:paperthin:commonspot_content_server:7.0.1 + cpe:/a:paperthin:commonspot_content_server:8.0.1 + + CVE-2014-2869 + 2014-04-15T19:13:17.557-04:00 + 2014-04-16T10:37:18.287-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-16T10:37:18.270-04:00 + + + + + CERT-VN + VU#437385 + + PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to obtain sensitive information via requests to unspecified URIs, as demonstrated by pathname, SQL server, e-mail address, and IP address information. + + + + + + + + + + + + cpe:/a:paperthin:commonspot_content_server:8.0.0 + cpe:/a:paperthin:commonspot_content_server:8.0.2 + cpe:/a:paperthin:commonspot_content_server:7.0.1 + cpe:/a:paperthin:commonspot_content_server:8.0.1 + + CVE-2014-2870 + 2014-04-15T19:13:17.587-04:00 + 2014-04-16T10:38:27.273-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-16T10:38:27.180-04:00 + + + + + CERT-VN + VU#437385 + + The default configuration of PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 uses cleartext for storage of credentials in a database, which makes it easier for context-dependent attackers to obtain sensitive information via unspecified vectors. + + + + + + + + + + + + cpe:/a:paperthin:commonspot_content_server:8.0.0 + cpe:/a:paperthin:commonspot_content_server:8.0.2 + cpe:/a:paperthin:commonspot_content_server:7.0.1 + cpe:/a:paperthin:commonspot_content_server:8.0.1 + + CVE-2014-2871 + 2014-04-15T19:13:17.617-04:00 + 2014-04-16T10:40:20.010-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-16T10:40:17.150-04:00 + + + + + CERT-VN + VU#437385 + + PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 relies on an HTTP session for entering credentials on login pages, which allows remote attackers to obtain sensitive information by sniffing the network. + + + + + + + + + + + + cpe:/a:paperthin:commonspot_content_server:8.0.0 + cpe:/a:paperthin:commonspot_content_server:8.0.2 + cpe:/a:paperthin:commonspot_content_server:7.0.1 + cpe:/a:paperthin:commonspot_content_server:8.0.1 + + CVE-2014-2872 + 2014-04-15T19:13:17.633-04:00 + 2014-04-16T10:41:32.937-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-16T10:41:32.887-04:00 + + + + + CERT-VN + VU#437385 + + PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to obtain potentially sensitive information from a directory listing via unspecified vectors. + + + + + + + + + + + + cpe:/a:paperthin:commonspot_content_server:8.0.0 + cpe:/a:paperthin:commonspot_content_server:8.0.2 + cpe:/a:paperthin:commonspot_content_server:7.0.1 + cpe:/a:paperthin:commonspot_content_server:8.0.1 + + CVE-2014-2873 + 2014-04-15T19:13:17.663-04:00 + 2014-04-16T10:43:17.970-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-16T10:43:17.797-04:00 + + + + + CERT-VN + VU#437385 + + PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 does not require authentication for access to log files, which allows remote attackers to obtain sensitive server information by using a predictable name in a request for a file. + + + + + + + + + + + + cpe:/a:paperthin:commonspot_content_server:8.0.0 + cpe:/a:paperthin:commonspot_content_server:8.0.2 + cpe:/a:paperthin:commonspot_content_server:7.0.1 + cpe:/a:paperthin:commonspot_content_server:8.0.1 + + CVE-2014-2874 + 2014-04-15T19:13:17.697-04:00 + 2014-04-16T10:47:39.103-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-16T10:47:37.793-04:00 + + + + + CERT-VN + VU#437385 + + PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to execute arbitrary code via shell metacharacters in an unspecified context. + + + + + + + + + cpe:/a:dell:sonicwall_email_security:7.5 + + CVE-2014-2879 + 2014-04-17T10:55:12.323-04:00 + 2014-04-18T14:03:19.900-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-18T14:03:19.883-04:00 + + + + + MISC + http://www.vulnerability-lab.com/get_content.php?id=1191 + + + CONFIRM + http://www.sonicwall.com/us/shared/download/Support-Bulletin_Email-Security_Scripting_Vulnerability__Resolved_in__ES746.pdf + + + SECTRACK + 1029965 + + + FULLDISC + 20140328 Dell SonicWall EMail Security 7.4.5 - Multiple Vulnerabilities (Bulletin) + + Multiple cross-site scripting (XSS) vulnerabilities in Dell SonicWALL Email Security 7.4.5 and earlier allow remote authenticated administrators to inject arbitrary web script or HTML via (1) the uploadPatch parameter to the System/Advanced page (settings_advanced.html) or (2) the uploadLicenses parameter in the License management (settings_upload_dlicense.html) page. + + + + + + + + + cpe:/a:oracle:identity_manager:11.1.2.1.0 + + CVE-2014-2880 + 2014-04-17T10:55:12.357-04:00 + 2014-04-18T14:02:38.163-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-18T14:02:38.133-04:00 + + + + + BID + 66615 + + + OSVDB + 105384 + + + EXPLOIT-DB + 32670 + + + MISC + http://packetstormsecurity.com/files/125992/Oracle-Identity-Manager-11g-R2-SP1-Unvalidated-Redirect.html + + Open redirect vulnerability in Oracle Identity Manager 11g R2 SP1 (11.1.2.1.0) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the backUrl parameter in a changepwd action to identity/faces/firstlogin. + + + + + + + + + + + + cpe:/o:citrix:netscaler_application_delivery_controller_firmware:9.3.e + cpe:/o:citrix:netscaler_access_gateway_firmware:9.3 + cpe:/o:citrix:netscaler_access_gateway_firmware:10.1.e + cpe:/o:citrix:netscaler_application_delivery_controller_firmware:10.1 + + CVE-2014-2881 + 2014-05-01T13:28:36.367-04:00 + 2014-05-01T15:06:13.173-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-05-01T15:06:11.737-04:00 + + + + SECTRACK + 1030180 + + + CONFIRM + http://support.citrix.com/article/CTX140651 + + Unspecified vulnerability in the Diffie-Hellman key agreement implementation in the management GUI Java applet in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 9.3-66.5 and 10.x before 10.1-122.17 has unknown impact and vectors. + + + + + + + + + + + + cpe:/o:citrix:netscaler_application_delivery_controller_firmware:9.3.e + cpe:/o:citrix:netscaler_access_gateway_firmware:9.3 + cpe:/o:citrix:netscaler_access_gateway_firmware:10.1.e + cpe:/o:citrix:netscaler_application_delivery_controller_firmware:10.1 + + CVE-2014-2882 + 2014-05-01T13:28:36.383-04:00 + 2014-05-01T15:06:15.627-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-05-01T15:06:15.517-04:00 + + + + SECTRACK + 1030180 + + + CONFIRM + http://support.citrix.com/article/CTX140651 + + Unspecified vulnerability in the management GUI in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 9.3-66.5 and 10.x before 10.1-122.17 has unspecified impact and vectors, related to certificate validation. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:herry:sfpagent:0.3.1::~~~ruby~~ + cpe:/a:herry:sfpagent:0.3.2::~~~ruby~~ + cpe:/a:herry:sfpagent:0.3.3::~~~ruby~~ + cpe:/a:herry:sfpagent:0.2.1::~~~ruby~~ + cpe:/a:herry:sfpagent:0.3.4::~~~ruby~~ + cpe:/a:herry:sfpagent:0.2.0::~~~ruby~~ + cpe:/a:herry:sfpagent:0.3.5::~~~ruby~~ + cpe:/a:herry:sfpagent:0.3.6::~~~ruby~~ + cpe:/a:herry:sfpagent:0.3.7::~~~ruby~~ + cpe:/a:herry:sfpagent:0.4.9::~~~ruby~~ + cpe:/a:herry:sfpagent:0.3.8::~~~ruby~~ + cpe:/a:herry:sfpagent:0.4.8::~~~ruby~~ + cpe:/a:herry:sfpagent:0.2.6::~~~ruby~~ + cpe:/a:herry:sfpagent:0.2.7::~~~ruby~~ + cpe:/a:herry:sfpagent:0.2.8::~~~ruby~~ + cpe:/a:herry:sfpagent:0.2.9::~~~ruby~~ + cpe:/a:herry:sfpagent:0.2.2::~~~ruby~~ + cpe:/a:herry:sfpagent:0.2.3::~~~ruby~~ + cpe:/a:herry:sfpagent:0.3.0::~~~ruby~~ + cpe:/a:herry:sfpagent:0.2.4::~~~ruby~~ + cpe:/a:herry:sfpagent:0.2.5::~~~ruby~~ + cpe:/a:herry:sfpagent:0.3.9::~~~ruby~~ + cpe:/a:herry:sfpagent:0.1.0::~~~ruby~~ + cpe:/a:herry:sfpagent:0.1.2::~~~ruby~~ + cpe:/a:herry:sfpagent:0.1.1::~~~ruby~~ + cpe:/a:herry:sfpagent:0.4.6::~~~ruby~~ + cpe:/a:herry:sfpagent:0.4.7::~~~ruby~~ + cpe:/a:herry:sfpagent:0.4.4::~~~ruby~~ + cpe:/a:herry:sfpagent:0.4.5::~~~ruby~~ + cpe:/a:herry:sfpagent:0.4.2::~~~ruby~~ + cpe:/a:herry:sfpagent:0.4.3::~~~ruby~~ + cpe:/a:herry:sfpagent:0.4.0::~~~ruby~~ + cpe:/a:herry:sfpagent:0.4.1::~~~ruby~~ + cpe:/a:herry:sfpagent:0.1.3::~~~ruby~~ + cpe:/a:herry:sfpagent:0.1.4::~~~ruby~~ + cpe:/a:herry:sfpagent:0.1.5::~~~ruby~~ + cpe:/a:herry:sfpagent:0.1.6::~~~ruby~~ + cpe:/a:herry:sfpagent:0.1.7::~~~ruby~~ + cpe:/a:herry:sfpagent:0.1.8::~~~ruby~~ + cpe:/a:herry:sfpagent:0.1.9::~~~ruby~~ + cpe:/a:herry:sfpagent:0.3.10::~~~ruby~~ + cpe:/a:herry:sfpagent:0.4.11::~~~ruby~~ + cpe:/a:herry:sfpagent:0.4.12::~~~ruby~~ + cpe:/a:herry:sfpagent:0.4.13::~~~ruby~~ + cpe:/a:herry:sfpagent:0.4.14::~~~ruby~~ + cpe:/a:herry:sfpagent:0.4.10::~~~ruby~~ + cpe:/a:herry:sfpagent:0.0.1::~~~ruby~~ + cpe:/a:herry:sfpagent:0.2.10::~~~ruby~~ + cpe:/a:herry:sfpagent:0.1.14::~~~ruby~~ + cpe:/a:herry:sfpagent:0.1.13::~~~ruby~~ + cpe:/a:herry:sfpagent:0.1.12::~~~ruby~~ + cpe:/a:herry:sfpagent:0.1.11::~~~ruby~~ + cpe:/a:herry:sfpagent:0.1.10::~~~ruby~~ + + CVE-2014-2888 + 2014-04-23T11:55:04.860-04:00 + 2014-04-24T13:08:17.750-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-24T13:08:17.000-04:00 + + + + MISC + http://www.vapid.dhs.org/advisories/spfagent-remotecmd.html + + + MLIST + [oss-security] 20140418 Re: Remote Command Injection in Ruby Gem sfpagent 0.4.14 + + + MLIST + [oss-security] 20140415 Remote Command Injection in Ruby Gem sfpagent 0.4.14 + + lib/sfpagent/bsig.rb in the sfpagent gem before 0.4.15 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the module name in a JSON request. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:linux:linux_kernel:3.1.6 + cpe:/o:linux:linux_kernel:3.0.4 + cpe:/o:linux:linux_kernel:3.1.5 + cpe:/o:linux:linux_kernel:3.0.5 + cpe:/o:linux:linux_kernel:3.0.2 + cpe:/o:linux:linux_kernel:3.0.48 + cpe:/o:linux:linux_kernel:3.0.3 + cpe:/o:linux:linux_kernel:3.1.7 + cpe:/o:linux:linux_kernel:3.0.49 + cpe:/o:linux:linux_kernel:3.0.32 + cpe:/o:linux:linux_kernel:3.1.2 + cpe:/o:linux:linux_kernel:3.0.8 + cpe:/o:linux:linux_kernel:3.0.46 + cpe:/o:linux:linux_kernel:3.1.1 + cpe:/o:linux:linux_kernel:3.0.47 + cpe:/o:linux:linux_kernel:3.1.4 + cpe:/o:linux:linux_kernel:3.0.6 + cpe:/o:linux:linux_kernel:3.0.44 + cpe:/o:linux:linux_kernel:3.1.3 + cpe:/o:linux:linux_kernel:3.0.7 + cpe:/o:linux:linux_kernel:3.0.45 + cpe:/o:linux:linux_kernel:3.0.42 + cpe:/o:linux:linux_kernel:3.0.40 + cpe:/o:linux:linux_kernel:3.0.29 + cpe:/o:linux:linux_kernel:3.0.41 + cpe:/o:linux:linux_kernel:3.0.59 + cpe:/o:linux:linux_kernel:3.0.55 + cpe:/o:linux:linux_kernel:3.0.56 + cpe:/o:linux:linux_kernel:3.0.57 + cpe:/o:linux:linux_kernel:3.0.58 + cpe:/o:linux:linux_kernel:3.0.51 + cpe:/o:linux:linux_kernel:3.0.52 + cpe:/o:linux:linux_kernel:3.0.53 + cpe:/o:linux:linux_kernel:3.0.50 + cpe:/o:linux:linux_kernel:3.0.17 + cpe:/o:linux:linux_kernel:3.0.16 + cpe:/o:linux:linux_kernel:3.0.43 + cpe:/o:linux:linux_kernel:3.0.15 + cpe:/o:linux:linux_kernel:3.0.14 + cpe:/o:linux:linux_kernel:3.0.13 + cpe:/o:linux:linux_kernel:3.0.12 + cpe:/o:linux:linux_kernel:3.0.11 + cpe:/o:linux:linux_kernel:3.0.24 + cpe:/o:linux:linux_kernel:3.0.61 + cpe:/o:linux:linux_kernel:3.0.25 + cpe:/o:linux:linux_kernel:3.0.60 + cpe:/o:linux:linux_kernel:3.0.22 + cpe:/o:linux:linux_kernel:3.0.23 + cpe:/o:linux:linux_kernel:3.0.28 + cpe:/o:linux:linux_kernel:3.0.64 + cpe:/o:linux:linux_kernel:3.0.26 + cpe:/o:linux:linux_kernel:3.0.63 + cpe:/o:linux:linux_kernel:3.0.10 + cpe:/o:linux:linux_kernel:3.0.27 + cpe:/o:linux:linux_kernel:3.0.62 + cpe:/o:linux:linux_kernel:3.0.68 + cpe:/o:linux:linux_kernel:3.0.67 + cpe:/o:linux:linux_kernel:3.0.66 + cpe:/o:linux:linux_kernel:3.0.20 + cpe:/o:linux:linux_kernel:3.1:rc1 + cpe:/o:linux:linux_kernel:3.0:rc4 + cpe:/o:linux:linux_kernel:3.0.9 + cpe:/o:linux:linux_kernel:3.1:rc4 + cpe:/o:linux:linux_kernel:3.0:rc3 + cpe:/o:linux:linux_kernel:3.0:rc2 + cpe:/o:linux:linux_kernel:3.1:rc2 + cpe:/o:linux:linux_kernel:3.0:rc1 + cpe:/o:linux:linux_kernel:3.0:rc7 + cpe:/o:linux:linux_kernel:3.0:rc6 + cpe:/o:linux:linux_kernel:3.0:rc5 + cpe:/o:linux:linux_kernel:3.0.54 + cpe:/o:linux:linux_kernel:3.0.33 + cpe:/o:linux:linux_kernel:3.0.1 + cpe:/o:linux:linux_kernel:3.0.34 + cpe:/o:linux:linux_kernel:3.0.35 + cpe:/o:linux:linux_kernel:3.0.36 + cpe:/o:linux:linux_kernel:3.0.37 + cpe:/o:linux:linux_kernel:3.0.38 + cpe:/o:linux:linux_kernel:3.0.39 + cpe:/o:linux:linux_kernel:3.1:rc3 + cpe:/o:linux:linux_kernel:3.0.30 + cpe:/o:linux:linux_kernel:3.0.31 + cpe:/o:linux:linux_kernel:3.1 + cpe:/o:linux:linux_kernel:3.0.18 + cpe:/o:linux:linux_kernel:3.0.65 + cpe:/o:linux:linux_kernel:3.0.19 + cpe:/o:linux:linux_kernel:3.0.21 + + CVE-2014-2889 + 2014-04-26T20:55:05.780-04:00 + 2014-04-28T11:47:57.460-04:00 + + + 4.6 + LOCAL + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-28T11:47:57.083-04:00 + + + + + CONFIRM + https://github.com/torvalds/linux/commit/a03ffcf873fe0f2565386ca8ef832144c42e67fa + + + MLIST + [oss-security] 20140418 Re: CVE request Linux kernel: arch: x86: net: bpf_jit: an off-by-one bug in x86_64 cond jump target + + + CONFIRM + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.1.8 + + + CONFIRM + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a03ffcf873fe0f2565386ca8ef832144c42e67fa + + Off-by-one error in the bpf_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 3.1.8, when BPF JIT is enabled, allows local users to cause a denial of service (system crash) or possibly gain privileges via a long jump after a conditional jump. + + + + + + + + + cpe:/a:siege:phpmyid:0.9 + + CVE-2014-2890 + 2014-04-22T10:23:35.923-04:00 + 2014-04-23T09:37:01.207-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-23T09:37:01.113-04:00 + + + + + BID + 66665 + + + MLIST + [oss-security] 20140418 Re: CVE Request - XXS in phpMyID (openid_error) + + + MLIST + [oss-security] 20140417 CVE Request - XXS in phpMyID (openid_error) + + Cross-site scripting (XSS) vulnerability in the wrap_html function in MyID.php in phpMyID 0.9 allows remote attackers to inject arbitrary web script or HTML via the openid_error parameter to MyID.config.php when the openid.mode parameter is set to error, which is not properly handled in an error message. + + + + + + + + + + + + cpe:/a:libmms_project:libmms:0.6.1 + cpe:/a:libmms_project:libmms:0.6.2 + cpe:/a:libmms_project:libmms:0.6 + cpe:/a:libmms_project:libmms:0.6.3 + + CVE-2014-2892 + 2014-04-22T10:23:35.940-04:00 + 2014-04-23T09:41:56.637-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-23T09:41:56.577-04:00 + + + + + MLIST + [oss-security] 20140418 Re: libmms heap-based buffer overflow fix + + + CONFIRM + http://sourceforge.net/p/libmms/code/ci/03bcfccc22919c72742b7338d02859962861e0e8 + + + XF + libmms-getanswer-bo(92640) + + + BID + 66933 + + + CONFIRM + http://sourceforge.net/p/libmms/code/ci/master/tree/ChangeLog + + + SECUNIA + 57875 + + Heap-based buffer overflow in the get_answer function in mmsh.c in libmms before 0.6.4 allows remote attackers to execute arbitrary code via a long line in an MMS over HTTP (MMSH) server response. + + + + + + + + + cpe:/a:llvm:clang:3.5 + + CVE-2014-2893 + 2014-04-23T11:55:05.033-04:00 + 2014-04-24T12:53:39.490-04:00 + + + 1.9 + LOCAL + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-24T12:53:39.457-04:00 + + + + + MISC + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=744817 + + + MLIST + [oss-security] 20140420 Re: Bug#744817: CVE request: insecure temporary file handling in clang's scan-build utility + + + MLIST + [oss-security] 20140416 CVE request: insecure temporary file handling in clang's scan-build utility + + The GetHTMLRunDir function in the scan-build utility in Clang 3.5 and earlier allows local users to obtain sensitive information or overwrite arbitrary files via a symlink attack on temporary directories with predictable names. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:qemu:qemu:1.0.1 + cpe:/a:qemu:qemu:1.2.0:rc1 + cpe:/a:qemu:qemu:1.2.0:rc2 + cpe:/a:qemu:qemu:1.1.2 + cpe:/a:qemu:qemu:1.2.0:rc3 + cpe:/a:qemu:qemu:1.3.0:rc2 + cpe:/a:qemu:qemu:1.3.0:rc1 + cpe:/a:qemu:qemu:1.2.0 + cpe:/a:qemu:qemu:1.5.1 + cpe:/a:qemu:qemu:1.5.2 + cpe:/a:qemu:qemu:1.5.3 + cpe:/a:qemu:qemu:1.5.0 + cpe:/a:qemu:qemu:0.9.1-5 + cpe:/a:qemu:qemu:1.4.1 + cpe:/a:qemu:qemu:1.4.2 + cpe:/a:qemu:qemu:1.3.0:rc0 + cpe:/a:qemu:qemu:0.9.0 + cpe:/a:qemu:qemu:0.9.1 + cpe:/a:qemu:qemu:0.11.0-rc0 + cpe:/a:qemu:qemu:1.6.0 + cpe:/a:qemu:qemu:0.11.0-rc1 + cpe:/a:qemu:qemu:1.2.0:rc0 + cpe:/a:qemu:qemu:1.6.1 + cpe:/a:qemu:qemu:0.11.0-rc2 + cpe:/a:qemu:qemu:1.6.2 + cpe:/a:qemu:qemu:1.7.1 + cpe:/a:qemu:qemu:0.8.0 + cpe:/a:qemu:qemu:0.8.1 + cpe:/a:qemu:qemu:0.8.2 + cpe:/a:qemu:qemu:0.5.1 + cpe:/a:qemu:qemu:0.5.0 + cpe:/a:qemu:qemu:0.5.5 + cpe:/a:qemu:qemu:0.1.2 + cpe:/a:qemu:qemu:0.5.4 + cpe:/a:qemu:qemu:0.5.3 + cpe:/a:qemu:qemu:0.5.2 + cpe:/a:qemu:qemu:0.14.0:rc0 + cpe:/a:qemu:qemu:0.14.0 + cpe:/a:qemu:qemu:0.14.1 + cpe:/a:qemu:qemu:0.4.3 + cpe:/a:qemu:qemu:0.4.2 + cpe:/a:qemu:qemu:0.4.1 + cpe:/a:qemu:qemu:0.10.0 + cpe:/a:qemu:qemu:0.1.4 + cpe:/a:qemu:qemu:0.1.5 + cpe:/a:qemu:qemu:0.1.3 + cpe:/a:qemu:qemu:0.1.6 + cpe:/a:qemu:qemu:0.15.2 + cpe:/a:qemu:qemu:0.15.1 + cpe:/a:qemu:qemu:0.1.1 + cpe:/a:qemu:qemu:1.1 + cpe:/a:qemu:qemu:1.0 + cpe:/a:qemu:qemu:1.1.1 + cpe:/a:qemu:qemu:0.11.0 + cpe:/a:qemu:qemu:0.11.1 + cpe:/a:qemu:qemu:0.11.0:rc0 + cpe:/a:qemu:qemu:0.13.0:rc0 + cpe:/a:qemu:qemu:0.13.0 + cpe:/a:qemu:qemu:0.10.1 + cpe:/a:qemu:qemu:0.3 + cpe:/a:qemu:qemu:0.4 + cpe:/a:qemu:qemu:0.1 + cpe:/a:qemu:qemu:0.10.3 + cpe:/a:qemu:qemu:0.10.2 + cpe:/a:qemu:qemu:0.2 + cpe:/a:qemu:qemu:1.4.0:rc0 + cpe:/a:qemu:qemu:0.12.0:rc1 + cpe:/a:qemu:qemu:0.10.5 + cpe:/a:qemu:qemu:0.10.4 + cpe:/a:qemu:qemu:0.12.0:rc2 + cpe:/a:qemu:qemu:0.10.6 + cpe:/a:qemu:qemu:1.5.0:rc2 + cpe:/a:qemu:qemu:1.0:rc4 + cpe:/a:qemu:qemu:1.1:rc1 + cpe:/a:qemu:qemu:1.5.0:rc1 + cpe:/a:qemu:qemu:1.0:rc3 + cpe:/a:qemu:qemu:1.1:rc4 + cpe:/a:qemu:qemu:1.0:rc2 + cpe:/a:qemu:qemu:1.5.0:rc3 + cpe:/a:qemu:qemu:1.0:rc1 + cpe:/a:qemu:qemu:1.1:rc2 + cpe:/a:qemu:qemu:0.6.1 + cpe:/a:qemu:qemu:1.1:rc3 + cpe:/a:qemu:qemu:0.6.0 + cpe:/a:qemu:qemu:0.7.2 + cpe:/a:qemu:qemu:0.7.0 + cpe:/a:qemu:qemu:0.7.1 + cpe:/a:qemu:qemu:1.6.0:rc1 + cpe:/a:qemu:qemu:1.6.0:rc2 + cpe:/a:qemu:qemu:1.6.0:rc3 + cpe:/a:qemu:qemu:0.11.0:rc2 + cpe:/a:qemu:qemu:0.11.0:rc1 + cpe:/a:qemu:qemu:0.12.1 + cpe:/a:qemu:qemu:0.12.0 + cpe:/a:qemu:qemu:0.14.0:rc2 + cpe:/a:qemu:qemu:0.14.0:rc1 + cpe:/a:qemu:qemu:0.12.5 + cpe:/a:qemu:qemu:1.4.0:rc1 + cpe:/a:qemu:qemu:0.12.4 + cpe:/a:qemu:qemu:0.13.0:rc1 + cpe:/a:qemu:qemu:0.12.3 + cpe:/a:qemu:qemu:0.12.2 + cpe:/a:qemu:qemu:1.2.1 + cpe:/a:qemu:qemu:1.2.2 + cpe:/a:qemu:qemu:0.15.0:rc1 + cpe:/a:qemu:qemu:0.15.0:rc2 + cpe:/a:qemu:qemu:1.3.0 + cpe:/a:qemu:qemu:1.3.1 + + CVE-2014-2894 + 2014-04-23T11:55:05.157-04:00 + 2014-04-24T13:02:58.990-04:00 + + + 7.2 + LOCAL + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-24T13:02:58.427-04:00 + + + + + MLIST + [Qemu-devel] 20140414 Re: [PATCH for 2.0] ide: Correct improper smart self test c + + + MLIST + [Qemu-devel] 20140414 Re: [PATCH for 2.0] ide: Correct improper smart self test c + + + MLIST + [Qemu-devel] 20140412 [PATCH for 2.0] ide: Correct improper smart self test c + + + BID + 66932 + + + MLIST + [oss-security] 20140418 Re: CVE request Qemu: out of bounds buffer access, guest triggerable via IDE SMART + + + MLIST + [oss-security] 20140415 CVE request Qemu: out of bounds buffer access, guest triggerable via IDE SMART + + + SECUNIA + 57945 + + Off-by-one error in the cmd_smart function in the smart self test in hw/ide/core.c in QEMU before 2.0 allows local users to have unspecified impact via a SMART EXECUTE OFFLINE command that triggers a buffer underflow and memory corruption. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:yassl:cyassl:2.2.0 + cpe:/a:yassl:cyassl:1.6.0 + cpe:/a:yassl:cyassl:1.0.3 + cpe:/a:yassl:cyassl:0.9.6 + cpe:/a:yassl:cyassl:0.5.0 + cpe:/a:yassl:cyassl:1.0.6 + cpe:/a:yassl:cyassl:0.9.8 + cpe:/a:yassl:cyassl:0.8.0 + cpe:/a:yassl:cyassl:1.1.0 + cpe:/a:yassl:cyassl:1.5.0 + cpe:/a:yassl:cyassl:0.9.9 + cpe:/a:yassl:cyassl:1.6.5 + cpe:/a:yassl:cyassl:0.6.3 + cpe:/a:yassl:cyassl:0.6.2 + cpe:/a:yassl:cyassl:1.9.0 + cpe:/a:yassl:cyassl:1.3.0 + cpe:/a:yassl:cyassl:1.8.0 + cpe:/a:yassl:cyassl:2.0.8 + cpe:/a:yassl:cyassl:2.6.0 + cpe:/a:yassl:cyassl:2.0.6 + cpe:/a:yassl:cyassl:0.4.0 + cpe:/a:yassl:cyassl:0.3.0 + cpe:/a:yassl:cyassl:2.7.0 + cpe:/a:yassl:cyassl:2.8.0 + cpe:/a:yassl:cyassl:0.6.0 + cpe:/a:yassl:cyassl:2.0.0:rc1 + cpe:/a:yassl:cyassl:0.9.0 + cpe:/a:yassl:cyassl:2.0.0:rc2 + cpe:/a:yassl:cyassl:2.0.0:rc3 + cpe:/a:yassl:cyassl:1.2.0 + cpe:/a:yassl:cyassl:2.9.0 + cpe:/a:yassl:cyassl:0.2.0 + cpe:/a:yassl:cyassl:1.0.0:rc1 + cpe:/a:yassl:cyassl:1.5.6 + cpe:/a:yassl:cyassl:1.0.0:rc2 + cpe:/a:yassl:cyassl:1.0.0:rc3 + cpe:/a:yassl:cyassl:1.5.4 + cpe:/a:yassl:cyassl:1.4.0 + cpe:/a:yassl:cyassl:2.4.0 + cpe:/a:yassl:cyassl:2.5.0 + cpe:/a:yassl:cyassl:2.4.6 + cpe:/a:yassl:cyassl:2.3.0 + cpe:/a:yassl:cyassl:2.0.2 + cpe:/a:yassl:cyassl:1.0.2 + cpe:/a:yassl:cyassl:0.5.5 + + CVE-2014-2899 + 2014-04-22T10:23:36.317-04:00 + 2014-04-23T08:34:57.897-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-23T08:34:57.677-04:00 + + + + + CONFIRM + http://www.wolfssl.com/yaSSL/Docs-cyassl-changelog.html + + + CONFIRM + http://www.wolfssl.com/yaSSL/Blog/Entries/2014/4/11_wolfSSL_Security_Advisory__April_9%2C_2014.html + + + SECUNIA + 57743 + + + MLIST + [oss-security] 20140418 Re: CVE ids for CyaSSL 2.9.4? + + + MLIST + [oss-security] 20140417 CVE ids for CyaSSL 2.9.4? + + wolfSSL CyaSSL before 2.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via (1) a request for the peer certificate when a certificate parsing failure occurs or (2) a client_key_exchange message when the ephemeral key is not found. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:yassl:cyassl:2.2.0 + cpe:/a:yassl:cyassl:1.6.0 + cpe:/a:yassl:cyassl:1.0.3 + cpe:/a:yassl:cyassl:0.9.6 + cpe:/a:yassl:cyassl:0.5.0 + cpe:/a:yassl:cyassl:1.0.6 + cpe:/a:yassl:cyassl:0.9.8 + cpe:/a:yassl:cyassl:0.8.0 + cpe:/a:yassl:cyassl:1.1.0 + cpe:/a:yassl:cyassl:1.5.0 + cpe:/a:yassl:cyassl:0.9.9 + cpe:/a:yassl:cyassl:1.6.5 + cpe:/a:yassl:cyassl:0.6.3 + cpe:/a:yassl:cyassl:0.6.2 + cpe:/a:yassl:cyassl:1.9.0 + cpe:/a:yassl:cyassl:1.3.0 + cpe:/a:yassl:cyassl:1.8.0 + cpe:/a:yassl:cyassl:2.0.8 + cpe:/a:yassl:cyassl:2.6.0 + cpe:/a:yassl:cyassl:2.0.6 + cpe:/a:yassl:cyassl:0.4.0 + cpe:/a:yassl:cyassl:0.3.0 + cpe:/a:yassl:cyassl:2.7.0 + cpe:/a:yassl:cyassl:2.8.0 + cpe:/a:yassl:cyassl:0.6.0 + cpe:/a:yassl:cyassl:2.0.0:rc1 + cpe:/a:yassl:cyassl:0.9.0 + cpe:/a:yassl:cyassl:2.0.0:rc2 + cpe:/a:yassl:cyassl:2.0.0:rc3 + cpe:/a:yassl:cyassl:1.2.0 + cpe:/a:yassl:cyassl:2.9.0 + cpe:/a:yassl:cyassl:0.2.0 + cpe:/a:yassl:cyassl:1.0.0:rc1 + cpe:/a:yassl:cyassl:1.5.6 + cpe:/a:yassl:cyassl:1.0.0:rc2 + cpe:/a:yassl:cyassl:1.0.0:rc3 + cpe:/a:yassl:cyassl:1.5.4 + cpe:/a:yassl:cyassl:1.4.0 + cpe:/a:yassl:cyassl:2.4.0 + cpe:/a:yassl:cyassl:2.5.0 + cpe:/a:yassl:cyassl:2.4.6 + cpe:/a:yassl:cyassl:2.3.0 + cpe:/a:yassl:cyassl:2.0.2 + cpe:/a:yassl:cyassl:1.0.2 + cpe:/a:yassl:cyassl:0.5.5 + + CVE-2014-2900 + 2014-04-22T10:23:36.317-04:00 + 2014-04-23T08:39:11.667-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-23T08:39:11.043-04:00 + + + + + CONFIRM + http://www.wolfssl.com/yaSSL/Docs-cyassl-changelog.html + + + CONFIRM + http://www.wolfssl.com/yaSSL/Blog/Entries/2014/4/11_wolfSSL_Security_Advisory__April_9%2C_2014.html + + + SECUNIA + 57743 + + + MLIST + [oss-security] 20140418 Re: CVE ids for CyaSSL 2.9.4? + + + MLIST + [oss-security] 20140417 CVE ids for CyaSSL 2.9.4? + + wolfSSL CyaSSL before 2.9.4 does not properly validate X.509 certificates with unknown critical extensions, which allows man-in-the-middle attackers to spoof servers via crafted X.509 certificate. + + + CVE-2014-2905 + 2014-05-02T10:55:07.260-04:00 + 2014-05-02T10:55:07.260-04:00 + + CONFIRM + https://github.com/fish-shell/fish-shell/issues/1436 + + + MLIST + [oss-security] 20140428 Upcoming security release of fish 2.1.1 + + fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly check the credentials, which allows local users to gain privileges via the universal variable socket, related to /tmp/fishd.socket.user permissions. + + + + + + + + + + + + + + + cpe:/a:wireshark:wireshark:1.10.6 + cpe:/a:wireshark:wireshark:1.10.1 + cpe:/a:wireshark:wireshark:1.10.5 + cpe:/a:wireshark:wireshark:1.10.2 + cpe:/a:wireshark:wireshark:1.10.4 + cpe:/a:wireshark:wireshark:1.10.3 + cpe:/a:wireshark:wireshark:1.10.0 + + CVE-2014-2907 + 2014-04-24T06:55:02.397-04:00 + 2014-04-24T14:56:58.507-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-24T14:56:58.427-04:00 + + + + CONFIRM + https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=30ba425e7e95f7b61b3a3e5ff0c46e4be9d3d8d7 + + + CONFIRM + https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9885 + + + CONFIRM + http://www.wireshark.org/security/wnpa-sec-2014-06.html + + The srtp_add_address function in epan/dissectors/packet-rtp.c in the RTP dissector in Wireshark 1.10.x before 1.10.7 does not properly update SRTP conversation data, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. + + + + + + + + + + + + + + + + + + + + cpe:/h:siemens:simatic_s7_cpu-1211c:- + cpe:/h:siemens:simatic_s7_cpu_1212c:- + cpe:/o:siemens:simatic_s7_cpu_1200_firmware:3.0 + cpe:/o:siemens:simatic_s7_cpu_1200_firmware:2.0 + cpe:/h:siemens:simatic_s7_cpu_1217c:- + cpe:/h:siemens:simatic_s7_cpu_1215c:- + cpe:/h:siemens:simatic_s7_cpu_1214c:- + cpe:/o:siemens:simatic_s7_cpu_1200_firmware:3.0.2 + + CVE-2014-2908 + 2014-04-25T01:12:07.847-04:00 + 2014-04-25T13:08:33.573-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-25T13:08:33.480-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-114-02 + + + CONFIRM + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-892012.pdf + + Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + + + + + + + + + + + cpe:/h:siemens:simatic_s7_cpu-1211c:- + cpe:/h:siemens:simatic_s7_cpu_1212c:- + cpe:/o:siemens:simatic_s7_cpu_1200_firmware:3.0 + cpe:/o:siemens:simatic_s7_cpu_1200_firmware:2.0 + cpe:/h:siemens:simatic_s7_cpu_1217c:- + cpe:/h:siemens:simatic_s7_cpu_1215c:- + cpe:/h:siemens:simatic_s7_cpu_1214c:- + cpe:/o:siemens:simatic_s7_cpu_1200_firmware:3.0.2 + + CVE-2014-2909 + 2014-04-25T01:12:07.863-04:00 + 2014-04-25T13:10:47.627-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-25T13:10:47.530-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-114-02 + + + CONFIRM + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-892012.pdf + + CRLF injection vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary HTTP headers via unspecified vectors. + + + + + + + + + + cpe:/o:xen:xen:4.4.0:- + cpe:/o:xen:xen:4.4.0:rc1 + + CVE-2014-2915 + 2014-04-24T10:55:04.467-04:00 + 2014-04-24T15:18:10.307-04:00 + + + 5.5 + ADJACENT_NETWORK + LOW + SINGLE_INSTANCE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-24T15:18:10.260-04:00 + + + + + CONFIRM + http://xenbits.xen.org/xsa/advisory-93.html + + + SECTRACK + 1030135 + + + MLIST + [oss-security] 20140423 Xen Security Advisory 93 (CVE-2014-2915) - Hardware features unintentionally exposed to guests on ARM + + + MLIST + [oss-security] 20140422 Re: Xen Security Advisory 93 - Hardware features unintentionally exposed to guests on ARM + + Xen 4.4.x, when running on ARM systems, does not properly restrict access to hardware features, which allows local guest users to cause a denial of service (host or guest crash) via unspecified vectors, related to (1) cache control, (2) coprocessors, (3) debug registers, and (4) other unspecified registers. + + + + + + + + + + + + cpe:/a:pimcore:pimcore:1.4.9 + cpe:/a:pimcore:pimcore:2.1.0 + cpe:/a:pimcore:pimcore:1.5.0 + cpe:/a:pimcore:pimcore:2.2.0 + + CVE-2014-2921 + 2014-04-21T18:55:08.397-04:00 + 2014-04-22T11:04:07.283-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-22T11:04:07.143-04:00 + + + + + CONFIRM + http://www.pimcore.org/en/resources/blog/pimcore+2.2+released_b442 + + + MISC + https://github.com/pedrib/PoC/blob/master/pimcore-2.1.0.txt + + + MLIST + [oss-security] 20140421 Re: Remote code execution in Pimcore CMS + + The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via vectors involving a Zend_Pdf_ElementFactory_Proxy object and a pathname with a trailing \0 character. + + + + + + + + + + + cpe:/a:pimcore:pimcore:1.4.9 + cpe:/a:pimcore:pimcore:2.1.0 + cpe:/a:pimcore:pimcore:1.5.0 + + CVE-2014-2922 + 2014-04-21T18:55:08.473-04:00 + 2014-04-22T11:06:56.257-04:00 + + + 6.4 + NETWORK + LOW + NONE + NONE + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-22T11:06:48.740-04:00 + + + + + MISC + https://github.com/pedrib/PoC/blob/master/pimcore-2.1.0.txt + + + CONFIRM + http://www.pimcore.org/en/resources/blog/pimcore+2.2+released_b442 + + + MLIST + [oss-security] 20140421 Re: Remote code execution in Pimcore CMS + + The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.1.0 does not properly handle an object obtained by unserializing a pathname, which allows remote attackers to conduct PHP object injection attacks and delete arbitrary files via vectors involving a Zend_Http_Response_Stream object. + + + + + + + + + + + + + + + + cpe:/o:asus:rt-ac68u_firmware:3.0.0.4.374_4983 + cpe:/o:asus:rt-ac68u_firmware:3.0.0.4.374.4755 + cpe:/h:asus:rt-ac68u:- + cpe:/o:asus:rt-ac68u_firmware:3.0.0.4.374_4887 + + CVE-2014-2925 + 2014-04-22T09:06:30.743-04:00 + 2014-04-22T15:29:04.440-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-22T15:29:04.393-04:00 + + + + + CONFIRM + http://www.asus.com/Networking/RTAC68U/HelpDesk_Download/ + + + CONFIRM + http://support.asus.com/download.aspx?m=RT-N66U+%28VER.B1%29 + + + FULLDISC + 20140404 Reflected Cross-Site Scripting within the ASUS RT-AC68U Managing Web Interface + + Cross-site scripting (XSS) vulnerability in Advanced_Wireless_Content.asp in ASUS RT-AC68U and other RT series routers with firmware before 3.0.0.4.374.5047 allows remote attackers to inject arbitrary web script or HTML via the current_page parameter to apply.cgi. + + + + + + + + + cpe:/a:sixnet:sixview_manager:2.4.1 + + CVE-2014-2976 + 2014-04-23T11:55:05.517-04:00 + 2014-04-24T13:15:57.687-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-24T13:15:57.590-04:00 + + + + + EXPLOIT-DB + 32973 + + Directory traversal vulnerability in Sixnet SixView Manager 2.4.1 allows remote attackers to read arbitrary files via a .. (dot dot) in an HTTP GET request to TCP port 18081. + + + + + + + + + cpe:/a:gnustep:base:1.24.6 + + CVE-2014-2980 + 2014-04-28T10:09:08.253-04:00 + 2014-04-29T09:16:01.830-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-29T09:16:01.660-04:00 + + + + + CONFIRM + http://svn.gna.org/viewcvs/gnustep/libs/base/trunk/Tools/gdomap.c?r1=37756&r2=37755&pathrev=37756 + + + CONFIRM + https://savannah.gnu.org/bugs/?41751 + + + XF + gnustep-cve20142980-dos(92688) + + + BID + 66992 + + + CONFIRM + http://svn.gna.org/viewcvs/gnustep/libs/base/trunk/ChangeLog?r1=37756&r2=37755&pathrev=37756 + + + SECUNIA + 58104 + + + MLIST + [oss-security] 20140421 Re: CVE request / advisory: gdomap (GNUstep core package <= 1.24.6) + + + MLIST + [oss-security] 20140419 CVE request / advisory: gdomap (GNUstep core package <= 1.24.6) + + Tools/gdomap.c in gdomap in GNUstep Base 1.24.6 and earlier, when run in daemon mode, does not properly handle the file descriptor for the logger, which allows remote attackers to cause a denial of service (abort) via an invalid request. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:drupal:drupal:6.21 + cpe:/a:drupal:drupal:6.0:rc3 + cpe:/a:drupal:drupal:6.29 + cpe:/a:drupal:drupal:6.0:rc2 + cpe:/a:drupal:drupal:6.20 + cpe:/a:drupal:drupal:6.0:rc4 + cpe:/a:drupal:drupal:6.0:rc1 + cpe:/a:drupal:drupal:6.24 + cpe:/a:drupal:drupal:6.23 + cpe:/a:drupal:drupal:6.22 + cpe:/a:drupal:drupal:7.0:rc1 + cpe:/a:drupal:drupal:7.0:rc2 + cpe:/a:drupal:drupal:7.0:rc3 + cpe:/a:drupal:drupal:6.28 + cpe:/a:drupal:drupal:7.0:rc4 + cpe:/a:drupal:drupal:6.27 + cpe:/a:drupal:drupal:6.26 + cpe:/a:drupal:drupal:6.25 + cpe:/a:drupal:drupal:7.11 + cpe:/a:drupal:drupal:6.10 + cpe:/a:drupal:drupal:7.17 + cpe:/a:drupal:drupal:7.18 + cpe:/a:drupal:drupal:6.18 + cpe:/a:drupal:drupal:7.15 + cpe:/a:drupal:drupal:7.16 + cpe:/a:drupal:drupal:7.13 + cpe:/a:drupal:drupal:7.14 + cpe:/a:drupal:drupal:7.12 + cpe:/a:drupal:drupal:6.11 + cpe:/a:drupal:drupal:7.0:alpha3 + cpe:/a:drupal:drupal:7.10 + cpe:/a:drupal:drupal:7.0:alpha2 + cpe:/a:drupal:drupal:6.13 + cpe:/a:drupal:drupal:6.12 + cpe:/a:drupal:drupal:6.15 + cpe:/a:drupal:drupal:7.0:alpha7 + cpe:/a:drupal:drupal:6.14 + cpe:/a:drupal:drupal:7.0:alpha6 + cpe:/a:drupal:drupal:7.19 + cpe:/a:drupal:drupal:6.17 + cpe:/a:drupal:drupal:6.16 + cpe:/a:drupal:drupal:6.0:beta2 + cpe:/a:drupal:drupal:7.0:alpha4 + cpe:/a:drupal:drupal:7.22 + cpe:/a:drupal:drupal:7.0:alpha5 + cpe:/a:drupal:drupal:6.0:beta1 + cpe:/a:drupal:drupal:7.0:alpha1 + cpe:/a:drupal:drupal:6.0:beta3 + cpe:/a:drupal:drupal:7.0:dev + cpe:/a:drupal:drupal:7.23 + cpe:/a:drupal:drupal:7.24 + cpe:/a:drupal:drupal:7.25 + cpe:/a:drupal:drupal:6.0:dev + cpe:/a:drupal:drupal:7.26 + cpe:/a:drupal:drupal:6.0:beta4 + cpe:/a:drupal:drupal:7.20 + cpe:/a:drupal:drupal:7.21 + cpe:/a:drupal:drupal:6.19 + cpe:/a:drupal:drupal:7.2 + cpe:/a:drupal:drupal:7.1 + cpe:/a:drupal:drupal:7.0 + cpe:/a:drupal:drupal:6.2 + cpe:/a:drupal:drupal:6.1 + cpe:/a:drupal:drupal:6.0 + cpe:/a:drupal:drupal:7.0:beta2 + cpe:/a:drupal:drupal:7.0:beta3 + cpe:/a:drupal:drupal:7.0:beta1 + cpe:/a:drupal:drupal:6.3 + cpe:/a:drupal:drupal:6.30 + + CVE-2014-2983 + 2014-04-23T11:55:05.890-04:00 + 2014-04-24T13:26:33.140-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-24T13:26:32.283-04:00 + + + + + CONFIRM + https://drupal.org/SA-CORE-2014-002 + + + MLIST + [oss-security] 20140421 Re: CVE Request for Drupal Core + + Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different anonymous users, which allows remote anonymous users to obtain sensitive interim form input information in opportunistic situations via unspecified vectors. + + + CVE-2014-2984 + 2014-04-25T01:12:07.897-04:00 + 2014-04-25T01:12:07.990-04:00 + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-2650. Reason: This candidate is a reservation duplicate of CVE-2014-2650. Notes: All CVE users should reference CVE-2014-2650 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. + + + + + + + + + + cpe:/o:xen:xen:4.4.0:- + cpe:/o:xen:xen:4.4.0:rc1 + + CVE-2014-2986 + 2014-04-28T10:09:08.487-04:00 + 2014-04-29T09:38:02.563-04:00 + + + 5.5 + ADJACENT_NETWORK + LOW + SINGLE_INSTANCE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-29T09:38:02.533-04:00 + + + + + CONFIRM + http://xenbits.xen.org/xsa/advisory-94.html + + + SECTRACK + 1030146 + + + BID + 67047 + + + MLIST + [oss-security] 20140423 Xen Security Advisory 94 (CVE-2014-2986) - ARM hypervisor crash on guest interrupt controller access + + + MLIST + [oss-security] 20140423 Re: Xen Security Advisory 94 - ARM hypervisor crash on guest interrupt controller access + + + MLIST + [oss-security] 20140423 Xen Security Advisory 94 - ARM hypervisor crash on guest interrupt controller access + + The vgic_distr_mmio_write function in the virtual guest interrupt controller (GIC) distributor (arch/arm/vgic.c) in Xen 4.4.x, when running on an ARM system, allows local guest users to cause a denial of service (NULL pointer dereference and host crash) via unspecified vectors. + + + + + + + + + cpe:/a:misli:misli.com_app:-::~~~~android~ + + CVE-2014-2992 + 2014-04-25T21:55:05.027-04:00 + 2014-04-28T09:21:00.697-04:00 + + + 6.4 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-28T09:21:00.573-04:00 + + + + + MISC + http://sceptive.com/p/mislicom-android-app-ssl-certificate-validation-weakness- + + + BUGTRAQ + 20140424 Misli.com Android App SSL certificate validation weakness + + The Misli.com application for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. + + + + + + + + + cpe:/a:birebin:birebin.com_app:-::~~~~android~ + + CVE-2014-2993 + 2014-04-25T21:55:05.060-04:00 + 2014-04-28T09:33:19.593-04:00 + + + 6.4 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-28T09:33:19.563-04:00 + + + + + MISC + http://sceptive.com/p/birebincom-android-app-ssl-certificate-validation-weakness- + + + BUGTRAQ + 20140424 Birebin.com Android App SSL certificate validation weakness + + The Birebin.com application for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. + + + + + + + + + cpe:/a:acunetix:web_vulnerability_scanner:8:build_20120704 + + CVE-2014-2994 + 2014-04-27T00:32:01.717-04:00 + 2014-04-28T12:06:13.133-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-28T12:06:13.087-04:00 + + + + + MISC + https://www.youtube.com/watch?v=RHaMx8K1GeM + + + EXPLOIT-DB + 32997 + + + CONFIRM + http://www.acunetix.com/blog/news/misleading-reports-0-day-acunetix-wvs/ + + + MISC + http://packetstormsecurity.com/files/126307/Acunetix-8-Scanner-Buffer-Overflow.html + + + MISC + http://packetstormsecurity.com/files/126306/Acunetix-8-Stack-Buffer-Overflow.html + + + MISC + http://osandamalith.wordpress.com/2014/04/24/pwning-script-kiddies-acunetix-buffer-overflow/ + + + MISC + http://an7isec.blogspot.co.il/2014/04/pown-noobs-acunetix-0day.html + + Stack-based buffer overflow in Acunetix Web Vulnerability Scanner (WVS) 8 build 20120704 allows remote attackers to execute arbitrary code via an HTML file containing an IMG element with a long URL (src attribute). + + + + + + + + + cpe:/a:xcloner:xcloner:3.5::standalone + + CVE-2014-2996 + 2014-04-25T16:55:03.040-04:00 + 2014-04-28T08:03:04.260-04:00 + + + 7.1 + NETWORK + HIGH + SINGLE_INSTANCE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-28T08:03:04.230-04:00 + + + + + MISC + https://www.htbridge.com/advisory/HTB23207 + + + BUGTRAQ + 20140409 &ETH;&iexcl;ross-Site Request Forgery (CSRF) in XCloner Standalone + + + EXPLOIT-DB + 32790 + + XCloner Standalone 3.5 and earlier, when enable_db_backup and sql_mem are enabled, allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the dbbackup_comp parameter in a generate action to index2.php. NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have the privileges to execute code. NOTE: this can be leveraged by remote attackers using CVE-2014-2579. + + + CVE-2014-3000 + 2014-05-02T10:55:07.433-04:00 + 2014-05-02T10:55:07.433-04:00 + + SECTRACK + 1030172 + + + BID + 67153 + + + FREEBSD + FreeBSD-SA-14:08 + + + SECUNIA + 58293 + + The TCP reassembly function in the inet module in FreeBSD 8.3 before p16, 8.4 before p9, 9.1 before p12, 9.2 before p5, and 10.0 before p2 allows remote attackers to cause a denial of service (undefined memory access and system crash) or possibly read system memory via multiple crafted packets, related to moving a reassemble queue entry to the segment list when the queue is full. + + + CVE-2014-3001 + 2014-05-02T10:55:07.510-04:00 + 2014-05-02T10:55:07.510-04:00 + + SECTRACK + 1030171 + + + BID + 67158 + + + FREEBSD + FreeBSD-SA-14:07 + + The device file system (aka devfs) in FreeBSD 10.0 before p2 does not load default rulesets when booting, which allows context-dependent attackers to bypass intended restrictions by leveraging a jailed device node process. + + + CVE-2014-3006 + 2014-05-02T10:55:07.590-04:00 + 2014-05-02T10:55:07.590-04:00 + + MISC + https://www.lsexperts.de/advisories/lse-2014-04-10.txt + + + BID + 67165 + + + BUGTRAQ + 20140430 LSE Leading Security Experts GmbH - LSE-2014-04-10 - Sitepark IES - Unauthenticated Access + + + FULLDISC + 20140430 LSE Leading Security Experts GmbH - LSE-2014-04-10 - Sitepark IES - Unauthenticated Access + + Sitepark Information Enterprise Server (IES) 2.9 before 2.9.6, when upgraded from an earlier version, does not properly restrict access, which allows remote attackers to change the manager account password and obtain sensitive information via a request to install/. + + + + + + + + + + cpe:/a:python:pillow:2.3.0 + cpe:/a:pythonware:python_imaging_library:1.1.7 + + CVE-2014-3007 + 2014-04-27T16:55:23.697-04:00 + 2014-04-28T13:51:13.663-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-28T13:51:13.617-04:00 + + + + + MISC + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059 + + + MISC + http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-1932.html + + Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py. + + + + + + + + + cpe:/a:unitrends:enterprise_backup:7.3.0 + + CVE-2014-3008 + 2014-04-28T10:09:08.940-04:00 + 2014-04-29T09:37:14.843-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-29T09:37:14.797-04:00 + + + + + MISC + https://gist.github.com/brandonprry/10745756 + + + XF + unitrends-snmpod-command-exec(92642) + + + BID + 66928 + + + EXPLOIT-DB + 32885 + + + SECUNIA + 58001 + + + FULLDISC + 20140415 Unitrends enterprise backup remote unauthenticated root + + Unitrends Enterprise Backup 7.3.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the comm parameter to recoveryconsole/bpl/snmpd.php. + + + CVE-2014-3125 + 2014-05-02T10:55:07.807-04:00 + 2014-05-02T10:55:07.807-04:00 + + CONFIRM + http://xenbits.xen.org/xsa/advisory-91.html + + + SECTRACK + 1030184 + + + BID + 67157 + + + MLIST + [oss-security] 20140430 Xen Security Advisory 91 - Hardware timer context is not properly context switched on ARM + + + MLIST + [oss-security] 20140430 Re: Xen Security Advisory 91 - Hardware timer context is not properly context switched on ARM + + + SECUNIA + 58347 + + Xen 4.4.x, when running on an ARM system, does not properly context switch the CNTKCTL_EL1 register, which allows local guest users to modify the hardware timers and cause a denial of service (crash) via unspecified vectors. + + + + + + + + + cpe:/a:sap:netweaver_software_lifecycle_manager:7.1 + + CVE-2014-3129 + 2014-04-30T10:22:07.203-04:00 + 2014-05-01T08:51:41.993-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-05-01T08:51:41.960-04:00 + + + + + CONFIRM + https://service.sap.com/sap/support/notes/1894049 + + + SECTRACK + 1030157 + + + MISC + http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-005 + + + FULLDISC + 20140428 [Onapsis Security Advisory 2014-005] Information disclosure in SAP Software Lifeclycle Manager + + + CONFIRM + http://scn.sap.com/docs/DOC-8218 + + The Java Server Pages in the Software Lifecycle Manager (SLM) in SAP NetWeaver allows remote attackers to obtain sensitive information via a crafted request, related to SAP Solution Manager 7.1. + + + + + + + + + cpe:/a:sap:netweaver_abap_application_server:- + + CVE-2014-3130 + 2014-04-30T10:22:07.250-04:00 + 2014-05-01T09:06:15.100-04:00 + + + 4.6 + LOCAL + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-05-01T09:06:15.007-04:00 + + + ALLOWS_OTHER_ACCESS + + + CONFIRM + https://service.sap.com/sap/support/notes/1910914 + + + MISC + http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-009 + + + FULLDISC + 20140428 [Onapsis Security Advisory 2014-009] SAP BASIS Missing Authorization Check + + + CONFIRM + http://scn.sap.com/docs/DOC-8218 + + The ABAP Help documentation and translation tools (BC-DOC-HLP) in Basis in SAP Netweaver ABAP Application Server does not properly restrict access, which allows local users to gain privileges and execute ABAP instructions via crafted help messages. + + + + + + + + + cpe:/a:sap:profile_maintenance:- + + CVE-2014-3131 + 2014-04-30T10:22:07.283-04:00 + 2014-05-01T10:06:43.287-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-05-01T10:06:43.113-04:00 + + + + + CONFIRM + https://service.sap.com/sap/support/notes/1917381 + + + MISC + http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-007 + + + FULLDISC + 20140428 [Onapsis Security Advisory 2014-007] Missing authorization check in SAP Profile Maintenance + + + CONFIRM + http://scn.sap.com/docs/DOC-8218 + + SAP Profile Maintenance does not properly restrict access, which allows remote authenticated users to obtain sensitive information via an unspecified RFC function, related to SAP Solution Manager 7.1. + + + + + + + + + cpe:/a:sap:background_processing:- + + CVE-2014-3132 + 2014-04-30T10:22:07.313-04:00 + 2014-05-01T10:18:20.887-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-05-01T10:18:20.827-04:00 + + + + + CONFIRM + https://service.sap.com/sap/support/notes/1918333 + + + MISC + http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-006 + + + FULLDISC + 20140428 [Onapsis Security Advisory 2014-006] Missing authorization check in SAP Background Processing RFC + + + CONFIRM + http://scn.sap.com/docs/DOC-8218 + + SAP Background Processing does not properly restrict access, which allows remote authenticated users to obtain sensitive information via an unspecified RFC function, related to SAP Solution Manager 7.1. + + + + + + + + + cpe:/a:sap:netweaver_java_application_server:- + + CVE-2014-3133 + 2014-04-30T10:22:07.343-04:00 + 2014-05-01T10:29:16.487-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-05-01T10:29:16.363-04:00 + + + + + CONFIRM + https://service.sap.com/sap/support/notes/1922547 + + + MISC + http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-008 + + + FULLDISC + 20140428 [Onapsis Security Advisory 2014-008] SAP NW Portal WD Information Disclosure + + + CONFIRM + http://scn.sap.com/docs/DOC-8218 + + SAP Netweaver Java Application Server does not properly restrict access, which allows remote attackers to obtain the list of SAP systems registered on an SLD via an unspecified webdynpro, related to SystemSelection. + + + + + + + + + cpe:/a:sap:businessobjects:- + + CVE-2014-3134 + 2014-04-30T10:22:07.377-04:00 + 2014-05-01T10:36:42.830-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-05-01T10:36:42.003-04:00 + + + + + CONFIRM + https://service.sap.com/sap/support/notes/1931399 + + + MISC + http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-010 + + + FULLDISC + 20140428 [Onapsis Security Advisory 2014-010] SAP BusinessObjects InfoView Reflected Cross Site Scripting + + + CONFIRM + http://scn.sap.com/docs/DOC-8218 + + Cross-site scripting (XSS) vulnerability in the InfoView application in SAP BusinessObjects allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + cpe:/a:vbulletin:vbulletin:5.1.1:alpha9 + + CVE-2014-3135 + 2014-04-30T10:22:07.610-04:00 + 2014-05-01T11:42:56.497-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-05-01T11:42:56.467-04:00 + + + + + XF + vbulletin-multiple-scripts-xss(92664) + + + BID + 66972 + + + MISC + http://packetstormsecurity.com/files/126226/vBulletin-5.1-Cross-Site-Scripting.html + + Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 5.1.1 Alpha 9 allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to privatemessage/new/, (2) the folderid parameter to a private message in privatemessage/view, (3) a fragment indicator to /help, or (4) the view parameter to a topic, as demonstrated by a request to forum/anunturi-importante/rst-power/67030-rst-admin-restore. + + + + + + + + + + + + + cpe:/a:xerox:docushare:6.6.1:update2 + cpe:/a:xerox:docushare:6.6.1:update1 + cpe:/a:xerox:docushare:6.6.1:- + cpe:/a:xerox:docushare:6.5.3:patch6 + cpe:/a:xerox:docushare:6.5.3:- + + CVE-2014-3138 + 2014-05-01T20:55:07.587-04:00 + 2014-05-02T10:38:12.993-04:00 + + + 6.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-05-02T10:38:12.917-04:00 + + + + + XF + xerox-docushare-sql-injection(92548) + + + MISC + http://www.xerox.com/download/security/security-bulletin/a72cd-4f7a54ce14460/cert_XRX14-003_V1.0.pdf + + + BID + 66922 + + + OSVDB + 105972 + + + EXPLOIT-DB + 32886 + + + SECUNIA + 57996 + + + FULLDISC + 20140415 Xerox DocuShare authenticated SQL injection + + + MISC + http://packetstormsecurity.com/files/126171/Xerox-DocuShare-SQL-Injection.html + + SQL injection vulnerability in Xerox DocuShare before 6.53 Patch 6 Hotfix 2, 6.6.1 Update 1before Hotfix 24, and 6.6.1 Update 2 before Hotfix 3 allows remote authenticated users to execute arbitrary SQL commands via the PATH_INFO to /docushare/dsweb/ResultBackgroundJobMultiple/. NOTE: some of these details are obtained from third party information. + + + + + + + + + cpe:/a:unitrends:enterprise_backup:7.3.0 + + CVE-2014-3139 + 2014-05-02T06:55:08.507-04:00 + 2014-05-02T14:24:56.593-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-05-02T14:24:56.530-04:00 + + + + + MISC + https://gist.github.com/brandonprry/10745756 + + + EXPLOIT-DB + 32885 + + + FULLDISC + 20140415 Unitrends enterprise backup remote unauthenticated root + + recoveryconsole/bpl/snmpd.php in Unitrends Enterprise Backup 7.3.0 allows remote attackers to bypass authentication by setting the auth parameter to a certain string. + + + CVE-2014-5795 + 2014-03-27T13:56:21.050-04:00 + 2014-03-27T13:56:21.143-04:00 + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-5795. Reason: This candidate is a duplicate of CVE-2013-5795. A typo caused the wrong ID to be used. Notes: All CVE users should reference CVE-2013-5795 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. + + + CVE-2014-5880 + 2014-03-27T14:55:06.357-04:00 + 2014-03-27T14:55:21.297-04:00 + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-5880. Reason: This candidate is a duplicate of CVE-2013-5880. A typo caused the wrong ID to be used. Notes: All CVE users should reference CVE-2013-5880 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. + + \ No newline at end of file diff --git a/dependency-check-core/src/test/resources/nvdcve-2.0-modified.xml b/dependency-check-core/src/test/resources/nvdcve-2.0-modified.xml new file mode 100644 index 000000000..c957ed736 --- /dev/null +++ b/dependency-check-core/src/test/resources/nvdcve-2.0-modified.xml @@ -0,0 +1,25227 @@ + + + + + + + + + + + + + + + cpe:/a:gnu:a2ps:4.13 + cpe:/a:gnu:a2ps:4.10.4 + cpe:/a:gnu:a2ps:4.12 + cpe:/a:gnu:a2ps:4.10.3 + cpe:/a:gnu:a2ps:4.13b + cpe:/a:gnu:a2ps:4.14 + + CVE-2001-1593 + 2014-04-05T17:55:06.097-04:00 + 2014-04-30T21:20:51.027-04:00 + + + 2.1 + LOCAL + LOW + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-07T11:31:06.027-04:00 + + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1060630 + + + CONFIRM + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737385 + + + DEBIAN + DSA-2892 + + + MLIST + [oss-security] 20140205 Re: CVE request: a2ps insecure temporary file use + + + MLIST + [oss-security] 20140204 Re: CVE request: a2ps insecure temporary file use + + + MLIST + [oss-security] 20140205 Re: CVE request: a2ps insecure temporary file use + + + CONFIRM + http://pkgs.fedoraproject.org/cgit/a2ps.git/plain/a2ps-4.13-security.patch + + The tempname_ensure function in lib/routines.h in a2ps 4.14 and earlier, as used by the spy_user function and possibly other functions, allows local users to modify arbitrary files via a symlink attack on a temporary file. + + + + + + + + + cpe:/a:blender:blender:2.63a + + CVE-2010-5105 + 2014-04-27T16:55:23.383-04:00 + 2014-04-28T13:07:11.647-04:00 + + + 3.3 + LOCAL + MEDIUM + NONE + NONE + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-28T13:07:11.413-04:00 + + + + + MISC + https://developer.blender.org/T22509 + + + MISC + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584621 + + + MLIST + [oss-security] 20120907 Re: CVE-2010 Request -- blender: Insecure temporary file use by creating file string in undo save quit Blender kernel routine (re-occurrence of CVE-2008-1103) + + + MLIST + [oss-security] 20120906 CVE-2010 Request -- blender: Insecure temporary file use by creating file string in undo save quit Blender kernel routine (re-occurrence of CVE-2008-1103) + + The undo save quit routine in the kernel in Blender 2.5, 2.63a, and earlier allows local users to overwrite arbitrary files via a symlink attack on the quit.blend temporary file. NOTE: this issue might be a regression of CVE-2008-1103. + + + + + + + + + + + + + + + + + + cpe:/a:canonical:update-manager:1%3a0.87.24 + cpe:/o:canonical:ubuntu_linux:11.04 + cpe:/o:canonical:ubuntu_linux:11.10 + cpe:/o:canonical:ubuntu_linux:10.04:-:lts + cpe:/o:canonical:ubuntu_linux:10.10 + cpe:/a:canonical:update-manager:1%3a0.142.19 + cpe:/a:canonical:update-manager:1%3a0.152.25 + cpe:/o:canonical:ubuntu_linux:8.04:-:lts + cpe:/a:canonical:update-manager:1%3a0.134.7 + cpe:/a:canonical:update-manager:1%3a0.150 + + CVE-2011-3152 + 2014-04-27T16:55:23.463-04:00 + 2014-04-28T13:31:19.020-04:00 + + + 6.4 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-28T13:31:18.910-04:00 + + + + + CONFIRM + https://bugs.launchpad.net/ubuntu/%2Bsource/update-manager/%2Bbug/881548 + + + XF + ubuntu-update-gpg-sec-bypass(71494) + + + UBUNTU + USN-1284-1 + + + BID + 50833 + + + OSVDB + 77642 + + + SECUNIA + 47024 + + DistUpgrade/DistUpgradeFetcherCore.py in Update Manager before 1:0.87.31.1, 1:0.134.x before 1:0.134.11.1, 1:0.142.x before 1:0.142.23.1, 1:0.150.x before 1:0.150.5.1, and 1:0.152.x before 1:0.152.25.5 on Ubuntu 8.04 through 11.10 does not verify the GPG signature before extracting an upgrade tarball, which allows man-in-the-middle attackers to (1) create or overwrite arbitrary files via a directory traversal attack using a crafted tar file, or (2) bypass authentication via a crafted meta-release file. + + + + + + + + + cpe:/a:litech:router_advertisement_daemon:1.8.1 + + CVE-2011-3602 + 2014-04-27T17:55:05.430-04:00 + 2014-04-28T14:30:28.767-04:00 + + + 6.4 + NETWORK + LOW + NONE + NONE + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-28T14:30:28.733-04:00 + + + + + CONFIRM + https://github.com/reubenhwk/radvd/commit/92e22ca23e52066da2258df8c76a2dca8a428bcc + + + UBUNTU + USN-1257-1 + + + MLIST + [oss-security] 20111007 radvd 1.8.2 released with security fixes + + + CONFIRM + http://www.litech.org/radvd/CHANGES + + + DEBIAN + DSA-2323 + + Directory traversal vulnerability in device-linux.c in the router advertisement daemon (radvd) before 1.8.2 allows local users to overwrite arbitrary files, and remote attackers to overwrite certain files, via a .. (dot dot) in an interface name. NOTE: this can be leveraged with a symlink to overwrite arbitrary files. + + + + + + + + + cpe:/a:litech:router_advertisement_daemon:1.8.1 + + CVE-2011-3603 + 2014-04-27T17:55:05.507-04:00 + 2014-04-28T15:12:37.730-04:00 + + + 4.4 + LOCAL + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-28T15:12:37.653-04:00 + + + + + MISC + https://access.redhat.com/security/cve/CVE-2011-3603 + + + MLIST + [oss-security] 20111007 radvd 1.8.2 released with security fixes + + + CONFIRM + http://www.litech.org/radvd/CHANGES + + The router advertisement daemon (radvd) before 1.8.2 does not properly handle errors in the privsep_init function, which causes the radvd daemon to run as root and has an unspecified impact. + + + CVE-2012-3415 + 2014-04-27T18:55:05.723-04:00 + 2014-04-27T18:55:05.817-04:00 + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-2401. Reason: This candidate is a duplicate of CVE-2012-2401. Notes: All CVE users should reference CVE-2012-2401 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. + + + + + + + + + cpe:/a:tinymce:tinymce:3.5.8 + + CVE-2012-4230 + 2014-04-25T10:15:30.360-04:00 + 2014-04-25T13:19:18.890-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-25T13:19:18.827-04:00 + + + + + XF + tinymce-htmlentities-xss(82744) + + + BID + 58424 + + + MISC + http://www.madirish.net/554 + + + FULLDISC + 20130311 XSS Vulnerability in TinyMCE + + + MISC + http://packetstormsecurity.com/files/120750/TinyMCE-3.5.8-Cross-Site-Scripting.html + + + OSVDB + 91130 + + The bbcode plugin in TinyMCE 3.5.8 does not properly enforce the TinyMCE security policy for the (1) encoding directive and (2) valid_elements attribute, which allows attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors, as demonstrated using a textarea element. + + + CVE-2012-4410 + 2014-04-26T20:55:05.530-04:00 + 2014-04-26T20:55:05.717-04:00 + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none. + + + + + + + + + cpe:/a:zlib:pigz:2.2.4-1 + + CVE-2013-0296 + 2014-04-27T17:55:05.570-04:00 + 2014-04-28T15:28:07.040-04:00 + + + 4.4 + LOCAL + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-28T15:28:06.977-04:00 + + + + + CONFIRM + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=700608 + + + MLIST + [oss-security] 20130215 Re: CVE# request: pigz creates temp file with insecure permissions + + + MLIST + [oss-security] 20130215 CVE# request: pigz creates temp file with insecure permissions + + + MLIST + [pigz-announce] 20120728 pigz version 2.2.5 released + + + SUSE + openSUSE-SU-2013:0540 + + Race condition in pigz before 2.2.5 uses permissions derived from the umask when compressing a file before setting that file's permissions to match those of the original file, which might allow local users to bypass intended access permissions while compression is occurring. + + + + + + + + + + + + + cpe:/a:php-fusion:php-fusion:7.02.01 + cpe:/a:php-fusion:php-fusion:7.02.05 + cpe:/a:php-fusion:php-fusion:7.02.04 + cpe:/a:php-fusion:php-fusion:7.02.03 + cpe:/a:php-fusion:php-fusion:7.02.02 + + CVE-2013-1804 + 2014-04-29T16:55:08.747-04:00 + 2014-04-30T08:03:32.140-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-30T08:03:32.077-04:00 + + + + + MISC + http://www.waraxe.us/advisory-97.html + + + CONFIRM + http://www.php-fusion.co.uk/news.php?readmore=569 + + + MLIST + [oss-security] 20130302 Re: CVE request: PHP-Fusion waraxe-2013-SA#097 + + + MLIST + [oss-security] 20130303 CVE request: PHP-Fusion waraxe-2013-SA#097 + + + SECUNIA + 52403 + + + FULLDISC + 20130228 [waraxe-2013-SA#097] - Multiple Vulnerabilities in PHP-Fusion 7.02.05 + + + MISC + http://packetstormsecurity.com/files/120598/PHP-Fusion-7.02.05-XSS-LFI-SQL-Injection.html + + + OSVDB + 90708 + + + OSVDB + 90707 + + Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to inject arbitrary web script or HTML via the (1) highlight parameter to forum/viewthread.php; or remote authenticated users with certain permissions to inject arbitrary web script or HTML via the (2) user_list or (3) user_types parameter to messages.php; (4) message parameter to infusions/shoutbox_panel/shoutbox_admin.php; (5) message parameter to administration/news.php; (6) panel_list parameter to administration/panel_editor.php; (7) HTTP User Agent string to administration/phpinfo.php; (8) "__BBCODE__" parameter to administration/bbcodes.php; errorMessage parameter to (9) article_cats.php, (10) download_cats.php, (11) news_cats.php, or (12) weblink_cats.php in administration/, when error is 3; or (13) body or (14) body2 parameter to administration/articles.php. + + + CVE-2013-1805 + 2014-04-30T19:58:26.217-04:00 + 2014-04-30T19:58:26.313-04:00 + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-1806. Reason: This issue was MERGED into CVE-2013-1806 in accordance with CVE content decisions, because it is the same type of vulnerability and affects the same versions. Notes: All CVE users should reference CVE-2013-1806 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. + + + + + + + + + + + + + cpe:/a:php-fusion:php-fusion:7.02.01 + cpe:/a:php-fusion:php-fusion:7.02.05 + cpe:/a:php-fusion:php-fusion:7.02.04 + cpe:/a:php-fusion:php-fusion:7.02.03 + cpe:/a:php-fusion:php-fusion:7.02.02 + + CVE-2013-1806 + 2014-04-30T19:58:26.547-04:00 + 2014-05-01T11:27:44.810-04:00 + + + 6.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-05-01T11:27:44.747-04:00 + + + + + CONFIRM + http://www.php-fusion.co.uk/news.php?readmore=569 + + + MISC + http://www.waraxe.us/advisory-97.html + + + OSVDB + 90696 + + + OSVDB + 90694 + + + OSVDB + 90692 + + + MLIST + [oss-security] 20130302 Re: CVE request: PHP-Fusion waraxe-2013-SA#097 + + + MLIST + [oss-security] 20130303 CVE request: PHP-Fusion waraxe-2013-SA#097 + + + FULLDISC + 20130228 [waraxe-2013-SA#097] - Multiple Vulnerabilities in PHP-Fusion 7.02.05 + + + MISC + http://packetstormsecurity.com/files/120598/PHP-Fusion-7.02.05-XSS-LFI-SQL-Injection.html + + Multiple directory traversal vulnerabilities in PHP-Fusion before 7.02.06 allow remote authenticated users to include and execute arbitrary files via a .. (dot dot) in the (1) user_theme parameter to maincore.php; or remote authenticated administrators to delete arbitrary files via the (2) enable parameter to administration/user_fields.php or (3) file parameter to administration/db_backup.php. + + + + + + + + + + + + + cpe:/a:php-fusion:php-fusion:7.02.01 + cpe:/a:php-fusion:php-fusion:7.02.05 + cpe:/a:php-fusion:php-fusion:7.02.04 + cpe:/a:php-fusion:php-fusion:7.02.03 + cpe:/a:php-fusion:php-fusion:7.02.02 + + CVE-2013-1807 + 2014-04-30T19:58:26.593-04:00 + 2014-05-01T11:35:01.293-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-05-01T11:35:01.247-04:00 + + + + + CONFIRM + http://www.php-fusion.co.uk/news.php?readmore=569 + + + MISC + http://www.waraxe.us/advisory-97.html + + + OSVDB + 90691 + + + MLIST + [oss-security] 20130302 Re: CVE request: PHP-Fusion waraxe-2013-SA#097 + + + MLIST + [oss-security] 20130303 CVE request: PHP-Fusion waraxe-2013-SA#097 + + + FULLDISC + 20130228 [waraxe-2013-SA#097] - Multiple Vulnerabilities in PHP-Fusion 7.02.05 + + + MISC + http://packetstormsecurity.com/files/120598/PHP-Fusion-7.02.05-XSS-LFI-SQL-Injection.html + + PHP-Fusion before 7.02.06 stores backup files with predictable filenames in an unrestricted directory under the web document root, which might allow remote attackers to obtain sensitive information via a direct request to the backup file in administration/db_backups/. + + + + + + + + + + + cpe:/a:ushahidi:ushahidi_platform:2.6.1 + cpe:/a:ushahidi:ushahidi_platform:2.5 + cpe:/a:ushahidi:ushahidi_platform:2.6 + + CVE-2013-2025 + 2014-04-25T13:12:02.957-04:00 + 2014-04-25T14:01:53.777-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-25T14:01:53.513-04:00 + + + + + CONFIRM + https://wiki.ushahidi.com/display/WIKI/1+May+2013+-+CVE-2013-2025 + + + MISC + https://github.com/rjmackay/Ushahidi_Web/commit/593719ff805a302e3ab2f2e535c875f90a04ea56 + + + CONFIRM + https://github.com/ushahidi/Ushahidi_Web/pull/1056 + + + CONFIRM + https://github.com/ushahidi/Ushahidi_Web/issues/1009 + + + BID + 59410 + + Cross-site scripting (XSS) vulnerability in Ushahidi Platform 2.5.x through 2.6.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + + + + + + + cpe:/a:transifex:transifex:0.4 + cpe:/a:transifex:transifex:0.3 + cpe:/a:transifex:transifex:0.2 + cpe:/a:transifex:transifex:0.1 + cpe:/a:transifex:transifex:0.8 + cpe:/a:transifex:transifex:0.7 + cpe:/a:transifex:transifex:0.6 + cpe:/a:transifex:transifex:0.5 + + CVE-2013-2073 + 2014-05-01T21:59:22.203-04:00 + 2014-05-02T10:49:01.703-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-05-02T10:49:01.483-04:00 + + + + + MLIST + [oss-security] 20130522 CVE-2013-2073 transifex-client: Does not validate HTTPS server certificate (fixed in transifex-client v0.9) + + + CONFIRM + http://blog.transifex.com/post/51072109836/new-version-of-the-transifex-client-has-been-released + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=952194 + + Transifex command-line client before 0.9 does not validate X.509 certificates, which allows man-in-the-middle attackers to spoof a Transifex server via an arbitrary certificate. + + + + + + + + + + + + + + cpe:/o:netgear:wndr4700_firmware:1.0.0.34 + cpe:/h:netgear:wndr4700:- + + CVE-2013-3069 + 2014-04-25T13:12:03.097-04:00 + 2014-04-25T14:07:16.803-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-25T14:07:16.757-04:00 + + + + + MISC + http://securityevaluators.com/knowledge/case_studies/routers/Vulnerability_Catalog.pdf + + + OSVDB + 92557 + + Multiple cross-site scripting (XSS) vulnerabilities in NETGEAR WNDR4700 with firmware 1.0.0.34 allow remote authenticated users to inject arbitrary web script or HTML via the (1) UserName or (2) Password to the NAS User Setup page, (3) deviceName to USB_advanced.htm, or (4) Network Key to the Wireless Setup page. + + + CVE-2013-4121 + 2014-05-01T06:55:05.973-04:00 + 2014-05-01T06:55:16.863-04:00 + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was a site-specific issue. Notes: none. + + + CVE-2013-4145 + 2014-04-27T00:32:01.577-04:00 + 2014-04-27T00:32:01.670-04:00 + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-3414. Reason: This candidate is a duplicate of CVE-2012-3414. Notes: All CVE users should reference CVE-2012-3414 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. + + + + + + + + + cpe:/a:dkorunic:pam_s%2fkey:- + + CVE-2013-4285 + 2014-04-28T10:09:05.783-04:00 + 2014-04-29T07:09:09.007-04:00 + + + 2.1 + LOCAL + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-29T07:09:08.947-04:00 + + + + + GENTOO + GLSA-201402-12 + + A certain Gentoo patch for the PAM S/Key module does not properly clear credentials from memory, which allows local users to obtain sensitive information by reading system memory. + + + + + + + + + + cpe:/a:joachim_noreiko:flag_module:7.x-3.0:rc1 + cpe:/a:joachim_noreiko:flag_module:7.x-3.0:beta1 + + CVE-2013-4336 + 2014-04-27T18:55:05.850-04:00 + 2014-04-28T15:32:53.987-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-28T15:32:53.940-04:00 + + + + + MISC + https://drupal.org/node/2076221 + + + CONFIRM + https://drupal.org/node/2075287 + + + MLIST + [oss-security] 20130911 Re: CVE request for Drupal contrib modules + + Cross-site scripting (XSS) vulnerability in the admin page in the Flag module 7.x-3.x before 7.x-3.1 for Drupal allows remote authenticated users with the "Administer flags" permission to inject arbitrary web script or HTML via the flag name. + + + CVE-2013-4337 + 2014-04-27T16:55:23.493-04:00 + 2014-04-27T16:55:23.587-04:00 + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-5965. Reason: This candidate is a duplicate of CVE-2013-5965. Notes: All CVE users should reference CVE-2013-5965 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. + + + + + + + + + cpe:/a:debian:ppthtml:0.5.1 + + CVE-2013-4565 + 2014-04-25T13:12:03.423-04:00 + 2014-04-25T14:25:05.913-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-25T14:25:05.820-04:00 + + + + + MISC + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=729279 + + + XF + ppthtml-cve20134565-bo(88885) + + + MLIST + [oss-security] 20131113 Re: CVE request: ppthtml heap-based buffer overflow + + Heap-based buffer overflow in the __OLEdecode function in ppthtml 0.5.1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted .ppt file. + + + + + + + + + + + + cpe:/a:ddsn:cm3_acora_content_management_system:6.0.6%2f1a + cpe:/a:ddsn:cm3_acora_content_management_system:5.5.7%2f12b + cpe:/a:ddsn:cm3_acora_content_management_system:6.0.2%2f1a + cpe:/a:ddsn:cm3_acora_content_management_system:5.5.0%2f1b-p1 + + CVE-2013-4722 + 2014-04-25T13:12:03.673-04:00 + 2014-04-25T14:34:34.400-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-25T14:34:34.353-04:00 + + + + + MISC + http://www.digitalsec.net/stuff/explt+advs/CM3.AcoraCMS.v6.txt + + + MISC + http://packetstormsecurity.com/files/122954/CM3-AcoraCMS-XSS-CSRF-Redirection-Disclosure.html + + + OSVDB + 96661 + + Multiple cross-site scripting (XSS) vulnerabilities in Admin/login/default.asp in DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) url, (3) qstr parameter. + + + + + + + + + + + + cpe:/a:ddsn:cm3_acora_content_management_system:6.0.6%2f1a + cpe:/a:ddsn:cm3_acora_content_management_system:5.5.7%2f12b + cpe:/a:ddsn:cm3_acora_content_management_system:6.0.2%2f1a + cpe:/a:ddsn:cm3_acora_content_management_system:5.5.0%2f1b-p1 + + CVE-2013-4723 + 2014-04-25T13:12:03.720-04:00 + 2014-04-25T14:38:24.733-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-25T14:38:23.813-04:00 + + + + + MISC + http://www.digitalsec.net/stuff/explt+advs/CM3.AcoraCMS.v6.txt + + + MISC + http://packetstormsecurity.com/files/122954/CM3-AcoraCMS-XSS-CSRF-Redirection-Disclosure.html + + + OSVDB + 96662 + + Open redirect vulnerability in DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the l parameter to track.aspx. + + + + + + + + + + + + cpe:/a:ddsn:cm3_acora_content_management_system:6.0.6%2f1a + cpe:/a:ddsn:cm3_acora_content_management_system:5.5.7%2f12b + cpe:/a:ddsn:cm3_acora_content_management_system:6.0.2%2f1a + cpe:/a:ddsn:cm3_acora_content_management_system:5.5.0%2f1b-p1 + + CVE-2013-4726 + 2014-04-25T13:12:03.767-04:00 + 2014-04-25T14:38:34.813-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-25T14:38:34.780-04:00 + + + + + MISC + http://www.digitalsec.net/stuff/explt+advs/CM3.AcoraCMS.v6.txt + + + MISC + http://packetstormsecurity.com/files/122954/CM3-AcoraCMS-XSS-CSRF-Redirection-Disclosure.html + + + OSVDB + 96665 + + Cross-site request forgery (CSRF) vulnerability in DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. + + + + + + + + + cpe:/a:google:picasa:3.9.0 + + CVE-2013-5349 + 2014-01-08T19:55:02.880-05:00 + 2014-04-25T09:38:37.810-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-14T08:31:37.000-05:00 + + + + + CONFIRM + https://support.google.com/picasa/answer/53209 + + + SECTRACK + 1029527 + + + MISC + http://secunia.com/secunia_research/2013-14/ + + + SECUNIA + 55555 + + Integer underflow in Picasa3.exe in Google Picasa before 3.9.0 Build 137.69 allows remote attackers to execute arbitrary code via a crafted JPEG tag that triggers a heap-based buffer overflow, as demonstrated using a Canon RAW CR2 file with a large JPEG tag value and a small size. + + + + + + + + + cpe:/a:google:picasa:3.9.0 + + CVE-2013-5357 + 2014-01-08T19:55:02.927-05:00 + 2014-04-25T09:38:54.730-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-14T08:32:17.000-05:00 + + + + + CONFIRM + https://support.google.com/picasa/answer/53209 + + + SECTRACK + 1029527 + + + MISC + http://secunia.com/secunia_research/2013-14/ + + + SECUNIA + 55555 + + Integer overflow in Picasa3.exe in Google Picasa before 3.9.0 Build 137.69 allows remote attackers to execute arbitrary code via a long TIFF tag that triggers a heap-based buffer overflow, as demonstrated using a Canon RAW CR2 file with a long TIFF StripByteCounts tag. + + + + + + + + + cpe:/a:google:picasa:3.9.0 + + CVE-2013-5358 + 2014-01-08T19:55:02.957-05:00 + 2014-04-25T09:39:34.187-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-14T08:32:43.000-05:00 + + + + + CONFIRM + https://support.google.com/picasa/answer/53209 + + + SECTRACK + 1029527 + + + MISC + http://secunia.com/secunia_research/2013-14/ + + + SECUNIA + 55555 + + Picasa3.exe in Google Picasa before 3.9.0 Build 137.69 allows remote attackers to trigger memory corruption via a crafted TIFF tag, as demonstrated using a KDC file with a DSLR-A100 model and certain sequences of tags. + + + + + + + + + cpe:/a:google:picasa:3.9.0 + + CVE-2013-5359 + 2014-01-08T19:55:02.987-05:00 + 2014-04-25T09:39:49.623-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-14T08:33:05.000-05:00 + + + + + CONFIRM + https://support.google.com/picasa/answer/53209 + + + SECTRACK + 1029527 + + + MISC + http://secunia.com/secunia_research/2013-14/ + + + SECUNIA + 55555 + + Stack-based buffer overflow in Picasa3.exe in Google Picasa before 3.9.0 Build 137.69 might allow remote attackers to execute arbitrary code via a crafted RAW file, as demonstrated using a KDC file with a certain size. + + + + + + + + + cpe:/a:powersoftware:winarchiver:3.2 + + CVE-2013-5660 + 2014-04-25T13:12:03.847-04:00 + 2014-04-25T14:44:00.477-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-25T14:44:00.370-04:00 + + + + + BID + 59626 + + + FULLDISC + 20130902 list of vulnerabilities discovered by realpentesting + + + MISC + http://realpentesting.blogspot.com.es/p/blog-page_3.html + + + MISC + http://packetstormsecurity.com/files/121512/Winarchiver-3.2-Buffer-Overflow.html + + + OSVDB + 92992 + + + MISC + http://osvdb.org/ref/92/winarchiver-overflow.txt + + Buffer overflow in Power Software WinArchiver 3.2 allows remote attackers to execute arbitrary code via a crafted .zip file. + + + + + + + + + + + + + + + + + + + + cpe:/a:openx:openx:2.8.10 + cpe:/a:openx:openx:2.8.11 + cpe:/a:openx:openx:2.8.9 + cpe:/a:openx:openx:2.8.1 + cpe:/a:openx:openx:2.8.6 + cpe:/a:openx:openx:2.8.5 + cpe:/a:openx:openx:2.8.8 + cpe:/a:openx:openx:2.8.7 + cpe:/a:openx:openx:2.8.2 + cpe:/a:openx:openx:2.8.4 + cpe:/a:openx:openx:2.8.3 + cpe:/a:openx:openx:2.8 + + CVE-2013-5954 + 2014-04-25T10:15:30.453-04:00 + 2014-04-25T13:38:00.707-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-25T13:38:00.627-04:00 + + + + + XF + openx-cve20135954-csrf(91889) + + + BID + 66251 + + + FULLDISC + 20140315 [CVE-2013-5954] Multiple Cross Site Request Forgery Vulnerabilities in OpenX 2.8.11 + + + MISC + http://packetstormsecurity.com/files/125735 + + Multiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.11 and earlier allow remote attackers to hijack the authentication of administrators for requests that delete (1) users via admin/agency-user-unlink.php, (2) advertisers via admin/advertiser-delete.php, (3) banners via admin/banner-delete.php, (4) campaigns via admin/campaign-delete.php, (5) channels via admin/channel-delete.php, (6) affiliate websites via admin/affiliate-delete.php, or (7) zones via admin/zone-delete.php. + + + + + + + + + cpe:/a:joomlaboat:com_youtubegallery:3.4.0::~~~joomla%21~~ + + CVE-2013-5956 + 2014-04-25T10:15:30.483-04:00 + 2014-04-25T13:42:55.557-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-25T13:42:55.510-04:00 + + + + + FULLDISC + 20140315 Re: XSS Vulnerability in the Youtube Gallery 3.4.0 Component + + + FULLDISC + 20140315 XSS Vulnerability in the Youtube Gallery 3.4.0 Component + + + MISC + http://packetstormsecurity.com/files/125732/Joomla-Youtube-Gallery-3.4.0-Cross-Site-Scripting.html + + Cross-site scripting (XSS) vulnerability in includes/flvthumbnail.php in the Youtube Gallery (com_youtubegallery) component 3.4.0 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the videofile parameter. + + + + + + + + + cpe:/a:openjpeg:openjpeg:1.5.1 + + CVE-2013-6053 + 2014-04-27T18:55:05.910-04:00 + 2014-04-28T13:38:17.750-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-28T13:38:17.720-04:00 + + + + + CONFIRM + https://code.google.com/p/openjpeg/issues/detail?id=297 + + + MISC + https://bugzilla.redhat.com/show_bug.cgi?id=1036493 + + + BID + 64121 + + + MLIST + [oss-security] 20131204 Fwd: [vs] multiple issues in openjpeg + + + CONFIRM + http://openjpeg.googlecode.com/svn/tags/version.1.5.2/NEWS + + OpenJPEG 1.5.1 allows remote attackers to obtain sensitive information via unspecified vectors that trigger a heap-based out-of-bounds read. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:ibm:websphere_virtual_enterprise:7.0 + cpe:/a:ibm:websphere_application_server:8.0.0.4 + cpe:/a:ibm:websphere_application_server:8.0.0.3 + cpe:/a:ibm:websphere_application_server:8.0.0.2 + cpe:/a:ibm:websphere_application_server:7.0.0.4 + cpe:/a:ibm:websphere_application_server:7.0.0.27 + cpe:/a:ibm:websphere_application_server:7.0.0.5 + cpe:/a:ibm:websphere_application_server:7.0.0.29 + cpe:/a:ibm:websphere_application_server:7.0.0.3 + cpe:/a:ibm:websphere_application_server:7.0.0.8 + cpe:/a:ibm:websphere_application_server:7.0.0.9 + cpe:/a:ibm:websphere_application_server:8.0.0.0 + cpe:/a:ibm:websphere_application_server:7.0.0.6 + cpe:/a:ibm:websphere_application_server:7.0.0.7 + cpe:/a:ibm:websphere_application_server:8.5.0.0 + cpe:/a:ibm:websphere_application_server:8.0.0.8 + cpe:/a:ibm:websphere_application_server:8.5.0.1 + cpe:/a:ibm:websphere_application_server:8.0.0.7 + cpe:/a:ibm:websphere_application_server:8.0.0.1 + cpe:/a:ibm:websphere_application_server:8.5.0.2 + cpe:/a:ibm:websphere_application_server:8.0.0.6 + cpe:/a:ibm:websphere_application_server:8.0.0.5 + cpe:/a:ibm:websphere_application_server:8.5.5.1 + cpe:/a:ibm:websphere_application_server:7.0.0.15 + cpe:/a:ibm:websphere_application_server:8.5.5.0 + cpe:/a:ibm:websphere_application_server:7.0.0.2 + cpe:/a:ibm:websphere_application_server:7.0.0.12 + cpe:/a:ibm:websphere_application_server:7.0.0.1 + cpe:/a:ibm:websphere_application_server:7.0.0.11 + cpe:/a:ibm:websphere_application_server:7.0.0.14 + cpe:/a:ibm:websphere_application_server:7.0.0.13 + cpe:/a:ibm:websphere_application_server:7.0.0.16 + cpe:/a:ibm:websphere_application_server:7.0.0.18 + cpe:/a:ibm:websphere_application_server:7.0.0.10 + cpe:/a:ibm:websphere_application_server:7.0.0.17 + cpe:/a:ibm:websphere_application_server:7.0.0.19 + cpe:/a:ibm:websphere_application_server:7.0.0.31 + cpe:/a:ibm:websphere_application_server:7.0 + cpe:/a:ibm:websphere_virtual_enterprise:7.0.0.2 + cpe:/a:ibm:websphere_virtual_enterprise:7.0.0.1 + cpe:/a:ibm:websphere_application_server:7.0.0.25 + cpe:/a:ibm:websphere_application_server:7.0.0.24 + cpe:/a:ibm:websphere_application_server:7.0.0.23 + cpe:/a:ibm:websphere_application_server:7.0.0.22 + cpe:/a:ibm:websphere_virtual_enterprise:7.0.0.3 + cpe:/a:ibm:websphere_virtual_enterprise:7.0.0.4 + cpe:/a:ibm:websphere_application_server:7.0.0.21 + + CVE-2013-6323 + 2014-05-01T13:29:56.683-04:00 + 2014-05-02T09:23:52.843-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-05-02T09:23:52.467-04:00 + + + + + XF + ibm-was-cve20136323-xss(88903) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21669554 + + + AIXAPAR + PI04880 + + + AIXAPAR + PI04777 + + Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.33, 8.x before 8.0.0.9, and 8.5.x before 8.5.5.2, and WebSphere Virtual Enterprise 7.x before 7.0.0.5, allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. + + + + + + + + + cpe:/a:redhat:enterprise_mrg:2.5 + + CVE-2013-6445 + 2014-04-30T10:22:05.813-04:00 + 2014-04-30T14:08:06.413-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-30T14:08:06.383-04:00 + + + + + SECTRACK + 1030158 + + + REDHAT + RHSA-2014:0441 + + + REDHAT + RHSA-2014:0440 + + Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, uses the DES-based crypt function to hash passwords, which makes it easier for attackers to obtain sensitive information via a brute-force attack. + + + + + + + + + cpe:/a:openjpeg:openjpeg:1.5.1 + + CVE-2013-6887 + 2014-04-27T16:55:23.633-04:00 + 2014-04-28T13:35:53.213-04:00 + + + 6.4 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-28T13:35:53.200-04:00 + + + + + SECUNIA + 57285 + + + MLIST + [oss-security] 20131204 Fwd: [vs] multiple issues in openjpeg + + + CONFIRM + http://openjpeg.googlecode.com/svn/tags/version.1.5.2/NEWS + + OpenJPEG 1.5.1 allows remote attackers to cause a denial of service via unspecified vectors that trigger NULL pointer dereferences, division-by-zero, and other errors. + + + + + + + + + cpe:/a:fortinet:fortiauthenticator:2.2 + + CVE-2013-6990 + 2014-04-30T10:22:05.860-04:00 + 2014-04-30T14:49:29.310-04:00 + + + 9.0 + NETWORK + LOW + SINGLE_INSTANCE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-30T14:49:29.247-04:00 + + + ALLOWS_ADMIN_ACCESS + + + CONFIRM + http://www.fortiguard.com/advisory/FG-IR-13-016/ + + FortiGuard FortiAuthenticator before 3.0 allows remote administrators to gain privileges via the command line interface. + + + CVE-2013-7060 + 2014-05-02T10:55:05.340-04:00 + 2014-05-02T10:55:05.340-04:00 + + CONFIRM + https://plone.org/security/20131210/path-leak + + + MLIST + [oss-security] 20131211 Re: CVE request for Plone + + + MLIST + [oss-security] 20131210 CVE request for Plone + + Products/CMFPlone/FactoryTool.py in Plone 3.3 through 4.3.2 allows remote attackers to obtain the installation path via vectors related to a file object for unspecified documentation which is initialized in class scope. + + + CVE-2013-7061 + 2014-05-02T10:55:05.417-04:00 + 2014-05-02T10:55:05.417-04:00 + + CONFIRM + https://plone.org/security/20131210/catalogue-exposure + + + MLIST + [oss-security] 20131211 Re: CVE request for Plone + + + MLIST + [oss-security] 20131210 CVE request for Plone + + Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspecified search API. + + + + + + + + + + cpe:/a:invitation_project:invitation:7.x-2.1::~~~drupal~~ + cpe:/a:invitation_project:invitation:7.x-2.0::~~~drupal~~ + + CVE-2013-7063 + 2014-04-29T10:38:43.827-04:00 + 2014-04-29T12:40:09.997-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-29T12:40:09.747-04:00 + + + + + MISC + https://drupal.org/node/2140097 + + + MLIST + [oss-security] 20131211 Re: CVE request for Drupal core, and contributed modules + + + MLIST + [oss-security] 20131206 CVE request for Drupal core, and contributed modules + + The Invitation module 7.x-2.x for Drupal does not properly check permissions, which allows remote attackers to obtain sensitive information via unspecified default views. + + + + + + + + + + + + + + + + + + cpe:/a:freelance-it-consultant:eu_cookie_compliance:7.x-1.1::~~~drupal~~ + cpe:/a:freelance-it-consultant:eu_cookie_compliance:7.x-1.2::~~~drupal~~ + cpe:/a:freelance-it-consultant:eu_cookie_compliance:7.x-1.x:dev:~~~drupal~~ + cpe:/a:freelance-it-consultant:eu_cookie_compliance:7.x-1.0::~~~drupal~~ + cpe:/a:freelance-it-consultant:eu_cookie_compliance:7.x-1.6::~~~drupal~~ + cpe:/a:freelance-it-consultant:eu_cookie_compliance:7.x-1.7::~~~drupal~~ + cpe:/a:freelance-it-consultant:eu_cookie_compliance:7.x-1.10::~~~drupal~~ + cpe:/a:freelance-it-consultant:eu_cookie_compliance:7.x-1.8::~~~drupal~~ + cpe:/a:freelance-it-consultant:eu_cookie_compliance:7.x-1.11::~~~drupal~~ + cpe:/a:freelance-it-consultant:eu_cookie_compliance:7.x-1.9::~~~drupal~~ + + CVE-2013-7064 + 2014-04-29T10:38:43.843-04:00 + 2014-04-29T13:09:54.353-04:00 + + + 2.1 + NETWORK + HIGH + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-29T13:09:54.257-04:00 + + + + + MISC + https://drupal.org/node/2140123 + + + CONFIRM + https://drupal.org/node/2139875 + + + MLIST + [oss-security] 20131211 Re: CVE request for Drupal core, and contributed modules + + + MLIST + [oss-security] 20131206 CVE request for Drupal core, and contributed modules + + Cross-site scripting (XSS) vulnerability in the EU Cookie Compliance module 7.x-1.x before 7.x-1.12 for Drupal allows remote authenticated administrators with the "Administer EU Cookie Compliance popup" permission to inject arbitrary web script or HTML via unspecified configuration values. + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:organic_groups_project:organic_groups:7.x-2.0:alpha1:~~~drupal~~ + cpe:/a:organic_groups_project:organic_groups:7.x-2.x:dev:~~~drupal~~ + cpe:/a:organic_groups_project:organic_groups:7.x-2.0:alpha3:~~~drupal~~ + cpe:/a:organic_groups_project:organic_groups:7.x-2.0:alpha2:~~~drupal~~ + cpe:/a:organic_groups_project:organic_groups:7.x-2.0:beta4:~~~drupal~~ + cpe:/a:organic_groups_project:organic_groups:7.x-2.0:-:~~~drupal~~ + cpe:/a:organic_groups_project:organic_groups:7.x-2.0:rc2:~~~drupal~~ + cpe:/a:organic_groups_project:organic_groups:7.x-2.0:beta2:~~~drupal~~ + cpe:/a:organic_groups_project:organic_groups:7.x-2.2::~~~drupal~~ + cpe:/a:organic_groups_project:organic_groups:7.x-2.0:rc1:~~~drupal~~ + cpe:/a:organic_groups_project:organic_groups:7.x-2.0:beta3:~~~drupal~~ + cpe:/a:organic_groups_project:organic_groups:7.x-2.1::~~~drupal~~ + cpe:/a:organic_groups_project:organic_groups:7.x-2.0:rc4:~~~drupal~~ + cpe:/a:organic_groups_project:organic_groups:7.x-2.0:rc3:~~~drupal~~ + cpe:/a:organic_groups_project:organic_groups:7.x-2.0:beta1:~~~drupal~~ + + CVE-2013-7065 + 2014-04-29T10:38:43.857-04:00 + 2014-04-29T13:30:10.003-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-29T13:30:09.517-04:00 + + + + + MISC + https://drupal.org/node/2140217 + + + CONFIRM + https://drupal.org/node/2140209 + + + MLIST + [oss-security] 20131211 Re: CVE request for Drupal core, and contributed modules + + + MLIST + [oss-security] 20131206 CVE request for Drupal core, and contributed modules + + The Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal allows remote attackers to bypass access restriction and post to arbitrary groups via a group audience field, as demonstrated by the og_group_ref field. + + + + + + + + + + + + + + + + + + + + + + cpe:/a:entity_reference_project:entityreference:7.x-1.x:dev + cpe:/a:entity_reference_project:entityreference:7.x-1.0:rc5 + cpe:/a:entity_reference_project:entityreference:7.x-1.0:- + cpe:/a:entity_reference_project:entityreference:7.x-1.0:beta5 + cpe:/a:entity_reference_project:entityreference:7.x-1.0:beta4 + cpe:/a:entity_reference_project:entityreference:7.x-1.0:alpha2 + cpe:/a:entity_reference_project:entityreference:7.x-1.0:beta3 + cpe:/a:entity_reference_project:entityreference:7.x-1.0:rc3 + cpe:/a:entity_reference_project:entityreference:7.x-1.0:beta1 + cpe:/a:entity_reference_project:entityreference:7.x-1.0:alpha1 + cpe:/a:entity_reference_project:entityreference:7.x-1.0:rc2 + cpe:/a:entity_reference_project:entityreference:7.x-1.0:rc4 + cpe:/a:entity_reference_project:entityreference:7.x-1.0:beta2 + cpe:/a:entity_reference_project:entityreference:7.x-1.0:rc1 + + CVE-2013-7066 + 2014-04-29T10:38:43.907-04:00 + 2014-04-29T13:45:04.283-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-29T13:45:04.080-04:00 + + + + + MISC + https://drupal.org/node/2140237 + + + CONFIRM + https://drupal.org/node/2140229 + + The Entity reference module 7.x-1.x before 7.x-1.1-rc1 for Drupal allows remote attackers to read private nodes titles by leveraging edit permissions to a node that references a private node. + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:organic_groups_project:organic_groups:7.x-2.0:alpha1:~~~drupal~~ + cpe:/a:organic_groups_project:organic_groups:7.x-2.x:dev:~~~drupal~~ + cpe:/a:organic_groups_project:organic_groups:7.x-2.0:alpha3:~~~drupal~~ + cpe:/a:organic_groups_project:organic_groups:7.x-2.0:alpha2:~~~drupal~~ + cpe:/a:organic_groups_project:organic_groups:7.x-2.0:beta4:~~~drupal~~ + cpe:/a:organic_groups_project:organic_groups:7.x-2.0:-:~~~drupal~~ + cpe:/a:organic_groups_project:organic_groups:7.x-2.0:rc2:~~~drupal~~ + cpe:/a:organic_groups_project:organic_groups:7.x-2.0:beta2:~~~drupal~~ + cpe:/a:organic_groups_project:organic_groups:7.x-2.2::~~~drupal~~ + cpe:/a:organic_groups_project:organic_groups:7.x-2.0:rc1:~~~drupal~~ + cpe:/a:organic_groups_project:organic_groups:7.x-2.0:beta3:~~~drupal~~ + cpe:/a:organic_groups_project:organic_groups:7.x-2.1::~~~drupal~~ + cpe:/a:organic_groups_project:organic_groups:7.x-2.0:rc4:~~~drupal~~ + cpe:/a:organic_groups_project:organic_groups:7.x-2.0:rc3:~~~drupal~~ + cpe:/a:organic_groups_project:organic_groups:7.x-2.0:beta1:~~~drupal~~ + + CVE-2013-7068 + 2014-04-29T10:38:43.907-04:00 + 2014-04-29T13:52:47.283-04:00 + + + 4.9 + NETWORK + MEDIUM + SINGLE_INSTANCE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-29T13:52:47.157-04:00 + + + + + MISC + https://drupal.org/node/2140217 + + + CONFIRM + https://drupal.org/node/2140209 + + + MLIST + [oss-security] 20131211 Re: CVE request for Drupal core, and contributed modules + + + MLIST + [oss-security] 20131206 CVE request for Drupal core, and contributed modules + + The Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users to bypass group restrictions on nodes with all groups set to optional input via an empty group field. + + + + + + + + + + + + + + + + + cpe:/a:transifex:transifex:0.4 + cpe:/a:transifex:transifex:0.3 + cpe:/a:transifex:transifex:0.2 + cpe:/a:transifex:transifex:0.1 + cpe:/a:transifex:transifex:0.8 + cpe:/a:transifex:transifex:0.7 + cpe:/a:transifex:transifex:0.6 + cpe:/a:transifex:transifex:0.5 + cpe:/a:transifex:transifex:0.9 + + CVE-2013-7110 + 2014-05-01T21:59:22.280-04:00 + 2014-05-02T10:52:37.023-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-05-02T10:52:30.287-04:00 + + + + + CONFIRM + https://github.com/transifex/transifex-client/issues/42 + + + MLIST + [oss-security] 20131215 Re: CVE-2013-2073 transifex-client: Does not validate HTTPS server certificate (fixed in transifex-client v0.9) + + + MLIST + [oss-security] 20131213 Re: CVE-2013-2073 transifex-client: Does not validate HTTPS server certificate (fixed in transifex-client v0.9) + + Transifex command-line client before 0.10 does not validate X.509 certificates for data transfer connections, which allows man-in-the-middle attackers to spoof a Transifex server via an arbitrary certificate. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-2073. + + + + + + + + + cpe:/a:basespace_ruby_sdk_project:basespace_ruby_sdk:0.1.7::~~~ruby~~ + + CVE-2013-7111 + 2014-04-29T10:38:46.250-04:00 + 2014-04-29T13:59:23.673-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-29T13:59:23.610-04:00 + + + + + MISC + http://www.vapid.dhs.org/advisories/bio-basespace-sdk.html + + + MLIST + [oss-security] 20131215 Re: Bio Basespace SDK 0.1.7 Ruby Gem exposes API Key via command line + + + MLIST + [oss-security] 20131214 Bio Basespace SDK 0.1.7 Ruby Gem exposes API Key via command line + + The put_call function in the API client (api/api_client.rb) in the BaseSpace Ruby SDK (aka bio-basespace-sdk) gem 0.1.7 for Ruby uses the API_KEY on the command line, which allows remote attackers to obtain sensitive information by listing the processes. + + + + + + + + + cpe:/a:phusion:juvia:- + + CVE-2013-7134 + 2014-04-29T10:38:46.437-04:00 + 2014-04-29T14:13:53.343-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-29T14:13:53.247-04:00 + + + + + MISC + https://github.com/phusion/juvia/issues/55 + + + MLIST + [oss-security] 20131217 Re: CVE request: Juvia secret token handling + + + MLIST + [oss-security] 20131216 CVE request: Juvia secret token handling + + Juvia uses the same secret key for all installations, which allows remote attackers to have unspecified impact by leveraging the secret key in app/config/initializers/secret_token.rb, related to cookies. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:gnome:gnome-shell:3.6.3 + cpe:/a:gnome:gnome-shell:3.7.3.1 + cpe:/a:gnome:gnome-shell:3.7.2.1 + cpe:/a:gnome:gnome-shell:3.0.1 + cpe:/a:gnome:gnome-shell:3.0.2 + cpe:/a:gnome:gnome-shell:3.5.90 + cpe:/a:gnome:gnome-shell:3.2.2 + cpe:/a:gnome:gnome-shell:3.5.91 + cpe:/a:gnome:gnome-shell:3.2.1 + cpe:/a:gnome:gnome-shell:3.5.92 + cpe:/a:gnome:gnome-shell:3.3.90 + cpe:/a:gnome:gnome-shell:3.7.1 + cpe:/a:gnome:gnome-shell:3.3.91 + cpe:/a:gnome:gnome-shell:3.3.92 + cpe:/a:gnome:gnome-shell:3.6.3.1 + cpe:/a:gnome:gnome-shell:3.1.90 + cpe:/a:gnome:gnome-shell:3.6.0 + cpe:/a:gnome:gnome-shell:3.1.90.1 + cpe:/a:gnome:gnome-shell:3.6.1 + cpe:/a:gnome:gnome-shell:3.6.2 + cpe:/a:gnome:gnome-shell:3.4.1 + cpe:/a:gnome:gnome-shell:3.4.2 + cpe:/a:gnome:gnome-shell:3.4.0 + cpe:/a:gnome:gnome-shell:3.0.0.1 + cpe:/a:gnome:gnome-shell:3.0.0.2 + cpe:/a:gnome:gnome-shell:3.1.91.1 + cpe:/a:gnome:gnome-shell:3.1.3 + cpe:/a:gnome:gnome-shell:3.1.4 + cpe:/a:gnome:gnome-shell:3.1.92 + cpe:/a:gnome:gnome-shell:3.1.91 + cpe:/a:gnome:gnome-shell:3.5.4 + cpe:/a:gnome:gnome-shell:3.7.4.1 + cpe:/a:gnome:gnome-shell:3.3.2 + cpe:/a:gnome:gnome-shell:3.2.0 + cpe:/a:gnome:gnome-shell:3.3.3 + cpe:/a:gnome:gnome-shell:3.7.2 + cpe:/a:gnome:gnome-shell:3.7.92 + cpe:/a:gnome:gnome-shell:3.3.5 + cpe:/a:gnome:gnome-shell:3.7.3 + cpe:/a:gnome:gnome-shell:3.7.91 + cpe:/a:gnome:gnome-shell:3.0.0 + cpe:/a:gnome:gnome-shell:3.7.4 + cpe:/a:gnome:gnome-shell:3.5.2 + cpe:/a:gnome:gnome-shell:3.7.5 + cpe:/a:gnome:gnome-shell:3.5.3 + cpe:/a:gnome:gnome-shell:3.2.2.1 + + CVE-2013-7220 + 2014-04-29T10:38:46.967-04:00 + 2014-04-29T14:53:47.390-04:00 + + + 4.6 + LOCAL + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-29T14:53:45.750-04:00 + + + + CONFIRM + https://github.com/o2platform/DefCon_RESTing/tree/master/Live-Demos/Neo4j + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1030431 + + + CONFIRM + https://bugzilla.gnome.org/show_bug.cgi?id=686740 + + + MLIST + [oss-security] 20131227 Re: Two CVE request for gnome-shell/screensaver issues + + + MLIST + [oss-security] 20131227 Re: Two CVE request for gnome-shell/screensaver issues + + + MLIST + [oss-security] 20131227 Two CVE request for gnome-shell/screensaver issues + + js/ui/screenShield.js in GNOME Shell (aka gnome-shell) before 3.8 allows physically proximate attackers to execute arbitrary commands by leveraging an unattended workstation with the keyboard focus on the Activities search. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:gnome:gnome-shell:3.7.3.1 + cpe:/a:gnome:gnome-shell:3.8.0 + cpe:/a:gnome:gnome-shell:3.7.2.1 + cpe:/a:gnome:gnome-shell:3.0.1 + cpe:/a:gnome:gnome-shell:3.0.2 + cpe:/a:gnome:gnome-shell:3.7.1 + cpe:/a:gnome:gnome-shell:3.3.90 + cpe:/a:gnome:gnome-shell:3.3.91 + cpe:/a:gnome:gnome-shell:3.3.92 + cpe:/a:gnome:gnome-shell:3.6.3.1 + cpe:/a:gnome:gnome-shell:3.6.0 + cpe:/a:gnome:gnome-shell:3.1.90.1 + cpe:/a:gnome:gnome-shell:3.6.1 + cpe:/a:gnome:gnome-shell:3.6.2 + cpe:/a:gnome:gnome-shell:3.4.1 + cpe:/a:gnome:gnome-shell:3.4.2 + cpe:/a:gnome:gnome-shell:3.4.0 + cpe:/a:gnome:gnome-shell:3.9.90 + cpe:/a:gnome:gnome-shell:3.1.91.1 + cpe:/a:gnome:gnome-shell:3.1.3 + cpe:/a:gnome:gnome-shell:3.1.4 + cpe:/a:gnome:gnome-shell:3.1.92 + cpe:/a:gnome:gnome-shell:3.1.91 + cpe:/a:gnome:gnome-shell:3.9.1 + cpe:/a:gnome:gnome-shell:3.3.2 + cpe:/a:gnome:gnome-shell:3.3.3 + cpe:/a:gnome:gnome-shell:3.7.92 + cpe:/a:gnome:gnome-shell:3.7.91 + cpe:/a:gnome:gnome-shell:3.3.5 + cpe:/a:gnome:gnome-shell:3.9.92 + cpe:/a:gnome:gnome-shell:3.9.91 + cpe:/a:gnome:gnome-shell:3.0.0 + cpe:/a:gnome:gnome-shell:3.5.2 + cpe:/a:gnome:gnome-shell:3.5.3 + cpe:/a:gnome:gnome-shell:3.9.3 + cpe:/a:gnome:gnome-shell:3.2.2.1 + cpe:/a:gnome:gnome-shell:3.9.2 + cpe:/a:gnome:gnome-shell:3.9.5 + cpe:/a:gnome:gnome-shell:3.9.4 + cpe:/a:gnome:gnome-shell:3.6.3 + cpe:/a:gnome:gnome-shell:3.8.4 + cpe:/a:gnome:gnome-shell:3.8.3 + cpe:/a:gnome:gnome-shell:3.8.2 + cpe:/a:gnome:gnome-shell:3.8.1 + cpe:/a:gnome:gnome-shell:3.5.90 + cpe:/a:gnome:gnome-shell:3.5.91 + cpe:/a:gnome:gnome-shell:3.2.2 + cpe:/a:gnome:gnome-shell:3.5.92 + cpe:/a:gnome:gnome-shell:3.2.1 + cpe:/a:gnome:gnome-shell:3.1.90 + cpe:/a:gnome:gnome-shell:3.0.0.1 + cpe:/a:gnome:gnome-shell:3.0.0.2 + cpe:/a:gnome:gnome-shell:3.5.4 + cpe:/a:gnome:gnome-shell:3.7.4.1 + cpe:/a:gnome:gnome-shell:3.2.0 + cpe:/a:gnome:gnome-shell:3.7.2 + cpe:/a:gnome:gnome-shell:3.7.3 + cpe:/a:gnome:gnome-shell:3.7.4 + cpe:/a:gnome:gnome-shell:3.7.5 + cpe:/a:gnome:gnome-shell:3.8.0.1 + + CVE-2013-7221 + 2014-04-29T10:38:47.170-04:00 + 2014-04-29T15:03:18.770-04:00 + + + 4.6 + LOCAL + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-29T15:03:17.957-04:00 + + + + + CONFIRM + https://git.gnome.org/browse/gnome-shell/commit/js/ui/main.js?id=efdf1ff755943fba1f8a9aaeff77daa3ed338088 + + + CONFIRM + https://bugzilla.gnome.org/show_bug.cgi?id=708313 + + + MLIST + [oss-security] 20131227 Re: Two CVE request for gnome-shell/screensaver issues + + + MLIST + [oss-security] 20131227 Two CVE request for gnome-shell/screensaver issues + + The automatic screen lock functionality in GNOME Shell (aka gnome-shell) before 3.10 does not prevent access to the "Enter a Command" dialog, which allows physically proximate attackers to execute arbitrary commands by leveraging an unattended workstation. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:simplemachines:simple_machines_forum:1.0.20 + cpe:/a:simplemachines:simple_machines_forum:1.0.22 + cpe:/a:simplemachines:simple_machines_forum:1.0.21 + cpe:/a:simplemachines:simple_machines_forum:1.0.23 + cpe:/a:simplemachines:simple_machines_forum:2.0:beta3.1 + cpe:/a:simplemachines:simple_machines_forum:1.0.17 + cpe:/a:simplemachines:simple_machines_forum:1.1:beta4 + cpe:/a:simplemachines:simple_machines_forum:1.0:beta4 + cpe:/a:simplemachines:simple_machines_forum:1.0.16 + cpe:/a:simplemachines:simple_machines_forum:2.0:beta2.1 + cpe:/a:simplemachines:simple_machines_forum:1.0.19 + cpe:/a:simplemachines:simple_machines_forum:1.0:beta6 + cpe:/a:simplemachines:simple_machines_forum:1.0.18 + cpe:/a:simplemachines:simple_machines_forum:1.1:beta1 + cpe:/a:simplemachines:simple_machines_forum:1.1:beta2 + cpe:/a:simplemachines:simple_machines_forum:1.1:beta3 + cpe:/a:simplemachines:simple_machines_forum:1.0 + cpe:/a:simplemachines:simple_machines_forum:1.1 + cpe:/a:simplemachines:simple_machines_forum:1.0.4 + cpe:/a:simplemachines:simple_machines_forum:1.0.3 + cpe:/a:simplemachines:simple_machines_forum:1.0.6 + cpe:/a:simplemachines:simple_machines_forum:1.0.5 + cpe:/a:simplemachines:simple_machines_forum:1.0.8 + cpe:/a:simplemachines:simple_machines_forum:1.0.7 + cpe:/a:simplemachines:simple_machines_forum:1.0.9 + cpe:/a:simplemachines:simple_machines_forum:1.1.7 + cpe:/a:simplemachines:simple_machines_forum:1.1.6 + cpe:/a:simplemachines:simple_machines_forum:1.1.9 + cpe:/a:simplemachines:simple_machines_forum:1.1.8 + cpe:/a:simplemachines:simple_machines_forum:1.1.3 + cpe:/a:simplemachines:simple_machines_forum:1.1.2 + cpe:/a:simplemachines:simple_machines_forum:1.1.5 + cpe:/a:simplemachines:simple_machines_forum:1.1.4 + cpe:/a:simplemachines:simple_machines_forum:1.0:rc2 + cpe:/a:simplemachines:simple_machines_forum:1.1.1 + cpe:/a:simplemachines:simple_machines_forum:1.0:rc1 + cpe:/a:simplemachines:simple_machines_forum:1.1:rc2 + cpe:/a:simplemachines:simple_machines_forum:1.1:rc1 + cpe:/a:simplemachines:simple_machines_forum:1.1:rc3 + cpe:/a:simplemachines:simple_machines_forum:2.0:beta1 + cpe:/a:simplemachines:simple_machines_forum:2.0:beta3 + cpe:/a:simplemachines:simple_machines_forum:2.0:beta2 + cpe:/a:simplemachines:simple_machines_forum:1.0:beta4.1 + cpe:/a:simplemachines:simple_machines_forum:2.0:beta4 + cpe:/a:simplemachines:simple_machines_forum:1.0.1 + cpe:/a:simplemachines:simple_machines_forum:1.0.2 + cpe:/a:simplemachines:simple_machines_forum:2.0.4 + cpe:/a:simplemachines:simple_machines_forum:1.1.12 + cpe:/a:simplemachines:simple_machines_forum:2.0.5 + cpe:/a:simplemachines:simple_machines_forum:1.1.11 + cpe:/a:simplemachines:simple_machines_forum:2.0.2 + cpe:/a:simplemachines:simple_machines_forum:2.0:rc5 + cpe:/a:simplemachines:simple_machines_forum:1.1.10 + cpe:/a:simplemachines:simple_machines_forum:2.0.3 + cpe:/a:simplemachines:simple_machines_forum:2.0:rc3 + cpe:/a:simplemachines:simple_machines_forum:1.1.16 + cpe:/a:simplemachines:simple_machines_forum:2.0:rc4 + cpe:/a:simplemachines:simple_machines_forum:1.1.15 + cpe:/a:simplemachines:simple_machines_forum:2.0.6 + cpe:/a:simplemachines:simple_machines_forum:2.0:rc1 + cpe:/a:simplemachines:simple_machines_forum:1.1.14 + cpe:/a:simplemachines:simple_machines_forum:2.0:rc2 + cpe:/a:simplemachines:simple_machines_forum:1.1.13 + cpe:/a:simplemachines:simple_machines_forum:2.0.1 + cpe:/a:simplemachines:simple_machines_forum:1.0.14 + cpe:/a:simplemachines:simple_machines_forum:1.0.15 + cpe:/a:simplemachines:simple_machines_forum:1.1.17 + cpe:/a:simplemachines:simple_machines_forum:1.0.12 + cpe:/a:simplemachines:simple_machines_forum:1.0.13 + cpe:/a:simplemachines:simple_machines_forum:1.0.10 + cpe:/a:simplemachines:simple_machines_forum:1.0:beta5 + + CVE-2013-7234 + 2014-04-29T10:38:47.607-04:00 + 2014-04-30T07:14:53.417-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-30T07:14:52.947-04:00 + + + + + MLIST + [oss-security] 20131229 Re: CVE request: SMF 1.1.19, 2.0.6 + + + MLIST + [oss-security] 20131230 CVE request: SMF 1.1.19, 2.0.6 + + + MISC + http://www.jakoblell.com/blog/2013/12/13/multiple-vulnerabilities-in-smf-forum-software/ + + + FULLDISC + 20131213 Multiple vulnerabilities in SMF forum software + + + CONFIRM + http://download.simplemachines.org/index.php?thanks;filename=smf_2-0-6_changelog.txt + + Simple Machines Forum (SMF) before 1.1.19 and 2.x before 2.0.6 allows remote attackers to conduct clickjacking attacks via an X-Frame-Options header. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:simplemachines:simple_machines_forum:1.0.20 + cpe:/a:simplemachines:simple_machines_forum:1.0.22 + cpe:/a:simplemachines:simple_machines_forum:1.0.21 + cpe:/a:simplemachines:simple_machines_forum:1.0.23 + cpe:/a:simplemachines:simple_machines_forum:2.0:beta3.1 + cpe:/a:simplemachines:simple_machines_forum:1.0.17 + cpe:/a:simplemachines:simple_machines_forum:1.1:beta4 + cpe:/a:simplemachines:simple_machines_forum:1.0:beta4 + cpe:/a:simplemachines:simple_machines_forum:1.0.16 + cpe:/a:simplemachines:simple_machines_forum:2.0:beta2.1 + cpe:/a:simplemachines:simple_machines_forum:1.0.19 + cpe:/a:simplemachines:simple_machines_forum:1.0:beta6 + cpe:/a:simplemachines:simple_machines_forum:1.0.18 + cpe:/a:simplemachines:simple_machines_forum:1.1:beta1 + cpe:/a:simplemachines:simple_machines_forum:1.1:beta2 + cpe:/a:simplemachines:simple_machines_forum:1.1:beta3 + cpe:/a:simplemachines:simple_machines_forum:1.0 + cpe:/a:simplemachines:simple_machines_forum:1.1 + cpe:/a:simplemachines:simple_machines_forum:1.0.4 + cpe:/a:simplemachines:simple_machines_forum:1.0.3 + cpe:/a:simplemachines:simple_machines_forum:1.0.6 + cpe:/a:simplemachines:simple_machines_forum:1.0.5 + cpe:/a:simplemachines:simple_machines_forum:1.0.8 + cpe:/a:simplemachines:simple_machines_forum:1.0.7 + cpe:/a:simplemachines:simple_machines_forum:1.0.9 + cpe:/a:simplemachines:simple_machines_forum:1.1.7 + cpe:/a:simplemachines:simple_machines_forum:1.1.6 + cpe:/a:simplemachines:simple_machines_forum:1.1.9 + cpe:/a:simplemachines:simple_machines_forum:1.1.8 + cpe:/a:simplemachines:simple_machines_forum:1.1.3 + cpe:/a:simplemachines:simple_machines_forum:1.1.2 + cpe:/a:simplemachines:simple_machines_forum:1.1.5 + cpe:/a:simplemachines:simple_machines_forum:1.1.4 + cpe:/a:simplemachines:simple_machines_forum:1.0:rc2 + cpe:/a:simplemachines:simple_machines_forum:1.1.1 + cpe:/a:simplemachines:simple_machines_forum:1.0:rc1 + cpe:/a:simplemachines:simple_machines_forum:1.1:rc2 + cpe:/a:simplemachines:simple_machines_forum:1.1:rc1 + cpe:/a:simplemachines:simple_machines_forum:1.1:rc3 + cpe:/a:simplemachines:simple_machines_forum:2.0:beta1 + cpe:/a:simplemachines:simple_machines_forum:2.0:beta3 + cpe:/a:simplemachines:simple_machines_forum:2.0:beta2 + cpe:/a:simplemachines:simple_machines_forum:1.0:beta4.1 + cpe:/a:simplemachines:simple_machines_forum:2.0:beta4 + cpe:/a:simplemachines:simple_machines_forum:1.0.1 + cpe:/a:simplemachines:simple_machines_forum:1.0.2 + cpe:/a:simplemachines:simple_machines_forum:2.0.4 + cpe:/a:simplemachines:simple_machines_forum:1.1.12 + cpe:/a:simplemachines:simple_machines_forum:2.0.5 + cpe:/a:simplemachines:simple_machines_forum:1.1.11 + cpe:/a:simplemachines:simple_machines_forum:2.0.2 + cpe:/a:simplemachines:simple_machines_forum:2.0:rc5 + cpe:/a:simplemachines:simple_machines_forum:1.1.10 + cpe:/a:simplemachines:simple_machines_forum:2.0.3 + cpe:/a:simplemachines:simple_machines_forum:2.0:rc3 + cpe:/a:simplemachines:simple_machines_forum:1.1.16 + cpe:/a:simplemachines:simple_machines_forum:2.0:rc4 + cpe:/a:simplemachines:simple_machines_forum:1.1.15 + cpe:/a:simplemachines:simple_machines_forum:2.0.6 + cpe:/a:simplemachines:simple_machines_forum:2.0:rc1 + cpe:/a:simplemachines:simple_machines_forum:1.1.14 + cpe:/a:simplemachines:simple_machines_forum:2.0:rc2 + cpe:/a:simplemachines:simple_machines_forum:1.1.13 + cpe:/a:simplemachines:simple_machines_forum:2.0.1 + cpe:/a:simplemachines:simple_machines_forum:1.0.14 + cpe:/a:simplemachines:simple_machines_forum:1.0.15 + cpe:/a:simplemachines:simple_machines_forum:1.1.17 + cpe:/a:simplemachines:simple_machines_forum:1.0.12 + cpe:/a:simplemachines:simple_machines_forum:1.0.13 + cpe:/a:simplemachines:simple_machines_forum:1.0.10 + cpe:/a:simplemachines:simple_machines_forum:1.0:beta5 + + CVE-2013-7235 + 2014-04-29T10:38:47.623-04:00 + 2014-04-30T07:18:45.863-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-30T07:18:45.550-04:00 + + + + + MLIST + [oss-security] 20131229 Re: CVE request: SMF 1.1.19, 2.0.6 + + + MLIST + [oss-security] 20131230 CVE request: SMF 1.1.19, 2.0.6 + + + MISC + http://www.jakoblell.com/blog/2013/12/13/multiple-vulnerabilities-in-smf-forum-software/ + + + FULLDISC + 20131213 Multiple vulnerabilities in SMF forum software + + + CONFIRM + http://download.simplemachines.org/index.php?thanks;filename=smf_2-0-6_changelog.txt + + Simple Machines Forum (SMF) before 1.1.19 and 2.x before 2.0.6 allows remote attackers to impersonate arbitrary users via multiple space characters characters. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:simplemachines:simple_machines_forum:1.0.20 + cpe:/a:simplemachines:simple_machines_forum:1.0.22 + cpe:/a:simplemachines:simple_machines_forum:1.0.21 + cpe:/a:simplemachines:simple_machines_forum:1.0.23 + cpe:/a:simplemachines:simple_machines_forum:1.1:beta4 + cpe:/a:simplemachines:simple_machines_forum:1.0.17 + cpe:/a:simplemachines:simple_machines_forum:1.0:beta4 + cpe:/a:simplemachines:simple_machines_forum:1.0.16 + cpe:/a:simplemachines:simple_machines_forum:1.0.19 + cpe:/a:simplemachines:simple_machines_forum:1.0:beta6 + cpe:/a:simplemachines:simple_machines_forum:1.0.18 + cpe:/a:simplemachines:simple_machines_forum:1.1:beta1 + cpe:/a:simplemachines:simple_machines_forum:1.1:beta2 + cpe:/a:simplemachines:simple_machines_forum:1.1:beta3 + cpe:/a:simplemachines:simple_machines_forum:1.0 + cpe:/a:simplemachines:simple_machines_forum:1.1 + cpe:/a:simplemachines:simple_machines_forum:1.0.4 + cpe:/a:simplemachines:simple_machines_forum:1.0.3 + cpe:/a:simplemachines:simple_machines_forum:1.0.6 + cpe:/a:simplemachines:simple_machines_forum:1.0.5 + cpe:/a:simplemachines:simple_machines_forum:1.0.8 + cpe:/a:simplemachines:simple_machines_forum:1.0.7 + cpe:/a:simplemachines:simple_machines_forum:1.0.9 + cpe:/a:simplemachines:simple_machines_forum:1.1.7 + cpe:/a:simplemachines:simple_machines_forum:1.1.6 + cpe:/a:simplemachines:simple_machines_forum:1.1.9 + cpe:/a:simplemachines:simple_machines_forum:1.1.8 + cpe:/a:simplemachines:simple_machines_forum:1.1.3 + cpe:/a:simplemachines:simple_machines_forum:1.1.2 + cpe:/a:simplemachines:simple_machines_forum:1.1.5 + cpe:/a:simplemachines:simple_machines_forum:1.1.4 + cpe:/a:simplemachines:simple_machines_forum:1.0:rc2 + cpe:/a:simplemachines:simple_machines_forum:1.1.1 + cpe:/a:simplemachines:simple_machines_forum:1.0:rc1 + cpe:/a:simplemachines:simple_machines_forum:1.1:rc2 + cpe:/a:simplemachines:simple_machines_forum:1.1:rc1 + cpe:/a:simplemachines:simple_machines_forum:1.1:rc3 + cpe:/a:simplemachines:simple_machines_forum:1.0:beta4.1 + cpe:/a:simplemachines:simple_machines_forum:1.0.1 + cpe:/a:simplemachines:simple_machines_forum:1.0.2 + cpe:/a:simplemachines:simple_machines_forum:1.1.12 + cpe:/a:simplemachines:simple_machines_forum:1.1.11 + cpe:/a:simplemachines:simple_machines_forum:1.1.10 + cpe:/a:simplemachines:simple_machines_forum:1.1.16 + cpe:/a:simplemachines:simple_machines_forum:1.1.15 + cpe:/a:simplemachines:simple_machines_forum:1.1.14 + cpe:/a:simplemachines:simple_machines_forum:2.0.6 + cpe:/a:simplemachines:simple_machines_forum:1.1.13 + cpe:/a:simplemachines:simple_machines_forum:1.0.14 + cpe:/a:simplemachines:simple_machines_forum:1.1.17 + cpe:/a:simplemachines:simple_machines_forum:1.0.15 + cpe:/a:simplemachines:simple_machines_forum:1.0.12 + cpe:/a:simplemachines:simple_machines_forum:1.0.13 + cpe:/a:simplemachines:simple_machines_forum:1.0.10 + cpe:/a:simplemachines:simple_machines_forum:1.0:beta5 + + CVE-2013-7236 + 2014-04-29T10:38:47.657-04:00 + 2014-04-30T07:21:25.227-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-30T07:21:24.960-04:00 + + + + + MLIST + [oss-security] 20131229 Re: CVE request: SMF 1.1.19, 2.0.6 + + + MLIST + [oss-security] 20131230 CVE request: SMF 1.1.19, 2.0.6 + + + MISC + http://www.jakoblell.com/blog/2013/12/13/multiple-vulnerabilities-in-smf-forum-software/ + + + FULLDISC + 20131213 Multiple vulnerabilities in SMF forum software + + Simple Machines Forum (SMF) 2.0.6, 1.1.19, and earlier allows remote attackers to impersonate arbitrary users via a Unicode homoglyph character in a username. + + + + + + + + + cpe:/a:neo4j:neo4j:1.9.2 + + CVE-2013-7259 + 2014-04-29T10:38:47.797-04:00 + 2014-04-30T07:44:00.303-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-30T07:44:00.240-04:00 + + + + + + MISC + https://github.com/o2platform/DefCon_RESTing/tree/master/Live-Demos/Neo4j + + + MLIST + [oss-security] 20140103 Re: Neo4J CSRF: Potential CVE candidate + + + MLIST + [oss-security] 20140103 Neo4J CSRF: Potential CVE candidate + + + MISC + http://blog.diniscruz.com/2013/08/neo4j-csrf-payload-to-start-processes.html + + Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary code, as demonstrated by a request to (1) db/data/ext/GremlinPlugin/graphdb/execute_script or (2) db/manage/server/console/. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:realnetworks:realplayer:12.0.0.1701::mac + cpe:/a:realnetworks:realplayer:7 + cpe:/a:realnetworks:realplayer:4 + cpe:/a:realnetworks:realplayer:6 + cpe:/a:realnetworks:realplayer:5 + cpe:/a:realnetworks:realplayer:15.0.4.43 + cpe:/a:realnetworks:realplayer:14.0.1.609 + cpe:/a:realnetworks:realplayer:15.02.71 + cpe:/a:realnetworks:realplayer:8 + cpe:/a:realnetworks:realplayer:14.0.0 + cpe:/a:realnetworks:realplayer:11.0.2.1744 + cpe:/a:realnetworks:realplayer:14.0.4 + cpe:/a:realnetworks:realplayer:10.1:10.0.0._481:mac + cpe:/a:realnetworks:realplayer:14.0.5 + cpe:/a:realnetworks:realplayer:11.1 + cpe:/a:realnetworks:realplayer:10.1:10.0.0.412:mac + cpe:/a:realnetworks:realplayer:12.0.0.1548 + cpe:/a:realnetworks:realplayer:14.0.1 + cpe:/a:realnetworks:realplayer:14.0.2 + cpe:/a:realnetworks:realplayer:11.0 + cpe:/a:realnetworks:realplayer:14.0.3 + cpe:/a:realnetworks:realplayer:10.1:10.0.0.396:mac + cpe:/a:realnetworks:realplayer:11_build_6.0.14.748 + cpe:/a:realnetworks:realplayer:15.0.5.109 + cpe:/a:realnetworks:realplayer:10.0:10.0.0.305:mac + cpe:/a:realnetworks:realplayer:16.0.0.282 + cpe:/a:realnetworks:realplayer:10.0:10.0.0.352:mac + cpe:/a:realnetworks:realplayer:11.0.4 + cpe:/a:realnetworks:realplayer:11.0.5 + cpe:/a:realnetworks:realplayer:11.1.3 + cpe:/a:realnetworks:realplayer:16.0.2.32 + cpe:/a:realnetworks:realplayer:15.0.0 + cpe:/a:realnetworks:realplayer:16.0.0 + cpe:/a:realnetworks:realplayer:15.0.4 + cpe:/a:realnetworks:realplayer:10.0 + cpe:/a:realnetworks:realplayer:10.5 + cpe:/a:realnetworks:realplayer:17.0.4.60 + cpe:/a:realnetworks:realplayer:12.0.1.1737:-:~-~-~mac_os_x~~ + cpe:/a:realnetworks:realplayer:12.0.0.1444 + cpe:/a:realnetworks:realplayer:11.0.2.2315 + cpe:/a:realnetworks:realplayer:2.1.4::enterprise + cpe:/a:realnetworks:realplayer:2.1.3::enterprise + cpe:/a:realnetworks:realplayer:2.1.2::enterprise + cpe:/a:realnetworks:realplayer:16.0.1.18 + cpe:/a:realnetworks:realplayer:16.0.3.51 + cpe:/a:realnetworks:realplayer:15.0.6.14 + cpe:/a:realnetworks:realplayer:11.0.3 + cpe:/a:realnetworks:realplayer:10.0:10.0.0.331:mac + cpe:/a:realnetworks:realplayer:11.0.2 + cpe:/a:realnetworks:realplayer:11.0.1 + + CVE-2013-7260 + 2014-01-03T15:55:06.383-05:00 + 2014-04-25T09:36:23.007-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-01-06T12:15:40.000-05:00 + + + + + CERT-VN + VU#698278 + + + XF + realplayer-cve20137260-bo(90160) + + + EXPLOIT-DB + 30468 + + + CONFIRM + http://service.real.com/realplayer/security/12202013_player/en/ + + Multiple stack-based buffer overflows in RealNetworks RealPlayer before 17.0.4.61 on Windows, and Mac RealPlayer before 12.0.1.1738, allow remote attackers to execute arbitrary code via a long (1) version number or (2) encoding declaration in the XML declaration of an RMP file, a different issue than CVE-2013-6877. + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:gnome:gnome_display_manager:3.1.91 + cpe:/a:gnome:gnome_display_manager:3.1.92 + cpe:/a:gnome:gnome_display_manager:3.1.2 + cpe:/a:gnome:gnome_display_manager:3.4.0 + cpe:/a:gnome:gnome_display_manager:3.4.1 + cpe:/a:gnome:gnome_display_manager:3.3.92 + cpe:/a:gnome:gnome_display_manager:3.4.0.1 + cpe:/a:gnome:gnome_display_manager:3.2.0 + cpe:/a:gnome:gnome_display_manager:3.2.1.1 + cpe:/a:gnome:gnome_display_manager:3.2.1 + cpe:/a:gnome:gnome_display_manager:3.0.2 + cpe:/a:gnome:gnome_display_manager:3.0.4 + cpe:/a:gnome:gnome_display_manager:3.3.92.1 + cpe:/a:gnome:gnome_display_manager:3.0.3 + cpe:/a:gnome:gnome_display_manager:3.0.0 + cpe:/a:gnome:gnome_display_manager:3.1.90 + + CVE-2013-7273 + 2014-04-29T10:38:49.857-04:00 + 2014-04-30T09:32:45.557-04:00 + + + 2.1 + LOCAL + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-30T09:32:45.383-04:00 + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1050745 + + + MISC + https://bugzilla.gnome.org/show_bug.cgi?id=704284 + + + CONFIRM + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=683338 + + + MLIST + [oss-security] 20140107 CVE Re: request: lightdm-gtk-greeter - local DOS due to NULL pointer dereference + + + MLIST + [oss-security] 20140107 CVE Re: request: lightdm-gtk-greeter - local DOS due to NULL pointer dereference + + GNOME Display Manager (gdm) 3.4.1 and earlier, when disable-user-list is set to true, allows local users to cause a denial of service (unable to login) by pressing the cancel button after entering a user name. + + + + + + + + + + + + + + + + + + + + + + cpe:/a:malcolm_nooning:pirpc:0.2010::~~~perl~~ + cpe:/a:malcolm_nooning:pirpc:0.2011::~~~perl~~ + cpe:/a:malcolm_nooning:pirpc:0.2001::~~~perl~~ + cpe:/a:malcolm_nooning:pirpc:0.2002::~~~perl~~ + cpe:/a:malcolm_nooning:pirpc:0.2003::~~~perl~~ + cpe:/a:malcolm_nooning:pirpc:0.2000::~~~perl~~ + cpe:/a:malcolm_nooning:pirpc:0.2020::~~~perl~~ + cpe:/a:malcolm_nooning:pirpc:0.2013::~~~perl~~ + cpe:/a:malcolm_nooning:pirpc:0.2012::~~~perl~~ + cpe:/a:malcolm_nooning:pirpc:0.2014::~~~perl~~ + cpe:/a:malcolm_nooning:pirpc:0.2017::~~~perl~~ + cpe:/a:malcolm_nooning:pirpc:0.2016::~~~perl~~ + cpe:/a:malcolm_nooning:pirpc:0.2019::~~~perl~~ + cpe:/a:malcolm_nooning:pirpc:0.2018::~~~perl~~ + + CVE-2013-7284 + 2014-04-29T10:38:49.890-04:00 + 2014-04-30T09:56:04.777-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-30T09:56:04.650-04:00 + + + + + MISC + https://rt.cpan.org/Public/Bug/Display.html?id=90474 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1051108 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1030572 + + + CONFIRM + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=734789 + + + MLIST + [oss-security] 20140109 Re: PlRPC Perl module: pre-auth remote code execution, weak crypto + + + MLIST + [oss-security] 20140109 PlRPC Perl module: pre-auth remote code execution, weak crypto + + The PlRPC module, possibly 0.2020 and earlier, for Perl uses the Storable module, which allows remote attackers to execute arbitrary code via a crafted request, which is not properly handled when it is deserialized. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:ubercart:ubercart:7.x-3.0:alpha1 + cpe:/a:ubercart:ubercart:7.x-3.4 + cpe:/a:ubercart:ubercart:7.x-3.5 + cpe:/a:ubercart:ubercart:7.x-3.2 + cpe:/a:ubercart:ubercart:7.x-3.3 + cpe:/a:ubercart:ubercart:6.x-2.0:dev + cpe:/a:ubercart:ubercart:7.x-3.0:dev + cpe:/a:ubercart:ubercart:7.x-3.0:beta2 + cpe:/a:ubercart:ubercart:7.x-3.0:rc3 + cpe:/a:ubercart:ubercart:7.x-3.0:beta3 + cpe:/a:ubercart:ubercart:7.x-3.0:rc4 + cpe:/a:ubercart:ubercart:6.x-2.3 + cpe:/a:ubercart:ubercart:7.x-3.0:beta1 + cpe:/a:ubercart:ubercart:7.x-3.0:rc2 + cpe:/a:ubercart:ubercart:6.x-2.2 + cpe:/a:ubercart:ubercart:7.x-3.0:rc1 + cpe:/a:ubercart:ubercart:6.x-2.1 + cpe:/a:ubercart:ubercart:7.x-3.0:beta4 + cpe:/a:ubercart:ubercart:6.x-2.0:beta4 + cpe:/a:ubercart:ubercart:6.x-2.0:beta5 + cpe:/a:ubercart:ubercart:6.x-2.0:beta6 + cpe:/a:ubercart:ubercart:6.x-2.0:beta1 + cpe:/a:ubercart:ubercart:6.x-2.0:beta2 + cpe:/a:ubercart:ubercart:6.x-2.0:beta3 + cpe:/a:ubercart:ubercart:6.x-2.0 + cpe:/a:ubercart:ubercart:6.x-2.8 + cpe:/a:ubercart:ubercart:6.x-2.4 + cpe:/a:ubercart:ubercart:6.x-2.6 + cpe:/a:ubercart:ubercart:6.x-2.7 + cpe:/a:ubercart:ubercart:6.x-2.11 + cpe:/a:ubercart:ubercart:6.x-2.12 + cpe:/a:ubercart:ubercart:6.x-2.10 + cpe:/a:ubercart:ubercart:6.x-2.9 + cpe:/a:ubercart:ubercart:7.x-3.0:alpha2 + cpe:/a:ubercart:ubercart:6.x-2.0:rc7 + cpe:/a:ubercart:ubercart:7.x-3.0:alpha3 + cpe:/a:ubercart:ubercart:6.x-2.0:rc6 + cpe:/a:ubercart:ubercart:6.x-2.0:rc5 + cpe:/a:ubercart:ubercart:6.x-2.0:rc4 + cpe:/a:ubercart:ubercart:6.x-2.0:rc3 + cpe:/a:ubercart:ubercart:6.x-2.0:rc2 + cpe:/a:ubercart:ubercart:7.x-3.1 + cpe:/a:ubercart:ubercart:6.x-2.0:rc1 + cpe:/a:ubercart:ubercart:7.x-3.0 + + CVE-2013-7302 + 2014-04-29T10:38:49.907-04:00 + 2014-04-30T10:04:51.667-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-30T10:04:51.293-04:00 + + + + + MISC + https://drupal.org/node/2158651 + + + CONFIRM + https://drupal.org/node/2158567 + + + CONFIRM + https://drupal.org/node/2158565 + + Session fixation vulnerability in the Ubercart module 6.x-2.x before 6.x-2.13 and 7.x-3.x before 7.x-3.6 for Drupal, when the "Log in new customers after checkout" option is enabled, allows remote attackers to hijack web sessions by leveraging knowledge of the original session ID. + + + + + + + + + + + + + + + + + + + + + cpe:/o:google:android:4.1 + cpe:/o:google:android:4.1.2 + cpe:/o:google:android:4.2.2 + cpe:/o:google:android:4.2.1 + cpe:/o:google:android:4.0.1 + cpe:/o:google:android:4.0.2 + cpe:/o:google:android:4.0 + cpe:/a:apache:harmony:6.0:m3 + cpe:/o:google:android:4.0.4 + cpe:/o:google:android:4.0.3 + cpe:/o:google:android:4.3 + cpe:/o:google:android:4.2 + cpe:/o:google:android:4.3.1 + + CVE-2013-7372 + 2014-04-29T16:55:08.933-04:00 + 2014-04-30T10:23:46.927-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-30T10:23:46.800-04:00 + + + + + CONFIRM + https://android.googlesource.com/platform/libcore/+/kitkat-release/luni/src/main/java/org/apache/harmony/security/provider/crypto/SHA1PRNG_SecureRandomImpl.java + + + CONFIRM + http://android-developers.blogspot.com.au/2013/08/some-securerandom-thoughts.html + + + MISC + https://bitcoin.org/en/alert/2013-08-11-android + + + MISC + http://www.nds.rub.de/media/nds/veroeffentlichungen/2013/03/25/paper_2.pdf + + The engineNextBytes function in classlib/modules/security/src/main/java/common/org/apache/harmony/security/provider/crypto/SHA1PRNG_SecureRandomImpl.java in the SecureRandom implementation in Apache Harmony through 6.0M3, as used in the Java Cryptography Architecture (JCA) in Android before 4.4 and other products, when no seed is provided by the user, uses an incorrect offset value, which makes it easier for attackers to defeat cryptographic protection mechanisms by leveraging the resulting PRNG predictability, as exploited in the wild against Bitcoin wallet applications in August 2013. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:google:android:4.1.2 + cpe:/o:google:android:2.2.2 + cpe:/o:google:android:3.1 + cpe:/o:google:android:2.2.1 + cpe:/o:google:android:3.0 + cpe:/o:google:android:4.0.4 + cpe:/o:google:android:4.0.3 + cpe:/o:google:android:3.2 + cpe:/o:google:android:4.1 + cpe:/o:google:android:4.0 + cpe:/o:google:android:2.3:rev1 + cpe:/o:google:android:3.2.1 + cpe:/o:google:android:2.2:rev1 + cpe:/o:google:android:1.5 + cpe:/o:google:android:1.6 + cpe:/o:google:android:2.3 + cpe:/o:google:android:2.1 + cpe:/o:google:android:2.2 + cpe:/o:google:android:2.3.1 + cpe:/o:google:android:2.0 + cpe:/o:google:android:1.1 + cpe:/o:google:android:3.2.6 + cpe:/o:google:android:1.0 + cpe:/o:google:android:4.3 + cpe:/o:google:android:3.2.4 + cpe:/o:google:android:4.2 + cpe:/o:google:android:2.3.7 + cpe:/o:google:android:3.2.2 + cpe:/o:google:android:4.2.2 + cpe:/o:google:android:2.2.3 + cpe:/o:google:android:4.2.1 + cpe:/o:google:android:4.0.1 + cpe:/o:google:android:4.0.2 + cpe:/o:google:android:2.3.6 + cpe:/o:google:android:2.3.4 + cpe:/o:google:android:2.0.1 + cpe:/o:google:android:2.3.5 + cpe:/o:google:android:4.3.1 + cpe:/o:google:android:2.3.2 + cpe:/o:google:android:2.3.3 + + CVE-2013-7373 + 2014-04-29T16:55:09.013-04:00 + 2014-04-30T08:57:21.250-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-30T08:57:20.750-04:00 + + + + + MISC + http://www.reddit.com/r/Android/comments/1k6f03/due_to_a_serious_encryptionrng_flaw_in_android/cblvum5 + + + MLIST + [openssl-dev] 20110416 Re: recycled pids causes PRNG to repeat + + + MLIST + [openssl-dev] 20110415 recycled pids causes PRNG to repeat + + + MISC + http://emboss.github.io/blog/2013/08/21/openssl-prng-is-not-really-fork-safe/ + + + CONFIRM + http://android-developers.blogspot.com.au/2013/08/some-securerandom-thoughts.html + + Android before 4.4 does not properly arrange for seeding of the OpenSSL PRNG, which makes it easier for attackers to defeat cryptographic protection mechanisms by leveraging use of the PRNG within multiple applications. + + + + + + + + + cpe:/o:canonical:ubuntu_linux:13.10 + + CVE-2013-7374 + 2014-05-01T13:28:36.227-04:00 + 2014-05-01T14:09:38.137-04:00 + + + 4.6 + LOCAL + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-05-01T14:09:38.013-04:00 + + + + + CONFIRM + https://bugs.launchpad.net/ubuntu/%2Bsource/indicator-datetime/%2Bbug/1246812 + + + UBUNTU + USN-2186-1 + + + MLIST + [oss-security] 20140430 Re: CVE Request: indicator-datetime issue + + + MLIST + [oss-security] 20140429 CVE Request: indicator-datetime issue + + + CONFIRM + http://bazaar.launchpad.net/~indicator-applet-developers/indicator-datetime/trunk.13.10/revision/282 + + The Ubuntu Date and Time Indicator (aka indicator-datetime) 13.10.0+13.10.x before 13.10.0+13.10.20131023.2-0ubuntu1.1 does not properly restrict access to Evolution, which allows local users to bypass the greeter screen restrictions by clicking the date. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:zarafa:zarafa:7.0 + cpe:/a:zarafa:zarafa:6.30.8 + cpe:/a:zarafa:zarafa:6.30.6 + cpe:/a:zarafa:zarafa:6.30.7 + cpe:/a:zarafa:zarafa:7.0.8 + cpe:/a:zarafa:zarafa:6.30.4 + cpe:/a:zarafa:zarafa:7.0.9 + cpe:/a:zarafa:zarafa:6.30.5 + cpe:/a:zarafa:zarafa:7.0.6 + cpe:/a:zarafa:zarafa:7.0.7 + cpe:/a:zarafa:zarafa:6.30.3 + cpe:/a:zarafa:zarafa:7.0.5 + cpe:/a:zarafa:zarafa:6.20.7 + cpe:/a:zarafa:zarafa:6.20.2 + cpe:/a:zarafa:zarafa:6.20.6 + cpe:/a:zarafa:zarafa:6.20.5 + cpe:/a:zarafa:zarafa:6.20.3 + cpe:/a:zarafa:zarafa:6.30.0 + cpe:/a:zarafa:zarafa:6.40.17 + cpe:/a:zarafa:zarafa:7.1.4 + cpe:/a:zarafa:zarafa:7.0.13 + cpe:/a:zarafa:zarafa:5.20 + cpe:/a:zarafa:zarafa:6.30.16 + cpe:/a:zarafa:zarafa:6.00 + cpe:/a:zarafa:zarafa:6.30.13 + cpe:/a:zarafa:zarafa:6.01 + cpe:/a:zarafa:zarafa:6.02 + cpe:/a:zarafa:zarafa:6.30.11 + cpe:/a:zarafa:zarafa:7.0.10 + cpe:/a:zarafa:zarafa:6.03 + cpe:/a:zarafa:zarafa:7.0.12 + cpe:/a:zarafa:zarafa:6.30.10 + cpe:/a:zarafa:zarafa:7.0.11 + cpe:/a:zarafa:zarafa:6.30.17 + cpe:/a:zarafa:zarafa:5.22 + cpe:/a:zarafa:zarafa:5.10 + cpe:/a:zarafa:zarafa:5.11 + cpe:/a:zarafa:zarafa:6.20.11 + cpe:/a:zarafa:zarafa:6.20.12 + cpe:/a:zarafa:zarafa:6.10 + cpe:/a:zarafa:zarafa:7.0.3 + cpe:/a:zarafa:zarafa:7.0.2 + cpe:/a:zarafa:zarafa:6.20.10 + cpe:/a:zarafa:zarafa:7.0.1 + cpe:/a:zarafa:zarafa:6.30.9 + cpe:/a:zarafa:zarafa:6.11 + cpe:/a:zarafa:zarafa:7.0.4 + cpe:/a:zarafa:zarafa:5.00 + cpe:/a:zarafa:zarafa:6.40.5 + cpe:/a:zarafa:zarafa:6.40.6 + cpe:/a:zarafa:zarafa:5.01 + cpe:/a:zarafa:zarafa:6.40.7 + cpe:/a:zarafa:zarafa:6.40.8 + cpe:/a:zarafa:zarafa:6.40.2 + cpe:/a:zarafa:zarafa:6.40.3 + cpe:/a:zarafa:zarafa:5.02 + cpe:/a:zarafa:zarafa:6.40.4 + cpe:/a:zarafa:zarafa:6.40.0 + cpe:/a:zarafa:zarafa:6.40.9 + cpe:/a:zarafa:zarafa:6.40.12 + cpe:/a:zarafa:zarafa:6.40.13 + cpe:/a:zarafa:zarafa:6.40.14 + cpe:/a:zarafa:zarafa:6.40.15 + cpe:/a:zarafa:zarafa:6.40.10 + cpe:/a:zarafa:zarafa:7.1.3 + cpe:/a:zarafa:zarafa:6.40.11 + cpe:/a:zarafa:zarafa:7.1.1 + cpe:/a:zarafa:zarafa:7.1.2 + cpe:/a:zarafa:zarafa:7.1.0 + cpe:/a:zarafa:zarafa:6.20 + cpe:/a:zarafa:zarafa:6.40.16 + + CVE-2014-0037 + 2014-04-28T10:09:06.080-04:00 + 2014-04-29T07:35:51.057-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-29T07:35:50.760-04:00 + + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1059903 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1056767 + + + MLIST + [oss-security] 20140131 Security Flaw CVE-2014-0037 + + + MANDRIVA + MDVSA-2014:044 + + The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 5.00 before 7.1.8 beta2 allows remote attackers to cause a denial of service (crash) via vectors related to "a NULL pointer of the username." + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:zarafa:zarafa:5.00 + cpe:/a:zarafa:zarafa:5.10 + cpe:/a:zarafa:zarafa:5.01 + cpe:/a:zarafa:zarafa:5.11 + cpe:/a:zarafa:zarafa:7.1.8 + cpe:/a:zarafa:zarafa:5.02 + cpe:/a:zarafa:zarafa:6.10 + cpe:/a:zarafa:zarafa:5.20 + cpe:/a:zarafa:zarafa:6.00 + cpe:/a:zarafa:zarafa:6.01 + cpe:/a:zarafa:zarafa:6.02 + cpe:/a:zarafa:zarafa:6.03 + cpe:/a:zarafa:zarafa:6.11 + cpe:/a:zarafa:zarafa:6.20 + cpe:/a:zarafa:zarafa:5.22 + + CVE-2014-0079 + 2014-04-28T10:09:06.157-04:00 + 2014-04-29T07:52:00.900-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-29T07:52:00.807-04:00 + + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1059903 + + + MANDRIVA + MDVSA-2014:044 + + The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 7.1.8, 6.20.0, and earlier, when using certain build conditions, allows remote attackers to cause a denial of service (crash) via vectors related to "a NULL pointer of the password." + + + + + + + + + cpe:/a:igor_sysoev:nginx:1.5.10 + + CVE-2014-0088 + 2014-04-29T10:38:49.920-04:00 + 2014-04-30T10:10:30.290-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-30T10:10:30.257-04:00 + + + + + MLIST + [nginx-announce] 20140304 nginx security advisory (CVE-2014-0088) + + + SECTRACK + 1030150 + + The SPDY implementation in the ngx_http_spdy_module module in nginx 1.5.10 before 1.5.11, when running on a 32-bit platform, allows remote attackers to execute arbitrary code via a crafted request. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apache:struts:2.3.14 + cpe:/a:apache:struts:2.3.15 + cpe:/a:apache:struts:2.3.12 + cpe:/a:apache:struts:2.3.14.1 + cpe:/a:apache:struts:2.3.14.2 + cpe:/a:apache:struts:2.3.16 + cpe:/a:apache:struts:2.3.14.3 + cpe:/a:apache:struts:2.3.7 + cpe:/a:apache:struts:2.3.8 + cpe:/a:apache:struts:2.0.14 + cpe:/a:apache:struts:2.3.15.1 + cpe:/a:apache:struts:2.0.13 + cpe:/a:apache:struts:2.3.15.2 + cpe:/a:apache:struts:2.0.12 + cpe:/a:apache:struts:2.0.11 + cpe:/a:apache:struts:2.0.10 + cpe:/a:apache:struts:2.0.0 + cpe:/a:apache:struts:2.3.4.1 + cpe:/a:apache:struts:2.0.1 + cpe:/a:apache:struts:2.0.6 + cpe:/a:apache:struts:2.0.7 + cpe:/a:apache:struts:2.0.8 + cpe:/a:apache:struts:2.0.9 + cpe:/a:apache:struts:2.0.2 + cpe:/a:apache:struts:2.0.3 + cpe:/a:apache:struts:2.0.4 + cpe:/a:apache:struts:2.0.5 + cpe:/a:apache:struts:2.1.1 + cpe:/a:apache:struts:2.1.2 + cpe:/a:apache:struts:2.1.3 + cpe:/a:apache:struts:2.1.4 + cpe:/a:apache:struts:2.1.5 + cpe:/a:apache:struts:2.1.6 + cpe:/a:apache:struts:2.1.8 + cpe:/a:apache:struts:2.2.1.1 + cpe:/a:apache:struts:2.1.0 + cpe:/a:apache:struts:2.1.8.1 + cpe:/a:apache:struts:2.0.11.2 + cpe:/a:apache:struts:2.0.11.1 + cpe:/a:apache:struts:2.2.3 + cpe:/a:apache:struts:2.2.1 + cpe:/a:apache:struts:2.2.3.1 + cpe:/a:apache:struts:2.3.4 + cpe:/a:apache:struts:2.3.15.3 + cpe:/a:apache:struts:2.3.3 + cpe:/a:apache:struts:2.3.1 + cpe:/a:apache:struts:2.3.16.1 + cpe:/a:apache:struts:2.3.1.2 + cpe:/a:apache:struts:2.3.1.1 + + CVE-2014-0112 + 2014-04-29T06:37:03.670-04:00 + 2014-04-29T09:59:24.903-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-29T09:59:24.420-04:00 + + + + + CONFIRM + https://cwiki.apache.org/confluence/display/WW/S2-021 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1091939 + + + JVNDB + JVNDB-2014-000045 + + + JVN + JVN#19294237 + + ParametersInterceptor in Apache Struts before 2.3.16.2 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apache:struts:2.3.14 + cpe:/a:apache:struts:2.3.15 + cpe:/a:apache:struts:2.3.12 + cpe:/a:apache:struts:2.3.14.1 + cpe:/a:apache:struts:2.3.14.2 + cpe:/a:apache:struts:2.3.16 + cpe:/a:apache:struts:2.3.14.3 + cpe:/a:apache:struts:2.3.7 + cpe:/a:apache:struts:2.3.8 + cpe:/a:apache:struts:2.0.14 + cpe:/a:apache:struts:2.3.15.1 + cpe:/a:apache:struts:2.0.13 + cpe:/a:apache:struts:2.3.15.2 + cpe:/a:apache:struts:2.0.12 + cpe:/a:apache:struts:2.0.11 + cpe:/a:apache:struts:2.0.10 + cpe:/a:apache:struts:2.0.0 + cpe:/a:apache:struts:2.3.4.1 + cpe:/a:apache:struts:2.0.1 + cpe:/a:apache:struts:2.0.6 + cpe:/a:apache:struts:2.0.7 + cpe:/a:apache:struts:2.0.8 + cpe:/a:apache:struts:2.0.9 + cpe:/a:apache:struts:2.0.2 + cpe:/a:apache:struts:2.0.3 + cpe:/a:apache:struts:2.0.4 + cpe:/a:apache:struts:2.0.5 + cpe:/a:apache:struts:2.1.1 + cpe:/a:apache:struts:2.1.2 + cpe:/a:apache:struts:2.1.3 + cpe:/a:apache:struts:2.1.4 + cpe:/a:apache:struts:2.1.5 + cpe:/a:apache:struts:2.1.6 + cpe:/a:apache:struts:2.1.8 + cpe:/a:apache:struts:2.2.1.1 + cpe:/a:apache:struts:2.1.0 + cpe:/a:apache:struts:2.1.8.1 + cpe:/a:apache:struts:2.0.11.2 + cpe:/a:apache:struts:2.0.11.1 + cpe:/a:apache:struts:2.2.3 + cpe:/a:apache:struts:2.2.1 + cpe:/a:apache:struts:2.2.3.1 + cpe:/a:apache:struts:2.3.4 + cpe:/a:apache:struts:2.3.15.3 + cpe:/a:apache:struts:2.3.3 + cpe:/a:apache:struts:2.3.1 + cpe:/a:apache:struts:2.3.16.1 + cpe:/a:apache:struts:2.3.1.2 + cpe:/a:apache:struts:2.3.1.1 + + CVE-2014-0113 + 2014-04-29T06:37:03.700-04:00 + 2014-04-29T09:59:31.653-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-29T09:59:30.983-04:00 + + + + + CONFIRM + https://cwiki.apache.org/confluence/display/WW/S2-021 + + CookieInterceptor in Apache Struts before 2.3.16.2, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094. + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:apache:struts:1.3.5 + cpe:/a:apache:struts:1.0 + cpe:/a:apache:struts:1.1:b3 + cpe:/a:apache:struts:1.1:b2 + cpe:/a:apache:struts:1.1 + cpe:/a:apache:struts:1.0.2 + cpe:/a:apache:struts:1.3.10 + cpe:/a:apache:struts:1.2.9 + cpe:/a:apache:struts:1.1:rc1 + cpe:/a:apache:struts:1.1:rc2 + cpe:/a:apache:struts:1.1:b1 + cpe:/a:apache:struts:1.2.2 + cpe:/a:apache:struts:1.3.8 + cpe:/a:apache:struts:1.2.4 + cpe:/a:apache:struts:1.2.6 + cpe:/a:apache:struts:1.2.7 + cpe:/a:apache:struts:1.2.8 + + CVE-2014-0114 + 2014-04-30T06:49:03.973-04:00 + 2014-04-30T10:28:16.450-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-30T10:28:16.280-04:00 + + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1091938 + + The ActionForm object in Apache Struts 1.x through 1.3.10 allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, which is passed to the getClass method. + + + + + + + + + + + + + cpe:/a:openstack:image_registry_and_delivery_service_%28glance%29:2013.2.1 + cpe:/a:openstack:image_registry_and_delivery_service_%28glance%29:2013.2.2 + cpe:/a:openstack:icehouse:rc-1 + cpe:/a:openstack:image_registry_and_delivery_service_%28glance%29:2013.2 + cpe:/a:openstack:image_registry_and_delivery_service_%28glance%29:2013.2.3 + + CVE-2014-0162 + 2014-04-27T16:55:23.667-04:00 + 2014-04-28T14:09:33.227-04:00 + + + 6.0 + NETWORK + MEDIUM + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-28T14:09:33.180-04:00 + + + + + CONFIRM + https://launchpad.net/bugs/1298698 + + + MLIST + [oss-security] 20140410 [OSSA 2014-012] Remote code execution in Glance Sheepdog backend (CVE-2014-0162) + + The Sheepdog backend in OpenStack Image Registry and Delivery Service (Glance) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote authenticated users with permission to insert or modify an image to execute arbitrary commands via a crafted location. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:linux:linux_kernel:3.0.48 + cpe:/o:linux:linux_kernel:3.0.49 + cpe:/o:linux:linux_kernel:3.0.46 + cpe:/o:linux:linux_kernel:3.0.47 + cpe:/o:linux:linux_kernel:3.0.44 + cpe:/o:linux:linux_kernel:3.0.45 + cpe:/o:linux:linux_kernel:3.0.42 + cpe:/o:linux:linux_kernel:3.4.70 + cpe:/o:linux:linux_kernel:3.4.71 + cpe:/o:linux:linux_kernel:3.0.40 + cpe:/o:linux:linux_kernel:3.0.41 + cpe:/o:linux:linux_kernel:3.4.45 + cpe:/o:linux:linux_kernel:3.4.44 + cpe:/o:linux:linux_kernel:3.4.46 + cpe:/o:linux:linux_kernel:3.4.41 + cpe:/o:linux:linux_kernel:3.4.40 + cpe:/o:linux:linux_kernel:3.4.43 + cpe:/o:linux:linux_kernel:3.4.42 + cpe:/o:linux:linux_kernel:3.4.49 + cpe:/o:linux:linux_kernel:3.4.48 + cpe:/o:linux:linux_kernel:3.0.59 + cpe:/o:linux:linux_kernel:3.4.47 + cpe:/o:linux:linux_kernel:3.0.55 + cpe:/o:linux:linux_kernel:3.0.56 + cpe:/o:linux:linux_kernel:3.0.57 + cpe:/o:linux:linux_kernel:3.0.58 + cpe:/o:linux:linux_kernel:3.0.51 + cpe:/o:linux:linux_kernel:3.0.52 + cpe:/o:linux:linux_kernel:3.0.53 + cpe:/o:linux:linux_kernel:3.11.10 + cpe:/o:linux:linux_kernel:3.0.50 + cpe:/o:linux:linux_kernel:3.4.57 + cpe:/o:linux:linux_kernel:3.4.56 + cpe:/o:linux:linux_kernel:3.4.55 + cpe:/o:linux:linux_kernel:3.4.54 + cpe:/o:linux:linux_kernel:3.4.53 + cpe:/o:linux:linux_kernel:3.4.52 + cpe:/o:linux:linux_kernel:3.4.51 + cpe:/o:linux:linux_kernel:3.4.50 + cpe:/o:linux:linux_kernel:3.0.43 + cpe:/o:linux:linux_kernel:3.10.26 + cpe:/o:linux:linux_kernel:3.4.59 + cpe:/o:linux:linux_kernel:3.0.24 + cpe:/o:linux:linux_kernel:3.0.25 + cpe:/o:linux:linux_kernel:3.0.22 + cpe:/o:linux:linux_kernel:3.1.9 + cpe:/o:linux:linux_kernel:3.0.23 + cpe:/o:linux:linux_kernel:3.10.28 + cpe:/o:linux:linux_kernel:3.0.28 + cpe:/o:linux:linux_kernel:3.10.27 + cpe:/o:linux:linux_kernel:3.0.26 + cpe:/o:linux:linux_kernel:3.10.29 + cpe:/o:linux:linux_kernel:3.4.58 + cpe:/o:linux:linux_kernel:3.0.27 + cpe:/o:linux:linux_kernel:3.10.24 + cpe:/o:linux:linux_kernel:3.10.23 + cpe:/o:linux:linux_kernel:3.10.25 + cpe:/o:linux:linux_kernel:3.10.20 + cpe:/o:linux:linux_kernel:3.1.8 + cpe:/o:linux:linux_kernel:3.0.20 + cpe:/o:linux:linux_kernel:3.10.22 + cpe:/o:linux:linux_kernel:3.10.21 + cpe:/o:linux:linux_kernel:3.4.21 + cpe:/o:linux:linux_kernel:3.4.20 + cpe:/o:linux:linux_kernel:3.4.23 + cpe:/o:linux:linux_kernel:3.4.22 + cpe:/o:linux:linux_kernel:3.4.24 + cpe:/o:linux:linux_kernel:3.4.27 + cpe:/o:linux:linux_kernel:3.4.26 + cpe:/o:linux:linux_kernel:3.4.29 + cpe:/o:linux:linux_kernel:3.10.15 + cpe:/o:linux:linux_kernel:3.4.28 + cpe:/o:linux:linux_kernel:3.0.54 + cpe:/o:linux:linux_kernel:3.0.33 + cpe:/o:linux:linux_kernel:3.0.34 + cpe:/o:linux:linux_kernel:3.0.35 + cpe:/o:linux:linux_kernel:3.0.36 + cpe:/o:linux:linux_kernel:3.10.19 + cpe:/o:linux:linux_kernel:3.0.37 + cpe:/o:linux:linux_kernel:3.10.18 + cpe:/o:linux:linux_kernel:3.0.38 + cpe:/o:linux:linux_kernel:3.4.25 + cpe:/o:linux:linux_kernel:3.10.17 + cpe:/o:linux:linux_kernel:3.0.39 + cpe:/o:linux:linux_kernel:3.10.16 + cpe:/o:linux:linux_kernel:3.10.14 + cpe:/o:linux:linux_kernel:3.10.13 + cpe:/o:linux:linux_kernel:3.10.12 + cpe:/o:linux:linux_kernel:3.10.11 + cpe:/o:linux:linux_kernel:3.10.10 + cpe:/o:linux:linux_kernel:3.0.30 + cpe:/o:linux:linux_kernel:3.0.31 + cpe:/o:linux:linux_kernel:3.9.8 + cpe:/o:linux:linux_kernel:3.5.5 + cpe:/o:linux:linux_kernel:3.4.32 + cpe:/o:linux:linux_kernel:3.9.9 + cpe:/o:linux:linux_kernel:3.5.6 + cpe:/o:linux:linux_kernel:3.4.31 + cpe:/o:linux:linux_kernel:3.5.7 + cpe:/o:linux:linux_kernel:3.4.30 + cpe:/o:linux:linux_kernel:3.7.1 + cpe:/o:linux:linux_kernel:3.4.35 + cpe:/o:linux:linux_kernel:3.9.0 + cpe:/o:linux:linux_kernel:3.0.18 + cpe:/o:linux:linux_kernel:3.4.34 + cpe:/o:linux:linux_kernel:3.4.33 + cpe:/o:linux:linux_kernel:3.9.2 + cpe:/o:linux:linux_kernel:3.9.1 + cpe:/o:linux:linux_kernel:3.0.19 + cpe:/o:linux:linux_kernel:3.4.39 + cpe:/o:linux:linux_kernel:3.9.4 + cpe:/o:linux:linux_kernel:3.4.38 + cpe:/o:linux:linux_kernel:3.9.3 + cpe:/o:linux:linux_kernel:3.4.37 + cpe:/o:linux:linux_kernel:3.9.6 + cpe:/o:linux:linux_kernel:3.9.5 + cpe:/o:linux:linux_kernel:3.0.21 + cpe:/o:linux:linux_kernel:3.9.7 + cpe:/o:linux:linux_kernel:3.5.4 + cpe:/o:linux:linux_kernel:3.0.4 + cpe:/o:linux:linux_kernel:3.0.5 + cpe:/o:linux:linux_kernel:3.0.2 + cpe:/o:linux:linux_kernel:3.0.3 + cpe:/o:linux:linux_kernel:3.0.8 + cpe:/o:linux:linux_kernel:3.0.6 + cpe:/o:linux:linux_kernel:3.0.7 + cpe:/o:linux:linux_kernel:3.13.9 + cpe:/o:linux:linux_kernel:3.4.36 + cpe:/o:linux:linux_kernel:3.12.17 + cpe:/o:linux:linux_kernel:3.13.1 + cpe:/o:linux:linux_kernel:3.6.10 + cpe:/o:linux:linux_kernel:3.6.11 + cpe:/o:linux:linux_kernel:3.13.8 + cpe:/o:linux:linux_kernel:3.13.6 + cpe:/o:linux:linux_kernel:3.13.7 + cpe:/o:linux:linux_kernel:3.13.4 + cpe:/o:linux:linux_kernel:3.13.5 + cpe:/o:linux:linux_kernel:3.13.2 + cpe:/o:linux:linux_kernel:3.13.3 + cpe:/o:linux:linux_kernel:3.4.1 + cpe:/o:linux:linux_kernel:3.4.19 + cpe:/o:linux:linux_kernel:3.4.17 + cpe:/o:linux:linux_kernel:3.4.3 + cpe:/o:linux:linux_kernel:3.4.18 + cpe:/o:linux:linux_kernel:3.4.2 + cpe:/o:linux:linux_kernel:3.2.9 + cpe:/o:linux:linux_kernel:3.4.15 + cpe:/o:linux:linux_kernel:3.2.8 + cpe:/o:linux:linux_kernel:3.4.16 + cpe:/o:linux:linux_kernel:3.4.4 + cpe:/o:linux:linux_kernel:3.12.12 + cpe:/o:linux:linux_kernel:3.2.7 + cpe:/o:linux:linux_kernel:3.4.13 + cpe:/o:linux:linux_kernel:3.12.13 + cpe:/o:linux:linux_kernel:3.12.10 + cpe:/o:linux:linux_kernel:3.4.11 + cpe:/o:linux:linux_kernel:3.12.11 + cpe:/o:linux:linux_kernel:3.4.12 + cpe:/o:linux:linux_kernel:3.12.16 + cpe:/o:linux:linux_kernel:3.4.10 + cpe:/o:linux:linux_kernel:3.12.14 + cpe:/o:linux:linux_kernel:3.12.15 + cpe:/o:linux:linux_kernel:3.0.61 + cpe:/o:linux:linux_kernel:3.3:rc2 + cpe:/o:linux:linux_kernel:3.4:rc7 + cpe:/o:linux:linux_kernel:3.0.60 + cpe:/o:linux:linux_kernel:3.3:rc7 + cpe:/o:linux:linux_kernel:3.4:rc5 + cpe:/o:linux:linux_kernel:3.3:rc5 + cpe:/o:linux:linux_kernel:3.4:rc6 + cpe:/o:linux:linux_kernel:3.3:rc6 + cpe:/o:linux:linux_kernel:3.0.64 + cpe:/o:linux:linux_kernel:3.0.63 + cpe:/o:linux:linux_kernel:3.0.62 + cpe:/o:linux:linux_kernel:3.12.1 + cpe:/o:linux:linux_kernel:3.0.68 + cpe:/o:linux:linux_kernel:3.0.67 + cpe:/o:linux:linux_kernel:3.0.66 + cpe:/o:linux:linux_kernel:3.4.14 + cpe:/o:linux:linux_kernel:3.12.7 + cpe:/o:linux:linux_kernel:3.2:rc2 + cpe:/o:linux:linux_kernel:3.1:rc1 + cpe:/o:linux:linux_kernel:3.0.9 + cpe:/o:linux:linux_kernel:3.0:rc4 + cpe:/o:linux:linux_kernel:3.12.8 + cpe:/o:linux:linux_kernel:3.1:rc4 + cpe:/o:linux:linux_kernel:3.0:rc3 + cpe:/o:linux:linux_kernel:3.12.9 + cpe:/o:linux:linux_kernel:3.0:rc2 + cpe:/o:linux:linux_kernel:3.1:rc2 + cpe:/o:linux:linux_kernel:3.0:rc1 + cpe:/o:linux:linux_kernel:3.2:rc7 + cpe:/o:linux:linux_kernel:3.12.3 + cpe:/o:linux:linux_kernel:3.1.10 + cpe:/o:linux:linux_kernel:3.2:rc6 + cpe:/o:linux:linux_kernel:3.12.4 + cpe:/o:linux:linux_kernel:3.2:rc5 + cpe:/o:linux:linux_kernel:3.0:rc7 + cpe:/o:linux:linux_kernel:3.12.5 + cpe:/o:linux:linux_kernel:3.9:rc3 + cpe:/o:linux:linux_kernel:3.0:rc6 + cpe:/o:linux:linux_kernel:3.12.6 + cpe:/o:linux:linux_kernel:3.0:rc5 + cpe:/o:linux:linux_kernel:3.9:rc1 + cpe:/o:linux:linux_kernel:3.9:rc4 + cpe:/o:linux:linux_kernel:3.9:rc7 + cpe:/o:linux:linux_kernel:3.12.2 + cpe:/o:linux:linux_kernel:3.9:rc2 + cpe:/o:linux:linux_kernel:3.9:rc5 + cpe:/o:linux:linux_kernel:3.3:rc3 + cpe:/o:linux:linux_kernel:3.4:rc4 + cpe:/o:linux:linux_kernel:3.4:rc3 + cpe:/o:linux:linux_kernel:3.3:rc1 + cpe:/o:linux:linux_kernel:3.4:rc2 + cpe:/o:linux:linux_kernel:3.9:rc6 + cpe:/o:linux:linux_kernel:3.3:rc4 + cpe:/o:linux:linux_kernel:3.4:rc1 + cpe:/o:linux:linux_kernel:3.4.5 + cpe:/o:linux:linux_kernel:3.2.2 + cpe:/o:linux:linux_kernel:3.2.3 + cpe:/o:linux:linux_kernel:3.2.1 + cpe:/o:linux:linux_kernel:3.4.6 + cpe:/o:linux:linux_kernel:3.2:rc3 + cpe:/o:linux:linux_kernel:3.2.6 + cpe:/o:linux:linux_kernel:3.4.7 + cpe:/o:linux:linux_kernel:3.2:rc4 + cpe:/o:linux:linux_kernel:3.1:rc3 + cpe:/o:linux:linux_kernel:3.4.8 + cpe:/o:linux:linux_kernel:3.2.4 + cpe:/o:linux:linux_kernel:3.4.9 + cpe:/o:linux:linux_kernel:3.2.5 + cpe:/o:linux:linux_kernel:3.0.65 + cpe:/o:linux:linux_kernel:3.2.12 + cpe:/o:linux:linux_kernel:3.8.10 + cpe:/o:linux:linux_kernel:3.8.12 + cpe:/o:linux:linux_kernel:3.8.11 + cpe:/o:linux:linux_kernel:3.8.13 + cpe:/o:linux:linux_kernel:3.7.9 + cpe:/o:linux:linux_kernel:3.7.8 + cpe:/o:linux:linux_kernel:3.7.7 + cpe:/o:linux:linux_kernel:3.7.6 + cpe:/o:linux:linux_kernel:3.6.3 + cpe:/o:linux:linux_kernel:3.7.5 + cpe:/o:linux:linux_kernel:3.7.4 + cpe:/o:linux:linux_kernel:3.7.3 + cpe:/o:linux:linux_kernel:3.7.2 + cpe:/o:linux:linux_kernel:3.6.7 + cpe:/o:linux:linux_kernel:3.6.6 + cpe:/o:linux:linux_kernel:3.6.5 + cpe:/o:linux:linux_kernel:3.6.4 + cpe:/o:linux:linux_kernel:3.6.9 + cpe:/o:linux:linux_kernel:3.6.8 + cpe:/o:linux:linux_kernel:3.10 + cpe:/o:linux:linux_kernel:3.11 + cpe:/o:linux:linux_kernel:3.12 + cpe:/o:linux:linux_kernel:3.13 + cpe:/o:linux:linux_kernel:3.10.1 + cpe:/o:linux:linux_kernel:3.10.2 + cpe:/o:linux:linux_kernel:3.10.3 + cpe:/o:linux:linux_kernel:3.6.2 + cpe:/o:linux:linux_kernel:3.6.1 + cpe:/o:linux:linux_kernel:3.3.6 + cpe:/o:linux:linux_kernel:3.3.7 + cpe:/o:linux:linux_kernel:3.3.8 + cpe:/o:linux:linux_kernel:3.0.1 + cpe:/o:linux:linux_kernel:3.2 + cpe:/o:linux:linux_kernel:3.1 + cpe:/o:linux:linux_kernel:3.7 + cpe:/o:linux:linux_kernel:3.6 + cpe:/o:linux:linux_kernel:3.4 + cpe:/o:linux:linux_kernel:3.1.6 + cpe:/o:linux:linux_kernel:3.1.5 + cpe:/o:linux:linux_kernel:3.1.7 + cpe:/o:linux:linux_kernel:3.0.32 + cpe:/o:linux:linux_kernel:3.8.9 + cpe:/o:linux:linux_kernel:3.1.2 + cpe:/o:linux:linux_kernel:3.1.1 + cpe:/o:linux:linux_kernel:3.1.4 + cpe:/o:linux:linux_kernel:3.1.3 + cpe:/o:linux:linux_kernel:3.9.10 + cpe:/o:linux:linux_kernel:3.0.29 + cpe:/o:linux:linux_kernel:3.3 + cpe:/o:linux:linux_kernel:3.8.4 + cpe:/o:linux:linux_kernel:3.2.26 + cpe:/o:linux:linux_kernel:3.8.5 + cpe:/o:linux:linux_kernel:3.2.27 + cpe:/o:linux:linux_kernel:3.8.2 + cpe:/o:linux:linux_kernel:3.2.24 + cpe:/o:linux:linux_kernel:3.8.3 + cpe:/o:linux:linux_kernel:3.2.25 + cpe:/o:linux:linux_kernel:3.8.8 + cpe:/o:linux:linux_kernel:3.8.6 + cpe:/o:linux:linux_kernel:3.2.28 + cpe:/o:linux:linux_kernel:3.8.7 + cpe:/o:linux:linux_kernel:3.2.29 + cpe:/o:linux:linux_kernel:3.3.3 + cpe:/o:linux:linux_kernel:3.3.4 + cpe:/o:linux:linux_kernel:3.3.5 + cpe:/o:linux:linux_kernel:3.2.22 + cpe:/o:linux:linux_kernel:3.8.1 + cpe:/o:linux:linux_kernel:3.2.20 + cpe:/o:linux:linux_kernel:3.3.1 + cpe:/o:linux:linux_kernel:3.2.21 + cpe:/o:linux:linux_kernel:3.3.2 + cpe:/o:linux:linux_kernel:3.11.1 + cpe:/o:linux:linux_kernel:3.11.2 + cpe:/o:linux:linux_kernel:3.2.23 + cpe:/o:linux:linux_kernel:3.0.17 + cpe:/o:linux:linux_kernel:3.9.11 + cpe:/o:linux:linux_kernel:3.0.16 + cpe:/o:linux:linux_kernel:3.0.15 + cpe:/o:linux:linux_kernel:3.2.30 + cpe:/o:linux:linux_kernel:3.0.14 + cpe:/o:linux:linux_kernel:3.0.13 + cpe:/o:linux:linux_kernel:3.0.12 + cpe:/o:linux:linux_kernel:3.0.11 + cpe:/o:linux:linux_kernel:3.4.61 + cpe:/o:linux:linux_kernel:3.0.10 + cpe:/o:linux:linux_kernel:3.4.64 + cpe:/o:linux:linux_kernel:3.8.0 + cpe:/o:linux:linux_kernel:3.4.65 + cpe:/o:linux:linux_kernel:3.4.62 + cpe:/o:linux:linux_kernel:3.4.63 + cpe:/o:linux:linux_kernel:3.4.68 + cpe:/o:linux:linux_kernel:3.4.66 + cpe:/o:linux:linux_kernel:3.4.67 + cpe:/o:linux:linux_kernel:3.5.3 + cpe:/o:linux:linux_kernel:3.5.1 + cpe:/o:linux:linux_kernel:3.5.2 + cpe:/o:linux:linux_kernel:3.10.4 + cpe:/o:linux:linux_kernel:3.14.1 + cpe:/o:linux:linux_kernel:3.4.72 + cpe:/o:linux:linux_kernel:3.10.9 + cpe:/o:linux:linux_kernel:3.4.73 + cpe:/o:linux:linux_kernel:3.4.74 + cpe:/o:linux:linux_kernel:3.4.75 + cpe:/o:linux:linux_kernel:3.4.76 + cpe:/o:linux:linux_kernel:3.10.5 + cpe:/o:linux:linux_kernel:3.4.77 + cpe:/o:linux:linux_kernel:3.10.6 + cpe:/o:linux:linux_kernel:3.4.78 + cpe:/o:linux:linux_kernel:3.10.7 + cpe:/o:linux:linux_kernel:3.4.79 + cpe:/o:linux:linux_kernel:3.10.8 + cpe:/o:linux:linux_kernel:3.7.10 + cpe:/o:linux:linux_kernel:3.2.17 + cpe:/o:linux:linux_kernel:3.2.18 + cpe:/o:linux:linux_kernel:3.2.19 + cpe:/o:linux:linux_kernel:3.2.13 + cpe:/o:linux:linux_kernel:3.2.14 + cpe:/o:linux:linux_kernel:3.11.3 + cpe:/o:linux:linux_kernel:3.2.15 + cpe:/o:linux:linux_kernel:3.4.60 + cpe:/o:linux:linux_kernel:3.2.16 + cpe:/o:linux:linux_kernel:3.11.5 + cpe:/o:linux:linux_kernel:3.11.4 + cpe:/o:linux:linux_kernel:3.2.10 + cpe:/o:linux:linux_kernel:3.11.7 + cpe:/o:linux:linux_kernel:3.2.11 + cpe:/o:linux:linux_kernel:3.11.6 + cpe:/o:linux:linux_kernel:3.11.9 + cpe:/o:linux:linux_kernel:3.11.8 + cpe:/o:linux:linux_kernel:3.4.69 + + CVE-2014-0181 + 2014-04-26T20:55:05.750-04:00 + 2014-04-28T11:50:11.293-04:00 + + + 2.1 + LOCAL + LOW + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-28T11:50:05.183-04:00 + + + + + CONFIRM + https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=90f62cf30a78721641e08737bda787552428061e + + + MLIST + [oss-security] 20140423 Re: CVE-2014-0181: Linux network reconfiguration due to incorrect netlink checks + + + MLIST + [netdev] 20140423 [PATCH 0/5]: Preventing abuse when passing file descriptors + + The Netlink implementation in the Linux kernel through 3.14.1 does not provide a mechanism for authorizing socket operations based on the opener of a socket, which allows local users to bypass intended access restrictions and modify network configurations by using a Netlink socket for the (1) stdout or (2) stderr of a setuid program. + + + + + + + + + + + + + + + + + + + cpe:/a:openstack:neutron:2013.2.3 + cpe:/a:openstack:neutron:2013.1.1 + cpe:/a:openstack:neutron:2013.2.2 + cpe:/a:openstack:neutron:2013.1.2 + cpe:/a:openstack:neutron:2013.2 + cpe:/a:openstack:neutron:2013.1 + cpe:/a:openstack:neutron:2013.1.4 + cpe:/a:openstack:neutron:2013.2.1 + cpe:/a:openstack:neutron:2013.1.3 + cpe:/a:openstack:neutron:2013.1.5 + cpe:/a:openstack:neutron:2014.1 + + CVE-2014-0187 + 2014-04-28T10:09:06.237-04:00 + 2014-04-29T10:26:22.943-04:00 + + + 9.0 + NETWORK + LOW + SINGLE_INSTANCE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-29T10:26:22.817-04:00 + + + + + CONFIRM + https://bugs.launchpad.net/neutron/+bug/1300785 + + + MLIST + [oss-security] 20140422 [OSSA 2014-014] Neutron security groups bypass through invalid CIDR (CVE-2014-0187) + + The openvswitch-agent process in OpenStack Neutron 2013.1 before 2013.2.4 and 2014.1 before 2014.1.1 allows remote authenticated users to bypass security group restrictions via an invalid CIDR in a security group rule, which prevents further rules from being applied. + + + CVE-2014-0189 + 2014-05-02T10:55:05.823-04:00 + 2014-05-02T10:55:05.823-04:00 + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1088732 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1081286 + + + BID + 67089 + + + MLIST + [oss-security] 20140428 CVE-2014-0189: /etc/sysconfig/virt-who is world-readable (contains unencrypted passwords) + + virt-who uses world-readable permissions for /etc/sysconfig/virt-who, which allows local users to obtain password for hypervisors by reading the file. + + + + + + + + + + + + + cpe:/a:pocoproject:poco_c%2b%2b_libraries:1.4.6:p2 + cpe:/a:pocoproject:poco_c%2b%2b_libraries:1.4.6:p1 + cpe:/a:pocoproject:poco_c%2b%2b_libraries:1.4.6:p3 + cpe:/a:pocoproject:poco_c%2b%2b_libraries:1.4.6:- + cpe:/a:pocoproject:poco_c%2b%2b_libraries:1.4.5 + + CVE-2014-0350 + 2014-04-25T21:55:04.967-04:00 + 2014-04-28T09:03:33.290-04:00 + + + 6.4 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-28T09:03:33.243-04:00 + + + + + CERT-VN + VU#118748 + + + CONFIRM + https://raw.githubusercontent.com/pocoproject/poco/poco-1.4.6p4-release/CHANGELOG + + The Poco::Net::X509Certificate::verify method in the NetSSL library in POCO C++ Libraries before 1.4.6p4 allows man-in-the-middle attackers to spoof SSL servers via crafted DNS PTR records that are requested during comparison of a server name to a wildcard domain name in an X.509 certificate. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-02-20 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-02 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-02-21 + cpe:/a:igniterealtime:smack:3.4.0 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-04-15 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-04-13 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-02-23 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-02-19 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-03 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-16 + cpe:/a:igniterealtime:smack:2.2.1 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-18 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-13 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-04-06 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-04-09 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-29 + cpe:/a:igniterealtime:smack:3.0.0 + cpe:/a:igniterealtime:smack:3.1.0 + cpe:/a:igniterealtime:smack:2.2.0 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-21 + cpe:/a:igniterealtime:smack:3.0.3 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-25 + cpe:/a:igniterealtime:smack:3.0.2 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-26 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-02-18 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-11 + cpe:/a:igniterealtime:smack:3.3.1 + cpe:/a:igniterealtime:smack:3.0.1 + cpe:/a:igniterealtime:smack:3.3.0 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-10 + cpe:/a:igniterealtime:smack:3.2.2 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-12 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-02-16 + cpe:/a:igniterealtime:smack:3.2.0 + cpe:/a:igniterealtime:smack:3.2.1 + + CVE-2014-0363 + 2014-04-30T06:49:04.490-04:00 + 2014-04-30T10:47:23.507-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-30T10:47:22.397-04:00 + + + + CERT-VN + VU#489228 + + + CONFIRM + http://issues.igniterealtime.org/browse/SMACK-410 + + + CONFIRM + http://community.igniterealtime.org/blogs/ignite/2014/04/17/asmack-400-rc1-has-been-released + + The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate chain. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-02-20 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-02 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-02-21 + cpe:/a:igniterealtime:smack:3.4.0 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-04-15 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-04-13 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-02-23 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-02-19 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-03 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-16 + cpe:/a:igniterealtime:smack:2.2.1 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-18 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-13 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-04-06 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-04-09 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-29 + cpe:/a:igniterealtime:smack:3.0.0 + cpe:/a:igniterealtime:smack:3.1.0 + cpe:/a:igniterealtime:smack:2.2.0 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-21 + cpe:/a:igniterealtime:smack:3.0.3 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-25 + cpe:/a:igniterealtime:smack:3.0.2 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-26 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-02-18 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-11 + cpe:/a:igniterealtime:smack:3.3.1 + cpe:/a:igniterealtime:smack:3.0.1 + cpe:/a:igniterealtime:smack:3.3.0 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-10 + cpe:/a:igniterealtime:smack:3.2.2 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-12 + cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-02-16 + cpe:/a:igniterealtime:smack:3.2.0 + cpe:/a:igniterealtime:smack:3.2.1 + + CVE-2014-0364 + 2014-04-30T06:49:04.520-04:00 + 2014-04-30T11:07:13.453-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-30T11:07:13.203-04:00 + + + + CERT-VN + VU#489228 + + + CONFIRM + http://community.igniterealtime.org/blogs/ignite/2014/04/17/asmack-400-rc1-has-been-released + + The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to spoof IQ responses via a crafted attribute. + + + + + + + + + cpe:/a:super_project:super:3.30.0 + + CVE-2014-0470 + 2014-04-30T10:22:06.110-04:00 + 2014-04-30T15:20:24.450-04:00 + + + 7.2 + LOCAL + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-30T15:20:24.403-04:00 + + + ALLOWS_ADMIN_ACCESS + + + MLIST + [oss-security] 20140428 super unchecked setuid (CVE-2014-0470) + + + DEBIAN + DSA-2917 + + super.c in Super 3.30.0 does not check the return value of the setuid function when the -F flag is set, which allows local users to gain privileges via unspecified vectors, aka an RLIMIT_NPROC attack. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:debian:dpkg:1.14.3 + cpe:/a:debian:dpkg:1.14.2 + cpe:/a:debian:dpkg:1.9.10 + cpe:/a:debian:dpkg:1.14.1 + cpe:/a:debian:dpkg:1.14.0 + cpe:/a:debian:dpkg:1.9.19 + cpe:/a:debian:dpkg:1.14.5 + cpe:/a:debian:dpkg:1.14.4 + cpe:/a:debian:dpkg:1.9.18 + cpe:/a:debian:dpkg:1.13.6 + cpe:/a:debian:dpkg:1.9.17 + cpe:/a:debian:dpkg:1.13.5 + cpe:/a:debian:dpkg:1.13.4 + cpe:/a:debian:dpkg:1.13.3 + cpe:/a:debian:dpkg:1.13.2 + cpe:/a:debian:dpkg:1.13.1 + cpe:/a:debian:dpkg:1.17.3 + cpe:/a:debian:dpkg:1.17.4 + cpe:/a:debian:dpkg:1.15.5.6 + cpe:/a:debian:dpkg:1.9.15 + cpe:/a:debian:dpkg:1.9.16 + cpe:/a:debian:dpkg:1.15.8.2 + cpe:/a:debian:dpkg:1.10.8 + cpe:/a:debian:dpkg:1.15.8.1 + cpe:/a:debian:dpkg:1.10.9 + cpe:/a:debian:dpkg:1.17.7 + cpe:/a:debian:dpkg:1.9.11 + cpe:/a:debian:dpkg:1.10.6 + cpe:/a:debian:dpkg:1.9.12 + cpe:/a:debian:dpkg:1.10.7 + cpe:/a:debian:dpkg:1.17.5 + cpe:/a:debian:dpkg:1.9.13 + cpe:/a:debian:dpkg:1.10.4 + cpe:/a:debian:dpkg:1.17.6 + cpe:/a:debian:dpkg:1.9.14 + cpe:/a:debian:dpkg:1.10.5 + cpe:/a:debian:dpkg:1.17.2 + cpe:/a:debian:dpkg:1.9.21 + cpe:/a:debian:dpkg:1.17.1 + cpe:/a:debian:dpkg:1.9.20 + cpe:/a:debian:dpkg:1.15.5.1 + cpe:/a:debian:dpkg:1.15.5.2 + cpe:/a:debian:dpkg:1.10.3 + cpe:/a:debian:dpkg:1.15.5.3 + cpe:/a:debian:dpkg:1.10.2 + cpe:/a:debian:dpkg:1.15.5.4 + cpe:/a:debian:dpkg:1.15.5.5 + cpe:/a:debian:dpkg:1.17.0 + cpe:/a:debian:dpkg:1.15.8.3 + cpe:/a:debian:dpkg:1.15.8.4 + cpe:/a:debian:dpkg:1.15.4.1 + cpe:/a:debian:dpkg:1.15.8.9 + cpe:/a:debian:dpkg:1.13.0 + cpe:/a:debian:dpkg:1.15.8.6 + cpe:/a:debian:dpkg:1.13.9 + cpe:/a:debian:dpkg:1.15.8.5 + cpe:/a:debian:dpkg:1.15.8.8 + cpe:/a:debian:dpkg:1.14.6 + cpe:/a:debian:dpkg:1.15.8.7 + cpe:/a:debian:dpkg:1.14.7 + cpe:/a:debian:dpkg:1.14.8 + cpe:/a:debian:dpkg:1.14.9 + cpe:/a:debian:dpkg:1.13.7 + cpe:/a:debian:dpkg:1.13.8 + cpe:/a:debian:dpkg:1.16.4.2 + cpe:/a:debian:dpkg:1.16.4.3 + cpe:/a:debian:dpkg:1.16.4.1 + cpe:/o:canonical:ubuntu_linux:10.04:-:lts + cpe:/a:debian:dpkg:1.14.21 + cpe:/a:debian:dpkg:1.14.20 + cpe:/a:debian:dpkg:1.14.23 + cpe:/a:debian:dpkg:1.14.22 + cpe:/a:debian:dpkg:1.13.11 + cpe:/a:debian:dpkg:1.14.16.1 + cpe:/a:debian:dpkg:1.13.10 + cpe:/a:debian:dpkg:1.14.16.2 + cpe:/o:canonical:ubuntu_linux:12.10 + cpe:/a:debian:dpkg:1.14.16.4 + cpe:/a:debian:dpkg:1.14.16.3 + cpe:/a:debian:dpkg:1.10 + cpe:/a:debian:dpkg:1.14.16.6 + cpe:/a:debian:dpkg:1.14.16.5 + cpe:/a:debian:dpkg:1.10.27 + cpe:/a:debian:dpkg:1.10.26 + cpe:/a:debian:dpkg:1.14.14 + cpe:/a:debian:dpkg:1.14.13 + cpe:/a:debian:dpkg:1.10.23 + cpe:/a:debian:dpkg:1.10.22 + cpe:/a:debian:dpkg:1.10.25 + cpe:/a:debian:dpkg:1.10.24 + cpe:/a:debian:dpkg:1.10.28 + cpe:/a:debian:dpkg:1.9.1 + cpe:/a:debian:dpkg:1.14.19 + cpe:/a:debian:dpkg:1.16.0.1 + cpe:/o:canonical:ubuntu_linux:12.04:-:lts + cpe:/a:debian:dpkg:1.10.20 + cpe:/a:debian:dpkg:1.10.21 + cpe:/a:debian:dpkg:1.14.15 + cpe:/a:debian:dpkg:1.14.16 + cpe:/a:debian:dpkg:1.14.17 + cpe:/a:debian:dpkg:1.14.18 + cpe:/a:debian:dpkg:1.14.25 + cpe:/a:debian:dpkg:1.14.24 + cpe:/a:debian:dpkg:1.10.16 + cpe:/a:debian:dpkg:1.10.15 + cpe:/a:debian:dpkg:1.16.1.2 + cpe:/a:debian:dpkg:1.10.14 + cpe:/a:debian:dpkg:1.16.1.1 + cpe:/a:debian:dpkg:1.10.13 + cpe:/a:debian:dpkg:1.10.12 + cpe:/a:debian:dpkg:1.10.11 + cpe:/a:debian:dpkg:1.16.0.3 + cpe:/a:debian:dpkg:1.16.0.2 + cpe:/a:debian:dpkg:1.13.13 + cpe:/a:debian:dpkg:1.13.12 + cpe:/a:debian:dpkg:1.13.11.1 + cpe:/a:debian:dpkg:1.13.18 + cpe:/a:debian:dpkg:1.10.17 + cpe:/a:debian:dpkg:1.13.19 + cpe:/a:debian:dpkg:1.10.18 + cpe:/a:debian:dpkg:1.14.11 + cpe:/a:debian:dpkg:1.14.12 + cpe:/a:debian:dpkg:1.13.14 + cpe:/a:debian:dpkg:1.13.15 + cpe:/a:debian:dpkg:1.14.10 + cpe:/a:debian:dpkg:1.13.16 + cpe:/a:debian:dpkg:1.13.17 + cpe:/a:debian:dpkg:1.14.28 + cpe:/a:debian:dpkg:1.14.29 + cpe:/a:debian:dpkg:1.10.19 + cpe:/a:debian:dpkg:1.14.26 + cpe:/a:debian:dpkg:1.14.27 + cpe:/a:debian:dpkg:1.16.3 + cpe:/a:debian:dpkg:1.16.2 + cpe:/a:debian:dpkg:1.9.2 + cpe:/a:debian:dpkg:1.15.6.1 + cpe:/a:debian:dpkg:1.9.3 + cpe:/a:debian:dpkg:1.16.1 + cpe:/a:debian:dpkg:1.16.0 + cpe:/a:debian:dpkg:1.16.11 + cpe:/a:debian:dpkg:1.15.7.2 + cpe:/a:debian:dpkg:1.15.0 + cpe:/a:debian:dpkg:1.16.12 + cpe:/a:debian:dpkg:1.15.2 + cpe:/a:debian:dpkg:1.16.10 + cpe:/a:debian:dpkg:1.15.1 + cpe:/a:debian:dpkg:1.15.4 + cpe:/a:debian:dpkg:1.13.24 + cpe:/a:debian:dpkg:1.15.3 + cpe:/a:debian:dpkg:1.13.23 + cpe:/a:debian:dpkg:1.15.7.1 + cpe:/a:debian:dpkg:1.13.25 + cpe:/o:canonical:ubuntu_linux:14.04::lts + cpe:/a:debian:dpkg:1.10.18.1 + cpe:/a:debian:dpkg:1.16.4 + cpe:/a:debian:dpkg:1.16.5 + cpe:/a:debian:dpkg:1.15.7 + cpe:/a:debian:dpkg:1.15.8 + cpe:/a:debian:dpkg:1.14.30 + cpe:/a:debian:dpkg:1.15.3.1 + cpe:/a:debian:dpkg:1.9.9 + cpe:/a:debian:dpkg:1.9.8 + cpe:/a:debian:dpkg:1.13.20 + cpe:/a:debian:dpkg:1.16.8 + cpe:/a:debian:dpkg:1.9.7 + cpe:/a:debian:dpkg:1.15.5 + cpe:/a:debian:dpkg:1.10.1 + cpe:/o:canonical:ubuntu_linux:13.10 + cpe:/a:debian:dpkg:1.13.21 + cpe:/a:debian:dpkg:1.16.9 + cpe:/a:debian:dpkg:1.15.6 + cpe:/a:debian:dpkg:1.13.22 + cpe:/a:debian:dpkg:1.16.6 + cpe:/a:debian:dpkg:1.16.7 + + CVE-2014-0471 + 2014-04-30T10:22:06.140-04:00 + 2014-05-01T12:33:41.257-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-05-01T12:33:40.477-04:00 + + + + + UBUNTU + USN-2183-1 + + + DEBIAN + DSA-2915 + + Directory traversal vulnerability in the unpacking functionality in dpkg before 1.15.9, 1.16.x before 1.16.13, and 1.17.x before 1.17.8 allows remote attackers to write arbitrary files via a crafted source package, related to "C-style filename quoting." + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:adobe:flash_player:11.2.202.261 + cpe:/a:adobe:flash_player:11.2.202.243 + cpe:/a:adobe:flash_player:11.2.202.280 + cpe:/a:adobe:flash_player:11.2.202.262 + cpe:/a:adobe:flash_player:11.2.202.285 + cpe:/a:adobe:flash_player:11.2.202.223 + cpe:/a:adobe:flash_player:11.7.700.275 + cpe:/a:adobe:flash_player:11.2.202.335 + cpe:/a:adobe:flash_player:11.2.202.336 + cpe:/a:adobe:flash_player:11.7.700.242 + cpe:/a:adobe:flash_player:11.7.700.202 + cpe:/a:adobe:flash_player:11.2.202.273 + cpe:/a:adobe:flash_player:11.7.700.272 + cpe:/a:adobe:flash_player:11.2.202.275 + cpe:/a:adobe:flash_player:11.2.202.235 + cpe:/a:adobe:flash_player:13.0.0.182 + cpe:/a:adobe:flash_player:11.2.202.236 + cpe:/a:adobe:flash_player:11.8.800.168 + cpe:/a:adobe:flash_player:11.7.700.257 + cpe:/a:adobe:flash_player:11.2.202.238 + cpe:/a:adobe:flash_player:11.2.202.341 + cpe:/a:adobe:flash_player:11.2.202.297 + cpe:/a:adobe:flash_player:11.2.202.258 + cpe:/a:adobe:flash_player:11.7.700.224 + cpe:/a:adobe:flash_player:11.7.700.225 + cpe:/a:adobe:flash_player:11.2.202.270 + cpe:/a:adobe:flash_player:11.8.800.94 + cpe:/a:adobe:flash_player:11.2.202.291 + cpe:/a:adobe:flash_player:11.2.202.251 + cpe:/a:adobe:flash_player:11.2.202.228 + cpe:/a:adobe:flash_player:11.7.700.232 + cpe:/a:adobe:flash_player:11.2.202.233 + cpe:/a:adobe:flash_player:11.2.202.346 + cpe:/a:adobe:flash_player:11.7.700.261 + cpe:/a:adobe:flash_player:11.7.700.260 + cpe:/a:adobe:flash_player:11.7.700.169 + cpe:/a:adobe:flash_player:11.8.800.97 + cpe:/a:adobe:flash_player:11.2.202.332 + cpe:/a:adobe:flash_player:11.7.700.269 + cpe:/a:adobe:flash_player:13.0.0.201 + cpe:/a:adobe:flash_player:11.2.202.350 + cpe:/a:adobe:flash_player:11.2.202.310 + + CVE-2014-0515 + 2014-04-29T06:37:03.733-04:00 + 2014-04-29T10:46:06.390-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-29T10:46:05.390-04:00 + + + + + CONFIRM + http://helpx.adobe.com/security/products/flash-player/apsb14-13.html + + Buffer overflow in Adobe Flash Player before 11.7.700.279 and 11.8.x through 13.0.x before 13.0.0.206 on Windows and OS X, and before 11.2.202.356 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in April 2014. + + + + + + + + + + + + cpe:/a:emc:rsa_access_manager:6.2:- + cpe:/a:emc:rsa_access_manager:6.2:sp1 + cpe:/a:emc:rsa_access_manager:6.1:sp4 + cpe:/a:emc:rsa_access_manager:6.1:sp3 + + CVE-2014-0646 + 2014-05-01T13:29:56.697-04:00 + 2014-05-02T09:49:06.440-04:00 + + + 6.9 + LOCAL + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-05-02T09:49:06.363-04:00 + + + + + BUGTRAQ + 20140430 ESA-2014-029: RSA Access Manager Sensitive Information Disclosure Vulnerability + + The runtime WS component in the server in EMC RSA Access Manager 6.1.3 before 6.1.3.39, 6.1.4 before 6.1.4.22, 6.2.0 before 6.2.0.11, and 6.2.1 before 6.2.1.03, when INFO logging is enabled, allows local users to discover cleartext passwords by reading log files. + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:softmotion3d:softmotion:- + cpe:/h:festo:cecx-x-c1_modular_master_controller:- + cpe:/a:3s-software:codesys_runtime_system:- + cpe:/h:festo:cecx-x-m1_modular_controller:- + + CVE-2014-0760 + 2014-04-25T01:12:07.693-04:00 + 2014-04-25T09:56:18.937-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-25T09:56:18.873-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01 + + The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion provide an undocumented access method involving the FTP protocol, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:softmotion3d:softmotion:- + cpe:/h:festo:cecx-x-c1_modular_master_controller:- + cpe:/a:3s-software:codesys_runtime_system:- + cpe:/h:festo:cecx-x-m1_modular_controller:- + + CVE-2014-0769 + 2014-04-25T01:12:07.753-04:00 + 2014-04-25T09:58:09.157-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-25T09:58:09.110-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01 + + The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion do not require authentication for connections to certain TCP ports, which allows remote attackers to (1) modify the configuration via a request to the debug service on port 4000 or (2) delete log entries via a request to the log service on port 4001. + + + + + + + + + + + cpe:/a:indusoft:web_studio:7.1:- + cpe:/a:indusoft:web_studio:7.1:sp2 + cpe:/a:indusoft:web_studio:7.1:sp1 + + CVE-2014-0780 + 2014-04-25T01:12:07.787-04:00 + 2014-04-25T11:48:51.573-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-25T11:48:51.433-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-107-02 + + Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests. + + + + + + + + + + + + + + cpe:/a:ecava:integraxor:4.1 + cpe:/a:ecava:integraxor:4.1.4369 + cpe:/a:ecava:integraxor:4.1.4390 + cpe:/a:ecava:integraxor:4.1.4360 + cpe:/a:ecava:integraxor:4.1.4340 + cpe:/a:ecava:integraxor:4.1.4380 + + CVE-2014-0786 + 2014-04-30T21:56:10.490-04:00 + 2014-05-01T12:18:09.443-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-05-01T12:18:09.240-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-091-01 + + + CONFIRM + http://www.integraxor.com/blog/category/security/vulnerability-note/ + + Ecava IntegraXor before 4.1.4393 allows remote attackers to read cleartext credentials for administrative accounts via SELECT statements that leverage the guest role. + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:ibm:websphere_application_server:8.0.0.4 + cpe:/a:ibm:websphere_application_server:8.0.0.3 + cpe:/a:ibm:websphere_application_server:8.0.0.2 + cpe:/a:ibm:websphere_application_server:8.0.0.0 + cpe:/a:ibm:websphere_application_server:8.0.0.8 + cpe:/a:ibm:websphere_application_server:8.5.0.0 + cpe:/a:ibm:websphere_application_server:8.0.0.1 + cpe:/a:ibm:websphere_application_server:8.0.0.7 + cpe:/a:ibm:websphere_application_server:8.5.0.1 + cpe:/a:ibm:websphere_application_server:8.0.0.6 + cpe:/a:ibm:websphere_application_server:8.5.0.2 + cpe:/a:ibm:websphere_application_server:8.0.0.5 + cpe:/a:ibm:websphere_application_server:8.5.5.1 + cpe:/a:ibm:websphere_application_server:8.5.5.0 + + CVE-2014-0823 + 2014-05-01T13:29:56.713-04:00 + 2014-05-02T09:54:20.187-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-05-02T09:54:20.043-04:00 + + + + + XF + ibm-was-cve20140823-viewfiles(90498) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21669554 + + + AIXAPAR + PI05324 + + IBM WebSphere Application Server (WAS) 8.x before 8.0.0.9 and 8.5.x before 8.5.5.2 allows remote attackers to read arbitrary files via a crafted URL. + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:ibm:websphere_application_server:8.0.0.4 + cpe:/a:ibm:websphere_application_server:8.0.0.3 + cpe:/a:ibm:websphere_application_server:8.0.0.2 + cpe:/a:ibm:websphere_application_server:8.0.0.0 + cpe:/a:ibm:websphere_application_server:8.0.0.8 + cpe:/a:ibm:websphere_application_server:8.5.0.0 + cpe:/a:ibm:websphere_application_server:8.0.0.7 + cpe:/a:ibm:websphere_application_server:8.5.0.1 + cpe:/a:ibm:websphere_application_server:8.0.0.1 + cpe:/a:ibm:websphere_application_server:8.5.0.2 + cpe:/a:ibm:websphere_application_server:8.0.0.6 + cpe:/a:ibm:websphere_application_server:8.0.0.5 + cpe:/a:ibm:websphere_application_server:8.5.5.1 + cpe:/a:ibm:websphere_application_server:8.5.5.0 + + CVE-2014-0857 + 2014-05-01T13:29:56.713-04:00 + 2014-05-02T09:57:31.300-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-05-02T09:57:30.973-04:00 + + + + + XF + ibm-was-cve20140857-info-disc(90863) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21669554 + + + AIXAPAR + PI07808 + + The Administrative Console in IBM WebSphere Application Server (WAS) 8.x before 8.0.0.9 and 8.5.x before 8.5.5.2 allows remote authenticated users to obtain sensitive information via a crafted request. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:ibm:websphere_application_server:8.0.0.4 + cpe:/a:ibm:websphere_application_server:8.0.0.3 + cpe:/a:ibm:websphere_application_server:8.0.0.2 + cpe:/a:ibm:websphere_application_server:7.0.0.4 + cpe:/a:ibm:websphere_application_server:7.0.0.5 + cpe:/a:ibm:websphere_application_server:7.0.0.27 + cpe:/a:ibm:websphere_application_server:7.0.0.3 + cpe:/a:ibm:websphere_application_server:7.0.0.29 + cpe:/a:ibm:websphere_application_server:7.0.0.8 + cpe:/a:ibm:websphere_application_server:7.0.0.9 + cpe:/a:ibm:websphere_application_server:7.0.0.6 + cpe:/a:ibm:websphere_application_server:8.0.0.0 + cpe:/a:ibm:websphere_application_server:7.0.0.7 + cpe:/a:ibm:websphere_application_server:8.5.0.0 + cpe:/a:ibm:websphere_application_server:8.0.0.8 + cpe:/a:ibm:websphere_application_server:8.5.0.1 + cpe:/a:ibm:websphere_application_server:8.0.0.7 + cpe:/a:ibm:websphere_application_server:8.0.0.1 + cpe:/a:ibm:websphere_application_server:8.5.0.2 + cpe:/a:ibm:websphere_application_server:8.0.0.6 + cpe:/a:ibm:websphere_application_server:8.0.0.5 + cpe:/a:ibm:websphere_application_server:8.5.5.1 + cpe:/a:ibm:websphere_application_server:7.0.0.15 + cpe:/a:ibm:websphere_application_server:8.5.5.0 + cpe:/a:ibm:websphere_application_server:7.0.0.2 + cpe:/a:ibm:websphere_application_server:7.0.0.1 + cpe:/a:ibm:websphere_application_server:7.0.0.12 + cpe:/a:ibm:websphere_application_server:7.0.0.11 + cpe:/a:ibm:websphere_application_server:7.0.0.14 + cpe:/a:ibm:websphere_application_server:7.0.0.13 + cpe:/a:ibm:websphere_application_server:7.0.0.16 + cpe:/a:ibm:websphere_application_server:7.0.0.10 + cpe:/a:ibm:websphere_application_server:7.0.0.18 + cpe:/a:ibm:websphere_application_server:7.0.0.17 + cpe:/a:ibm:websphere_application_server:7.0.0.19 + cpe:/a:ibm:websphere_application_server:7.0.0.31 + cpe:/a:ibm:websphere_application_server:7.0 + cpe:/a:ibm:websphere_application_server:7.0.0.25 + cpe:/a:ibm:websphere_application_server:7.0.0.24 + cpe:/a:ibm:websphere_application_server:7.0.0.23 + cpe:/a:ibm:websphere_application_server:7.0.0.22 + cpe:/a:ibm:websphere_application_server:7.0.0.21 + + CVE-2014-0859 + 2014-05-01T13:29:56.730-04:00 + 2014-05-02T10:01:30.323-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-05-02T10:01:29.917-04:00 + + + + XF + ibm-was-cve20140859-retry(90879) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21669554 + + + AIXAPAR + PI08892 + + The web-server plugin in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.33, 8.x before 8.0.0.9, and 8.5.x before 8.5.5.2, when POST retries are enabled, allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors. + + + + + + + + + + + + + cpe:/a:ibm:websphere_application_server:8.5.0.0:-:liberty_profile + cpe:/a:ibm:websphere_application_server:8.5.0.2:-:liberty_profile + cpe:/a:ibm:websphere_application_server:8.5.0.1:-:liberty_profile + cpe:/a:ibm:websphere_application_server:8.5.5.0:-:liberty_profile + cpe:/a:ibm:websphere_application_server:8.5.5.1:-:liberty_profile + + CVE-2014-0896 + 2014-05-01T13:29:56.747-04:00 + 2014-05-02T10:14:42.947-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-05-02T10:14:42.897-04:00 + + + + + XF + ibm-was-cve20140896-info-disc(91326) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21669554 + + + AIXAPAR + PI10134 + + IBM WebSphere Application Server (WAS) Liberty Profile 8.5.x before 8.5.5.2 allows remote attackers to obtain sensitive information via a crafted request. + + + + + + + + + cpe:/a:ibm:tivoli_netcool%2fomnibus:7.4.0 + + CVE-2014-0941 + 2014-05-01T13:29:56.760-04:00 + 2014-05-02T10:25:37.247-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-05-02T10:25:37.233-04:00 + + + + + XF + ibm-netcoolomnibus-cve20140941-xss(92400) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21671686 + + Cross-site scripting (XSS) vulnerability in webtop/eventviewer/eventViewer.jsp in the Web GUI in IBM Netcool/OMNIbus 7.4.0 before FP2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2014-0942. + + + + + + + + + cpe:/a:ibm:tivoli_netcool%2fomnibus:7.4.0 + + CVE-2014-0942 + 2014-05-01T13:29:56.777-04:00 + 2014-05-02T10:28:48.147-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-05-02T10:28:46.083-04:00 + + + + + XF + ibm-netcoolomnibus-cve20140942-xss(92401) + + + CONFIRM + http://www-01.ibm.com/support/docview.wss?uid=swg21671686 + + Cross-site scripting (XSS) vulnerability in webtop/eventviewer/eventViewer.jsp in the Web GUI in IBM Netcool/OMNIbus 7.4.0 before FP2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2014-0941. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:livetecs:timeline:6.2.7 + cpe:/a:livetecs:timeline:2.94 + cpe:/a:livetecs:timeline:3.1.1 + cpe:/a:livetecs:timeline:3.5.1 + cpe:/a:livetecs:timeline:2.91 + cpe:/a:livetecs:timeline:3.0.3 + cpe:/a:livetecs:timeline:3.0.1 + cpe:/a:livetecs:timeline:4.2.1 + cpe:/a:livetecs:timeline:2.81 + cpe:/a:livetecs:timeline:6.0.1 + cpe:/a:livetecs:timeline:3.0.5 + cpe:/a:livetecs:timeline:7.1.1 + cpe:/a:livetecs:timeline:6.2.71 + cpe:/a:livetecs:timeline:3.6.1 + cpe:/a:livetecs:timeline:4.3.1 + cpe:/a:livetecs:timeline:6.2.1 + cpe:/a:livetecs:timeline:6.2.3 + cpe:/a:livetecs:timeline:3.8.1 + cpe:/a:livetecs:timeline:3.2.1 + cpe:/a:livetecs:timeline:6.2.4 + cpe:/a:livetecs:timeline:5.2.1 + cpe:/a:livetecs:timeline:4.9.1 + cpe:/a:livetecs:timeline:6.2.6 + cpe:/a:livetecs:timeline:3.7.1 + + CVE-2014-1217 + 2014-04-28T10:09:06.440-04:00 + 2014-04-29T08:09:11.557-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-29T08:09:11.210-04:00 + + + + + MISC + https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1217/ + + + BID + 67043 + + + BUGTRAQ + 20140423 CVE-2014-1217 - Unauthenticated access to sensitive information and functionality in Livetecs Timelive + + + FULLDISC + 20140423 CVE-2014-1217 - Unauthenticated access to sensitive information and functionality in Livetecs Timelive + + Livetecs Timelive before 6.2.8 does not properly restrict access to systemsetting.aspx, which allows remote attackers to change configurations and obtain the database connection string and credentials via unspecified vectors. + + + + + + + + + cpe:/a:coreftp:core_ftp:1.2 + + CVE-2014-1441 + 2014-05-01T21:59:22.357-04:00 + 2014-05-02T11:11:59.343-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-05-02T11:11:59.140-04:00 + + + + + OSVDB + 102966 + + + SECUNIA + 56850 + + + FULLDISC + 20140205 Core FTP Server Vulnerabilities + + + MISC + http://packetstormsecurity.com/files/125073/Core-FTP-Server-1.2-DoS-Traversal-Disclosure.html + + + CONFIRM + http://coreftp.com/forums/viewtopic.php?t=2985707 + + Core FTP Server 1.2 before build 515 allows remote attackers to cause a denial of service (reachable assertion and crash) via an AUTH SSL command with malformed data, as demonstrated by pressing the enter key twice. + + + + + + + + + cpe:/a:coreftp:core_ftp:1.2 + + CVE-2014-1442 + 2014-05-01T21:59:22.390-04:00 + 2014-05-02T11:19:26.310-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-05-02T11:19:26.280-04:00 + + + + + OSVDB + 102967 + + + SECUNIA + 56850 + + + FULLDISC + 20140205 Core FTP Server Vulnerabilities + + + MISC + http://packetstormsecurity.com/files/125073/Core-FTP-Server-1.2-DoS-Traversal-Disclosure.html + + + CONFIRM + http://coreftp.com/forums/viewtopic.php?t=2985707 + + Directory traversal vulnerability in Core FTP Server 1.2 before build 515 allows remote authenticated users to determine the existence of arbitrary files via a /../ sequence in an XCRC command. + + + + + + + + + cpe:/a:coreftp:core_ftp:1.2 + + CVE-2014-1443 + 2014-05-01T21:59:22.420-04:00 + 2014-05-02T11:21:20.283-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-05-02T11:21:20.220-04:00 + + + + + OSVDB + 102968 + + + SECUNIA + 56850 + + + FULLDISC + 20140205 Core FTP Server Vulnerabilities + + + MISC + http://packetstormsecurity.com/files/125073/Core-FTP-Server-1.2-DoS-Traversal-Disclosure.html + + + CONFIRM + http://coreftp.com/forums/viewtopic.php?t=2985707 + + Core FTP Server 1.2 before build 515 allows remote authenticated users to obtain sensitive information (password for the previous user) via a USER command with a specific length, possibly related to an out-of-bounds read. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:thunderbird:6.0.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:thunderbird:1.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:thunderbird:16.0 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:thunderbird:1.5 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:thunderbird:11.0 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:thunderbird:6.0.2 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:thunderbird:0.7.1 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:thunderbird:0.7.2 + cpe:/a:mozilla:thunderbird:0.7.3 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:thunderbird:1.5.2 + cpe:/a:mozilla:thunderbird:1.0.3 + cpe:/a:mozilla:thunderbird:1.0.4 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:thunderbird:1.0.5 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:thunderbird:1.0.6 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:thunderbird:3.1.15 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:thunderbird:3.1.16 + cpe:/a:mozilla:thunderbird:3.1.17 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:thunderbird:1.0.2 + cpe:/a:mozilla:thunderbird:1.0.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:thunderbird:3.1.10 + cpe:/a:mozilla:thunderbird:1.5.1 + cpe:/a:mozilla:thunderbird:1.0.8 + cpe:/a:mozilla:thunderbird:1.0.7 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:thunderbird:3.1.14 + cpe:/a:mozilla:thunderbird:3.1.13 + cpe:/a:mozilla:thunderbird:3.1.12 + cpe:/a:mozilla:thunderbird:3.1.11 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:thunderbird:17.0.4 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:seamonkey:2.25:- + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:thunderbird:12.0.1 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:thunderbird:1.5.0.3 + cpe:/a:mozilla:thunderbird:1.5.0.2 + cpe:/a:mozilla:thunderbird:1.5.0.1 + cpe:/a:mozilla:thunderbird:3.0.11 + cpe:/a:mozilla:thunderbird:3.0.10 + cpe:/a:mozilla:thunderbird:13.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:thunderbird:14.0 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:thunderbird:7.0 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:thunderbird:8.0 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:thunderbird:0.2 + cpe:/a:mozilla:thunderbird:0.3 + cpe:/a:mozilla:thunderbird:0.4 + cpe:/a:mozilla:thunderbird:0.5 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:thunderbird:0.1 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:thunderbird:1.7.1 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:thunderbird:1.7.3 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:thunderbird:0.9 + cpe:/a:mozilla:thunderbird:0.8 + cpe:/a:mozilla:thunderbird:0.7 + cpe:/a:mozilla:thunderbird:0.6 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:thunderbird:15.0.1 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:thunderbird:9.0 + cpe:/a:mozilla:thunderbird:6.0 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:28.0 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:thunderbird:12.0 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:thunderbird:15.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:thunderbird:24.0.1 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:thunderbird:2.0.0.5 + cpe:/a:mozilla:thunderbird:2.0.0.4 + cpe:/a:mozilla:thunderbird:2.0.0.7 + cpe:/a:mozilla:thunderbird:2.0.0.6 + cpe:/a:mozilla:thunderbird:11.0.1 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:thunderbird:2.0.0.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:thunderbird:2.0.0.3 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:thunderbird:2.0.0.0 + cpe:/a:mozilla:thunderbird:2.0.0.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:thunderbird:1.5.0.9 + cpe:/a:mozilla:thunderbird:1.5.0.8 + cpe:/a:mozilla:thunderbird:1.5.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.6 + cpe:/a:mozilla:thunderbird:2.0.0.8 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.9 + cpe:/a:mozilla:thunderbird:16.0.2 + cpe:/a:mozilla:thunderbird:16.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:thunderbird:24.3 + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:thunderbird:24.2 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox_esr:24.3 + cpe:/a:mozilla:thunderbird:24.1 + cpe:/a:mozilla:thunderbird:3.0.9 + cpe:/a:mozilla:thunderbird:24.0 + cpe:/a:mozilla:thunderbird:24.1.1 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:thunderbird:24.4 + cpe:/a:mozilla:firefox_esr:24.4 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:thunderbird:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:thunderbird:5.0 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:thunderbird:3.0.4 + cpe:/a:mozilla:thunderbird:3.0.3 + cpe:/a:mozilla:thunderbird:3.0.2 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:thunderbird:3.0.1 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:thunderbird:3.1.3 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:thunderbird:3.1.2 + cpe:/a:mozilla:thunderbird:3.1.1 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:thunderbird:3.1.4 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:thunderbird:3.1.5 + cpe:/a:mozilla:seamonkey:2.25:beta3 + cpe:/a:mozilla:thunderbird:3.1.6 + cpe:/a:mozilla:thunderbird:3.1.7 + cpe:/a:mozilla:thunderbird:2.0.0.18 + cpe:/a:mozilla:thunderbird:2.0.0.17 + cpe:/a:mozilla:thunderbird:2.0.0.16 + cpe:/a:mozilla:thunderbird:2.0.0.15 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:thunderbird:3.0.5 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:thunderbird:3.0.6 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:thunderbird:3.0.7 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:thunderbird:3.0.8 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:thunderbird:3.0 + cpe:/a:mozilla:thunderbird:3.1 + cpe:/a:mozilla:thunderbird:1.0.5:beta + cpe:/a:mozilla:thunderbird:2.0.0.21 + cpe:/a:mozilla:thunderbird:2.0.0.20 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:thunderbird:2.0.0.11 + cpe:/a:mozilla:thunderbird:2.0.0.12 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:thunderbird:2.0.0.13 + cpe:/a:mozilla:thunderbird:2.0.0.14 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:thunderbird:3.1.9 + cpe:/a:mozilla:thunderbird:3.1.8 + cpe:/a:mozilla:thunderbird:2.0.0.19 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:thunderbird:2.0.0.22 + cpe:/a:mozilla:thunderbird:2.0.0.23 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:thunderbird:1.5.0.10 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:thunderbird:1.5.0.13 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:thunderbird:7.0.1 + cpe:/a:mozilla:thunderbird:1.5.0.14 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.11 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:thunderbird:1.5.0.12 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:thunderbird:13.0.1 + cpe:/a:mozilla:thunderbird:2.0 + cpe:/a:mozilla:thunderbird:9.0.1 + cpe:/a:mozilla:thunderbird:10.0 + cpe:/a:mozilla:seamonkey:2.26:rc1 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:thunderbird:10.0.3 + cpe:/a:mozilla:thunderbird:10.0.4 + cpe:/a:mozilla:thunderbird:10.0.1 + cpe:/a:mozilla:thunderbird:10.0.2 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1518 + 2014-04-30T06:49:04.677-04:00 + 2014-04-30T11:29:46.733-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-30T11:29:44.043-04:00 + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=993546 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=992968 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=991471 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=986843 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=986678 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=980537 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=966630 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=952022 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=944353 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-34.html + + Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:28.0 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.25:- + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:seamonkey:2.25:beta3 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:seamonkey:2.26:rc1 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1519 + 2014-04-30T06:49:04.707-04:00 + 2014-04-30T11:51:53.667-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-30T11:51:51.027-04:00 + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=996883 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=995607 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=990794 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=986864 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=977955 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=953104 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=946658 + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=919592 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-34.html + + Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:28.0 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox_esr:24.3 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:firefox_esr:24.4 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1520 + 2014-04-30T06:49:04.753-04:00 + 2014-04-30T12:02:09.143-04:00 + + + 6.9 + LOCAL + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-30T12:02:07.173-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=961676 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-35.html + + maintenservice_installer.exe in the Maintenance Service Installer in Mozilla Firefox before 29.0 and Firefox ESR 24.x before 24.5 on Windows allows local users to gain privileges by placing a Trojan horse DLL file into a temporary directory at an unspecified point in the update process. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:28.0 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.25:- + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:seamonkey:2.25:beta3 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:seamonkey:2.26:rc1 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1522 + 2014-04-30T06:49:04.787-04:00 + 2014-04-30T12:11:38.583-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-30T12:11:36.177-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=995289 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-36.html + + The mozilla::dom::OscillatorNodeEngine::ComputeCustom function in the Web Audio subsystem in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read, memory corruption, and application crash) via crafted content. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:thunderbird:6.0.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:thunderbird:1.0 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:thunderbird:16.0 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:thunderbird:1.5 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:thunderbird:11.0 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:thunderbird:6.0.2 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:thunderbird:0.7.1 + cpe:/a:mozilla:thunderbird:0.7.2 + cpe:/a:mozilla:thunderbird:0.7.3 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:thunderbird:1.0.3 + cpe:/a:mozilla:thunderbird:1.5.2 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:thunderbird:1.0.4 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:thunderbird:1.0.5 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:thunderbird:1.0.6 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:thunderbird:3.1.15 + cpe:/a:mozilla:thunderbird:3.1.16 + cpe:/a:mozilla:thunderbird:3.1.17 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:thunderbird:1.0.2 + cpe:/a:mozilla:thunderbird:1.0.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:thunderbird:3.1.10 + cpe:/a:mozilla:thunderbird:1.5.1 + cpe:/a:mozilla:thunderbird:1.0.8 + cpe:/a:mozilla:thunderbird:1.0.7 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:thunderbird:3.1.14 + cpe:/a:mozilla:thunderbird:3.1.13 + cpe:/a:mozilla:thunderbird:3.1.12 + cpe:/a:mozilla:thunderbird:3.1.11 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:thunderbird:17.0.4 + cpe:/a:mozilla:seamonkey:2.25:- + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:thunderbird:12.0.1 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:thunderbird:1.5.0.3 + cpe:/a:mozilla:thunderbird:1.5.0.2 + cpe:/a:mozilla:thunderbird:1.5.0.1 + cpe:/a:mozilla:thunderbird:3.0.11 + cpe:/a:mozilla:thunderbird:3.0.10 + cpe:/a:mozilla:thunderbird:13.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:thunderbird:14.0 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:thunderbird:7.0 + cpe:/a:mozilla:thunderbird:8.0 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:thunderbird:0.2 + cpe:/a:mozilla:thunderbird:0.3 + cpe:/a:mozilla:thunderbird:0.4 + cpe:/a:mozilla:thunderbird:0.5 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:thunderbird:0.1 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:thunderbird:1.7.1 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:thunderbird:1.7.3 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:thunderbird:0.9 + cpe:/a:mozilla:thunderbird:0.8 + cpe:/a:mozilla:thunderbird:0.7 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:thunderbird:0.6 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:thunderbird:15.0.1 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:thunderbird:9.0 + cpe:/a:mozilla:thunderbird:6.0 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:28.0 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:thunderbird:12.0 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:thunderbird:15.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:thunderbird:24.0.1 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:thunderbird:2.0.0.5 + cpe:/a:mozilla:thunderbird:2.0.0.4 + cpe:/a:mozilla:thunderbird:2.0.0.7 + cpe:/a:mozilla:thunderbird:11.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.6 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:thunderbird:2.0.0.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:thunderbird:2.0.0.3 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:thunderbird:2.0.0.0 + cpe:/a:mozilla:thunderbird:2.0.0.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:thunderbird:1.5.0.9 + cpe:/a:mozilla:thunderbird:1.5.0.8 + cpe:/a:mozilla:thunderbird:1.5.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.6 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.8 + cpe:/a:mozilla:thunderbird:2.0.0.9 + cpe:/a:mozilla:thunderbird:16.0.2 + cpe:/a:mozilla:thunderbird:16.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:thunderbird:24.3 + cpe:/a:mozilla:thunderbird:24.2 + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox_esr:24.3 + cpe:/a:mozilla:thunderbird:3.0.9 + cpe:/a:mozilla:thunderbird:24.1 + cpe:/a:mozilla:thunderbird:24.0 + cpe:/a:mozilla:thunderbird:24.1.1 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:thunderbird:24.4 + cpe:/a:mozilla:firefox_esr:24.4 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:thunderbird:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:thunderbird:5.0 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:thunderbird:3.0.4 + cpe:/a:mozilla:thunderbird:3.0.3 + cpe:/a:mozilla:thunderbird:3.0.2 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:thunderbird:3.0.1 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:thunderbird:3.1.3 + cpe:/a:mozilla:thunderbird:3.1.2 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:thunderbird:3.1.1 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:thunderbird:3.1.4 + cpe:/a:mozilla:seamonkey:2.25:beta3 + cpe:/a:mozilla:thunderbird:3.1.5 + cpe:/a:mozilla:thunderbird:3.1.6 + cpe:/a:mozilla:thunderbird:3.1.7 + cpe:/a:mozilla:thunderbird:2.0.0.18 + cpe:/a:mozilla:thunderbird:2.0.0.17 + cpe:/a:mozilla:thunderbird:2.0.0.16 + cpe:/a:mozilla:thunderbird:2.0.0.15 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:thunderbird:3.0.5 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:thunderbird:3.0.6 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:thunderbird:3.0.7 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:thunderbird:3.0.8 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:thunderbird:3.0 + cpe:/a:mozilla:thunderbird:3.1 + cpe:/a:mozilla:thunderbird:1.0.5:beta + cpe:/a:mozilla:thunderbird:2.0.0.21 + cpe:/a:mozilla:thunderbird:2.0.0.20 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:thunderbird:2.0.0.11 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:thunderbird:2.0.0.12 + cpe:/a:mozilla:thunderbird:2.0.0.13 + cpe:/a:mozilla:thunderbird:2.0.0.14 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:thunderbird:3.1.9 + cpe:/a:mozilla:thunderbird:3.1.8 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:thunderbird:2.0.0.19 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:thunderbird:2.0.0.22 + cpe:/a:mozilla:thunderbird:2.0.0.23 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:thunderbird:1.5.0.10 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:thunderbird:1.5.0.13 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.14 + cpe:/a:mozilla:thunderbird:7.0.1 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.11 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:thunderbird:1.5.0.12 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:thunderbird:13.0.1 + cpe:/a:mozilla:thunderbird:2.0 + cpe:/a:mozilla:thunderbird:9.0.1 + cpe:/a:mozilla:thunderbird:10.0 + cpe:/a:mozilla:seamonkey:2.26:rc1 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:thunderbird:10.0.3 + cpe:/a:mozilla:thunderbird:10.0.4 + cpe:/a:mozilla:thunderbird:10.0.1 + cpe:/a:mozilla:thunderbird:10.0.2 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1523 + 2014-04-30T06:49:04.800-04:00 + 2014-04-30T12:24:23.030-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-30T12:24:19.860-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=969226 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-37.html + + Heap-based buffer overflow in the read_u32 function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG image. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:thunderbird:6.0.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:thunderbird:1.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:thunderbird:16.0 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:thunderbird:1.5 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:thunderbird:11.0 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:thunderbird:6.0.2 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:thunderbird:0.7.1 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:thunderbird:0.7.2 + cpe:/a:mozilla:thunderbird:0.7.3 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:thunderbird:1.5.2 + cpe:/a:mozilla:thunderbird:1.0.3 + cpe:/a:mozilla:thunderbird:1.0.4 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:thunderbird:1.0.5 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:thunderbird:1.0.6 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:thunderbird:3.1.15 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:thunderbird:3.1.16 + cpe:/a:mozilla:thunderbird:3.1.17 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:thunderbird:1.0.2 + cpe:/a:mozilla:thunderbird:1.0.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:thunderbird:3.1.10 + cpe:/a:mozilla:thunderbird:1.5.1 + cpe:/a:mozilla:thunderbird:1.0.8 + cpe:/a:mozilla:thunderbird:1.0.7 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:thunderbird:3.1.14 + cpe:/a:mozilla:thunderbird:3.1.13 + cpe:/a:mozilla:thunderbird:3.1.12 + cpe:/a:mozilla:thunderbird:3.1.11 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:thunderbird:17.0.4 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:seamonkey:2.25:- + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:thunderbird:12.0.1 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:thunderbird:1.5.0.3 + cpe:/a:mozilla:thunderbird:1.5.0.2 + cpe:/a:mozilla:thunderbird:1.5.0.1 + cpe:/a:mozilla:thunderbird:3.0.11 + cpe:/a:mozilla:thunderbird:3.0.10 + cpe:/a:mozilla:thunderbird:13.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:thunderbird:14.0 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:thunderbird:7.0 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:thunderbird:8.0 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:thunderbird:0.2 + cpe:/a:mozilla:thunderbird:0.3 + cpe:/a:mozilla:thunderbird:0.4 + cpe:/a:mozilla:thunderbird:0.5 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:thunderbird:0.1 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:thunderbird:1.7.1 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:thunderbird:1.7.3 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:thunderbird:0.9 + cpe:/a:mozilla:thunderbird:0.8 + cpe:/a:mozilla:thunderbird:0.7 + cpe:/a:mozilla:thunderbird:0.6 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:thunderbird:15.0.1 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:thunderbird:9.0 + cpe:/a:mozilla:thunderbird:6.0 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:28.0 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:thunderbird:12.0 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:thunderbird:15.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:thunderbird:24.0.1 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:thunderbird:2.0.0.5 + cpe:/a:mozilla:thunderbird:2.0.0.4 + cpe:/a:mozilla:thunderbird:2.0.0.7 + cpe:/a:mozilla:thunderbird:2.0.0.6 + cpe:/a:mozilla:thunderbird:11.0.1 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:thunderbird:2.0.0.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:thunderbird:2.0.0.3 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:thunderbird:2.0.0.0 + cpe:/a:mozilla:thunderbird:2.0.0.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:thunderbird:1.5.0.9 + cpe:/a:mozilla:thunderbird:1.5.0.8 + cpe:/a:mozilla:thunderbird:1.5.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.6 + cpe:/a:mozilla:thunderbird:2.0.0.8 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.9 + cpe:/a:mozilla:thunderbird:16.0.2 + cpe:/a:mozilla:thunderbird:16.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:thunderbird:24.3 + cpe:/a:mozilla:thunderbird:24.2 + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:thunderbird:24.1 + cpe:/a:mozilla:thunderbird:3.0.9 + cpe:/a:mozilla:firefox_esr:24.3 + cpe:/a:mozilla:thunderbird:24.0 + cpe:/a:mozilla:thunderbird:24.1.1 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:thunderbird:24.4 + cpe:/a:mozilla:firefox_esr:24.4 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:thunderbird:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:thunderbird:5.0 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:thunderbird:3.0.4 + cpe:/a:mozilla:thunderbird:3.0.3 + cpe:/a:mozilla:thunderbird:3.0.2 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:thunderbird:3.0.1 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:thunderbird:3.1.3 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:thunderbird:3.1.2 + cpe:/a:mozilla:thunderbird:3.1.1 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:thunderbird:3.1.4 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:thunderbird:3.1.5 + cpe:/a:mozilla:seamonkey:2.25:beta3 + cpe:/a:mozilla:thunderbird:3.1.6 + cpe:/a:mozilla:thunderbird:3.1.7 + cpe:/a:mozilla:thunderbird:2.0.0.18 + cpe:/a:mozilla:thunderbird:2.0.0.17 + cpe:/a:mozilla:thunderbird:2.0.0.16 + cpe:/a:mozilla:thunderbird:2.0.0.15 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:thunderbird:3.0.5 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:thunderbird:3.0.6 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:thunderbird:3.0.7 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:thunderbird:3.0.8 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:thunderbird:3.0 + cpe:/a:mozilla:thunderbird:3.1 + cpe:/a:mozilla:thunderbird:1.0.5:beta + cpe:/a:mozilla:thunderbird:2.0.0.21 + cpe:/a:mozilla:thunderbird:2.0.0.20 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:thunderbird:2.0.0.11 + cpe:/a:mozilla:thunderbird:2.0.0.12 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:thunderbird:2.0.0.13 + cpe:/a:mozilla:thunderbird:2.0.0.14 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:thunderbird:3.1.9 + cpe:/a:mozilla:thunderbird:3.1.8 + cpe:/a:mozilla:thunderbird:2.0.0.19 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:thunderbird:2.0.0.22 + cpe:/a:mozilla:thunderbird:2.0.0.23 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:thunderbird:1.5.0.10 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:thunderbird:1.5.0.13 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:thunderbird:7.0.1 + cpe:/a:mozilla:thunderbird:1.5.0.14 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.11 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:thunderbird:1.5.0.12 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:thunderbird:13.0.1 + cpe:/a:mozilla:thunderbird:2.0 + cpe:/a:mozilla:thunderbird:9.0.1 + cpe:/a:mozilla:thunderbird:10.0 + cpe:/a:mozilla:seamonkey:2.26:rc1 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:thunderbird:10.0.3 + cpe:/a:mozilla:thunderbird:10.0.4 + cpe:/a:mozilla:thunderbird:10.0.1 + cpe:/a:mozilla:thunderbird:10.0.2 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1524 + 2014-04-30T06:49:04.833-04:00 + 2014-04-30T12:33:27.033-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-30T12:33:24.253-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=989183 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-38.html + + The nsXBLProtoImpl::InstallImplementation function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 does not properly check whether objects are XBL objects, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted JavaScript code that accesses a non-XBL object as if it were an XBL object. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:28.0 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:seamonkey:2.25:- + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:seamonkey:2.25:beta3 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:seamonkey:2.26:rc1 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:7.0 + cpe:/a:mozilla:firefox:1.5.6 + + CVE-2014-1525 + 2014-04-30T06:49:04.863-04:00 + 2014-04-30T12:39:27.297-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-30T12:39:22.030-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=989210 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-39.html + + The mozilla::dom::TextTrack::AddCue function in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 does not properly perform garbage collection for Text Track Manager variables, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and heap memory corruption) via a crafted VIDEO element in an HTML document. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:28.0 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:seamonkey:2.25:- + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:seamonkey:2.25:beta3 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:seamonkey:2.26:rc1 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:7.0 + cpe:/a:mozilla:firefox:1.5.6 + + CVE-2014-1526 + 2014-04-30T06:49:04.880-04:00 + 2014-04-30T12:56:20.300-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-30T12:56:17.970-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=988106 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-47.html + + The XrayWrapper implementation in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allows user-assisted remote attackers to bypass intended access restrictions via a crafted web site that is visited in the debugger, leading to unwrapping operations and calls to DOM methods on the unwrapped objects. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:28.0 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1527 + 2014-04-30T06:49:04.910-04:00 + 2014-04-30T13:01:15.387-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-30T13:01:13.310-04:00 + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=960146 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-40.html + + Mozilla Firefox before 29.0 on Android allows remote attackers to spoof the address bar via crafted JavaScript code that uses DOM events to prevent the reemergence of the actual address bar after scrolling has taken it off of the screen. + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:28.0 + cpe:/a:mozilla:seamonkey:2.25:- + + CVE-2014-1528 + 2014-04-30T06:49:04.943-04:00 + 2014-04-30T13:07:51.433-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-30T13:07:51.277-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=963962 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-41.html + + The sse2_composite_src_x888_8888 function in Pixman, as used in Cairo in Mozilla Firefox 28.0 and SeaMonkey 2.25 on Windows, allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) by painting on a CANVAS element. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:thunderbird:6.0.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:thunderbird:1.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:thunderbird:16.0 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:thunderbird:1.5 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:thunderbird:11.0 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:thunderbird:6.0.2 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:thunderbird:0.7.1 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:thunderbird:0.7.2 + cpe:/a:mozilla:thunderbird:0.7.3 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:thunderbird:1.5.2 + cpe:/a:mozilla:thunderbird:1.0.3 + cpe:/a:mozilla:thunderbird:1.0.4 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:thunderbird:1.0.5 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:thunderbird:1.0.6 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:thunderbird:3.1.15 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:thunderbird:3.1.16 + cpe:/a:mozilla:thunderbird:3.1.17 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:thunderbird:1.0.2 + cpe:/a:mozilla:thunderbird:1.0.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:thunderbird:3.1.10 + cpe:/a:mozilla:thunderbird:1.5.1 + cpe:/a:mozilla:thunderbird:1.0.8 + cpe:/a:mozilla:thunderbird:1.0.7 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:thunderbird:3.1.14 + cpe:/a:mozilla:thunderbird:3.1.13 + cpe:/a:mozilla:thunderbird:3.1.12 + cpe:/a:mozilla:thunderbird:3.1.11 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:thunderbird:17.0.4 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:seamonkey:2.25:- + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:thunderbird:12.0.1 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:thunderbird:1.5.0.3 + cpe:/a:mozilla:thunderbird:1.5.0.2 + cpe:/a:mozilla:thunderbird:1.5.0.1 + cpe:/a:mozilla:thunderbird:3.0.11 + cpe:/a:mozilla:thunderbird:3.0.10 + cpe:/a:mozilla:thunderbird:13.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:thunderbird:14.0 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:thunderbird:7.0 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:thunderbird:8.0 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:thunderbird:0.2 + cpe:/a:mozilla:thunderbird:0.3 + cpe:/a:mozilla:thunderbird:0.4 + cpe:/a:mozilla:thunderbird:0.5 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:thunderbird:0.1 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:thunderbird:1.7.1 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:thunderbird:1.7.3 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:thunderbird:0.9 + cpe:/a:mozilla:thunderbird:0.8 + cpe:/a:mozilla:thunderbird:0.7 + cpe:/a:mozilla:thunderbird:0.6 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:thunderbird:15.0.1 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:thunderbird:9.0 + cpe:/a:mozilla:thunderbird:6.0 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:28.0 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:thunderbird:12.0 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:thunderbird:15.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:thunderbird:24.0.1 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:thunderbird:2.0.0.5 + cpe:/a:mozilla:thunderbird:2.0.0.4 + cpe:/a:mozilla:thunderbird:2.0.0.7 + cpe:/a:mozilla:thunderbird:2.0.0.6 + cpe:/a:mozilla:thunderbird:11.0.1 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:thunderbird:2.0.0.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:thunderbird:2.0.0.3 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:thunderbird:2.0.0.0 + cpe:/a:mozilla:thunderbird:2.0.0.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:thunderbird:1.5.0.9 + cpe:/a:mozilla:thunderbird:1.5.0.8 + cpe:/a:mozilla:thunderbird:1.5.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.6 + cpe:/a:mozilla:thunderbird:2.0.0.8 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.9 + cpe:/a:mozilla:thunderbird:16.0.2 + cpe:/a:mozilla:thunderbird:16.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:thunderbird:24.3 + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:thunderbird:24.2 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox_esr:24.3 + cpe:/a:mozilla:thunderbird:24.1 + cpe:/a:mozilla:thunderbird:3.0.9 + cpe:/a:mozilla:thunderbird:24.0 + cpe:/a:mozilla:thunderbird:24.1.1 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:thunderbird:24.4 + cpe:/a:mozilla:firefox_esr:24.4 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:thunderbird:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:thunderbird:5.0 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:thunderbird:3.0.4 + cpe:/a:mozilla:thunderbird:3.0.3 + cpe:/a:mozilla:thunderbird:3.0.2 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:thunderbird:3.0.1 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:thunderbird:3.1.3 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:thunderbird:3.1.2 + cpe:/a:mozilla:thunderbird:3.1.1 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:thunderbird:3.1.4 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:thunderbird:3.1.5 + cpe:/a:mozilla:seamonkey:2.25:beta3 + cpe:/a:mozilla:thunderbird:3.1.6 + cpe:/a:mozilla:thunderbird:3.1.7 + cpe:/a:mozilla:thunderbird:2.0.0.18 + cpe:/a:mozilla:thunderbird:2.0.0.17 + cpe:/a:mozilla:thunderbird:2.0.0.16 + cpe:/a:mozilla:thunderbird:2.0.0.15 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:thunderbird:3.0.5 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:thunderbird:3.0.6 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:thunderbird:3.0.7 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:thunderbird:3.0.8 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:thunderbird:3.0 + cpe:/a:mozilla:thunderbird:3.1 + cpe:/a:mozilla:thunderbird:1.0.5:beta + cpe:/a:mozilla:thunderbird:2.0.0.21 + cpe:/a:mozilla:thunderbird:2.0.0.20 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:thunderbird:2.0.0.11 + cpe:/a:mozilla:thunderbird:2.0.0.12 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:thunderbird:2.0.0.13 + cpe:/a:mozilla:thunderbird:2.0.0.14 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:thunderbird:3.1.9 + cpe:/a:mozilla:thunderbird:3.1.8 + cpe:/a:mozilla:thunderbird:2.0.0.19 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:thunderbird:2.0.0.22 + cpe:/a:mozilla:thunderbird:2.0.0.23 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:thunderbird:1.5.0.10 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:thunderbird:1.5.0.13 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:thunderbird:7.0.1 + cpe:/a:mozilla:thunderbird:1.5.0.14 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.11 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:thunderbird:1.5.0.12 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:thunderbird:13.0.1 + cpe:/a:mozilla:thunderbird:2.0 + cpe:/a:mozilla:thunderbird:9.0.1 + cpe:/a:mozilla:thunderbird:10.0 + cpe:/a:mozilla:seamonkey:2.26:rc1 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:thunderbird:10.0.3 + cpe:/a:mozilla:thunderbird:10.0.4 + cpe:/a:mozilla:thunderbird:10.0.1 + cpe:/a:mozilla:thunderbird:10.0.2 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1529 + 2014-04-30T06:49:04.973-04:00 + 2014-04-30T13:12:49.910-04:00 + + + 9.3 + NETWORK + MEDIUM + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-30T13:12:46.863-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=987003 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-42.html + + The Web Notification API in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to bypass intended source-component restrictions and execute arbitrary JavaScript code in a privileged context via a crafted web page for which Notification.permission is granted. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:thunderbird:6.0.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:thunderbird:1.0 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:thunderbird:16.0 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:thunderbird:1.5 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:thunderbird:11.0 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:thunderbird:6.0.2 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:thunderbird:0.7.1 + cpe:/a:mozilla:thunderbird:0.7.2 + cpe:/a:mozilla:thunderbird:0.7.3 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:thunderbird:1.0.3 + cpe:/a:mozilla:thunderbird:1.5.2 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:thunderbird:1.0.4 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:thunderbird:1.0.5 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:thunderbird:1.0.6 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:thunderbird:3.1.15 + cpe:/a:mozilla:thunderbird:3.1.16 + cpe:/a:mozilla:thunderbird:3.1.17 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:thunderbird:1.0.2 + cpe:/a:mozilla:thunderbird:1.0.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:thunderbird:3.1.10 + cpe:/a:mozilla:thunderbird:1.5.1 + cpe:/a:mozilla:thunderbird:1.0.8 + cpe:/a:mozilla:thunderbird:1.0.7 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:thunderbird:3.1.14 + cpe:/a:mozilla:thunderbird:3.1.13 + cpe:/a:mozilla:thunderbird:3.1.12 + cpe:/a:mozilla:thunderbird:3.1.11 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:thunderbird:17.0.4 + cpe:/a:mozilla:seamonkey:2.25:- + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:thunderbird:12.0.1 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:thunderbird:1.5.0.3 + cpe:/a:mozilla:thunderbird:1.5.0.2 + cpe:/a:mozilla:thunderbird:1.5.0.1 + cpe:/a:mozilla:thunderbird:3.0.11 + cpe:/a:mozilla:thunderbird:3.0.10 + cpe:/a:mozilla:thunderbird:13.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:thunderbird:14.0 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:thunderbird:7.0 + cpe:/a:mozilla:thunderbird:8.0 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:thunderbird:0.2 + cpe:/a:mozilla:thunderbird:0.3 + cpe:/a:mozilla:thunderbird:0.4 + cpe:/a:mozilla:thunderbird:0.5 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:thunderbird:0.1 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:thunderbird:1.7.1 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:thunderbird:1.7.3 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:thunderbird:0.9 + cpe:/a:mozilla:thunderbird:0.8 + cpe:/a:mozilla:thunderbird:0.7 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:thunderbird:0.6 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:thunderbird:15.0.1 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:thunderbird:9.0 + cpe:/a:mozilla:thunderbird:6.0 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:28.0 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:thunderbird:12.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:thunderbird:15.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:thunderbird:24.0.1 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:thunderbird:2.0.0.5 + cpe:/a:mozilla:thunderbird:2.0.0.4 + cpe:/a:mozilla:thunderbird:2.0.0.7 + cpe:/a:mozilla:thunderbird:11.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.6 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:thunderbird:2.0.0.2 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:thunderbird:2.0.0.3 + cpe:/a:mozilla:thunderbird:2.0.0.0 + cpe:/a:mozilla:thunderbird:2.0.0.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:thunderbird:1.5.0.9 + cpe:/a:mozilla:thunderbird:1.5.0.8 + cpe:/a:mozilla:thunderbird:1.5.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.6 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.8 + cpe:/a:mozilla:thunderbird:2.0.0.9 + cpe:/a:mozilla:thunderbird:16.0.2 + cpe:/a:mozilla:thunderbird:16.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:thunderbird:24.3 + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:thunderbird:24.2 + cpe:/a:mozilla:firefox_esr:24.3 + cpe:/a:mozilla:thunderbird:3.0.9 + cpe:/a:mozilla:thunderbird:24.1 + cpe:/a:mozilla:thunderbird:24.0 + cpe:/a:mozilla:thunderbird:24.1.1 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:thunderbird:24.4 + cpe:/a:mozilla:firefox_esr:24.4 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:thunderbird:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:thunderbird:5.0 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:thunderbird:3.0.4 + cpe:/a:mozilla:thunderbird:3.0.3 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:thunderbird:3.0.2 + cpe:/a:mozilla:thunderbird:3.0.1 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:thunderbird:3.1.3 + cpe:/a:mozilla:thunderbird:3.1.2 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:thunderbird:3.1.1 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:thunderbird:3.1.4 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:thunderbird:3.1.5 + cpe:/a:mozilla:seamonkey:2.25:beta3 + cpe:/a:mozilla:thunderbird:3.1.6 + cpe:/a:mozilla:thunderbird:3.1.7 + cpe:/a:mozilla:thunderbird:2.0.0.18 + cpe:/a:mozilla:thunderbird:2.0.0.17 + cpe:/a:mozilla:thunderbird:2.0.0.16 + cpe:/a:mozilla:thunderbird:2.0.0.15 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:thunderbird:3.0.5 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:thunderbird:3.0.6 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:thunderbird:3.0.7 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:thunderbird:3.0.8 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:thunderbird:3.0 + cpe:/a:mozilla:thunderbird:3.1 + cpe:/a:mozilla:thunderbird:1.0.5:beta + cpe:/a:mozilla:thunderbird:2.0.0.21 + cpe:/a:mozilla:thunderbird:2.0.0.20 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:thunderbird:2.0.0.11 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:thunderbird:2.0.0.12 + cpe:/a:mozilla:thunderbird:2.0.0.13 + cpe:/a:mozilla:thunderbird:2.0.0.14 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:thunderbird:3.1.9 + cpe:/a:mozilla:thunderbird:3.1.8 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:thunderbird:2.0.0.19 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:thunderbird:2.0.0.22 + cpe:/a:mozilla:thunderbird:2.0.0.23 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:thunderbird:1.5.0.10 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.13 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.14 + cpe:/a:mozilla:thunderbird:7.0.1 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:thunderbird:1.5.0.11 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.12 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:thunderbird:13.0.1 + cpe:/a:mozilla:thunderbird:2.0 + cpe:/a:mozilla:thunderbird:9.0.1 + cpe:/a:mozilla:thunderbird:10.0 + cpe:/a:mozilla:seamonkey:2.26:rc1 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:thunderbird:10.0.3 + cpe:/a:mozilla:thunderbird:10.0.4 + cpe:/a:mozilla:thunderbird:10.0.1 + cpe:/a:mozilla:thunderbird:10.0.2 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1530 + 2014-04-30T06:49:05.003-04:00 + 2014-04-30T13:19:08.407-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-30T13:19:05.297-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=895557 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-43.html + + The docshell implementation in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to trigger the loading of a URL with a spoofed baseURI property, and conduct cross-site scripting (XSS) attacks, via a crafted web site that performs history navigation. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:thunderbird:6.0.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:thunderbird:1.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:thunderbird:16.0 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:thunderbird:1.5 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:thunderbird:11.0 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:thunderbird:6.0.2 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:thunderbird:0.7.1 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:thunderbird:0.7.2 + cpe:/a:mozilla:thunderbird:0.7.3 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:thunderbird:1.0.3 + cpe:/a:mozilla:thunderbird:1.5.2 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:thunderbird:1.0.4 + cpe:/a:mozilla:thunderbird:1.0.5 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:thunderbird:1.0.6 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:thunderbird:3.1.15 + cpe:/a:mozilla:thunderbird:3.1.16 + cpe:/a:mozilla:thunderbird:3.1.17 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:thunderbird:1.0.2 + cpe:/a:mozilla:thunderbird:1.0.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:thunderbird:3.1.10 + cpe:/a:mozilla:thunderbird:1.5.1 + cpe:/a:mozilla:thunderbird:1.0.8 + cpe:/a:mozilla:thunderbird:1.0.7 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:thunderbird:3.1.14 + cpe:/a:mozilla:thunderbird:3.1.13 + cpe:/a:mozilla:thunderbird:3.1.12 + cpe:/a:mozilla:thunderbird:3.1.11 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:thunderbird:17.0.4 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:seamonkey:2.25:- + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:thunderbird:12.0.1 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:thunderbird:1.5.0.3 + cpe:/a:mozilla:thunderbird:1.5.0.2 + cpe:/a:mozilla:thunderbird:1.5.0.1 + cpe:/a:mozilla:thunderbird:3.0.11 + cpe:/a:mozilla:thunderbird:3.0.10 + cpe:/a:mozilla:thunderbird:13.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:thunderbird:14.0 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:thunderbird:7.0 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:thunderbird:8.0 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:thunderbird:0.2 + cpe:/a:mozilla:thunderbird:0.3 + cpe:/a:mozilla:thunderbird:0.4 + cpe:/a:mozilla:thunderbird:0.5 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:thunderbird:0.1 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:thunderbird:1.7.1 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:thunderbird:1.7.3 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:thunderbird:0.9 + cpe:/a:mozilla:thunderbird:0.8 + cpe:/a:mozilla:thunderbird:0.7 + cpe:/a:mozilla:thunderbird:0.6 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:thunderbird:15.0.1 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:thunderbird:9.0 + cpe:/a:mozilla:thunderbird:6.0 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:28.0 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:thunderbird:12.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:thunderbird:15.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:thunderbird:24.0.1 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:thunderbird:2.0.0.5 + cpe:/a:mozilla:thunderbird:2.0.0.4 + cpe:/a:mozilla:thunderbird:2.0.0.7 + cpe:/a:mozilla:thunderbird:2.0.0.6 + cpe:/a:mozilla:thunderbird:11.0.1 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:thunderbird:2.0.0.2 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:thunderbird:2.0.0.3 + cpe:/a:mozilla:thunderbird:2.0.0.0 + cpe:/a:mozilla:thunderbird:2.0.0.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:thunderbird:1.5.0.9 + cpe:/a:mozilla:thunderbird:1.5.0.8 + cpe:/a:mozilla:thunderbird:1.5.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.6 + cpe:/a:mozilla:thunderbird:2.0.0.8 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.9 + cpe:/a:mozilla:thunderbird:16.0.2 + cpe:/a:mozilla:thunderbird:16.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:thunderbird:24.3 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:thunderbird:24.2 + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:thunderbird:24.1 + cpe:/a:mozilla:thunderbird:3.0.9 + cpe:/a:mozilla:firefox_esr:24.3 + cpe:/a:mozilla:thunderbird:24.0 + cpe:/a:mozilla:thunderbird:24.1.1 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:thunderbird:24.4 + cpe:/a:mozilla:firefox_esr:24.4 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:thunderbird:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:thunderbird:5.0 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:thunderbird:3.0.4 + cpe:/a:mozilla:thunderbird:3.0.3 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:thunderbird:3.0.2 + cpe:/a:mozilla:thunderbird:3.0.1 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:thunderbird:3.1.3 + cpe:/a:mozilla:thunderbird:3.1.2 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:thunderbird:3.1.1 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:thunderbird:3.1.4 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:thunderbird:3.1.5 + cpe:/a:mozilla:seamonkey:2.25:beta3 + cpe:/a:mozilla:thunderbird:3.1.6 + cpe:/a:mozilla:thunderbird:3.1.7 + cpe:/a:mozilla:thunderbird:2.0.0.18 + cpe:/a:mozilla:thunderbird:2.0.0.17 + cpe:/a:mozilla:thunderbird:2.0.0.16 + cpe:/a:mozilla:thunderbird:2.0.0.15 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:thunderbird:3.0.5 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:thunderbird:3.0.6 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:thunderbird:3.0.7 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:thunderbird:3.0.8 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:thunderbird:3.0 + cpe:/a:mozilla:thunderbird:3.1 + cpe:/a:mozilla:thunderbird:1.0.5:beta + cpe:/a:mozilla:thunderbird:2.0.0.21 + cpe:/a:mozilla:thunderbird:2.0.0.20 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:thunderbird:2.0.0.11 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:thunderbird:2.0.0.12 + cpe:/a:mozilla:thunderbird:2.0.0.13 + cpe:/a:mozilla:thunderbird:2.0.0.14 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:thunderbird:3.1.9 + cpe:/a:mozilla:thunderbird:3.1.8 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:thunderbird:2.0.0.19 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:thunderbird:2.0.0.22 + cpe:/a:mozilla:thunderbird:2.0.0.23 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:thunderbird:1.5.0.10 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:thunderbird:1.5.0.13 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:thunderbird:7.0.1 + cpe:/a:mozilla:thunderbird:1.5.0.14 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.11 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:thunderbird:1.5.0.12 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:thunderbird:13.0.1 + cpe:/a:mozilla:thunderbird:2.0 + cpe:/a:mozilla:thunderbird:9.0.1 + cpe:/a:mozilla:thunderbird:10.0 + cpe:/a:mozilla:seamonkey:2.26:rc1 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:thunderbird:10.0.3 + cpe:/a:mozilla:thunderbird:10.0.4 + cpe:/a:mozilla:thunderbird:10.0.1 + cpe:/a:mozilla:thunderbird:10.0.2 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1531 + 2014-04-30T06:49:05.037-04:00 + 2014-04-30T13:44:36.193-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-30T13:44:32.600-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=987140 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-44.html + + Use-after-free vulnerability in the nsGenericHTMLElement::GetWidthHeightForImage function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving an imgLoader object that is not properly handled during an image-resize operation. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mozilla:firefox:1.5.0.1 + cpe:/a:mozilla:firefox:1.5.0.2 + cpe:/a:mozilla:firefox:1.5.0.3 + cpe:/a:mozilla:thunderbird:6.0.1 + cpe:/a:mozilla:firefox:8.0 + cpe:/a:mozilla:firefox:5.0 + cpe:/a:mozilla:thunderbird:1.0 + cpe:/a:mozilla:firefox:17.0.7 + cpe:/a:mozilla:thunderbird:16.0 + cpe:/a:mozilla:firefox:17.0.6 + cpe:/a:mozilla:firefox:17.0.9 + cpe:/a:mozilla:firefox:17.0.8 + cpe:/a:mozilla:firefox:17.0.11 + cpe:/a:mozilla:firefox:3.0.9 + cpe:/a:mozilla:firefox:17.0.10 + cpe:/a:mozilla:thunderbird:1.5 + cpe:/a:mozilla:seamonkey:2.4.1 + cpe:/a:mozilla:thunderbird:11.0 + cpe:/a:mozilla:firefox:23.0 + cpe:/a:mozilla:thunderbird:6.0.2 + cpe:/a:mozilla:firefox:17.0.5 + cpe:/a:mozilla:firefox:17.0.4 + cpe:/a:mozilla:firefox:17.0.3 + cpe:/a:mozilla:firefox:17.0.2 + cpe:/a:mozilla:firefox:24.1 + cpe:/a:mozilla:firefox:24.0 + cpe:/a:mozilla:seamonkey:2.1:alpha1 + cpe:/a:mozilla:seamonkey:2.1:alpha3 + cpe:/a:mozilla:seamonkey:2.1:alpha2 + cpe:/a:mozilla:firefox:1.5:beta1 + cpe:/a:mozilla:firefox:1.5:beta2 + cpe:/a:mozilla:firefox:3.6.22 + cpe:/a:mozilla:seamonkey:2.0.12 + cpe:/a:mozilla:firefox:10.0.9 + cpe:/a:mozilla:firefox:3.6.21 + cpe:/a:mozilla:seamonkey:2.0.13 + cpe:/a:mozilla:firefox:3.6.20 + cpe:/a:mozilla:firefox:1.5.0.8 + cpe:/a:mozilla:seamonkey:2.0.10 + cpe:/a:mozilla:firefox:1.5.0.9 + cpe:/a:mozilla:seamonkey:2.0.11 + cpe:/a:mozilla:firefox:10.0.6 + cpe:/a:mozilla:firefox:3.6.26 + cpe:/a:mozilla:firefox:1.5.0.6 + cpe:/a:mozilla:firefox:10.0.5 + cpe:/a:mozilla:firefox:3.6.25 + cpe:/a:mozilla:firefox:1.5.0.7 + cpe:/a:mozilla:firefox:10.0.8 + cpe:/a:mozilla:firefox:3.6.24 + cpe:/a:mozilla:firefox:1.5.0.4 + cpe:/a:mozilla:seamonkey:2.0.14 + cpe:/a:mozilla:firefox:10.0.7 + cpe:/a:mozilla:firefox:3.6.23 + cpe:/a:mozilla:firefox:1.5.0.5 + cpe:/a:mozilla:firefox:10.0.1 + cpe:/a:mozilla:firefox:3.0.1 + cpe:/a:mozilla:firefox:10.0.2 + cpe:/a:mozilla:firefox:3.0.2 + cpe:/a:mozilla:firefox:10.0.3 + cpe:/a:mozilla:firefox:3.0.3 + cpe:/a:mozilla:firefox:10.0.4 + cpe:/a:mozilla:firefox:3.0.4 + cpe:/a:mozilla:firefox:3.0.5 + cpe:/a:mozilla:firefox:3.0.6 + cpe:/a:mozilla:firefox:3.0.7 + cpe:/a:mozilla:firefox:3.0.8 + cpe:/a:mozilla:firefox:19.0.2 + cpe:/a:mozilla:firefox:18.0.1 + cpe:/a:mozilla:firefox:19.0.1 + cpe:/a:mozilla:firefox:18.0.2 + cpe:/a:mozilla:thunderbird:0.7.1 + cpe:/a:mozilla:firefox:13.0 + cpe:/a:mozilla:thunderbird:0.7.2 + cpe:/a:mozilla:thunderbird:0.7.3 + cpe:/a:mozilla:firefox:6.0 + cpe:/a:mozilla:firefox:2.0 + cpe:/a:mozilla:firefox:14.0 + cpe:/a:mozilla:thunderbird:1.5.2 + cpe:/a:mozilla:thunderbird:1.0.3 + cpe:/a:mozilla:thunderbird:1.0.4 + cpe:/a:mozilla:seamonkey:2.0:alpha_1 + cpe:/a:mozilla:thunderbird:1.0.5 + cpe:/a:mozilla:firefox:4.0 + cpe:/a:mozilla:thunderbird:1.0.6 + cpe:/a:mozilla:firefox:9.0 + cpe:/a:mozilla:seamonkey:2.0:alpha_3 + cpe:/a:mozilla:seamonkey:2.0:alpha_2 + cpe:/a:mozilla:firefox:3.6.28 + cpe:/a:mozilla:firefox:3.6.27 + cpe:/a:mozilla:thunderbird:3.1.15 + cpe:/a:mozilla:seamonkey:2.0:rc2 + cpe:/a:mozilla:thunderbird:3.1.16 + cpe:/a:mozilla:thunderbird:3.1.17 + cpe:/a:mozilla:firefox:18.0 + cpe:/a:mozilla:thunderbird:1.0.2 + cpe:/a:mozilla:thunderbird:1.0.1 + cpe:/a:mozilla:seamonkey:2.1:rc1 + cpe:/a:mozilla:seamonkey:2.0:rc1 + cpe:/a:mozilla:seamonkey:2.1:rc2 + cpe:/a:mozilla:thunderbird:3.1.10 + cpe:/a:mozilla:thunderbird:1.5.1 + cpe:/a:mozilla:thunderbird:1.0.8 + cpe:/a:mozilla:thunderbird:1.0.7 + cpe:/a:mozilla:seamonkey:2.3.1 + cpe:/a:mozilla:seamonkey:2.3.2 + cpe:/a:mozilla:seamonkey:2.3.3 + cpe:/a:mozilla:firefox:9.0.1 + cpe:/a:mozilla:firefox:21.0 + cpe:/a:mozilla:firefox:3.6.10 + cpe:/a:mozilla:firefox:3.6.11 + cpe:/a:mozilla:firefox:3.6.12 + cpe:/a:mozilla:firefox:3.6.13 + cpe:/a:mozilla:firefox:3.6.14 + cpe:/a:mozilla:firefox:3.6.15 + cpe:/a:mozilla:firefox:3.5.3 + cpe:/a:mozilla:firefox:3.5.2 + cpe:/a:mozilla:firefox:3.5.1 + cpe:/a:mozilla:thunderbird:17.0.8 + cpe:/a:mozilla:thunderbird:17.0.6 + cpe:/a:mozilla:thunderbird:17.0.7 + cpe:/a:mozilla:thunderbird:3.1.14 + cpe:/a:mozilla:thunderbird:3.1.13 + cpe:/a:mozilla:thunderbird:3.1.12 + cpe:/a:mozilla:thunderbird:3.1.11 + cpe:/a:mozilla:thunderbird:17.0.1 + cpe:/a:mozilla:thunderbird:17.0.3 + cpe:/a:mozilla:firefox:3.6.19 + cpe:/a:mozilla:thunderbird:17.0.2 + cpe:/a:mozilla:firefox:3.6.18 + cpe:/a:mozilla:thunderbird:17.0.5 + cpe:/a:mozilla:firefox:3.6.17 + cpe:/a:mozilla:thunderbird:17.0.4 + cpe:/a:mozilla:firefox:3.6.16 + cpe:/a:mozilla:seamonkey:2.25:- + cpe:/a:mozilla:firefox:3.6 + cpe:/a:mozilla:firefox:3.5 + cpe:/a:mozilla:firefox:6.0.1 + cpe:/a:mozilla:firefox:6.0.2 + cpe:/a:mozilla:thunderbird:12.0.1 + cpe:/a:mozilla:firefox:4.0:beta10 + cpe:/a:mozilla:thunderbird:1.5.0.3 + cpe:/a:mozilla:thunderbird:1.5.0.2 + cpe:/a:mozilla:thunderbird:1.5.0.1 + cpe:/a:mozilla:thunderbird:3.0.11 + cpe:/a:mozilla:thunderbird:3.0.10 + cpe:/a:mozilla:thunderbird:13.0 + cpe:/a:mozilla:firefox:25.0.1 + cpe:/a:mozilla:firefox:4.0:beta11 + cpe:/a:mozilla:firefox:4.0:beta12 + cpe:/a:mozilla:firefox:3.0 + cpe:/a:mozilla:firefox:3.5.6 + cpe:/a:mozilla:firefox:3.5.7 + cpe:/a:mozilla:firefox:3.5.4 + cpe:/a:mozilla:firefox:3.5.5 + cpe:/a:mozilla:thunderbird:14.0 + cpe:/a:mozilla:firefox:3.5.8 + cpe:/a:mozilla:firefox:3.5.9 + cpe:/a:mozilla:seamonkey:2.0.3 + cpe:/a:mozilla:seamonkey:2.0.4 + cpe:/a:mozilla:seamonkey:2.0.5 + cpe:/a:mozilla:seamonkey:2.0.6 + cpe:/a:mozilla:seamonkey:2.0.7 + cpe:/a:mozilla:seamonkey:2.0.8 + cpe:/a:mozilla:seamonkey:2.0.9 + cpe:/a:mozilla:seamonkey:2.0.1 + cpe:/a:mozilla:firefox:2.0.0.10 + cpe:/a:mozilla:firefox:3.5.11 + cpe:/a:mozilla:firefox:3.5.12 + cpe:/a:mozilla:firefox:3.5.13 + cpe:/a:mozilla:firefox:3.5.14 + cpe:/a:mozilla:seamonkey:2.0.2 + cpe:/a:mozilla:firefox:3.5.10 + cpe:/a:mozilla:firefox:4.0:beta1 + cpe:/a:mozilla:firefox:4.0:beta7 + cpe:/a:mozilla:firefox:4.0:beta6 + cpe:/a:mozilla:firefox:4.0:beta5 + cpe:/a:mozilla:thunderbird:7.0 + cpe:/a:mozilla:firefox:4.0:beta4 + cpe:/a:mozilla:thunderbird:8.0 + cpe:/a:mozilla:firefox:4.0:beta3 + cpe:/a:mozilla:firefox:4.0:beta2 + cpe:/a:mozilla:firefox:4.0:beta8 + cpe:/a:mozilla:firefox:4.0:beta9 + cpe:/a:mozilla:seamonkey:2.13.2 + cpe:/a:mozilla:seamonkey:2.13.1 + cpe:/a:mozilla:thunderbird:0.2 + cpe:/a:mozilla:thunderbird:0.3 + cpe:/a:mozilla:thunderbird:0.4 + cpe:/a:mozilla:thunderbird:0.5 + cpe:/a:mozilla:firefox:3.6.7 + cpe:/a:mozilla:firefox:3.6.8 + cpe:/a:mozilla:firefox:3.6.9 + cpe:/a:mozilla:firefox:3.6.3 + cpe:/a:mozilla:firefox:3.6.4 + cpe:/a:mozilla:firefox:2.0.0.19 + cpe:/a:mozilla:thunderbird:0.1 + cpe:/a:mozilla:firefox:3.6.6 + cpe:/a:mozilla:firefox:1.5.3 + cpe:/a:mozilla:firefox:1.5.2 + cpe:/a:mozilla:firefox:1.0.2 + cpe:/a:mozilla:firefox:1.5.5 + cpe:/a:mozilla:firefox:1.0.1 + cpe:/a:mozilla:firefox:1.5.4 + cpe:/a:mozilla:firefox:7.0.1 + cpe:/a:mozilla:firefox:1.5.1 + cpe:/a:mozilla:firefox:2.0.0.18 + cpe:/a:mozilla:firefox:2.0.0.17 + cpe:/a:mozilla:firefox:2.0.0.16 + cpe:/a:mozilla:firefox:2.0.0.15 + cpe:/a:mozilla:firefox:2.0.0.14 + cpe:/a:mozilla:firefox:2.0.0.13 + cpe:/a:mozilla:firefox:2.0.0.12 + cpe:/a:mozilla:firefox:2.0.0.11 + cpe:/a:mozilla:thunderbird:1.7.1 + cpe:/a:mozilla:firefox:1.0.7 + cpe:/a:mozilla:thunderbird:1.7.3 + cpe:/a:mozilla:firefox:1.0.8 + cpe:/a:mozilla:firefox:1.0.5 + cpe:/a:mozilla:firefox:1.0.6 + cpe:/a:mozilla:firefox:1.0.3 + cpe:/a:mozilla:firefox:1.0.4 + cpe:/a:mozilla:thunderbird:17.0 + cpe:/a:mozilla:thunderbird:0.9 + cpe:/a:mozilla:thunderbird:0.8 + cpe:/a:mozilla:thunderbird:0.7 + cpe:/a:mozilla:thunderbird:0.6 + cpe:/a:mozilla:firefox:16.0 + cpe:/a:mozilla:firefox:2.0.0.20 + cpe:/a:mozilla:firefox:15.0 + cpe:/a:mozilla:thunderbird:15.0.1 + cpe:/a:mozilla:firefox:0.6.1 + cpe:/a:mozilla:firefox:3.0.10 + cpe:/a:mozilla:firefox:3.0.11 + cpe:/a:mozilla:firefox:3.0.12 + cpe:/a:mozilla:firefox:3.0.13 + cpe:/a:mozilla:firefox:3.0.14 + cpe:/a:mozilla:firefox:3.0.15 + cpe:/a:mozilla:firefox:3.0.16 + cpe:/a:mozilla:firefox:3.0.17 + cpe:/a:mozilla:thunderbird:9.0 + cpe:/a:mozilla:thunderbird:6.0 + cpe:/a:mozilla:firefox:16.0.2 + cpe:/a:mozilla:firefox:16.0.1 + cpe:/a:mozilla:firefox:3.6.2 + cpe:/a:mozilla:firefox:1.5.8 + cpe:/a:mozilla:firefox:1.5.7 + cpe:/a:mozilla:firefox:1.5.6 + cpe:/a:mozilla:firefox:24.1.1 + cpe:/a:mozilla:seamonkey:2.16.2 + cpe:/a:mozilla:seamonkey:2.16.1 + cpe:/a:mozilla:seamonkey:2.12.1 + cpe:/a:mozilla:seamonkey:2.9 + cpe:/a:mozilla:seamonkey:2.7 + cpe:/a:mozilla:seamonkey:2.8 + cpe:/a:mozilla:seamonkey:2.9.1 + cpe:/a:mozilla:seamonkey:2.5 + cpe:/a:mozilla:firefox_esr:24.1.0 + cpe:/a:mozilla:seamonkey:2.6 + cpe:/a:mozilla:seamonkey:2.3 + cpe:/a:mozilla:seamonkey:2.1 + cpe:/a:mozilla:seamonkey:2.2 + cpe:/a:mozilla:seamonkey:2.0 + cpe:/a:mozilla:firefox:1.5.0.11 + cpe:/a:mozilla:firefox:1.5.0.12 + cpe:/a:mozilla:firefox:28.0 + cpe:/a:mozilla:firefox:1.5.0.10 + cpe:/a:mozilla:firefox_esr:24.1.1 + cpe:/a:mozilla:seamonkey:2.4 + cpe:/a:mozilla:seamonkey:2.16 + cpe:/a:mozilla:seamonkey:2.17 + cpe:/a:mozilla:seamonkey:2.19 + cpe:/a:mozilla:firefox:13.0.1 + cpe:/a:mozilla:thunderbird:12.0 + cpe:/a:mozilla:firefox:20.0 + cpe:/a:mozilla:seamonkey:2.15 + cpe:/a:mozilla:thunderbird:15.0 + cpe:/a:mozilla:seamonkey:2.20 + cpe:/a:mozilla:firefox:19.0 + cpe:/a:mozilla:seamonkey:2.22 + cpe:/a:mozilla:seamonkey:2.21 + cpe:/a:mozilla:firefox:0.9.3 + cpe:/a:mozilla:seamonkey:2.24 + cpe:/a:mozilla:seamonkey:2.23 + cpe:/a:mozilla:firefox:2.0.0.9 + cpe:/a:mozilla:firefox:2.0.0.8 + cpe:/a:mozilla:firefox:0.10 + cpe:/a:mozilla:seamonkey:2.11 + cpe:/a:mozilla:seamonkey:2.10 + cpe:/a:mozilla:thunderbird:24.0.1 + cpe:/a:mozilla:seamonkey:2.14 + cpe:/a:mozilla:seamonkey:2.13 + cpe:/a:mozilla:seamonkey:2.12 + cpe:/a:mozilla:thunderbird:2.0.0.5 + cpe:/a:mozilla:thunderbird:2.0.0.4 + cpe:/a:mozilla:thunderbird:2.0.0.7 + cpe:/a:mozilla:thunderbird:2.0.0.6 + cpe:/a:mozilla:thunderbird:11.0.1 + cpe:/a:mozilla:seamonkey:2.15.1 + cpe:/a:mozilla:seamonkey:2.15.2 + cpe:/a:mozilla:firefox:3.5.19 + cpe:/a:mozilla:firefox:3.5.15 + cpe:/a:mozilla:firefox:3.5.16 + cpe:/a:mozilla:firefox:3.5.17 + cpe:/a:mozilla:firefox:3.5.18 + cpe:/a:mozilla:firefox:15.0.1 + cpe:/a:mozilla:seamonkey:2.10.1 + cpe:/a:mozilla:thunderbird:2.0.0.2 + cpe:/a:mozilla:firefox:0.9:rc + cpe:/a:mozilla:firefox:0.9.2 + cpe:/a:mozilla:thunderbird:2.0.0.3 + cpe:/a:mozilla:firefox:0.9.1 + cpe:/a:mozilla:thunderbird:2.0.0.0 + cpe:/a:mozilla:thunderbird:2.0.0.1 + cpe:/a:mozilla:seamonkey:2.7.1 + cpe:/a:mozilla:firefox:0.10.1 + cpe:/a:mozilla:seamonkey:2.7.2 + cpe:/a:mozilla:thunderbird:1.5.0.9 + cpe:/a:mozilla:thunderbird:1.5.0.8 + cpe:/a:mozilla:thunderbird:1.5.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.4 + cpe:/a:mozilla:thunderbird:1.5.0.7 + cpe:/a:mozilla:thunderbird:1.5.0.6 + cpe:/a:mozilla:thunderbird:2.0.0.8 + cpe:/a:mozilla:firefox:8.0.1 + cpe:/a:mozilla:thunderbird:2.0.0.9 + cpe:/a:mozilla:thunderbird:16.0.2 + cpe:/a:mozilla:thunderbird:16.0.1 + cpe:/a:mozilla:firefox:5.0.1 + cpe:/a:mozilla:thunderbird:24.3 + cpe:/a:mozilla:thunderbird:24.2 + cpe:/a:mozilla:firefox:1.0:preview_release + cpe:/a:mozilla:firefox_esr:24.2 + cpe:/a:mozilla:thunderbird:24.1 + cpe:/a:mozilla:thunderbird:3.0.9 + cpe:/a:mozilla:firefox_esr:24.3 + cpe:/a:mozilla:thunderbird:24.0 + cpe:/a:mozilla:thunderbird:24.1.1 + cpe:/a:mozilla:firefox_esr:24.0 + cpe:/a:mozilla:firefox:20.0.1 + cpe:/a:mozilla:thunderbird:24.4 + cpe:/a:mozilla:firefox_esr:24.4 + cpe:/a:mozilla:seamonkey:2.14:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta2 + cpe:/a:mozilla:seamonkey:2.14:beta3 + cpe:/a:mozilla:thunderbird:1.5:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta1 + cpe:/a:mozilla:seamonkey:2.12:beta6 + cpe:/a:mozilla:seamonkey:2.14:beta4 + cpe:/a:mozilla:seamonkey:2.10:beta1 + cpe:/a:mozilla:seamonkey:2.11:beta6 + cpe:/a:mozilla:seamonkey:2.13:beta4 + cpe:/a:mozilla:seamonkey:2.14:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta4 + cpe:/a:mozilla:seamonkey:2.13:beta5 + cpe:/a:mozilla:thunderbird:5.0 + cpe:/a:mozilla:seamonkey:2.11:beta4 + cpe:/a:mozilla:seamonkey:2.12:beta5 + cpe:/a:mozilla:seamonkey:2.12:beta2 + cpe:/a:mozilla:seamonkey:2.13:beta3 + cpe:/a:mozilla:seamonkey:2.11:beta2 + cpe:/a:mozilla:seamonkey:2.12:beta3 + cpe:/a:mozilla:seamonkey:2.14:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta3 + cpe:/a:mozilla:seamonkey:2.13:beta1 + cpe:/a:mozilla:seamonkey:2.10:beta3 + cpe:/a:mozilla:seamonkey:2.12:beta1 + cpe:/a:mozilla:seamonkey:2.13:beta6 + cpe:/a:mozilla:thunderbird:3.0.4 + cpe:/a:mozilla:thunderbird:3.0.3 + cpe:/a:mozilla:thunderbird:3.0.2 + cpe:/a:mozilla:firefox:26.0 + cpe:/a:mozilla:thunderbird:3.0.1 + cpe:/a:mozilla:seamonkey:2.0:beta_2 + cpe:/a:mozilla:seamonkey:2.0:beta_1 + cpe:/a:mozilla:thunderbird:3.1.3 + cpe:/a:mozilla:seamonkey:2.5:beta4 + cpe:/a:mozilla:thunderbird:3.1.2 + cpe:/a:mozilla:thunderbird:3.1.1 + cpe:/a:mozilla:seamonkey:2.8:beta5 + cpe:/a:mozilla:seamonkey:2.4:beta1 + cpe:/a:mozilla:seamonkey:2.7:beta4 + cpe:/a:mozilla:firefox:14.0.1 + cpe:/a:mozilla:seamonkey:2.6:beta4 + cpe:/a:mozilla:seamonkey:2.7:beta5 + cpe:/a:mozilla:thunderbird:3.1.4 + cpe:/a:mozilla:seamonkey:2.25:beta2 + cpe:/a:mozilla:thunderbird:3.1.5 + cpe:/a:mozilla:seamonkey:2.25:beta3 + cpe:/a:mozilla:thunderbird:3.1.6 + cpe:/a:mozilla:thunderbird:3.1.7 + cpe:/a:mozilla:thunderbird:2.0.0.18 + cpe:/a:mozilla:thunderbird:2.0.0.17 + cpe:/a:mozilla:thunderbird:2.0.0.16 + cpe:/a:mozilla:thunderbird:2.0.0.15 + cpe:/a:mozilla:seamonkey:2.20:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta3 + cpe:/a:mozilla:seamonkey:2.22:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta1 + cpe:/a:mozilla:thunderbird:3.0.5 + cpe:/a:mozilla:seamonkey:2.24:beta1 + cpe:/a:mozilla:seamonkey:2.21:beta2 + cpe:/a:mozilla:thunderbird:3.0.6 + cpe:/a:mozilla:seamonkey:2.23:beta1 + cpe:/a:mozilla:seamonkey:2.20:beta2 + cpe:/a:mozilla:thunderbird:3.0.7 + cpe:/a:mozilla:seamonkey:2.23:beta2 + cpe:/a:mozilla:thunderbird:3.0.8 + cpe:/a:mozilla:firefox:10.0 + cpe:/a:mozilla:seamonkey:2.25:beta1 + cpe:/a:mozilla:seamonkey:2.22:beta2 + cpe:/a:mozilla:seamonkey:2.11:beta5 + cpe:/a:mozilla:thunderbird:3.0 + cpe:/a:mozilla:thunderbird:3.1 + cpe:/a:mozilla:thunderbird:1.0.5:beta + cpe:/a:mozilla:thunderbird:2.0.0.21 + cpe:/a:mozilla:thunderbird:2.0.0.20 + cpe:/a:mozilla:seamonkey:2.19:beta2 + cpe:/a:mozilla:firefox:23.0.1 + cpe:/a:mozilla:seamonkey:2.17:beta2 + cpe:/a:mozilla:seamonkey:2.18:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta2 + cpe:/a:mozilla:seamonkey:2.15:beta2 + cpe:/a:mozilla:seamonkey:2.16:beta3 + cpe:/a:mozilla:seamonkey:2.18:beta1 + cpe:/a:mozilla:seamonkey:2.16:beta2 + cpe:/a:mozilla:seamonkey:2.17:beta3 + cpe:/a:mozilla:seamonkey:2.19:beta1 + cpe:/a:mozilla:seamonkey:2.6.1 + cpe:/a:mozilla:seamonkey:2.16:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta3 + cpe:/a:mozilla:seamonkey:2.17:beta1 + cpe:/a:mozilla:seamonkey:2.15:beta6 + cpe:/a:mozilla:seamonkey:2.17:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta1 + cpe:/a:mozilla:seamonkey:2.18:beta4 + cpe:/a:mozilla:seamonkey:2.15:beta4 + cpe:/a:mozilla:seamonkey:2.16:beta5 + cpe:/a:mozilla:seamonkey:2.16:beta4 + cpe:/a:mozilla:thunderbird:2.0.0.11 + cpe:/a:mozilla:thunderbird:2.0.0.12 + cpe:/a:mozilla:seamonkey:2.15:beta5 + cpe:/a:mozilla:thunderbird:2.0.0.13 + cpe:/a:mozilla:thunderbird:2.0.0.14 + cpe:/a:mozilla:seamonkey:2.9:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta2 + cpe:/a:mozilla:seamonkey:2.9:beta1 + cpe:/a:mozilla:seamonkey:2.6:beta2 + cpe:/a:mozilla:seamonkey:2.7:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta2 + cpe:/a:mozilla:seamonkey:2.8:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta6 + cpe:/a:mozilla:seamonkey:2.4:beta2 + cpe:/a:mozilla:seamonkey:2.5:beta3 + cpe:/a:mozilla:seamonkey:2.7:beta1 + cpe:/a:mozilla:seamonkey:2.5:beta2 + cpe:/a:mozilla:seamonkey:2.6:beta3 + cpe:/a:mozilla:seamonkey:2.8:beta1 + cpe:/a:mozilla:seamonkey:2.8:beta4 + cpe:/a:mozilla:seamonkey:2.5:beta1 + cpe:/a:mozilla:seamonkey:2.9:beta4 + cpe:/a:mozilla:seamonkey:2.4:beta3 + cpe:/a:mozilla:seamonkey:2.6:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta3 + cpe:/a:mozilla:seamonkey:2.3:beta1 + cpe:/a:mozilla:seamonkey:2.1:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta3 + cpe:/a:mozilla:seamonkey:2.1:beta1 + cpe:/a:mozilla:seamonkey:2.2:beta1 + cpe:/a:mozilla:thunderbird:3.1.9 + cpe:/a:mozilla:thunderbird:3.1.8 + cpe:/a:mozilla:thunderbird:2.0.0.19 + cpe:/a:mozilla:seamonkey:2.3:beta2 + cpe:/a:mozilla:seamonkey:2.2:beta2 + cpe:/a:mozilla:seamonkey:2.3:beta3 + cpe:/a:mozilla:thunderbird:2.0.0.22 + cpe:/a:mozilla:thunderbird:2.0.0.23 + cpe:/a:mozilla:firefox:27.0.1 + cpe:/a:mozilla:firefox:0.7.1 + cpe:/a:mozilla:firefox:25.0 + cpe:/a:mozilla:firefox:12.0:beta6 + cpe:/a:mozilla:firefox:0.1 + cpe:/a:mozilla:firefox:0.2 + cpe:/a:mozilla:thunderbird:1.5.0.10 + cpe:/a:mozilla:firefox:0.3 + cpe:/a:mozilla:firefox:0.4 + cpe:/a:mozilla:firefox:27.0 + cpe:/a:mozilla:firefox:0.5 + cpe:/a:mozilla:thunderbird:1.5.0.13 + cpe:/a:mozilla:firefox:2.0.0.4 + cpe:/a:mozilla:thunderbird:7.0.1 + cpe:/a:mozilla:thunderbird:1.5.0.14 + cpe:/a:mozilla:firefox:2.0.0.5 + cpe:/a:mozilla:thunderbird:1.5.0.11 + cpe:/a:mozilla:firefox:2.0.0.6 + cpe:/a:mozilla:thunderbird:1.5.0.12 + cpe:/a:mozilla:firefox:2.0.0.7 + cpe:/a:mozilla:firefox:2.0.0.1 + cpe:/a:mozilla:firefox:2.0.0.2 + cpe:/a:mozilla:firefox:1.0 + cpe:/a:mozilla:firefox:2.0.0.3 + cpe:/a:mozilla:firefox_esr:24.0.2 + cpe:/a:mozilla:firefox:12.0 + cpe:/a:mozilla:firefox:10.0.10 + cpe:/a:mozilla:firefox:10.0.11 + cpe:/a:mozilla:firefox:10.0.12 + cpe:/a:mozilla:firefox:1.5 + cpe:/a:mozilla:firefox:0.9 + cpe:/a:mozilla:firefox:11.0 + cpe:/a:mozilla:firefox:0.8 + cpe:/a:mozilla:firefox:0.7 + cpe:/a:mozilla:firefox:0.6 + cpe:/a:mozilla:firefox_esr:24.0.1 + cpe:/a:mozilla:seamonkey:2.17.1 + cpe:/a:mozilla:thunderbird:13.0.1 + cpe:/a:mozilla:thunderbird:2.0 + cpe:/a:mozilla:thunderbird:9.0.1 + cpe:/a:mozilla:thunderbird:10.0 + cpe:/a:mozilla:seamonkey:2.26:rc1 + cpe:/a:mozilla:seamonkey:2.22.1 + cpe:/a:mozilla:firefox:4.0.1 + cpe:/a:mozilla:thunderbird:10.0.3 + cpe:/a:mozilla:thunderbird:10.0.4 + cpe:/a:mozilla:thunderbird:10.0.1 + cpe:/a:mozilla:thunderbird:10.0.2 + cpe:/a:mozilla:firefox:3.0.18 + cpe:/a:mozilla:firefox:3.0.19 + cpe:/a:mozilla:firefox:7.0 + + CVE-2014-1532 + 2014-04-30T06:49:05.067-04:00 + 2014-04-30T13:51:29.847-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-30T13:51:26.927-04:00 + + + + + CONFIRM + https://bugzilla.mozilla.org/show_bug.cgi?id=966006 + + + CONFIRM + http://www.mozilla.org/security/announce/2014/mfsa2014-46.html + + Use-after-free vulnerability in the nsHostResolver::ConditionallyRefreshRecord function in libxul.so in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors related to host resolution. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:google:chrome:34.0.1847.131 + cpe:/a:google:chrome:34.0.1847.130 + + CVE-2014-1730 + 2014-04-26T06:55:05.433-04:00 + 2014-04-28T10:29:20.927-04:00 + + + 7.8 + NETWORK + LOW + NONE + COMPLETE + NONE + NONE + http://nvd.nist.gov + 2014-04-28T10:29:19.757-04:00 + + + + + CONFIRM + https://code.google.com/p/v8/source/detail?r=20595 + + + CONFIRM + https://code.google.com/p/v8/source/detail?r=20593 + + + CONFIRM + https://code.google.com/p/v8/source/detail?r=20388 + + + CONFIRM + https://code.google.com/p/v8/source/detail?r=20377 + + + CONFIRM + https://code.google.com/p/v8/source/detail?r=20375 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=354967 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html + + Google V8, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly store internationalization metadata, which allows remote attackers to bypass intended access restrictions by leveraging "type confusion" and reading property values, related to i18n.js and runtime.cc. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:google:chrome:34.0.1847.131 + cpe:/a:google:chrome:34.0.1847.130 + + CVE-2014-1731 + 2014-04-26T06:55:05.480-04:00 + 2014-04-28T10:31:52.497-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-28T10:31:51.403-04:00 + + + + + CONFIRM + https://src.chromium.org/viewvc/blink?revision=171216&view=revision + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=349903 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html + + core/html/HTMLSelectElement.cpp in the DOM implementation in Blink, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly check renderer state upon a focus event, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion" for SELECT elements. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:google:chrome:34.0.1847.131 + cpe:/a:google:chrome:34.0.1847.130 + + CVE-2014-1732 + 2014-04-26T06:55:05.513-04:00 + 2014-04-28T10:38:32.990-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-28T10:38:30.227-04:00 + + + + + CONFIRM + https://src.chromium.org/viewvc/chrome?revision=261737&view=revision + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=352851 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html + + Use-after-free vulnerability in browser/ui/views/speech_recognition_bubble_views.cc in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact via an INPUT element that triggers the presence of a Speech Recognition Bubble window for an incorrect duration. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:google:chrome:34.0.1847.131 + cpe:/a:google:chrome:34.0.1847.130 + + CVE-2014-1733 + 2014-04-26T06:55:05.543-04:00 + 2014-04-28T10:43:50.860-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-28T10:43:49.673-04:00 + + + + + CONFIRM + https://src.chromium.org/viewvc/chrome?revision=260157&view=revision + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=351103 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html + + The PointerCompare function in codegen.cc in Seccomp-BPF, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly merge blocks, which might allow remote attackers to bypass intended sandbox restrictions by leveraging renderer access. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:google:chrome:34.0.1847.131 + cpe:/a:google:chrome:34.0.1847.130 + + CVE-2014-1734 + 2014-04-26T06:55:05.560-04:00 + 2014-04-28T11:15:37.607-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-28T11:15:36.073-04:00 + + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=367314 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=357382 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=356181 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html + + Multiple unspecified vulnerabilities in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux allow attackers to cause a denial of service or possibly have other impact via unknown vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:google:chrome:34.0.1847.131 + cpe:/a:google:chrome:34.0.1847.130 + + CVE-2014-1735 + 2014-04-26T06:55:05.590-04:00 + 2014-04-28T11:21:36.240-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-28T11:21:35.007-04:00 + + + + CONFIRM + https://src.chromium.org/viewvc/blink?revision=171127&view=revision + + + CONFIRM + https://src.chromium.org/viewvc/blink?revision=171077&view=revision + + + CONFIRM + https://code.google.com/p/v8/source/detail?r=20624 + + + CONFIRM + https://code.google.com/p/v8/source/detail?r=20622 + + + CONFIRM + https://code.google.com/p/v8/source/detail?r=20501 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=360429 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=359525 + + + CONFIRM + https://code.google.com/p/chromium/issues/detail?id=359130 + + + CONFIRM + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html + + Multiple unspecified vulnerabilities in Google V8 before 3.24.35.33, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, allow attackers to cause a denial of service or possibly have other impact via unknown vectors. + + + + + + + + + cpe:/a:microsoft:internet_explorer:11:- + + CVE-2014-1762 + 2014-04-27T06:55:03.153-04:00 + 2014-04-28T12:15:10.007-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-28T12:15:09.977-04:00 + + + + MISC + http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/ + + + MISC + http://twitter.com/thezdi/statuses/443810610958958592 + + Unspecified vulnerability in Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code with medium-integrity privileges and bypass a sandbox protection mechanism via unknown vectors, as demonstrated by ZDI during a Pwn4Fun competition at CanSecWest 2014. + + + + + + + + + cpe:/a:microsoft:internet_explorer:11:- + + CVE-2014-1763 + 2014-04-27T06:55:03.200-04:00 + 2014-04-28T12:17:29.263-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-28T12:17:29.247-04:00 + + + + + MISC + http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/ + + + MISC + http://twitter.com/thezdi/statuses/443855973673754624 + + Use-after-free vulnerability in Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014. + + + + + + + + + cpe:/a:microsoft:internet_explorer:11:- + + CVE-2014-1764 + 2014-04-27T06:55:03.233-04:00 + 2014-04-28T12:26:37.700-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-28T12:26:37.670-04:00 + + + + + MISC + http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/ + + + MISC + http://twitter.com/thezdi/statuses/443855973673754624 + + Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism by leveraging "object confusion" in a broker process, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014. + + + + + + + + + cpe:/a:microsoft:internet_explorer:11:- + + CVE-2014-1765 + 2014-04-27T06:55:03.247-04:00 + 2014-04-28T12:34:52.230-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-28T12:34:52.183-04:00 + + + + + MISC + http://www.pwn2own.com/2014/03/pwn2own-results-thursday-day-two/ + + + MISC + http://twitter.com/thezdi/statuses/444216845734666240 + + Multiple use-after-free vulnerabilities in Microsoft Internet Explorer 11 allow remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by Sebastian Apelt and Andreas Schmidt during a Pwn2Own competition at CanSecWest 2014. + + + + + + + + + cpe:/o:microsoft:windows_8.1:- + + CVE-2014-1766 + 2014-04-27T06:55:03.280-04:00 + 2014-04-28T12:40:57.350-04:00 + + + 7.2 + LOCAL + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-28T12:40:57.303-04:00 + + + + MISC + http://www.pwn2own.com/2014/03/pwn2own-results-thursday-day-two/ + + + MISC + http://twitter.com/thezdi/statuses/444216845734666240 + + Unspecified vulnerability in the kernel in Microsoft Windows 8.1 allows local users to gain privileges via unknown vectors, as demonstrated by Sebastian Apelt and Andreas Schmidt during a Pwn2Own competition at CanSecWest 2014. + + + + + + + + + + + + + + cpe:/a:microsoft:internet_explorer:8 + cpe:/a:microsoft:internet_explorer:7 + cpe:/a:microsoft:internet_explorer:9 + cpe:/a:microsoft:internet_explorer:11:- + cpe:/a:microsoft:internet_explorer:6 + cpe:/a:microsoft:internet_explorer:10 + + CVE-2014-1776 + 2014-04-27T06:55:03.340-04:00 + 2014-04-28T12:53:15.060-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-28T12:53:15.013-04:00 + + + + + CONFIRM + https://technet.microsoft.com/library/security/2963983 + + + MISC + http://www.fireeye.com/blog/uncategorized/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html + + Use-after-free vulnerability in VGX.DLL in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as exploited in the wild in April 2014. + + + + + + + + + + + + cpe:/a:southrivertech:titan_ftp_server:10.01.1740 + cpe:/a:southrivertech:titan_ftp_server:10.0.1733 + cpe:/a:southrivertech:titan_ftp_server:10.40 + cpe:/a:southrivertech:titan_ftp_server:10.30 + + CVE-2014-1841 + 2014-04-29T06:37:03.763-04:00 + 2014-04-29T11:23:07.387-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-29T11:23:07.323-04:00 + + + + + FULLDISC + 20140210 Titan FTP Server Directory Traversal Vulnerabilities - [CVE-2014-1841 / CVE-2014-1842 / CVE-2014-1843] + + Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to copy an arbitrary user's home folder via a Move action with a .. (dot dot) in the src parameter. + + + + + + + + + + + + cpe:/a:southrivertech:titan_ftp_server:10.01.1740 + cpe:/a:southrivertech:titan_ftp_server:10.0.1733 + cpe:/a:southrivertech:titan_ftp_server:10.40 + cpe:/a:southrivertech:titan_ftp_server:10.30 + + CVE-2014-1842 + 2014-04-29T06:37:03.780-04:00 + 2014-04-29T11:24:52.327-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-29T11:24:52.280-04:00 + + + + + FULLDISC + 20140210 Titan FTP Server Directory Traversal Vulnerabilities - [CVE-2014-1841 / CVE-2014-1842 / CVE-2014-1843] + + Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to list all usernames via a Go action with a .. (dot dot) in the search-bar value. + + + + + + + + + + + + cpe:/a:southrivertech:titan_ftp_server:10.01.1740 + cpe:/a:southrivertech:titan_ftp_server:10.0.1733 + cpe:/a:southrivertech:titan_ftp_server:10.40 + cpe:/a:southrivertech:titan_ftp_server:10.30 + + CVE-2014-1843 + 2014-04-29T06:37:03.810-04:00 + 2014-04-29T11:34:23.800-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-29T11:34:23.737-04:00 + + + + + FULLDISC + 20140210 Titan FTP Server Directory Traversal Vulnerabilities - [CVE-2014-1841 / CVE-2014-1842 / CVE-2014-1843] + + Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to obtain the property information of an arbitrary home folder via a Properties action with a .. (dot dot) in the src parameter. + + + CVE-2014-1899 + 2014-05-02T10:55:05.933-04:00 + 2014-05-02T10:55:05.933-04:00 + + CONFIRM + https://support.citrix.com/article/CTX140291 + + Cross-site scripting (XSS) vulnerability in Citrix NetScaler Gateway (formerly Citrix Access Gateway Enterprise Edition) 9.x before 9.3.66.5 and 10.x before 10.1.123.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + cpe:/a:fortinet:fortiweb:5.0.2 + + CVE-2014-1955 + 2014-04-30T10:22:06.173-04:00 + 2014-05-01T08:14:40.323-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-05-01T08:14:40.247-04:00 + + + + + CONFIRM + http://www.fortiguard.com/advisory/FG-IR-13-009/ + + Cross-site scripting (XSS) vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + cpe:/a:fortinet:fortiweb:5.0.2 + + CVE-2014-1956 + 2014-04-30T10:22:06.203-04:00 + 2014-05-01T08:20:06.820-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-05-01T08:20:06.787-04:00 + + + + CONFIRM + http://www.fortiguard.com/advisory/FG-IR-13-009/ + + CRLF injection vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors. + + + + + + + + + cpe:/a:fortinet:fortiweb:5.0.2 + + CVE-2014-1957 + 2014-04-30T10:22:06.237-04:00 + 2014-05-01T08:54:07.450-04:00 + + + 6.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-05-01T08:54:06.467-04:00 + + + ALLOWS_USER_ACCESS + + + CONFIRM + http://www.fortiguard.com/advisory/FG-IR-13-009/ + + FortiGuard FortiWeb before 5.0.3 allows remote authenticated users to gain privileges via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cybozu:garoon:2.1.3 + cpe:/a:cybozu:garoon:2.1.2 + cpe:/a:cybozu:garoon:2.1.1 + cpe:/a:cybozu:garoon:2.5.4 + cpe:/a:cybozu:garoon:2.5.2 + cpe:/a:cybozu:garoon:2.5.3 + cpe:/a:cybozu:garoon:2.5.0 + cpe:/a:cybozu:garoon:2.5.1 + cpe:/a:cybozu:garoon:3.0.1 + cpe:/a:cybozu:garoon:3.0.3 + cpe:/a:cybozu:garoon:3.0.2 + cpe:/a:cybozu:garoon:3.7.1 + cpe:/a:cybozu:garoon:3.7.0 + cpe:/a:cybozu:garoon:3.7:sp2 + cpe:/a:cybozu:garoon:3.7:sp1 + cpe:/a:cybozu:garoon:3.1.3 + cpe:/a:cybozu:garoon:2.0.0 + cpe:/a:cybozu:garoon:3.1.0 + cpe:/a:cybozu:garoon:3.1.1 + cpe:/a:cybozu:garoon:3.1.2 + cpe:/a:cybozu:garoon:2.1.0 + cpe:/a:cybozu:garoon:3.7.2 + cpe:/a:cybozu:garoon:3.5.3 + cpe:/a:cybozu:garoon:3.5.0 + cpe:/a:cybozu:garoon:3.5.4 + cpe:/a:cybozu:garoon:3.0.0 + cpe:/a:cybozu:garoon:3.5.2 + cpe:/a:cybozu:garoon:3.5.1 + cpe:/a:cybozu:garoon:3.5.5 + + CVE-2014-1988 + 2014-05-02T06:55:07.430-04:00 + 2014-05-02T11:32:37.667-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-05-02T11:32:37.167-04:00 + + + + CONFIRM + https://support.cybozu.com/ja-jp/article/8105 + + + JVNDB + JVNDB-2014-000042 + + + JVN + JVN#90519014 + + The Phone Messages feature in Cybozu Garoon 2.0.0 through 3.7 SP2 allows remote authenticated users to cause a denial of service (resource consumption) via unspecified vectors. + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cybozu:garoon:3.1.3 + cpe:/a:cybozu:garoon:3.1.0 + cpe:/a:cybozu:garoon:3.1.1 + cpe:/a:cybozu:garoon:3.1.2 + cpe:/a:cybozu:garoon:3.7:sp3 + cpe:/a:cybozu:garoon:3.0.1 + cpe:/a:cybozu:garoon:3.0.3 + cpe:/a:cybozu:garoon:3.7.1 + cpe:/a:cybozu:garoon:3.0.2 + cpe:/a:cybozu:garoon:3.7.0 + cpe:/a:cybozu:garoon:3.7.2 + cpe:/a:cybozu:garoon:3.5.3 + cpe:/a:cybozu:garoon:3.5.4 + cpe:/a:cybozu:garoon:3.5.0 + cpe:/a:cybozu:garoon:3.7:sp2 + cpe:/a:cybozu:garoon:3.0.0 + cpe:/a:cybozu:garoon:3.7:sp1 + cpe:/a:cybozu:garoon:3.5.2 + cpe:/a:cybozu:garoon:3.5.5 + cpe:/a:cybozu:garoon:3.5.1 + + CVE-2014-1989 + 2014-05-02T06:55:07.787-04:00 + 2014-05-02T11:35:28.657-04:00 + + + 6.0 + NETWORK + MEDIUM + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-05-02T11:35:28.530-04:00 + + + + + CONFIRM + https://support.cybozu.com/ja/article/5264 + + + JVNDB + JVNDB-2014-000043 + + + JVN + JVN#31230946 + + Cybozu Garoon 3.0 through 3.7 SP3 allows remote authenticated users to bypass intended access restrictions and delete schedule information via unspecified API calls. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:livetecs:timeline:6.2.7 + cpe:/a:livetecs:timeline:2.94 + cpe:/a:livetecs:timeline:3.1.1 + cpe:/a:livetecs:timeline:3.5.1 + cpe:/a:livetecs:timeline:6.2.8 + cpe:/a:livetecs:timeline:2.91 + cpe:/a:livetecs:timeline:3.0.3 + cpe:/a:livetecs:timeline:3.0.1 + cpe:/a:livetecs:timeline:4.2.1 + cpe:/a:livetecs:timeline:2.81 + cpe:/a:livetecs:timeline:6.0.1 + cpe:/a:livetecs:timeline:3.0.5 + cpe:/a:livetecs:timeline:6.2.71 + cpe:/a:livetecs:timeline:3.6.1 + cpe:/a:livetecs:timeline:4.3.1 + cpe:/a:livetecs:timeline:6.2.1 + cpe:/a:livetecs:timeline:6.2.3 + cpe:/a:livetecs:timeline:3.8.1 + cpe:/a:livetecs:timeline:3.2.1 + cpe:/a:livetecs:timeline:6.2.4 + cpe:/a:livetecs:timeline:5.2.1 + cpe:/a:livetecs:timeline:4.9.1 + cpe:/a:livetecs:timeline:6.2.6 + cpe:/a:livetecs:timeline:3.7.1 + + CVE-2014-2042 + 2014-04-28T10:09:06.563-04:00 + 2014-04-29T08:18:50.870-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-29T08:18:50.713-04:00 + + + + BUGTRAQ + 20140423 CVE-2014-2042 - Unrestricted file upload in Livetecs Timelive + + + FULLDISC + 20140423 CVE-2014-2042 - Unrestricted file upload in Livetecs Timelive + + Unrestricted file upload vulnerability in the Manage Project functionality in Livetecs Timelive before 6.5.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in a predictable directory in Uploads/. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_system_software:f9.3 + cpe:/h:cisco:telepresence_system_codec_3000_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.2 + cpe:/h:cisco:telepresence_system_edge_75_mxp:- + cpe:/h:cisco:telepresence_system_edge_95_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.1 + cpe:/h:cisco:tandberg_880_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.0 + cpe:/h:cisco:telepresence_system_edge_85_mxp:- + cpe:/h:cisco:telepresence_system_codec_6000_mxp:- + cpe:/h:cisco:tandberg_550_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.1.2 + cpe:/a:cisco:telepresence_system_software:f9.1.1 + cpe:/h:cisco:tandberg_990_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.1.0 + cpe:/a:cisco:telepresence_system_software:fnc9.3 + cpe:/h:cisco:telepresence_system_1700_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.0.1 + cpe:/h:cisco:tandberg_770_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.0.2 + cpe:/h:cisco:telepresence_system_1000_mxp:- + cpe:/h:cisco:tandberg_2000_mxp:- + + CVE-2014-2156 + 2014-05-02T06:55:07.977-04:00 + 2014-05-02T11:49:05.840-04:00 + + + 7.1 + NETWORK + MEDIUM + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-05-02T11:49:05.340-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series + + Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCty45739. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_system_software:f9.3 + cpe:/h:cisco:telepresence_system_codec_3000_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.2 + cpe:/h:cisco:telepresence_system_edge_75_mxp:- + cpe:/h:cisco:telepresence_system_edge_95_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.1 + cpe:/h:cisco:tandberg_880_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.0 + cpe:/h:cisco:telepresence_system_edge_85_mxp:- + cpe:/h:cisco:telepresence_system_codec_6000_mxp:- + cpe:/h:cisco:tandberg_550_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.1.2 + cpe:/a:cisco:telepresence_system_software:f9.1.1 + cpe:/h:cisco:tandberg_990_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.1.0 + cpe:/a:cisco:telepresence_system_software:fnc9.3 + cpe:/h:cisco:telepresence_system_1700_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.0.1 + cpe:/h:cisco:tandberg_770_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.0.2 + cpe:/h:cisco:telepresence_system_1000_mxp:- + cpe:/h:cisco:tandberg_2000_mxp:- + + CVE-2014-2157 + 2014-05-02T06:55:08.007-04:00 + 2014-05-02T12:03:27.213-04:00 + + + 7.1 + NETWORK + MEDIUM + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-05-02T12:03:26.963-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series + + Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCty45733. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_system_software:f9.3 + cpe:/h:cisco:telepresence_system_codec_3000_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.2 + cpe:/h:cisco:telepresence_system_edge_75_mxp:- + cpe:/h:cisco:telepresence_system_edge_95_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.1 + cpe:/h:cisco:tandberg_880_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.0 + cpe:/h:cisco:telepresence_system_edge_85_mxp:- + cpe:/h:cisco:telepresence_system_codec_6000_mxp:- + cpe:/h:cisco:tandberg_550_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.1.2 + cpe:/a:cisco:telepresence_system_software:f9.1.1 + cpe:/h:cisco:tandberg_990_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.1.0 + cpe:/a:cisco:telepresence_system_software:fnc9.3 + cpe:/h:cisco:telepresence_system_1700_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.0.1 + cpe:/h:cisco:tandberg_770_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.0.2 + cpe:/h:cisco:telepresence_system_1000_mxp:- + cpe:/h:cisco:tandberg_2000_mxp:- + + CVE-2014-2158 + 2014-05-02T06:55:08.037-04:00 + 2014-05-02T12:18:44.133-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-05-02T12:18:43.603-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series + + Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCty45720. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_system_software:f9.3 + cpe:/h:cisco:telepresence_system_codec_3000_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.2 + cpe:/h:cisco:telepresence_system_edge_75_mxp:- + cpe:/h:cisco:telepresence_system_edge_95_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.1 + cpe:/h:cisco:tandberg_880_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.0 + cpe:/h:cisco:telepresence_system_edge_85_mxp:- + cpe:/h:cisco:telepresence_system_codec_6000_mxp:- + cpe:/h:cisco:tandberg_550_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.1.2 + cpe:/a:cisco:telepresence_system_software:f9.1.1 + cpe:/h:cisco:tandberg_990_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.1.0 + cpe:/a:cisco:telepresence_system_software:fnc9.3 + cpe:/h:cisco:telepresence_system_1700_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.0.1 + cpe:/h:cisco:tandberg_770_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.0.2 + cpe:/h:cisco:telepresence_system_1000_mxp:- + cpe:/h:cisco:tandberg_2000_mxp:- + + CVE-2014-2159 + 2014-05-02T06:55:08.070-04:00 + 2014-05-02T12:23:55.550-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-05-02T12:23:55.317-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series + + The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted packets, aka Bug ID CSCtq78722. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_system_software:f9.3 + cpe:/h:cisco:telepresence_system_codec_3000_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.2 + cpe:/h:cisco:telepresence_system_edge_75_mxp:- + cpe:/h:cisco:telepresence_system_edge_95_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.1 + cpe:/h:cisco:tandberg_880_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.0 + cpe:/h:cisco:telepresence_system_edge_85_mxp:- + cpe:/h:cisco:telepresence_system_codec_6000_mxp:- + cpe:/h:cisco:tandberg_550_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.1.2 + cpe:/a:cisco:telepresence_system_software:f9.1.1 + cpe:/h:cisco:tandberg_990_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.1.0 + cpe:/a:cisco:telepresence_system_software:fnc9.3 + cpe:/h:cisco:telepresence_system_1700_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.0.1 + cpe:/h:cisco:tandberg_770_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.0.2 + cpe:/h:cisco:telepresence_system_1000_mxp:- + cpe:/h:cisco:tandberg_2000_mxp:- + + CVE-2014-2160 + 2014-05-02T06:55:08.100-04:00 + 2014-05-02T12:40:58.290-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-05-02T12:40:57.930-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series + + The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted packets, aka Bug ID CSCty45745. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_system_software:f9.3 + cpe:/h:cisco:telepresence_system_codec_3000_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.2 + cpe:/h:cisco:telepresence_system_edge_75_mxp:- + cpe:/h:cisco:telepresence_system_edge_95_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.1 + cpe:/h:cisco:tandberg_880_mxp:- + cpe:/a:cisco:telepresence_system_software:fnc9.1.0 + cpe:/h:cisco:telepresence_system_edge_85_mxp:- + cpe:/h:cisco:telepresence_system_codec_6000_mxp:- + cpe:/h:cisco:tandberg_550_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.1.2 + cpe:/a:cisco:telepresence_system_software:f9.1.1 + cpe:/h:cisco:tandberg_990_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.1.0 + cpe:/a:cisco:telepresence_system_software:fnc9.3 + cpe:/h:cisco:telepresence_system_1700_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.0.1 + cpe:/h:cisco:tandberg_770_mxp:- + cpe:/a:cisco:telepresence_system_software:f9.0.2 + cpe:/h:cisco:telepresence_system_1000_mxp:- + cpe:/h:cisco:tandberg_2000_mxp:- + + CVE-2014-2161 + 2014-05-02T06:55:08.117-04:00 + 2014-05-02T12:43:40.373-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-05-02T12:43:40.200-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series + + The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted packets, aka Bug ID CSCty45731. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_tc_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.3 + cpe:/a:cisco:telepresence_tc_software:4.1.1 + cpe:/a:cisco:telepresence_te_software:4.1.0 + cpe:/a:cisco:telepresence_te_software:4.1.1 + cpe:/a:cisco:telepresence_tc_software:4.0.4 + cpe:/a:cisco:telepresence_te_software:6.0 + cpe:/a:cisco:telepresence_tc_software:4.0.0 + cpe:/a:cisco:telepresence_tc_software:4.0.1 + cpe:/a:cisco:telepresence_tc_software:4.2.0 + cpe:/a:cisco:telepresence_tc_software:4.2.1 + cpe:/a:cisco:telepresence_tc_software:4.2.2 + cpe:/a:cisco:telepresence_tc_software:4.2.3 + cpe:/a:cisco:telepresence_tc_software:4.2.4 + cpe:/a:cisco:telepresence_tc_software:5.1.3 + cpe:/a:cisco:telepresence_tc_software:5.0.2 + cpe:/a:cisco:telepresence_tc_software:5.1.4 + cpe:/a:cisco:telepresence_tc_software:5.1.1 + cpe:/a:cisco:telepresence_tc_software:5.1.2 + cpe:/a:cisco:telepresence_tc_software:5.1.5 + cpe:/a:cisco:telepresence_tc_software:5.1.7 + cpe:/a:cisco:telepresence_tc_software:5.1.0 + cpe:/a:cisco:telepresence_tc_software:5.0.0 + cpe:/a:cisco:telepresence_tc_software:5.1.6 + cpe:/a:cisco:telepresence_tc_software:5.0.1 + + CVE-2014-2162 + 2014-05-02T06:55:08.147-04:00 + 2014-05-02T14:14:17.070-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-05-02T14:14:14.103-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCud29566. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_tc_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.3 + cpe:/a:cisco:telepresence_tc_software:4.1.1 + cpe:/a:cisco:telepresence_te_software:4.1.0 + cpe:/a:cisco:telepresence_te_software:4.1.1 + cpe:/a:cisco:telepresence_tc_software:4.0.4 + cpe:/a:cisco:telepresence_tc_software:4.0.0 + cpe:/a:cisco:telepresence_tc_software:4.0.1 + cpe:/a:cisco:telepresence_tc_software:4.2.0 + cpe:/a:cisco:telepresence_tc_software:4.2.1 + cpe:/a:cisco:telepresence_tc_software:4.2.2 + cpe:/a:cisco:telepresence_tc_software:4.2.3 + cpe:/a:cisco:telepresence_tc_software:4.2.4 + cpe:/a:cisco:telepresence_tc_software:5.1.3 + cpe:/a:cisco:telepresence_tc_software:5.0.2 + cpe:/a:cisco:telepresence_tc_software:5.1.4 + cpe:/a:cisco:telepresence_tc_software:5.1.1 + cpe:/a:cisco:telepresence_tc_software:5.1.2 + cpe:/a:cisco:telepresence_tc_software:5.1.5 + cpe:/a:cisco:telepresence_tc_software:5.1.7 + cpe:/a:cisco:telepresence_tc_software:5.1.0 + cpe:/a:cisco:telepresence_tc_software:5.0.0 + cpe:/a:cisco:telepresence_tc_software:5.1.6 + cpe:/a:cisco:telepresence_tc_software:5.0.1 + + CVE-2014-2163 + 2014-05-02T06:55:08.180-04:00 + 2014-05-02T14:13:53.820-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-05-02T14:13:50.697-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCua64961. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_tc_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.3 + cpe:/a:cisco:telepresence_te_software:4.1.0 + cpe:/a:cisco:telepresence_tc_software:4.1.1 + cpe:/a:cisco:telepresence_te_software:4.1.1 + cpe:/a:cisco:telepresence_tc_software:4.0.4 + cpe:/a:cisco:telepresence_te_software:6.0 + cpe:/a:cisco:telepresence_tc_software:4.0.0 + cpe:/a:cisco:telepresence_tc_software:4.0.1 + cpe:/a:cisco:telepresence_tc_software:4.2.0 + cpe:/a:cisco:telepresence_tc_software:4.2.1 + cpe:/a:cisco:telepresence_tc_software:4.2.2 + cpe:/a:cisco:telepresence_tc_software:4.2.3 + cpe:/a:cisco:telepresence_tc_software:4.2.4 + cpe:/a:cisco:telepresence_tc_software:5.0.2 + cpe:/a:cisco:telepresence_tc_software:5.1.3 + cpe:/a:cisco:telepresence_tc_software:5.1.4 + cpe:/a:cisco:telepresence_tc_software:5.1.1 + cpe:/a:cisco:telepresence_tc_software:5.1.2 + cpe:/a:cisco:telepresence_tc_software:5.1.5 + cpe:/a:cisco:telepresence_tc_software:5.1.7 + cpe:/a:cisco:telepresence_tc_software:5.1.0 + cpe:/a:cisco:telepresence_tc_software:5.0.0 + cpe:/a:cisco:telepresence_tc_software:5.0.1 + cpe:/a:cisco:telepresence_tc_software:5.1.6 + + CVE-2014-2164 + 2014-05-02T06:55:08.193-04:00 + 2014-05-02T14:13:20.710-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-05-02T14:13:17.883-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCuj94651. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_tc_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.3 + cpe:/a:cisco:telepresence_te_software:4.1.0 + cpe:/a:cisco:telepresence_tc_software:4.1.1 + cpe:/a:cisco:telepresence_te_software:4.1.1 + cpe:/a:cisco:telepresence_tc_software:4.0.4 + cpe:/a:cisco:telepresence_te_software:6.0 + cpe:/a:cisco:telepresence_tc_software:4.0.0 + cpe:/a:cisco:telepresence_tc_software:4.0.1 + cpe:/a:cisco:telepresence_tc_software:4.2.0 + cpe:/a:cisco:telepresence_tc_software:4.2.1 + cpe:/a:cisco:telepresence_tc_software:4.2.2 + cpe:/a:cisco:telepresence_tc_software:4.2.3 + cpe:/a:cisco:telepresence_tc_software:4.2.4 + cpe:/a:cisco:telepresence_tc_software:5.0.2 + cpe:/a:cisco:telepresence_tc_software:5.1.3 + cpe:/a:cisco:telepresence_tc_software:5.1.4 + cpe:/a:cisco:telepresence_tc_software:5.1.1 + cpe:/a:cisco:telepresence_tc_software:5.1.2 + cpe:/a:cisco:telepresence_tc_software:5.1.5 + cpe:/a:cisco:telepresence_tc_software:5.1.7 + cpe:/a:cisco:telepresence_tc_software:5.1.0 + cpe:/a:cisco:telepresence_tc_software:5.0.0 + cpe:/a:cisco:telepresence_tc_software:5.0.1 + cpe:/a:cisco:telepresence_tc_software:5.1.6 + + CVE-2014-2165 + 2014-05-02T06:55:08.227-04:00 + 2014-05-02T14:12:54.537-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-05-02T14:12:52.367-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCtq72699. + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_tc_software:4.1.2 + cpe:/a:cisco:telepresence_tc_software:4.2.0 + cpe:/a:cisco:telepresence_te_software:4.1.2 + cpe:/a:cisco:telepresence_tc_software:4.2.1 + cpe:/a:cisco:telepresence_te_software:4.1.3 + cpe:/a:cisco:telepresence_tc_software:4.2.2 + cpe:/a:cisco:telepresence_tc_software:4.1.1 + cpe:/a:cisco:telepresence_tc_software:4.2.3 + cpe:/a:cisco:telepresence_te_software:4.1.0 + cpe:/a:cisco:telepresence_tc_software:4.2.4 + cpe:/a:cisco:telepresence_te_software:4.1.1 + cpe:/a:cisco:telepresence_tc_software:4.0.4 + cpe:/a:cisco:telepresence_tc_software:4.0.0 + cpe:/a:cisco:telepresence_tc_software:4.0.1 + + CVE-2014-2166 + 2014-05-02T06:55:08.240-04:00 + 2014-05-02T13:41:32.207-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-05-02T13:41:31.647-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + The SIP implementation in Cisco TelePresence TC Software 4.x and TE Software 4.x allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCto70562. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_tc_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.3 + cpe:/a:cisco:telepresence_tc_software:4.1.1 + cpe:/a:cisco:telepresence_te_software:4.1.0 + cpe:/a:cisco:telepresence_te_software:4.1.1 + cpe:/a:cisco:telepresence_tc_software:4.0.4 + cpe:/a:cisco:telepresence_te_software:6.0 + cpe:/a:cisco:telepresence_tc_software:4.0.0 + cpe:/a:cisco:telepresence_tc_software:4.0.1 + cpe:/a:cisco:telepresence_tc_software:4.2.0 + cpe:/a:cisco:telepresence_tc_software:4.2.1 + cpe:/a:cisco:telepresence_tc_software:4.2.2 + cpe:/a:cisco:telepresence_tc_software:4.2.3 + cpe:/a:cisco:telepresence_tc_software:4.2.4 + cpe:/a:cisco:telepresence_tc_software:5.1.3 + cpe:/a:cisco:telepresence_tc_software:5.0.2 + cpe:/a:cisco:telepresence_tc_software:5.1.4 + cpe:/a:cisco:telepresence_tc_software:5.1.1 + cpe:/a:cisco:telepresence_tc_software:5.1.2 + cpe:/a:cisco:telepresence_tc_software:5.1.5 + cpe:/a:cisco:telepresence_tc_software:5.1.7 + cpe:/a:cisco:telepresence_tc_software:5.1.0 + cpe:/a:cisco:telepresence_tc_software:5.0.0 + cpe:/a:cisco:telepresence_tc_software:5.1.6 + cpe:/a:cisco:telepresence_tc_software:5.0.1 + + CVE-2014-2167 + 2014-05-02T06:55:08.273-04:00 + 2014-05-02T14:12:16.380-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-05-02T14:12:14.223-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCua86589. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_tc_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.3 + cpe:/a:cisco:telepresence_te_software:4.1.0 + cpe:/a:cisco:telepresence_tc_software:4.1.1 + cpe:/a:cisco:telepresence_te_software:4.1.1 + cpe:/a:cisco:telepresence_tc_software:4.0.4 + cpe:/a:cisco:telepresence_te_software:6.0 + cpe:/a:cisco:telepresence_tc_software:4.0.0 + cpe:/a:cisco:telepresence_tc_software:4.0.1 + cpe:/a:cisco:telepresence_tc_software:4.2.0 + cpe:/a:cisco:telepresence_tc_software:4.2.1 + cpe:/a:cisco:telepresence_tc_software:4.2.2 + cpe:/a:cisco:telepresence_tc_software:4.2.3 + cpe:/a:cisco:telepresence_tc_software:4.2.4 + cpe:/a:cisco:telepresence_tc_software:5.0.2 + cpe:/a:cisco:telepresence_tc_software:5.1.3 + cpe:/a:cisco:telepresence_tc_software:5.1.4 + cpe:/a:cisco:telepresence_tc_software:5.1.1 + cpe:/a:cisco:telepresence_tc_software:5.1.2 + cpe:/a:cisco:telepresence_tc_software:5.1.5 + cpe:/a:cisco:telepresence_tc_software:5.1.7 + cpe:/a:cisco:telepresence_tc_software:5.1.0 + cpe:/a:cisco:telepresence_tc_software:5.0.0 + cpe:/a:cisco:telepresence_tc_software:5.0.1 + cpe:/a:cisco:telepresence_tc_software:5.1.6 + + CVE-2014-2168 + 2014-05-02T06:55:08.287-04:00 + 2014-05-02T14:11:50.380-04:00 + + + 7.6 + NETWORK + HIGH + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-05-02T14:11:45.863-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + Buffer overflow in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to execute arbitrary code via crafted DNS response packets, aka Bug ID CSCty44804. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_tc_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.3 + cpe:/a:cisco:telepresence_te_software:4.1.0 + cpe:/a:cisco:telepresence_tc_software:4.1.1 + cpe:/a:cisco:telepresence_te_software:4.1.1 + cpe:/a:cisco:telepresence_tc_software:4.0.4 + cpe:/a:cisco:telepresence_te_software:6.0 + cpe:/a:cisco:telepresence_tc_software:4.0.0 + cpe:/a:cisco:telepresence_tc_software:4.0.1 + cpe:/a:cisco:telepresence_tc_software:4.2.0 + cpe:/a:cisco:telepresence_tc_software:4.2.1 + cpe:/a:cisco:telepresence_tc_software:4.2.2 + cpe:/a:cisco:telepresence_tc_software:4.2.3 + cpe:/a:cisco:telepresence_tc_software:4.2.4 + cpe:/a:cisco:telepresence_tc_software:5.0.2 + cpe:/a:cisco:telepresence_tc_software:5.1.3 + cpe:/a:cisco:telepresence_tc_software:5.1.4 + cpe:/a:cisco:telepresence_tc_software:5.1.1 + cpe:/a:cisco:telepresence_tc_software:5.1.2 + cpe:/a:cisco:telepresence_tc_software:6.0.0 + cpe:/a:cisco:telepresence_tc_software:5.1.5 + cpe:/a:cisco:telepresence_tc_software:6.0.1 + cpe:/a:cisco:telepresence_tc_software:6.1.0 + cpe:/a:cisco:telepresence_tc_software:5.1.7 + cpe:/a:cisco:telepresence_tc_software:5.1.0 + cpe:/a:cisco:telepresence_tc_software:6.1.1 + cpe:/a:cisco:telepresence_tc_software:5.0.0 + cpe:/a:cisco:telepresence_tc_software:6.1.2 + cpe:/a:cisco:telepresence_tc_software:5.0.1 + cpe:/a:cisco:telepresence_tc_software:5.1.6 + + CVE-2014-2169 + 2014-05-02T06:55:08.320-04:00 + 2014-05-02T14:11:05.753-04:00 + + + 9.0 + NETWORK + LOW + SINGLE_INSTANCE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-05-02T14:11:03.360-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + Cisco TelePresence TC Software 4.x through 6.x before 6.2.0 and TE Software 4.x and 6.0 allow remote authenticated users to execute arbitrary commands by using the commands as arguments to internal system scripts, aka Bug ID CSCue60211. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_tc_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.3 + cpe:/a:cisco:telepresence_te_software:4.1.0 + cpe:/a:cisco:telepresence_tc_software:4.1.1 + cpe:/a:cisco:telepresence_te_software:4.1.1 + cpe:/a:cisco:telepresence_tc_software:4.0.4 + cpe:/a:cisco:telepresence_te_software:6.0 + cpe:/a:cisco:telepresence_tc_software:4.0.0 + cpe:/a:cisco:telepresence_tc_software:4.0.1 + cpe:/a:cisco:telepresence_tc_software:4.2.0 + cpe:/a:cisco:telepresence_tc_software:4.2.1 + cpe:/a:cisco:telepresence_tc_software:4.2.2 + cpe:/a:cisco:telepresence_tc_software:4.2.3 + cpe:/a:cisco:telepresence_tc_software:4.2.4 + cpe:/a:cisco:telepresence_tc_software:5.0.2 + cpe:/a:cisco:telepresence_tc_software:5.1.3 + cpe:/a:cisco:telepresence_tc_software:5.1.4 + cpe:/a:cisco:telepresence_tc_software:5.1.1 + cpe:/a:cisco:telepresence_tc_software:5.1.2 + cpe:/a:cisco:telepresence_tc_software:6.0.0 + cpe:/a:cisco:telepresence_tc_software:5.1.5 + cpe:/a:cisco:telepresence_tc_software:5.1.0 + cpe:/a:cisco:telepresence_tc_software:5.0.0 + cpe:/a:cisco:telepresence_tc_software:5.0.1 + cpe:/a:cisco:telepresence_tc_software:5.1.6 + + CVE-2014-2170 + 2014-05-02T06:55:08.337-04:00 + 2014-05-02T14:00:25.717-04:00 + + + 9.0 + NETWORK + LOW + SINGLE_INSTANCE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-05-02T14:00:25.403-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + Cisco TelePresence TC Software 4.x and 5.x before 5.1.7 and 6.x before 6.0.1 and TE Software 4.x and 6.0 allow remote authenticated users to execute arbitrary commands by using the commands as arguments to tshell (aka tcsh) scripts, aka Bug ID CSCue60202. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_te_software:6.0.1 + cpe:/a:cisco:telepresence_tc_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.3 + cpe:/a:cisco:telepresence_te_software:4.1.0 + cpe:/a:cisco:telepresence_tc_software:4.1.1 + cpe:/a:cisco:telepresence_te_software:4.1.1 + cpe:/a:cisco:telepresence_tc_software:4.0.4 + cpe:/a:cisco:telepresence_te_software:6.0 + cpe:/a:cisco:telepresence_tc_software:4.0.0 + cpe:/a:cisco:telepresence_tc_software:4.0.1 + cpe:/a:cisco:telepresence_tc_software:4.2.0 + cpe:/a:cisco:telepresence_tc_software:4.2.1 + cpe:/a:cisco:telepresence_tc_software:4.2.2 + cpe:/a:cisco:telepresence_tc_software:4.2.3 + cpe:/a:cisco:telepresence_tc_software:4.2.4 + cpe:/a:cisco:telepresence_tc_software:5.0.2 + cpe:/a:cisco:telepresence_tc_software:5.1.3 + cpe:/a:cisco:telepresence_tc_software:5.1.4 + cpe:/a:cisco:telepresence_tc_software:5.1.1 + cpe:/a:cisco:telepresence_tc_software:5.1.2 + cpe:/a:cisco:telepresence_tc_software:6.0.0 + cpe:/a:cisco:telepresence_tc_software:5.1.5 + cpe:/a:cisco:telepresence_tc_software:5.1.7 + cpe:/a:cisco:telepresence_tc_software:5.1.0 + cpe:/a:cisco:telepresence_tc_software:5.0.0 + cpe:/a:cisco:telepresence_tc_software:5.0.1 + cpe:/a:cisco:telepresence_tc_software:5.1.6 + + CVE-2014-2171 + 2014-05-02T06:55:08.367-04:00 + 2014-05-02T14:10:31.783-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-05-02T14:10:29.673-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + Heap-based buffer overflow in Cisco TelePresence TC Software 4.x through 6.x before 6.0.1 and TE Software 4.x and 6.0.x before 6.0.2 allows remote attackers to execute arbitrary code via crafted SIP packets, aka Bug ID CSCud81796. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_tc_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.3 + cpe:/a:cisco:telepresence_tc_software:4.1.1 + cpe:/a:cisco:telepresence_te_software:4.1.0 + cpe:/a:cisco:telepresence_te_software:4.1.1 + cpe:/a:cisco:telepresence_tc_software:4.0.4 + cpe:/a:cisco:telepresence_te_software:6.0 + cpe:/a:cisco:telepresence_tc_software:4.0.0 + cpe:/a:cisco:telepresence_tc_software:4.0.1 + cpe:/a:cisco:telepresence_tc_software:4.2.0 + cpe:/a:cisco:telepresence_tc_software:4.2.1 + cpe:/a:cisco:telepresence_tc_software:4.2.2 + cpe:/a:cisco:telepresence_tc_software:4.2.3 + cpe:/a:cisco:telepresence_tc_software:4.2.4 + cpe:/a:cisco:telepresence_tc_software:5.1.3 + cpe:/a:cisco:telepresence_tc_software:5.0.2 + cpe:/a:cisco:telepresence_tc_software:5.1.4 + cpe:/a:cisco:telepresence_tc_software:5.1.1 + cpe:/a:cisco:telepresence_tc_software:5.1.2 + cpe:/a:cisco:telepresence_tc_software:5.1.5 + cpe:/a:cisco:telepresence_tc_software:5.1.7 + cpe:/a:cisco:telepresence_tc_software:5.1.0 + cpe:/a:cisco:telepresence_tc_software:5.0.0 + cpe:/a:cisco:telepresence_tc_software:5.1.6 + cpe:/a:cisco:telepresence_tc_software:5.0.1 + + CVE-2014-2172 + 2014-05-02T06:55:08.383-04:00 + 2014-05-02T14:09:54.500-04:00 + + + 6.6 + LOCAL + MEDIUM + SINGLE_INSTANCE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-05-02T14:09:54.360-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + Buffer overflow in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows local users to gain privileges by leveraging improper handling of the u-boot compiler flag for internal executable files, aka Bug ID CSCub67693. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_tc_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.3 + cpe:/a:cisco:telepresence_te_software:4.1.0 + cpe:/a:cisco:telepresence_tc_software:4.1.1 + cpe:/a:cisco:telepresence_te_software:4.1.1 + cpe:/a:cisco:telepresence_tc_software:4.0.4 + cpe:/a:cisco:telepresence_te_software:6.0 + cpe:/a:cisco:telepresence_tc_software:4.0.0 + cpe:/a:cisco:telepresence_tc_software:4.0.1 + cpe:/a:cisco:telepresence_tc_software:4.2.0 + cpe:/a:cisco:telepresence_tc_software:4.2.1 + cpe:/a:cisco:telepresence_tc_software:4.2.2 + cpe:/a:cisco:telepresence_tc_software:4.2.3 + cpe:/a:cisco:telepresence_tc_software:4.2.4 + cpe:/a:cisco:telepresence_tc_software:5.0.2 + cpe:/a:cisco:telepresence_tc_software:5.1.3 + cpe:/a:cisco:telepresence_tc_software:5.1.4 + cpe:/a:cisco:telepresence_tc_software:5.1.1 + cpe:/a:cisco:telepresence_tc_software:5.1.2 + cpe:/a:cisco:telepresence_tc_software:5.1.5 + cpe:/a:cisco:telepresence_tc_software:5.1.7 + cpe:/a:cisco:telepresence_tc_software:5.1.0 + cpe:/a:cisco:telepresence_tc_software:5.0.0 + cpe:/a:cisco:telepresence_tc_software:5.0.1 + cpe:/a:cisco:telepresence_tc_software:5.1.6 + + CVE-2014-2173 + 2014-05-02T06:55:08.413-04:00 + 2014-05-02T14:15:25.027-04:00 + + + 7.2 + LOCAL + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-05-02T14:15:24.760-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 do not properly restrict access to the serial port, which allows local users to gain privileges via unspecified commands, aka Bug ID CSCub67692. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:cisco:telepresence_tc_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.2 + cpe:/a:cisco:telepresence_te_software:4.1.3 + cpe:/a:cisco:telepresence_tc_software:4.1.1 + cpe:/a:cisco:telepresence_te_software:4.1.0 + cpe:/a:cisco:telepresence_te_software:4.1.1 + cpe:/a:cisco:telepresence_tc_software:4.0.4 + cpe:/a:cisco:telepresence_te_software:6.0 + cpe:/a:cisco:telepresence_tc_software:4.0.0 + cpe:/a:cisco:telepresence_tc_software:4.0.1 + cpe:/a:cisco:telepresence_tc_software:4.2.0 + cpe:/a:cisco:telepresence_tc_software:4.2.1 + cpe:/a:cisco:telepresence_tc_software:4.2.2 + cpe:/a:cisco:telepresence_tc_software:4.2.3 + cpe:/a:cisco:telepresence_tc_software:4.2.4 + cpe:/a:cisco:telepresence_tc_software:5.1.3 + cpe:/a:cisco:telepresence_tc_software:5.0.2 + cpe:/a:cisco:telepresence_tc_software:5.1.4 + cpe:/a:cisco:telepresence_tc_software:5.1.1 + cpe:/a:cisco:telepresence_tc_software:5.1.2 + cpe:/a:cisco:telepresence_tc_software:5.1.5 + cpe:/a:cisco:telepresence_tc_software:5.1.7 + cpe:/a:cisco:telepresence_tc_software:5.1.0 + cpe:/a:cisco:telepresence_tc_software:5.0.0 + cpe:/a:cisco:telepresence_tc_software:5.1.6 + cpe:/a:cisco:telepresence_tc_software:5.0.1 + + CVE-2014-2175 + 2014-05-02T06:55:08.430-04:00 + 2014-05-02T14:17:51.313-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-05-02T14:17:51.077-04:00 + + + + + CISCO + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allow remote attackers to cause a denial of service (memory consumption) via crafted H.225 packets, aka Bug ID CSCtq78849. + + + + + + + + + + cpe:/a:cisco:unified_contact_center_enterprise + cpe:/a:cisco:unified_contact_center_express_editor_software:- + + CVE-2014-2180 + 2014-04-29T06:37:03.967-04:00 + 2014-04-29T11:42:38.457-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-29T11:42:38.363-04:00 + + + + + CISCO + 20140428 Cisco Unified Contact Center Express Arbitrary File Upload Vulnerability + + The Document Management component in Cisco Unified Contact Center Express does not properly validate a parameter, which allows remote authenticated users to upload files to arbitrary pathnames via a crafted HTTP request, aka Bug ID CSCun74133. + + + + + + + + + cpe:/a:cisco:adaptive_security_appliance_software:- + + CVE-2014-2182 + 2014-04-29T06:37:03.997-04:00 + 2014-04-29T11:46:24.903-04:00 + + + 6.1 + ADJACENT_NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-29T11:46:24.870-04:00 + + + + + CISCO + 20140428 Cisco ASA DHCPv6 Denial of Service Vulnerability + + Cisco Adaptive Security Appliance (ASA) Software, when DHCPv6 replay is configured, allows remote attackers to cause a denial of service (device reload) via a crafted DHCPv6 packet, aka Bug ID CSCun45520. + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:cisco:ios_xe:3.10.1s1 + cpe:/h:cisco:asr_1006_router:- + cpe:/h:cisco:asr_1023_router:- + cpe:/o:cisco:ios_xe:3.10.0s + cpe:/h:cisco:asr_1001_router:- + cpe:/h:cisco:asr_1002-x_router:- + cpe:/h:cisco:asr_1004_router:- + cpe:/o:cisco:ios_xe:3.10 + cpe:/h:cisco:asr_1013_router:- + cpe:/h:cisco:asr_1002_fixed_router:- + cpe:/h:cisco:asr_1002_router:- + cpe:/o:cisco:ios_xe:3.10.1s + cpe:/o:cisco:ios_xe:3.10.2s + + CVE-2014-2183 + 2014-04-29T06:37:04.013-04:00 + 2014-04-29T12:19:28.250-04:00 + + + 6.3 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-29T12:19:27.877-04:00 + + + + + CONFIRM + http://tools.cisco.com/security/center/viewAlert.x?alertId=33971 + + + CISCO + 20140428 Cisco IOS XE Software Malformed L2TP Packet Vulnerability + + The L2TP module in Cisco IOS XE 3.10S(.2) and earlier on ASR 1000 routers allows remote authenticated users to cause a denial of service (ESP card reload) via a malformed L2TP packet, aka Bug ID CSCun09973. + + + + + + + + + cpe:/a:cisco:unified_communications_manager + + CVE-2014-2184 + 2014-04-29T06:37:04.047-04:00 + 2014-04-29T12:08:03.257-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-29T12:08:03.210-04:00 + + + + + CISCO + 20140428 Cisco Unified Communications Manager Sensitive Information Disclosure Vulnerability + + The IP Manager Assistant (IPMA) component in Cisco Unified Communications Manager (Unified CM) allows remote attackers to obtain sensitive information via a crafted URL, aka Bug ID CSCun74352. + + + + + + + + + cpe:/a:cisco:unified_communications_manager + + CVE-2014-2185 + 2014-04-29T06:37:04.077-04:00 + 2014-04-29T12:08:08.930-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-29T12:08:08.900-04:00 + + + + + CISCO + 20140428 Cisco Unified Communications Manager CDR Management Vulnerability + + The Call Detail Records (CDR) Management component in Cisco Unified Communications Manager (Unified CM) allows remote authenticated users to obtain sensitive information by reading extraneous fields in an HTML document, aka Bug ID CSCun74374. + + + + + + + + + cpe:/a:cisco:webex_meetings_server:- + + CVE-2014-2186 + 2014-04-30T06:49:05.207-04:00 + 2014-04-30T13:56:16.513-04:00 + + + 6.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-30T13:56:16.467-04:00 + + + + + CISCO + 20140429 Cisco WebEx Meetings Server Cross-Site Request Forgery Vulnerability + + Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco WebEx Meetings Server allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj81777. + + + + + + + + + cpe:/a:ajenti:ajenti:1.2.13 + + CVE-2014-2260 + 2014-04-30T19:58:26.733-04:00 + 2014-05-01T11:42:19.917-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-05-01T11:42:19.870-04:00 + + + + + MISC + https://github.com/Eugeny/ajenti/commit/3270fd1d78391bb847b4c9ce37cf921f485b1310 + + + CONFIRM + https://github.com/Eugeny/ajenti/issues/233 + + + BID + 64982 + + + OSVDB + 102174 + + + MISC + http://packetstormsecurity.com/files/124804/Ajenti-1.2.13-Cross-Site-Scripting.html + + Cross-site scripting (XSS) vulnerability in plugins/main/content/js/ajenti.coffee in Eugene Pankov Ajenti 1.2.13 allows remote authenticated users to inject arbitrary web script or HTML via the command field in the Cron functionality. + + + + + + + + + cpe:/a:net-snmp:net-snmp:5.7.3:pre1 + + CVE-2014-2285 + 2014-04-27T18:55:05.990-04:00 + 2014-04-28T15:43:31.097-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-28T15:43:31.067-04:00 + + + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1072778 + + + CONFIRM + https://bugzilla.redhat.com/show_bug.cgi?id=1072044 + + + MISC + http://www.nntp.perl.org/group/perl.perl5.porters/2006/09/msg116250.html + + + CONFIRM + http://sourceforge.net/p/net-snmp/patches/1275/ + + + SUSE + openSUSE-SU-2014:0399 + + + SUSE + openSUSE-SU-2014:0398 + + + MLIST + [oss-security] 20140305 CVE request for two net-snmp remote DoS flaws + + The perl_trapd_handler function in perl/TrapReceiver/TrapReceiver.xs in Net-SNMP 5.7.3.pre3 and earlier, when using certain Perl versions, allows remote attackers to cause a denial of service (snmptrapd crash) via an empty community string in an SNMP trap, which triggers a NULL pointer dereference within the newSVpv function in Perl. + + + CVE-2014-2322 + 2014-05-02T10:55:07.217-04:00 + 2014-05-02T10:55:07.217-04:00 + + MISC + http://www.vapid.dhs.org/advisories/arabic-ruby-gem.html + + + MLIST + [oss-security] 20140312 Re: Remote Command Injection in Arabic Prawn 0.0.1 Ruby Gem + + + MLIST + [oss-security] 20140310 Remote Command Injection in Arabic Prawn 0.0.1 Ruby Gem + + lib/string_utf_support.rb in the Arabic Prawn 0.0.1 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) downloaded_file or (2) url variable. + + + + + + + + + cpe:/a:dompdf:dompdf:0.6.0:beta3 + + CVE-2014-2383 + 2014-04-28T10:09:06.707-04:00 + 2014-04-29T08:18:44.760-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-29T08:18:44.683-04:00 + + + + + MISC + https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2383/ + + + CONFIRM + https://github.com/dompdf/dompdf/commit/23a693993299e669306929e3d49a4a1f7b3fb028 + + + BUGTRAQ + 20140423 CVE-2014-2383 - Arbitrary file read in dompdf + + + FULLDISC + 20140423 CVE-2014-2383 - Arbitrary file read in dompdf + + dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:tibco:managed_file_transfer_internet_server:7.0 + cpe:/a:tibco:slingshot:1.9.0 + cpe:/a:tibco:managed_file_transfer_command_center:6.7 + cpe:/a:tibco:managed_file_transfer_command_center:7.2.0 + cpe:/a:tibco:managed_file_transfer_command_center:7.2.1 + cpe:/a:tibco:slingshot:1.7.0 + cpe:/a:tibco:vault:1.0.0 + cpe:/a:tibco:managed_file_transfer_command_center:7.1.0 + cpe:/a:tibco:managed_file_transfer_internet_server:7.0.1 + cpe:/a:tibco:managed_file_transfer_internet_server:7.1.0 + cpe:/a:tibco:managed_file_transfer_internet_server:7.2.0 + cpe:/a:tibco:managed_file_transfer_internet_server:7.2.1 + cpe:/a:tibco:managed_file_transfer_internet_server:6.7 + cpe:/a:tibco:managed_file_transfer_command_center:7.0 + cpe:/a:tibco:slingshot:1.8.0 + cpe:/a:tibco:slingshot:1.8.1 + cpe:/a:tibco:managed_file_transfer_command_center:7.0.1 + + CVE-2014-2545 + 2014-04-30T06:49:05.380-04:00 + 2014-05-01T15:15:07.567-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-04-30T14:17:44.543-04:00 + + + + + CONFIRM + http://www.tibco.com/multimedia/mft_advisory_20140429_tcm8-21013.txt + + + CONFIRM + http://www.tibco.com/mk/advisory.jsp + + TIBCO Managed File Transfer Internet Server before 7.2.2, Managed File Transfer Command Center before 7.2.2, Slingshot before 1.9.1, and Vault before 1.0.1 allow remote attackers to obtain sensitive information via a crafted HTTP request. + + + + + + + + + + + + + + + + cpe:/a:bluecoat:content_analysis_system_software:1.1.2.1 + cpe:/h:bluecoat:content_analysis_system:- + cpe:/a:bluecoat:content_analysis_system_software:1.1 + cpe:/a:bluecoat:content_analysis_system_software:1.1.1.1 + + CVE-2014-2565 + 2014-04-30T10:22:06.377-04:00 + 2014-05-01T09:49:31.517-04:00 + + + 6.5 + ADJACENT_NETWORK + HIGH + SINGLE_INSTANCE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-05-01T09:49:31.437-04:00 + + + + + CONFIRM + https://kb.bluecoat.com/index?page=content&id=SA78&actp=LIST + + The commandline interface in Blue Coat Content Analysis System (CAS) 1.1 before 1.1.4.2 allows remote administrators to execute arbitrary commands via unspecified vectors, related to "command injection." + + + + + + + + + cpe:/a:xcloner:xcloner:3.5::standalone + + CVE-2014-2579 + 2014-04-25T16:55:03.007-04:00 + 2014-04-28T08:01:35.070-04:00 + + + 7.6 + NETWORK + HIGH + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-28T08:01:34.070-04:00 + + + + + MISC + https://www.htbridge.com/advisory/HTB23207 + + + BUGTRAQ + 20140409 &ETH;&iexcl;ross-Site Request Forgery (CSRF) in XCloner Standalone + + + EXPLOIT-DB + 32790 + + Multiple cross-site request forgery (CSRF) vulnerabilities in XCloner Standalone 3.5 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) change the administrator password via the config task to index2.php or (2) when the enable_db_backup and sql_mem options are enabled, access the database backup functionality via the dbbackup_comp parameter in the generate action to index2.php. NOTE: vector 2 might be a duplicate of CVE-2014-2340, which is for the XCloner Wordpress plugin. NOTE: remote attackers can leverage CVE-2014-2996 with vector 2 to execute arbitrary commands. + + + + + + + + + + + + + + + + + + + cpe:/o:hp:integrated_lights-out_2_firmware:1.75 + cpe:/o:hp:integrated_lights-out_2_firmware:1.30 + cpe:/o:hp:integrated_lights-out_2_firmware:1.20 + cpe:/o:hp:integrated_lights-out_2_firmware:1.00 + cpe:/o:hp:integrated_lights-out_2_firmware:1.10 + cpe:/o:hp:integrated_lights-out_2_firmware:2.22 + cpe:/o:hp:integrated_lights-out_2_firmware:2.23 + cpe:/o:hp:integrated_lights-out_2_firmware:2.20 + cpe:/o:hp:integrated_lights-out_2_firmware:2.12 + cpe:/o:hp:integrated_lights-out_2_firmware:2.15 + cpe:/o:hp:integrated_lights-out_2_firmware:1.70 + + CVE-2014-2601 + 2014-04-24T19:55:05.580-04:00 + 2014-04-25T09:20:31.153-04:00 + + + 7.8 + NETWORK + LOW + NONE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-25T09:20:31.043-04:00 + + + + HP + SSRT101509 + + + HP + HPSBHF03006 + + The server in HP Integrated Lights-Out 2 (aka iLO 2) 2.23 and earlier allows remote attackers to cause a denial of service via crafted HTTPS traffic, as demonstrated by traffic from a CVE-2014-0160 vulnerability-assessment tool. + + + + + + + + + cpe:/a:papercut:papercut_mf:14.1 + + CVE-2014-2657 + 2014-04-28T10:09:07.080-04:00 + 2014-04-29T09:08:14.863-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-29T09:08:14.817-04:00 + + + + XF + papercut-cve20142657-unspec(92650) + + + CONFIRM + http://www.papercut-mf.com/release-history/ + + Unspecified vulnerability in the print release functionality in PaperCut MF 14.1 (Build 26983) has unknown impact and remote vectors, related to embedded MFPs. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:papercut:papercut_mf:14.0 + cpe:/a:papercut:papercut_mf:14.1 + cpe:/a:papercut:papercut_mf:13.0 + cpe:/a:papercut:papercut_ng:13.5 + cpe:/a:papercut:papercut_mf:13.2 + cpe:/a:papercut:papercut_ng:13.4 + cpe:/a:papercut:papercut_ng:12.4 + cpe:/a:papercut:papercut_mf:13.1 + cpe:/a:papercut:papercut_ng:12.2 + cpe:/a:papercut:papercut_ng:12.3 + cpe:/a:papercut:papercut_mf:13.3 + cpe:/a:papercut:papercut_ng:12.0 + cpe:/a:papercut:papercut_ng:12.1 + cpe:/a:papercut:papercut_mf:12.5 + cpe:/a:papercut:papercut_ng:14.0 + cpe:/a:papercut:papercut_ng:14.1 + cpe:/a:papercut:papercut_ng:13.2 + cpe:/a:papercut:papercut_mf:12.4 + cpe:/a:papercut:papercut_ng:13.1 + cpe:/a:papercut:papercut_ng:13.0 + cpe:/a:papercut:papercut_mf:12.0 + cpe:/a:papercut:papercut_mf:12.1 + cpe:/a:papercut:papercut_mf:12.2 + cpe:/a:papercut:papercut_ng:13.3 + cpe:/a:papercut:papercut_mf:12.3 + cpe:/a:papercut:papercut_ng:12.5 + cpe:/a:papercut:papercut_mf:13.5 + cpe:/a:papercut:papercut_mf:13.4 + + CVE-2014-2658 + 2014-04-28T10:09:07.517-04:00 + 2014-04-29T09:03:33.383-04:00 + + + 5.0 + NETWORK + LOW + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-29T09:03:33.070-04:00 + + + + XF + papercut-cve20142658-dos(92649) + + + CONFIRM + http://www.papercut.com/release-history/ + + + CONFIRM + http://www.papercut-mf.com/release-history/ + + + SECUNIA + 58037 + + Unspecified vulnerability in Papercut MF and NG before 14.1 (Build 26983) allows attacker to cause a denial of service via unknown vectors. + + + + + + + + + + + + cpe:/a:videowhisper:videowhisper:7.x-1.3::~~~drupal~~ + cpe:/a:videowhisper:videowhisper:7.x-1.0::~~~drupal~~ + cpe:/a:videowhisper:videowhisper:7.x-1.1::~~~drupal~~ + cpe:/a:videowhisper:videowhisper:7.x-1.x:dev:~~~drupal~~ + + CVE-2014-2715 + 2014-04-28T10:09:07.643-04:00 + 2014-04-29T08:57:40.247-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-29T08:57:40.170-04:00 + + + + + BUGTRAQ + 20140425 [CVE-2014-2715] Cross-site scripting (XSS) vulnerability in Videowhisper + + Multiple cross-site scripting (XSS) vulnerabilities in vwrooms\templates\logout.tpl.php in the VideoWhisper Webcam plugins for Drupal 7.x allow remote attackers to inject arbitrary web script or HTML via the (1) module or (2) message parameter to index.php. + + + + + + + + + cpe:/a:ektron:ektron_content_management_system:8.7.0 + + CVE-2014-2729 + 2014-04-25T10:15:30.517-04:00 + 2014-04-25T13:51:50.370-04:00 + + + 3.5 + NETWORK + MEDIUM + SINGLE_INSTANCE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-25T13:51:50.260-04:00 + + + + + BUGTRAQ + 20140416 [SECURITY] Stored Cross Site Scripting in Ektron CMS 8.7 + + + BUGTRAQ + 20140416 [Security Advisory] Stored Cross Site Scripting in Ektron CMS 8.7 + + + MISC + http://packetstormsecurity.com/files/126187/Ektron-CMS-8.7-Cross-Site-Scripting.html + + Cross-site scripting (XSS) vulnerability in content.aspx in Ektron CMS 8.7 before 8.7.0.055 allows remote authenticated users to inject arbitrary web script or HTML via the category0 parameter, which is not properly handled when displaying the Subjects tab in the View Properties menu option. + + + + + + + + + + + + + + + + + + + + cpe:/a:ruby-lang:ruby:2.0.0:rc2 + cpe:/a:ruby-lang:ruby:2.0.0:p247 + cpe:/a:ruby-lang:ruby:2.1:preview1 + cpe:/a:ruby-lang:ruby:2.0.0:rc1 + cpe:/a:ruby-lang:ruby:2.0.0:p195 + cpe:/a:ruby-lang:ruby:2.0.0:p0 + cpe:/a:ruby-lang:ruby:2.0.0:preview2 + cpe:/a:ruby-lang:ruby:2.0.0:preview1 + cpe:/a:ruby-lang:ruby:2.1.1 + cpe:/a:ruby-lang:ruby:2.1:- + cpe:/a:ruby-lang:ruby:2.0 + cpe:/a:ruby-lang:ruby:2.0.0 + + CVE-2014-2734 + 2014-04-24T19:55:05.707-04:00 + 2014-04-25T09:30:18.403-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-25T09:30:13.623-04:00 + + + + + MISC + https://gist.github.com/10446549 + + + FULLDISC + 20140416 Ruby OpenSSL private key spoofing ~ CVE-2014-2734 with PoC + + + MISC + http://packetstormsecurity.com/files/126218/Ruby-OpenSSL-Private-Key-Spoofing.html + + The openssl extension in Ruby 2.x does not properly maintain the state of process memory after a file is reopened, which allows remote attackers to spoof signatures within the context of a Ruby script that attempts signature verification after performing a certain sequence of filesystem operations. + + + + + + + + + + + + + + cpe:/a:wdc:arkeia_virtual_appliance:- + cpe:/o:wdc:arkeia_virtual_appliance_firmware:10.2.7 + + CVE-2014-2846 + 2014-04-28T10:09:07.877-04:00 + 2014-04-29T09:07:44.203-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-29T09:07:44.127-04:00 + + + + + BUGTRAQ + 20140423 SEC Consult SA-20140423-0 :: Path Traversal/Remote Code Execution in WD Arkeia Network Backup Appliances + + + FULLDISC + 20140423 SEC Consult SA-20140423-0 :: Path Traversal/Remote Code Execution in WD Arkeia Network Backup Appliances + + Directory traversal vulnerability in opt/arkeia/wui/htdocs/index.php in the WD Arkeia virtual appliance (AVA) with firmware before 10.2.9 allows remote attackers to read arbitrary files and execute arbitrary PHP code via a ..././ (dot dot dot slash dot slash) in the lang Cookie parameter, as demonstrated by a request to login/doLogin. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:mediawiki:mediawiki:1.4:beta2 + cpe:/a:mediawiki:mediawiki:1.4:beta3 + cpe:/a:mediawiki:mediawiki:1.17:beta_1 + cpe:/a:mediawiki:mediawiki:1.4:beta1 + cpe:/a:mediawiki:mediawiki:1.14.0:rc1 + cpe:/a:mediawiki:mediawiki:1.21.1 + cpe:/a:mediawiki:mediawiki:1.13.1 + cpe:/a:mediawiki:mediawiki:1.13.0 + cpe:/a:mediawiki:mediawiki:1.20.1 + cpe:/a:mediawiki:mediawiki:1.17.0:rc1 + cpe:/a:mediawiki:mediawiki:1.11 + cpe:/a:mediawiki:mediawiki:1.18:beta_1 + cpe:/a:mediawiki:mediawiki:1.19:beta_2 + cpe:/a:mediawiki:mediawiki:1.13.4 + cpe:/a:mediawiki:mediawiki:1.19:beta_1 + cpe:/a:mediawiki:mediawiki:1.13.3 + cpe:/a:mediawiki:mediawiki:1.13.2 + cpe:/a:mediawiki:mediawiki:1.13.0:rc2 + cpe:/a:mediawiki:mediawiki:1.13.0:rc1 + cpe:/a:mediawiki:mediawiki:1.20.2 + cpe:/a:mediawiki:mediawiki:1.4.11 + cpe:/a:mediawiki:mediawiki:1.5:alpha1 + cpe:/a:mediawiki:mediawiki:1.11.0 + cpe:/a:mediawiki:mediawiki:1.4.12 + cpe:/a:mediawiki:mediawiki:1.4.13 + cpe:/a:mediawiki:mediawiki:1.4.0 + cpe:/a:mediawiki:mediawiki:1.4.14 + cpe:/a:mediawiki:mediawiki:1.4.1 + cpe:/a:mediawiki:mediawiki:1.4.2 + cpe:/a:mediawiki:mediawiki:1.4.3 + cpe:/a:mediawiki:mediawiki:1.4.4 + cpe:/a:mediawiki:mediawiki:1.4.5 + cpe:/a:mediawiki:mediawiki:1.8.4 + cpe:/a:mediawiki:mediawiki:1.4.6 + cpe:/a:mediawiki:mediawiki:1.8.5 + cpe:/a:mediawiki:mediawiki:1.8.3 + cpe:/a:mediawiki:mediawiki:1.4.10 + cpe:/a:mediawiki:mediawiki:1.7.1 + cpe:/a:mediawiki:mediawiki:1.10.0:rc2 + cpe:/a:mediawiki:mediawiki:1.7.2 + cpe:/a:mediawiki:mediawiki:1.7.0 + cpe:/a:mediawiki:mediawiki:1.16.0:beta2 + cpe:/a:mediawiki:mediawiki:1.7.3 + cpe:/a:mediawiki:mediawiki:1.10.0:rc1 + cpe:/a:mediawiki:mediawiki:1.3.10 + cpe:/a:mediawiki:mediawiki:1.5:alpha2 + cpe:/a:mediawiki:mediawiki:1.5.5 + cpe:/a:mediawiki:mediawiki:1.16.0:beta1 + cpe:/a:mediawiki:mediawiki:1.1.0 + cpe:/a:mediawiki:mediawiki:1.16.0:beta3 + cpe:/a:mediawiki:mediawiki:1.5.0 + cpe:/a:mediawiki:mediawiki:1.3.14 + cpe:/a:mediawiki:mediawiki:1.22.4 + cpe:/a:mediawiki:mediawiki:1.21.7 + cpe:/a:mediawiki:mediawiki:1.18.1 + cpe:/a:mediawiki:mediawiki:1.19.10 + cpe:/a:mediawiki:mediawiki:1.3.15 + cpe:/a:mediawiki:mediawiki:1.22.5 + cpe:/a:mediawiki:mediawiki:1.21.8 + cpe:/a:mediawiki:mediawiki:1.21.5 + cpe:/a:mediawiki:mediawiki:1.19.12 + cpe:/a:mediawiki:mediawiki:1.21.6 + cpe:/a:mediawiki:mediawiki:1.19.11 + cpe:/a:mediawiki:mediawiki:1.5.4 + cpe:/a:mediawiki:mediawiki:1.16.2 + cpe:/a:mediawiki:mediawiki:1.19.14 + cpe:/a:mediawiki:mediawiki:1.21.3 + cpe:/a:mediawiki:mediawiki:1.5.3 + cpe:/a:mediawiki:mediawiki:1.3.11 + cpe:/a:mediawiki:mediawiki:1.22.1 + cpe:/a:mediawiki:mediawiki:1.16.1 + cpe:/a:mediawiki:mediawiki:1.19.13 + cpe:/a:mediawiki:mediawiki:1.21.4 + cpe:/a:mediawiki:mediawiki:1.5.2 + cpe:/a:mediawiki:mediawiki:1.3.12 + cpe:/a:mediawiki:mediawiki:1.22.2 + cpe:/a:mediawiki:mediawiki:1.16.0 + cpe:/a:mediawiki:mediawiki:1.5.1 + cpe:/a:mediawiki:mediawiki:1.3.13 + cpe:/a:mediawiki:mediawiki:1.22.3 + cpe:/a:mediawiki:mediawiki:1.21.2 + cpe:/a:mediawiki:mediawiki:1.8.1 + cpe:/a:mediawiki:mediawiki:1.5.6 + cpe:/a:mediawiki:mediawiki:1.3.1 + cpe:/a:mediawiki:mediawiki:1.8.0 + cpe:/a:mediawiki:mediawiki:1.3.2 + cpe:/a:mediawiki:mediawiki:1.5.8 + cpe:/a:mediawiki:mediawiki:1.5.7 + cpe:/a:mediawiki:mediawiki:1.3.0 + cpe:/a:mediawiki:mediawiki:1.3.5 + cpe:/a:mediawiki:mediawiki:1.18.0 + cpe:/a:mediawiki:mediawiki:1.3.6 + cpe:/a:mediawiki:mediawiki:1.3.3 + cpe:/a:mediawiki:mediawiki:1.9.0 + cpe:/a:mediawiki:mediawiki:1.3.4 + cpe:/a:mediawiki:mediawiki:1.9.1 + cpe:/a:mediawiki:mediawiki:1.5:rc4 + cpe:/a:mediawiki:mediawiki:1.18.3 + cpe:/a:mediawiki:mediawiki:1.5:rc2 + cpe:/a:mediawiki:mediawiki:1.3.7 + cpe:/a:mediawiki:mediawiki:1.18.2 + cpe:/a:mediawiki:mediawiki:1.4.7 + cpe:/a:mediawiki:mediawiki:1.4.9 + cpe:/a:mediawiki:mediawiki:1.8.2 + cpe:/a:mediawiki:mediawiki:1.5:rc3 + cpe:/a:mediawiki:mediawiki:1.4.8 + cpe:/a:mediawiki:mediawiki:1.12.0 + cpe:/a:mediawiki:mediawiki:1.12.2 + cpe:/a:mediawiki:mediawiki:1.12.1 + cpe:/a:mediawiki:mediawiki:1.12.4 + cpe:/a:mediawiki:mediawiki:1.12.3 + cpe:/a:mediawiki:mediawiki:1.10.2 + cpe:/a:mediawiki:mediawiki:1.10.4 + cpe:/a:mediawiki:mediawiki:1.10.3 + cpe:/a:mediawiki:mediawiki:1.19.0 + cpe:/a:mediawiki:mediawiki:1.18.0:rc1 + cpe:/a:mediawiki:mediawiki:1.19.9 + cpe:/a:mediawiki:mediawiki:1.14.1 + cpe:/a:mediawiki:mediawiki:1.14.0 + cpe:/a:mediawiki:mediawiki:1.6.12 + cpe:/a:mediawiki:mediawiki:1.6.11 + cpe:/a:mediawiki:mediawiki:1.6.10 + cpe:/a:mediawiki:mediawiki:1.9.5 + cpe:/a:mediawiki:mediawiki:1.9.6 + cpe:/a:mediawiki:mediawiki:1.9.3 + cpe:/a:mediawiki:mediawiki:1.9.4 + cpe:/a:mediawiki:mediawiki:1.9.2 + cpe:/a:mediawiki:mediawiki:1.6.4 + cpe:/a:mediawiki:mediawiki:1.19.5 + cpe:/a:mediawiki:mediawiki:1.19.4 + cpe:/a:mediawiki:mediawiki:1.19.7 + cpe:/a:mediawiki:mediawiki:1.19.6 + cpe:/a:mediawiki:mediawiki:1.3.9 + cpe:/a:mediawiki:mediawiki:1.19.1 + cpe:/a:mediawiki:mediawiki:1.3 + cpe:/a:mediawiki:mediawiki:1.22.0 + cpe:/a:mediawiki:mediawiki:1.19.3 + cpe:/a:mediawiki:mediawiki:1.9.0:rc2 + cpe:/a:mediawiki:mediawiki:1.3.8 + cpe:/a:mediawiki:mediawiki:1.19.2 + cpe:/a:mediawiki:mediawiki:1.6.0 + cpe:/a:mediawiki:mediawiki:1.6.1 + cpe:/a:mediawiki:mediawiki:1.19.8 + cpe:/a:mediawiki:mediawiki:1.6.2 + cpe:/a:mediawiki:mediawiki:1.6.3 + cpe:/a:mediawiki:mediawiki:1.11.2 + cpe:/a:mediawiki:mediawiki:1.19 + cpe:/a:mediawiki:mediawiki:1.20.4 + cpe:/a:mediawiki:mediawiki:1.20.5 + cpe:/a:mediawiki:mediawiki:1.17 + cpe:/a:mediawiki:mediawiki:1.11.1 + cpe:/a:mediawiki:mediawiki:1.18 + cpe:/a:mediawiki:mediawiki:1.20.3 + cpe:/a:mediawiki:mediawiki:1.20.8 + cpe:/a:mediawiki:mediawiki:1.15.5 + cpe:/a:mediawiki:mediawiki:1.20.6 + cpe:/a:mediawiki:mediawiki:1.20.7 + cpe:/a:mediawiki:mediawiki:1.15.0 + cpe:/a:mediawiki:mediawiki:1.15.1 + cpe:/a:mediawiki:mediawiki:1.15.2 + cpe:/a:mediawiki:mediawiki:1.15.3 + cpe:/a:mediawiki:mediawiki:1.10.1 + cpe:/a:mediawiki:mediawiki:1.10.0 + cpe:/a:mediawiki:mediawiki:1.17.2 + cpe:/a:mediawiki:mediawiki:1.6.9 + cpe:/a:mediawiki:mediawiki:1.17.0 + cpe:/a:mediawiki:mediawiki:1.6.8 + cpe:/a:mediawiki:mediawiki:1.17.1 + cpe:/a:mediawiki:mediawiki:1.15.0:rc1 + cpe:/a:mediawiki:mediawiki:1.2.6 + cpe:/a:mediawiki:mediawiki:1.2.5 + cpe:/a:mediawiki:mediawiki:1.2.4 + cpe:/a:mediawiki:mediawiki:1.6.5 + cpe:/a:mediawiki:mediawiki:1.2.3 + cpe:/a:mediawiki:mediawiki:1.2.2 + cpe:/a:mediawiki:mediawiki:1.6.7 + cpe:/a:mediawiki:mediawiki:1.2.1 + cpe:/a:mediawiki:mediawiki:1.6.6 + cpe:/a:mediawiki:mediawiki:1.5:beta4 + cpe:/a:mediawiki:mediawiki:1.17.4 + cpe:/a:mediawiki:mediawiki:1.17.3 + cpe:/a:mediawiki:mediawiki:1.5:beta2 + cpe:/a:mediawiki:mediawiki:1.5:beta1 + cpe:/a:mediawiki:mediawiki:1.5:beta3 + cpe:/a:mediawiki:mediawiki:1.2.0 + cpe:/a:mediawiki:mediawiki:1.15.4 + cpe:/a:mediawiki:mediawiki:1.4:beta4 + cpe:/a:mediawiki:mediawiki:1.21 + cpe:/a:mediawiki:mediawiki:1.4:beta5 + cpe:/a:mediawiki:mediawiki:1.20 + cpe:/a:mediawiki:mediawiki:1.4:beta6 + cpe:/a:mediawiki:mediawiki:1.12.0:rc1 + cpe:/a:mediawiki:mediawiki:1.11.0:rc1 + + CVE-2014-2853 + 2014-04-29T14:55:08.723-04:00 + 2014-04-30T08:44:58.270-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-30T08:44:57.067-04:00 + + + + + CONFIRM + https://www.mediawiki.org/wiki/Release_notes/1.22#Changes_since_1.22.5 + + + CONFIRM + https://www.mediawiki.org/wiki/Release_notes/1.21#Changes_since_1.21.8 + + + MISC + https://github.com/wikimedia/mediawiki-core/commit/0b695ae09aada343ab59be4a3c9963995a1143b6 + + + CONFIRM + https://bugzilla.wikimedia.org/show_bug.cgi?id=63251 + + + MISC + https://bugzilla.redhat.com/show_bug.cgi?id=1091967 + + + BID + 67068 + + + SECUNIA + 58262 + + + MLIST + [MediaWiki-announce] 20140424 MediaWiki Security and Maintenance Releases: 1.22.6 and 1.21.9 + + Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remote attackers to inject arbitrary web script or HTML via the sort key in an info action. + + + + + + + + + + + + cpe:/o:citrix:netscaler_application_delivery_controller_firmware:9.3.e + cpe:/o:citrix:netscaler_access_gateway_firmware:9.3 + cpe:/o:citrix:netscaler_access_gateway_firmware:10.1.e + cpe:/o:citrix:netscaler_application_delivery_controller_firmware:10.1 + + CVE-2014-2881 + 2014-05-01T13:28:36.367-04:00 + 2014-05-01T15:06:13.173-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-05-01T15:06:11.737-04:00 + + + + SECTRACK + 1030180 + + + CONFIRM + http://support.citrix.com/article/CTX140651 + + Unspecified vulnerability in the Diffie-Hellman key agreement implementation in the management GUI Java applet in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 9.3-66.5 and 10.x before 10.1-122.17 has unknown impact and vectors. + + + + + + + + + + + + cpe:/o:citrix:netscaler_application_delivery_controller_firmware:9.3.e + cpe:/o:citrix:netscaler_access_gateway_firmware:9.3 + cpe:/o:citrix:netscaler_access_gateway_firmware:10.1.e + cpe:/o:citrix:netscaler_application_delivery_controller_firmware:10.1 + + CVE-2014-2882 + 2014-05-01T13:28:36.383-04:00 + 2014-05-01T15:06:15.627-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-05-01T15:06:15.517-04:00 + + + + SECTRACK + 1030180 + + + CONFIRM + http://support.citrix.com/article/CTX140651 + + Unspecified vulnerability in the management GUI in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 9.3-66.5 and 10.x before 10.1-122.17 has unspecified impact and vectors, related to certificate validation. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/o:linux:linux_kernel:3.1.6 + cpe:/o:linux:linux_kernel:3.0.4 + cpe:/o:linux:linux_kernel:3.1.5 + cpe:/o:linux:linux_kernel:3.0.5 + cpe:/o:linux:linux_kernel:3.0.2 + cpe:/o:linux:linux_kernel:3.0.48 + cpe:/o:linux:linux_kernel:3.0.3 + cpe:/o:linux:linux_kernel:3.1.7 + cpe:/o:linux:linux_kernel:3.0.49 + cpe:/o:linux:linux_kernel:3.0.32 + cpe:/o:linux:linux_kernel:3.1.2 + cpe:/o:linux:linux_kernel:3.0.8 + cpe:/o:linux:linux_kernel:3.0.46 + cpe:/o:linux:linux_kernel:3.1.1 + cpe:/o:linux:linux_kernel:3.0.47 + cpe:/o:linux:linux_kernel:3.1.4 + cpe:/o:linux:linux_kernel:3.0.6 + cpe:/o:linux:linux_kernel:3.0.44 + cpe:/o:linux:linux_kernel:3.1.3 + cpe:/o:linux:linux_kernel:3.0.7 + cpe:/o:linux:linux_kernel:3.0.45 + cpe:/o:linux:linux_kernel:3.0.42 + cpe:/o:linux:linux_kernel:3.0.40 + cpe:/o:linux:linux_kernel:3.0.29 + cpe:/o:linux:linux_kernel:3.0.41 + cpe:/o:linux:linux_kernel:3.0.59 + cpe:/o:linux:linux_kernel:3.0.55 + cpe:/o:linux:linux_kernel:3.0.56 + cpe:/o:linux:linux_kernel:3.0.57 + cpe:/o:linux:linux_kernel:3.0.58 + cpe:/o:linux:linux_kernel:3.0.51 + cpe:/o:linux:linux_kernel:3.0.52 + cpe:/o:linux:linux_kernel:3.0.53 + cpe:/o:linux:linux_kernel:3.0.50 + cpe:/o:linux:linux_kernel:3.0.17 + cpe:/o:linux:linux_kernel:3.0.16 + cpe:/o:linux:linux_kernel:3.0.43 + cpe:/o:linux:linux_kernel:3.0.15 + cpe:/o:linux:linux_kernel:3.0.14 + cpe:/o:linux:linux_kernel:3.0.13 + cpe:/o:linux:linux_kernel:3.0.12 + cpe:/o:linux:linux_kernel:3.0.11 + cpe:/o:linux:linux_kernel:3.0.24 + cpe:/o:linux:linux_kernel:3.0.61 + cpe:/o:linux:linux_kernel:3.0.25 + cpe:/o:linux:linux_kernel:3.0.60 + cpe:/o:linux:linux_kernel:3.0.22 + cpe:/o:linux:linux_kernel:3.0.23 + cpe:/o:linux:linux_kernel:3.0.28 + cpe:/o:linux:linux_kernel:3.0.64 + cpe:/o:linux:linux_kernel:3.0.26 + cpe:/o:linux:linux_kernel:3.0.63 + cpe:/o:linux:linux_kernel:3.0.10 + cpe:/o:linux:linux_kernel:3.0.27 + cpe:/o:linux:linux_kernel:3.0.62 + cpe:/o:linux:linux_kernel:3.0.68 + cpe:/o:linux:linux_kernel:3.0.67 + cpe:/o:linux:linux_kernel:3.0.66 + cpe:/o:linux:linux_kernel:3.0.20 + cpe:/o:linux:linux_kernel:3.1:rc1 + cpe:/o:linux:linux_kernel:3.0:rc4 + cpe:/o:linux:linux_kernel:3.0.9 + cpe:/o:linux:linux_kernel:3.1:rc4 + cpe:/o:linux:linux_kernel:3.0:rc3 + cpe:/o:linux:linux_kernel:3.0:rc2 + cpe:/o:linux:linux_kernel:3.1:rc2 + cpe:/o:linux:linux_kernel:3.0:rc1 + cpe:/o:linux:linux_kernel:3.0:rc7 + cpe:/o:linux:linux_kernel:3.0:rc6 + cpe:/o:linux:linux_kernel:3.0:rc5 + cpe:/o:linux:linux_kernel:3.0.54 + cpe:/o:linux:linux_kernel:3.0.33 + cpe:/o:linux:linux_kernel:3.0.1 + cpe:/o:linux:linux_kernel:3.0.34 + cpe:/o:linux:linux_kernel:3.0.35 + cpe:/o:linux:linux_kernel:3.0.36 + cpe:/o:linux:linux_kernel:3.0.37 + cpe:/o:linux:linux_kernel:3.0.38 + cpe:/o:linux:linux_kernel:3.0.39 + cpe:/o:linux:linux_kernel:3.1:rc3 + cpe:/o:linux:linux_kernel:3.0.30 + cpe:/o:linux:linux_kernel:3.0.31 + cpe:/o:linux:linux_kernel:3.1 + cpe:/o:linux:linux_kernel:3.0.18 + cpe:/o:linux:linux_kernel:3.0.65 + cpe:/o:linux:linux_kernel:3.0.19 + cpe:/o:linux:linux_kernel:3.0.21 + + CVE-2014-2889 + 2014-04-26T20:55:05.780-04:00 + 2014-04-28T11:47:57.460-04:00 + + + 4.6 + LOCAL + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-28T11:47:57.083-04:00 + + + + + CONFIRM + https://github.com/torvalds/linux/commit/a03ffcf873fe0f2565386ca8ef832144c42e67fa + + + MLIST + [oss-security] 20140418 Re: CVE request Linux kernel: arch: x86: net: bpf_jit: an off-by-one bug in x86_64 cond jump target + + + CONFIRM + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.1.8 + + + CONFIRM + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a03ffcf873fe0f2565386ca8ef832144c42e67fa + + Off-by-one error in the bpf_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 3.1.8, when BPF JIT is enabled, allows local users to cause a denial of service (system crash) or possibly gain privileges via a long jump after a conditional jump. + + + CVE-2014-2905 + 2014-05-02T10:55:07.260-04:00 + 2014-05-02T10:55:07.260-04:00 + + CONFIRM + https://github.com/fish-shell/fish-shell/issues/1436 + + + MLIST + [oss-security] 20140428 Upcoming security release of fish 2.1.1 + + fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly check the credentials, which allows local users to gain privileges via the universal variable socket, related to /tmp/fishd.socket.user permissions. + + + + + + + + + + + + + + + + + + + + cpe:/h:siemens:simatic_s7_cpu-1211c:- + cpe:/h:siemens:simatic_s7_cpu_1212c:- + cpe:/o:siemens:simatic_s7_cpu_1200_firmware:3.0 + cpe:/o:siemens:simatic_s7_cpu_1200_firmware:2.0 + cpe:/h:siemens:simatic_s7_cpu_1217c:- + cpe:/h:siemens:simatic_s7_cpu_1215c:- + cpe:/h:siemens:simatic_s7_cpu_1214c:- + cpe:/o:siemens:simatic_s7_cpu_1200_firmware:3.0.2 + + CVE-2014-2908 + 2014-04-25T01:12:07.847-04:00 + 2014-04-25T13:08:33.573-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-25T13:08:33.480-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-114-02 + + + CONFIRM + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-892012.pdf + + Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + + + + + + + + + + + cpe:/h:siemens:simatic_s7_cpu-1211c:- + cpe:/h:siemens:simatic_s7_cpu_1212c:- + cpe:/o:siemens:simatic_s7_cpu_1200_firmware:3.0 + cpe:/o:siemens:simatic_s7_cpu_1200_firmware:2.0 + cpe:/h:siemens:simatic_s7_cpu_1217c:- + cpe:/h:siemens:simatic_s7_cpu_1215c:- + cpe:/h:siemens:simatic_s7_cpu_1214c:- + cpe:/o:siemens:simatic_s7_cpu_1200_firmware:3.0.2 + + CVE-2014-2909 + 2014-04-25T01:12:07.863-04:00 + 2014-04-25T13:10:47.627-04:00 + + + 5.8 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-04-25T13:10:47.530-04:00 + + + + + MISC + http://ics-cert.us-cert.gov/advisories/ICSA-14-114-02 + + + CONFIRM + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-892012.pdf + + CRLF injection vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary HTTP headers via unspecified vectors. + + + + + + + + + cpe:/a:gnustep:base:1.24.6 + + CVE-2014-2980 + 2014-04-28T10:09:08.253-04:00 + 2014-04-29T09:16:01.830-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + NONE + PARTIAL + http://nvd.nist.gov + 2014-04-29T09:16:01.660-04:00 + + + + + CONFIRM + http://svn.gna.org/viewcvs/gnustep/libs/base/trunk/Tools/gdomap.c?r1=37756&r2=37755&pathrev=37756 + + + CONFIRM + https://savannah.gnu.org/bugs/?41751 + + + XF + gnustep-cve20142980-dos(92688) + + + BID + 66992 + + + CONFIRM + http://svn.gna.org/viewcvs/gnustep/libs/base/trunk/ChangeLog?r1=37756&r2=37755&pathrev=37756 + + + SECUNIA + 58104 + + + MLIST + [oss-security] 20140421 Re: CVE request / advisory: gdomap (GNUstep core package <= 1.24.6) + + + MLIST + [oss-security] 20140419 CVE request / advisory: gdomap (GNUstep core package <= 1.24.6) + + Tools/gdomap.c in gdomap in GNUstep Base 1.24.6 and earlier, when run in daemon mode, does not properly handle the file descriptor for the logger, which allows remote attackers to cause a denial of service (abort) via an invalid request. + + + CVE-2014-2984 + 2014-04-25T01:12:07.897-04:00 + 2014-04-25T01:12:07.990-04:00 + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-2650. Reason: This candidate is a reservation duplicate of CVE-2014-2650. Notes: All CVE users should reference CVE-2014-2650 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. + + + + + + + + + + cpe:/o:xen:xen:4.4.0:- + cpe:/o:xen:xen:4.4.0:rc1 + + CVE-2014-2986 + 2014-04-28T10:09:08.487-04:00 + 2014-04-29T09:38:02.563-04:00 + + + 5.5 + ADJACENT_NETWORK + LOW + SINGLE_INSTANCE + NONE + NONE + COMPLETE + http://nvd.nist.gov + 2014-04-29T09:38:02.533-04:00 + + + + + CONFIRM + http://xenbits.xen.org/xsa/advisory-94.html + + + SECTRACK + 1030146 + + + BID + 67047 + + + MLIST + [oss-security] 20140423 Xen Security Advisory 94 (CVE-2014-2986) - ARM hypervisor crash on guest interrupt controller access + + + MLIST + [oss-security] 20140423 Re: Xen Security Advisory 94 - ARM hypervisor crash on guest interrupt controller access + + + MLIST + [oss-security] 20140423 Xen Security Advisory 94 - ARM hypervisor crash on guest interrupt controller access + + The vgic_distr_mmio_write function in the virtual guest interrupt controller (GIC) distributor (arch/arm/vgic.c) in Xen 4.4.x, when running on an ARM system, allows local guest users to cause a denial of service (NULL pointer dereference and host crash) via unspecified vectors. + + + + + + + + + cpe:/a:misli:misli.com_app:-::~~~~android~ + + CVE-2014-2992 + 2014-04-25T21:55:05.027-04:00 + 2014-04-28T09:21:00.697-04:00 + + + 6.4 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-28T09:21:00.573-04:00 + + + + + MISC + http://sceptive.com/p/mislicom-android-app-ssl-certificate-validation-weakness- + + + BUGTRAQ + 20140424 Misli.com Android App SSL certificate validation weakness + + The Misli.com application for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. + + + + + + + + + cpe:/a:birebin:birebin.com_app:-::~~~~android~ + + CVE-2014-2993 + 2014-04-25T21:55:05.060-04:00 + 2014-04-28T09:33:19.593-04:00 + + + 6.4 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + NONE + http://nvd.nist.gov + 2014-04-28T09:33:19.563-04:00 + + + + + MISC + http://sceptive.com/p/birebincom-android-app-ssl-certificate-validation-weakness- + + + BUGTRAQ + 20140424 Birebin.com Android App SSL certificate validation weakness + + The Birebin.com application for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. + + + + + + + + + cpe:/a:acunetix:web_vulnerability_scanner:8:build_20120704 + + CVE-2014-2994 + 2014-04-27T00:32:01.717-04:00 + 2014-04-28T12:06:13.133-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-28T12:06:13.087-04:00 + + + + + MISC + https://www.youtube.com/watch?v=RHaMx8K1GeM + + + EXPLOIT-DB + 32997 + + + CONFIRM + http://www.acunetix.com/blog/news/misleading-reports-0-day-acunetix-wvs/ + + + MISC + http://packetstormsecurity.com/files/126307/Acunetix-8-Scanner-Buffer-Overflow.html + + + MISC + http://packetstormsecurity.com/files/126306/Acunetix-8-Stack-Buffer-Overflow.html + + + MISC + http://osandamalith.wordpress.com/2014/04/24/pwning-script-kiddies-acunetix-buffer-overflow/ + + + MISC + http://an7isec.blogspot.co.il/2014/04/pown-noobs-acunetix-0day.html + + Stack-based buffer overflow in Acunetix Web Vulnerability Scanner (WVS) 8 build 20120704 allows remote attackers to execute arbitrary code via an HTML file containing an IMG element with a long URL (src attribute). + + + + + + + + + cpe:/a:xcloner:xcloner:3.5::standalone + + CVE-2014-2996 + 2014-04-25T16:55:03.040-04:00 + 2014-04-28T08:03:04.260-04:00 + + + 7.1 + NETWORK + HIGH + SINGLE_INSTANCE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-28T08:03:04.230-04:00 + + + + + MISC + https://www.htbridge.com/advisory/HTB23207 + + + BUGTRAQ + 20140409 &ETH;&iexcl;ross-Site Request Forgery (CSRF) in XCloner Standalone + + + EXPLOIT-DB + 32790 + + XCloner Standalone 3.5 and earlier, when enable_db_backup and sql_mem are enabled, allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the dbbackup_comp parameter in a generate action to index2.php. NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have the privileges to execute code. NOTE: this can be leveraged by remote attackers using CVE-2014-2579. + + + CVE-2014-3000 + 2014-05-02T10:55:07.433-04:00 + 2014-05-02T10:55:07.433-04:00 + + SECTRACK + 1030172 + + + BID + 67153 + + + FREEBSD + FreeBSD-SA-14:08 + + + SECUNIA + 58293 + + The TCP reassembly function in the inet module in FreeBSD 8.3 before p16, 8.4 before p9, 9.1 before p12, 9.2 before p5, and 10.0 before p2 allows remote attackers to cause a denial of service (undefined memory access and system crash) or possibly read system memory via multiple crafted packets, related to moving a reassemble queue entry to the segment list when the queue is full. + + + CVE-2014-3001 + 2014-05-02T10:55:07.510-04:00 + 2014-05-02T10:55:07.510-04:00 + + SECTRACK + 1030171 + + + BID + 67158 + + + FREEBSD + FreeBSD-SA-14:07 + + The device file system (aka devfs) in FreeBSD 10.0 before p2 does not load default rulesets when booting, which allows context-dependent attackers to bypass intended restrictions by leveraging a jailed device node process. + + + CVE-2014-3006 + 2014-05-02T10:55:07.590-04:00 + 2014-05-02T10:55:07.590-04:00 + + MISC + https://www.lsexperts.de/advisories/lse-2014-04-10.txt + + + BID + 67165 + + + BUGTRAQ + 20140430 LSE Leading Security Experts GmbH - LSE-2014-04-10 - Sitepark IES - Unauthenticated Access + + + FULLDISC + 20140430 LSE Leading Security Experts GmbH - LSE-2014-04-10 - Sitepark IES - Unauthenticated Access + + Sitepark Information Enterprise Server (IES) 2.9 before 2.9.6, when upgraded from an earlier version, does not properly restrict access, which allows remote attackers to change the manager account password and obtain sensitive information via a request to install/. + + + + + + + + + + cpe:/a:python:pillow:2.3.0 + cpe:/a:pythonware:python_imaging_library:1.1.7 + + CVE-2014-3007 + 2014-04-27T16:55:23.697-04:00 + 2014-04-28T13:51:13.663-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-28T13:51:13.617-04:00 + + + + + MISC + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059 + + + MISC + http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-1932.html + + Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py. + + + + + + + + + cpe:/a:unitrends:enterprise_backup:7.3.0 + + CVE-2014-3008 + 2014-04-28T10:09:08.940-04:00 + 2014-04-29T09:37:14.843-04:00 + + + 10.0 + NETWORK + LOW + NONE + COMPLETE + COMPLETE + COMPLETE + http://nvd.nist.gov + 2014-04-29T09:37:14.797-04:00 + + + + + MISC + https://gist.github.com/brandonprry/10745756 + + + XF + unitrends-snmpod-command-exec(92642) + + + BID + 66928 + + + EXPLOIT-DB + 32885 + + + SECUNIA + 58001 + + + FULLDISC + 20140415 Unitrends enterprise backup remote unauthenticated root + + Unitrends Enterprise Backup 7.3.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the comm parameter to recoveryconsole/bpl/snmpd.php. + + + CVE-2014-3125 + 2014-05-02T10:55:07.807-04:00 + 2014-05-02T10:55:07.807-04:00 + + CONFIRM + http://xenbits.xen.org/xsa/advisory-91.html + + + SECTRACK + 1030184 + + + BID + 67157 + + + MLIST + [oss-security] 20140430 Xen Security Advisory 91 - Hardware timer context is not properly context switched on ARM + + + MLIST + [oss-security] 20140430 Re: Xen Security Advisory 91 - Hardware timer context is not properly context switched on ARM + + + SECUNIA + 58347 + + Xen 4.4.x, when running on an ARM system, does not properly context switch the CNTKCTL_EL1 register, which allows local guest users to modify the hardware timers and cause a denial of service (crash) via unspecified vectors. + + + + + + + + + cpe:/a:sap:netweaver_software_lifecycle_manager:7.1 + + CVE-2014-3129 + 2014-04-30T10:22:07.203-04:00 + 2014-05-01T08:51:41.993-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-05-01T08:51:41.960-04:00 + + + + + CONFIRM + https://service.sap.com/sap/support/notes/1894049 + + + SECTRACK + 1030157 + + + MISC + http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-005 + + + FULLDISC + 20140428 [Onapsis Security Advisory 2014-005] Information disclosure in SAP Software Lifeclycle Manager + + + CONFIRM + http://scn.sap.com/docs/DOC-8218 + + The Java Server Pages in the Software Lifecycle Manager (SLM) in SAP NetWeaver allows remote attackers to obtain sensitive information via a crafted request, related to SAP Solution Manager 7.1. + + + + + + + + + cpe:/a:sap:netweaver_abap_application_server:- + + CVE-2014-3130 + 2014-04-30T10:22:07.250-04:00 + 2014-05-01T09:06:15.100-04:00 + + + 4.6 + LOCAL + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-05-01T09:06:15.007-04:00 + + + ALLOWS_OTHER_ACCESS + + + CONFIRM + https://service.sap.com/sap/support/notes/1910914 + + + MISC + http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-009 + + + FULLDISC + 20140428 [Onapsis Security Advisory 2014-009] SAP BASIS Missing Authorization Check + + + CONFIRM + http://scn.sap.com/docs/DOC-8218 + + The ABAP Help documentation and translation tools (BC-DOC-HLP) in Basis in SAP Netweaver ABAP Application Server does not properly restrict access, which allows local users to gain privileges and execute ABAP instructions via crafted help messages. + + + + + + + + + cpe:/a:sap:profile_maintenance:- + + CVE-2014-3131 + 2014-04-30T10:22:07.283-04:00 + 2014-05-01T10:06:43.287-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-05-01T10:06:43.113-04:00 + + + + + CONFIRM + https://service.sap.com/sap/support/notes/1917381 + + + MISC + http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-007 + + + FULLDISC + 20140428 [Onapsis Security Advisory 2014-007] Missing authorization check in SAP Profile Maintenance + + + CONFIRM + http://scn.sap.com/docs/DOC-8218 + + SAP Profile Maintenance does not properly restrict access, which allows remote authenticated users to obtain sensitive information via an unspecified RFC function, related to SAP Solution Manager 7.1. + + + + + + + + + cpe:/a:sap:background_processing:- + + CVE-2014-3132 + 2014-04-30T10:22:07.313-04:00 + 2014-05-01T10:18:20.887-04:00 + + + 4.0 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-05-01T10:18:20.827-04:00 + + + + + CONFIRM + https://service.sap.com/sap/support/notes/1918333 + + + MISC + http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-006 + + + FULLDISC + 20140428 [Onapsis Security Advisory 2014-006] Missing authorization check in SAP Background Processing RFC + + + CONFIRM + http://scn.sap.com/docs/DOC-8218 + + SAP Background Processing does not properly restrict access, which allows remote authenticated users to obtain sensitive information via an unspecified RFC function, related to SAP Solution Manager 7.1. + + + + + + + + + cpe:/a:sap:netweaver_java_application_server:- + + CVE-2014-3133 + 2014-04-30T10:22:07.343-04:00 + 2014-05-01T10:29:16.487-04:00 + + + 5.0 + NETWORK + LOW + NONE + PARTIAL + NONE + NONE + http://nvd.nist.gov + 2014-05-01T10:29:16.363-04:00 + + + + + CONFIRM + https://service.sap.com/sap/support/notes/1922547 + + + MISC + http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-008 + + + FULLDISC + 20140428 [Onapsis Security Advisory 2014-008] SAP NW Portal WD Information Disclosure + + + CONFIRM + http://scn.sap.com/docs/DOC-8218 + + SAP Netweaver Java Application Server does not properly restrict access, which allows remote attackers to obtain the list of SAP systems registered on an SLD via an unspecified webdynpro, related to SystemSelection. + + + + + + + + + cpe:/a:sap:businessobjects:- + + CVE-2014-3134 + 2014-04-30T10:22:07.377-04:00 + 2014-05-01T10:36:42.830-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-05-01T10:36:42.003-04:00 + + + + + CONFIRM + https://service.sap.com/sap/support/notes/1931399 + + + MISC + http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-010 + + + FULLDISC + 20140428 [Onapsis Security Advisory 2014-010] SAP BusinessObjects InfoView Reflected Cross Site Scripting + + + CONFIRM + http://scn.sap.com/docs/DOC-8218 + + Cross-site scripting (XSS) vulnerability in the InfoView application in SAP BusinessObjects allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + cpe:/a:vbulletin:vbulletin:5.1.1:alpha9 + + CVE-2014-3135 + 2014-04-30T10:22:07.610-04:00 + 2014-05-01T11:42:56.497-04:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2014-05-01T11:42:56.467-04:00 + + + + + XF + vbulletin-multiple-scripts-xss(92664) + + + BID + 66972 + + + MISC + http://packetstormsecurity.com/files/126226/vBulletin-5.1-Cross-Site-Scripting.html + + Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 5.1.1 Alpha 9 allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to privatemessage/new/, (2) the folderid parameter to a private message in privatemessage/view, (3) a fragment indicator to /help, or (4) the view parameter to a topic, as demonstrated by a request to forum/anunturi-importante/rst-power/67030-rst-admin-restore. + + + + + + + + + + + + + cpe:/a:xerox:docushare:6.6.1:update2 + cpe:/a:xerox:docushare:6.6.1:update1 + cpe:/a:xerox:docushare:6.6.1:- + cpe:/a:xerox:docushare:6.5.3:patch6 + cpe:/a:xerox:docushare:6.5.3:- + + CVE-2014-3138 + 2014-05-01T20:55:07.587-04:00 + 2014-05-02T10:38:12.993-04:00 + + + 6.5 + NETWORK + LOW + SINGLE_INSTANCE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-05-02T10:38:12.917-04:00 + + + + + XF + xerox-docushare-sql-injection(92548) + + + MISC + http://www.xerox.com/download/security/security-bulletin/a72cd-4f7a54ce14460/cert_XRX14-003_V1.0.pdf + + + BID + 66922 + + + OSVDB + 105972 + + + EXPLOIT-DB + 32886 + + + SECUNIA + 57996 + + + FULLDISC + 20140415 Xerox DocuShare authenticated SQL injection + + + MISC + http://packetstormsecurity.com/files/126171/Xerox-DocuShare-SQL-Injection.html + + SQL injection vulnerability in Xerox DocuShare before 6.53 Patch 6 Hotfix 2, 6.6.1 Update 1before Hotfix 24, and 6.6.1 Update 2 before Hotfix 3 allows remote authenticated users to execute arbitrary SQL commands via the PATH_INFO to /docushare/dsweb/ResultBackgroundJobMultiple/. NOTE: some of these details are obtained from third party information. + + + + + + + + + cpe:/a:unitrends:enterprise_backup:7.3.0 + + CVE-2014-3139 + 2014-05-02T06:55:08.507-04:00 + 2014-05-02T14:24:56.593-04:00 + + + 7.5 + NETWORK + LOW + NONE + PARTIAL + PARTIAL + PARTIAL + http://nvd.nist.gov + 2014-05-02T14:24:56.530-04:00 + + + + + MISC + https://gist.github.com/brandonprry/10745756 + + + EXPLOIT-DB + 32885 + + + FULLDISC + 20140415 Unitrends enterprise backup remote unauthenticated root + + recoveryconsole/bpl/snmpd.php in Unitrends Enterprise Backup 7.3.0 allows remote attackers to bypass authentication by setting the auth parameter to a certain string. + + \ No newline at end of file diff --git a/dependency-check-core/src/test/resources/nvdcve-2014.xml b/dependency-check-core/src/test/resources/nvdcve-2014.xml new file mode 100644 index 000000000..360c18a7d --- /dev/null +++ b/dependency-check-core/src/test/resources/nvdcve-2014.xml @@ -0,0 +1,77521 @@ + + + + + Buffer overflow in client/mysql.cc in Oracle MySQL and MariaDB before 5.5.35 allows remote database servers to cause a denial of service (crash) and possibly execute arbitrary code via a long server version string. + + + + + + + + + + + http://bazaar.launchpad.net/~maria-captains/maria/5.5/revision/2502.565.64 + https://mariadb.com/kb/en/mariadb-5535-changelog/ + https://bugzilla.redhat.com/show_bug.cgi?id=1054592 + 102714 + RHSA-2014:0189 + RHSA-2014:0186 + RHSA-2014:0173 + RHSA-2014:0164 + 102713 + + + + + + + + + + + + + The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. + + + + + + + + + + + 65901 + 57719 + 57716 + 57125 + RHSA-2014:0372 + RHSA-2014:0371 + http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message. + + + + + + + + + + + 65902 + 57719 + 57716 + 57125 + RHSA-2014:0372 + RHSA-2014:0371 + RHSA-2014:0254 + RHSA-2014:0245 + http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Stack-based buffer overflow in udisks before 1.0.5 and 2.x before 2.1.3 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long mount point. + + + + + + + + + + + [devkit-devel] 20140310 udisks 2.1.3 / 1.0.5 security updates + USN-2142-1 + DSA-2872 + RHSA-2014:0293 + openSUSE-SU-2014:0390 + openSUSE-SU-2014:0389 + openSUSE-SU-2014:0388 + + + + + + + + + + + + + + + + + + + + + + + + + The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a timing side-channel attack. + + + + + + + + + [oss-security] 20140117 [OSSA 2014-002] Swift TempURL timing attack (CVE-2014-0006) + https://bugs.launchpad.net/swift/+bug/1265665 + RHSA-2014:0232 + + + + + + + + + + + + + + + + + + + + + + + + + lib/adminlib.php in Moodle through 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 logs cleartext passwords, which allows remote authenticated administrators to obtain sensitive information by reading the Config Changes Report. + + + + + + + + + https://moodle.org/mod/forum/discuss.php?d=252414 + http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-36721 + 1029647 + [oss-security] 20140120 Moodle security notifications public + FEDORA-2014-1396 + FEDORA-2014-1377 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + course/loginas.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 does not enforce the moodle/site:accessallgroups capability requirement for outside-group users in a SEPARATEGROUPS configuration, which allows remote authenticated users to perform "login as" actions via a direct request. + + + + + + + + + + https://moodle.org/mod/forum/discuss.php?d=252415 + http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-42643 + 1029648 + [oss-security] 20140120 Moodle security notifications public + FEDORA-2014-1396 + FEDORA-2014-1377 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Multiple cross-site request forgery (CSRF) vulnerabilities in user/profile/index.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 allow remote attackers to hijack the authentication of administrators for requests that delete (1) categories or (2) fields. + + + + + + + + + + + + https://moodle.org/mod/forum/discuss.php?d=252416 + http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-42883 + 1029649 + [oss-security] 20140120 Moodle security notifications public + FEDORA-2014-1396 + FEDORA-2014-1377 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request. + + + + + + + + + + http://curl.haxx.se/docs/adv_20140129.html + USN-2097-1 + SSA:2014-044-01 + 1029710 + 65270 + DSA-2849 + 56734 + 56731 + 56728 + openSUSE-SU-2014:0274 + FEDORA-2014-1864 + FEDORA-2014-1876 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + stunnel before 5.00, when using fork threading, does not properly update the state of the OpenSSL pseudo-random number generator (PRNG), which causes subsequent children with the same process ID to use the same entropy pool and allows remote attackers to obtain private keys for EC (ECDSA) or DSA certificates. + + + + + + + + + https://www.stunnel.org/sdf_ChangeLog.html + https://bugzilla.redhat.com/show_bug.cgi?id=1072180 + https://bugzilla.redhat.com/attachment.cgi?id=870826&action=diff + [oss-security] 20140305 libssh and stunnel PRNG flaws + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The RAND_bytes function in libssh before 0.6.3, when forking is enabled, does not properly reset the state of the OpenSSL pseudo-random number generator (PRNG), which causes the state to be shared between children processes and allows local users to obtain sensitive information by leveraging a pid collision. + + + + + + + + + http://www.libssh.org/2014/03/04/libssh-0-6-3-security-release/ + https://bugzilla.redhat.com/show_bug.cgi?id=1072191 + USN-2145-1 + [oss-security] 20140305 libssh and stunnel PRNG flaws + DSA-2879 + 57407 + openSUSE-SU-2014:0370 + openSUSE-SU-2014:0366 + + + + + + + + + + + + + + + + + + + + Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.0 and JBoss WildFly Application Server, when run under a security manager, do not properly restrict access to the Modular Service Container (MSC) service registry, which allows local users to modify the server via a crafted deployment. + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1052783 + RHSA-2014:0172 + RHSA-2014:0171 + RHSA-2014:0170 + + + + + + + + + + + + + Stack-based buffer overflow in socat 1.3.0.0 through 1.7.2.2 and 2.0.0-b1 through 2.0.0-b6 allows local users to cause a denial of service (segmentation fault) via a long server name in the PROXY-CONNECT address in the command line. + + + + + + + + + http://www.dest-unreach.org/socat + [oss-security] 20140128 Socat security advisory 5 - PROXY-CONNECT address overflow + 65201 + MDVSA-2014:033 + http://www.dest-unreach.org/socat/contrib/socat-secadv5.txt + 102612 + FEDORA-2014-1795 + FEDORA-2014-1811 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The IRC protocol plugin in libpurple in Pidgin before 2.10.8 does not validate argument counts, which allows remote IRC servers to cause a denial of service (application crash) via a crafted message. + + + + + + + + + RHSA-2014:0139 + USN-2100-1 + DSA-2859 + http://pidgin.im/news/security/?id=85 + openSUSE-SU-2014:0326 + openSUSE-SU-2014:0239 + http://hg.pidgin.im/pidgin/main/rev/a167504359e5 + http://hg.pidgin.im/pidgin/main/rev/9f132a6855cd + http://hg.pidgin.im/pidgin/main/rev/7d0fb0c6d8d4 + http://hg.pidgin.im/pidgin/main/rev/6b0e0566af20 + http://hg.pidgin.im/pidgin/main/rev/5845d9fa7084 + http://hg.pidgin.im/pidgin/main/rev/4d9be297d399 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly check the return value of the sigCheckPkg function, which allows remote attackers to bypass the RMP package signing restriction via an unsigned package. + + + + + + + + + http://yum.baseurl.org/gitweb?p=yum.git;a=commitdiff;h=9df69e5794 + https://bugzilla.redhat.com/show_bug.cgi?id=1057377 + https://bugzilla.redhat.com/show_bug.cgi?id=1052440 + 65119 + 56637 + + + + + + + + + + + + + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-1690. Reason: This candidate is a reservation duplicate of CVE-2014-1690. Notes: All CVE users should reference CVE-2014-1690 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. + + + + + + The play_wave_from_socket function in audio/auserver.c in Flite 1.4 allows local users to modify arbitrary files via a symlink attack on /tmp/awb.wav. NOTE: some of these details are obtained from third party information. + + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1048678 + 64791 + 101948 + MDVSA-2014:032 + [oss-security] 20140110 temporary file issue in flite + FEDORA-2014-0579 + FEDORA-2014-0574 + + + + + + + + + + libvirt 1.1.1 through 1.2.0 allows context-dependent attackers to bypass the domain:getattr and connect:search_domains restrictions in ACLs and obtain sensitive domain object information via a request to the (1) virConnectDomainEventRegister and (2) virConnectDomainEventRegisterAny functions in the event registration API. + + + + + + + + + + [libvirt] 20140115 [PATCH 0/4] CVE-2014-0028: domain events vs. ACL filtering + https://bugzilla.redhat.com/show_bug.cgi?id=1048637 + USN-2093-1 + openSUSE-SU-2014:0268 + http://libvirt.org/news.html + + + + + + + + + + + + + + The (1) ListNetworkACL and (2) listNetworkACLLists APIs in Apache CloudStack before 4.2.1 allow remote authenticated users to list network ACLS for other users via a crafted request. + + + + + + + + + https://issues.apache.org/jira/browse/CLOUDSTACK-5145 + https://blogs.apache.org/cloudstack/entry/cve_2014_0031_cloudstack_listnetworkacl + 55960 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The get_resource function in repos.c in the mod_dav_svn module in Apache Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service (crash) via vectors related to the server root and request methods other than GET, as demonstrated by the "svn ls http://svn.example.com" command. + + + + + + + + + http://svn.apache.org/viewvc?view=revision&revision=1557320 + apache-subversion-cve20140032-dos(90986) + 65434 + 102927 + http://svn.apache.org/repos/asf/subversion/tags/1.8.6/CHANGES + http://svn.apache.org/repos/asf/subversion/tags/1.7.15/CHANGES + 56822 + RHSA-2014:0255 + [subversion-dev] 20140110 Sin mod_dav_svn with repositories on / + [subversion-dev] 20140110 Re: Segfault in mod_dav_svn with repositories on / + [subversion-dev] 20140110 2 Re: Segfault in mod_dav_svn with repositories on / + openSUSE-SU-2014:0334 + openSUSE-SU-2014:0307 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL. + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1069919 + http://tomcat.apache.org/security-6.html + http://svn.apache.org/viewvc?view=revision&revision=1558822 + + + + + + + + + + + + + + The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors. + + + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1058595 + [oss-security] 20140306 CVE-2014-0036 rubygem-rbovirt: unsafe use of rest-client + FEDORA-2014-3526 + FEDORA-2014-3573 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 5.00 before 7.1.8 beta2 allows remote attackers to cause a denial of service (crash) via vectors related to "a NULL pointer of the username." + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1059903 + https://bugzilla.redhat.com/show_bug.cgi?id=1056767 + [oss-security] 20140131 Security Flaw CVE-2014-0037 + MDVSA-2014:044 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter. + + + + + + + + + + + https://github.com/torvalds/linux/commit/2def2ef2ae5f3990aabdbe8a755911902707d268 + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2def2ef2ae5f3990aabdbe8a755911902707d268 + https://github.com/saelo/cve-2014-0038 + https://code.google.com/p/chromium/issues/detail?id=338594 + https://bugzilla.redhat.com/show_bug.cgi?id=1060023 + USN-2096-1 + USN-2095-1 + USN-2094-1 + [oss-security] 20140131 Linux 3.4+: arbitrary write with CONFIG_X86_X32 (CVE-2014-0038) + MDVSA-2014:038 + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.2 + 31347 + 31346 + http://pastebin.com/raw.php?i=DH3Lbg54 + openSUSE-SU-2014:0205 + openSUSE-SU-2014:0204 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Untrusted search path vulnerability in fwsnort before 1.6.4, when not running as root, allows local users to execute arbitrary code via a Trojan horse fwsnort.conf in the current working directory. + Per: http://cwe.mitre.org/data/definitions/426.html + +"CWE-426: Untrusted Search Path" + + + + + + + + + + + https://github.com/mrash/fwsnort/commit/fa977453120cc48e1654f373311f9cac468d3348 + https://github.com/mrash/fwsnort/blob/master/ChangeLog + 65341 + [oss-security] 20140203 CVE-2014-0039: fwsnort loaded configuration file from cwd when run as a non-root user + 102822 + FEDORA-2014-1972 + FEDORA-2014-1975 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The opus_packet_get_samples_per_frame function in client in Mumble 1.2.4 and the 1.2.3 pre-release snapshots allows remote attackers to cause a denial of service (crash) via a crafted length prefix value, which triggers a NULL pointer dereference or a heap-based buffer over-read (aka "out-of-bounds array access"). + + + + + + + + + DSA-2854 + 102904 + http://mumble.info/security/Mumble-SA-2014-001.txt + openSUSE-SU-2014:0271 + + + + + + + + + + + + + The needSamples method in AudioOutputSpeech.cpp in the client in Mumble 1.2.4 and the 1.2.3 pre-release snapshots, Mumble for iOS 1.1 through 1.2.2, and MumbleKit before commit fd190328a9b24d37382b269a5674b0c0c7a7e36d does not check the return value of the opus_decode_float function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted Opus voice packet, which triggers an error in opus_decode_float, a conversion of a negative integer to an unsigned integer, and a heap-based buffer over-read and over-write. + + + + + + + + + + + DSA-2854 + 102958 + 102905 + http://mumble.info/security/Mumble-SA-2014-004.txt + http://mumble.info/security/Mumble-SA-2014-002.txt + openSUSE-SU-2014:0271 + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the link-to helper in Ember.js 1.2.x before 1.2.2, 1.3.x before 1.3.2, and 1.4.x before 1.4.0-beta.6, when used in non-block form, allows remote attackers to inject arbitrary web script or HTML via the title attribute. + + + + + + + + + + https://groups.google.com/forum/#!topic/ember-security/1h6FRgr8lXQ + emberjs-linkto-xss(91242) + [oss-security] 20140214 [CVE-2014-0046] XSS Vulnerability With {{link-to}} Helper in Non-block Form + 56965 + http://emberjs.com/blog/2014/02/07/ember-security-releases.html + + + + + + + + + + + + + + Buffer overflow in the complete_emulated_mmio function in arch/x86/kvm/x86.c in the Linux kernel before 3.13.6 allows guest OS users to execute arbitrary code on the host OS by leveraging a loop that triggers an invalid memory copy affecting certain cancel_work_item data. + + + + + + + + + + + [oss-security] 20140303 CVE-2014-0049 -- Linux kernel: kvm: mmio_fragments out-of-the-bounds access + https://github.com/torvalds/linux/commit/a08d3b3b99efd509133946056531cdf8f3a0c09b + https://bugzilla.redhat.com/show_bug.cgi?id=1062368 + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.6 + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a08d3b3b99efd509133946056531cdf8f3a0c09b + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions. + + + + + + + + + http://tomcat.apache.org/security-8.html + http://tomcat.apache.org/security-7.html + http://svn.apache.org/r1565143 + https://bugzilla.redhat.com/show_bug.cgi?id=1062337 + 57915 + RHSA-2014:0400 + [commons-dev] 20140206 [SECURITY] CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat DoS + JVNDB-2014-000017 + JVN#14876762 + http://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 before 2.3.6 does not properly restrict access to files in the WEB-INF directory, which allows remote attackers to obtain sensitive information via a direct request. NOTE: this identifier has been SPLIT due to different researchers and different vulnerability types. See CVE-2014-2857 for the META-INF variant and CVE-2014-2858 for the directory traversal. + + + + + + + + + https://twitter.com/Ramsharan065/status/434975409134792704 + grails-cve20140053-info-disc(91270) + 65678 + 20140227 Update: CVE-2014-0053 Information Disclosure when using Grails + http://www.gopivotal.com/security/cve-2014-0053 + 56841 + 20140227 Update: CVE-2014-0053 Information Disclosure when using Grails + 20140219 CVE-2014-0053 Information Disclosure when using Grails + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429. + + + + + + + + + + + + https://jira.spring.io/browse/SPR-11376 + 57915 + RHSA-2014:0400 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The get_rx_bufs function in drivers/vhost/net.c in the vhost-net subsystem in the Linux kernel package before 2.6.32-431.11.2 on Red Hat Enterprise Linux (RHEL) 6 does not properly handle vhost_get_vq_desc errors, which allows guest OS users to cause a denial of service (host OS crash) via unspecified vectors. + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1062577 + RHSA-2014:0339 + RHSA-2014:0328 + + + + + + + + + + The x_button method in the ServiceController (vmdb/app/controllers/service_controller.rb) in Red Hat CloudForms 3.0 Management Engine 5.2 allows remote attackers to execute arbitrary methods via unspecified vectors. + + + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1064140 + 57376 + RHSA-2014:0215 + + + + + + + + + + + + + The security audit functionality in Red Hat JBoss Enterprise Application Platform (EAP) 6.x before 6.2.1 logs request parameters in plaintext, which might allow local users to obtain passwords by reading the log files. + + + + + + + + + RHSA-2014:0205 + RHSA-2014:0204 + + + + + + + + + + + + + PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows remote authenticated members of a role to add or remove arbitrary users to that role by calling the SET ROLE command before the associated GRANT command. + + + + + + + + + http://www.postgresql.org/about/news/1506/ + DSA-2865 + DSA-2864 + http://wiki.postgresql.org/wiki/20140220securityrelease + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The validator functions for the procedural languages (PLs) in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to gain privileges via a function that is (1) defined in another language or (2) not allowed to be directly called by the user due to permissions. + + + + + + + + + + + http://www.postgresql.org/about/news/1506/ + DSA-2865 + DSA-2864 + http://wiki.postgresql.org/wiki/20140220securityrelease + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Race condition in the (1) CREATE INDEX and (2) unspecified ALTER TABLE commands in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allows remote authenticated users to create an unauthorized index or read portions of unauthorized tables by creating or deleting a table with the same name during the timing window. + + + + + + + + + + http://www.postgresql.org/about/news/1506/ + DSA-2865 + DSA-2864 + http://wiki.postgresql.org/wiki/20140220securityrelease + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Multiple stack-based buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via vectors related to an incorrect MAXDATELEN constant and datetime values involving (1) intervals, (2) timestamps, or (3) timezones, a different vulnerability than CVE-2014-0065. + + + + + + + + + + + https://github.com/postgres/postgres/commit/4318daecc959886d001a6e79c6ea853e8b1dfb4b + https://bugzilla.redhat.com/show_bug.cgi?id=1065226 + http://www.postgresql.org/support/security/ + http://www.postgresql.org/about/news/1506/ + DSA-2865 + DSA-2864 + http://wiki.postgresql.org/wiki/20140220securityrelease + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Multiple integer overflows in the path_in and other unspecified functions in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact and attack vectors, which trigger a buffer overflow. NOTE: this identifier has been SPLIT due to different affected versions; use CVE-2014-2669 for the hstore vector. + + + + + + + + + + + https://github.com/postgres/postgres/commit/31400a673325147e1205326008e32135a78b4d8a + https://bugzilla.redhat.com/show_bug.cgi?id=1065230 + http://www.postgresql.org/support/security/ + http://www.postgresql.org/about/news/1506/ + DSA-2865 + DSA-2864 + http://wiki.postgresql.org/wiki/20140220securityrelease + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Multiple buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact and attack vectors, a different vulnerability than CVE-2014-0063. + + + + + + + + + + + http://www.postgresql.org/about/news/1506/ + DSA-2865 + DSA-2864 + http://wiki.postgresql.org/wiki/20140220securityrelease + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The chkpass extension in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly check the return value of the crypt library function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via unspecified vectors. + + + + + + + + + http://www.postgresql.org/about/news/1506/ + DSA-2865 + DSA-2864 + http://wiki.postgresql.org/wiki/20140220securityrelease + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The "make check" command for the test suites in PostgreSQL 9.3.3 and earlier does not properly invoke initdb to specify the authentication requirements for a database cluster to be used for the tests, which allows local users to gain privileges by leveraging access to this cluster. + + + + + + + + + + + http://www.postgresql.org/about/news/1506/ + DSA-2865 + DSA-2864 + http://wiki.postgresql.org/wiki/20140220securityrelease + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer. + + + + + + + + + + + https://github.com/torvalds/linux/commit/5d81de8e8667da7135d3a32a964087c0faf5483f + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=5d81de8e8667da7135d3a32a964087c0faf5483f + https://bugzilla.redhat.com/show_bug.cgi?id=1064253 + [oss-security] 20140217 CVE-2014-0069 -- kernel: cifs: incorrect handling of bogus user pointers during uncached writes + RHSA-2014:0328 + [linux-cifs] 20140214 [PATCH] cifs: ensure that uncached writes handle unmapped areas correctly + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. + + + + + + PackStack in Red Hat OpenStack 4.0 does not enforce the default security groups when deployed to Neutron, which allows remote attackers to bypass intended access restrictions and make unauthorized connections. + + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1064163 + 66001 + RHSA-2014:0233 + + + + + + + + + + The Montgomery ladder implementation in OpenSSL through 1.0.0l does not ensure that certain swap operations have a constant-time behavior, which makes it easier for local users to obtain ECDSA nonces via a FLUSH+RELOAD cache side-channel attack. + + + + + + + + + https://bugzilla.novell.com/show_bug.cgi?id=869945 + https://bugs.gentoo.org/show_bug.cgi?id=505278 + http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=2198be3483259de374f91e57d247d0fc667aef29 + http://eprint.iacr.org/2014/140 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + drivers/vhost/net.c in the Linux kernel before 3.13.10, when mergeable buffers are disabled, does not properly validate packet lengths, which allows guest OS users to cause a denial of service (memory corruption and host OS crash) or possibly gain privileges on the host OS via crafted packets, related to the handle_rx and get_rx_bufs functions. + + + + + + + + + + + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.10 + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d8316f3991d207fe32881a9ac20241be8fa2bad0 + https://github.com/torvalds/linux/commit/d8316f3991d207fe32881a9ac20241be8fa2bad0 + https://bugzilla.redhat.com/show_bug.cgi?id=1064440 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 7.1.8, 6.20.0, and earlier, when using certain build conditions, allows remote attackers to cause a denial of service (crash) via vectors related to "a NULL pointer of the password." + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1059903 + MDVSA-2014:044 + + + + + + + + + + + + + + + + + + + + + + + + SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving \ (backslash) characters that are not properly handled in operations on array columns. + + + + + + + + + + + [rubyonrails-security] 20140218 Data Injection Vulnerability in Active Record (CVE-2014-0080) + [oss-security] 20140218 Data Injection Vulnerability in Active Record (CVE-2014-0080) + + + + + + + + + + + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper. + + + + + + + + + + [rubyonrails-security] 20140218 XSS Vulnerability in number_to_currency, number_to_percentage and number_to_human (CVE-2014-0081) + 57376 + RHSA-2014:0306 + RHSA-2014:0215 + [oss-security] 20140218 XSS Vulnerability in number_to_currency, number_to_percentage and number_to_human (CVE-2014-0081) + openSUSE-SU-2014:0295 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render method, which allows remote attackers to cause a denial of service (memory consumption) by including these strings in headers. + + + + + + + + + [rubyonrails-security] 20140218 Denial of Service Vulnerability in Action View when using render :text (CVE-2014-0082) + http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/ + 57836 + 57376 + RHSA-2014:0306 + RHSA-2014:0215 + [oss-security] 20140218 Denial of Service Vulnerability in Action View when using render :text (CVE-2014-0082) + openSUSE-SU-2014:0295 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Apache Zookeeper logs cleartext admin passwords, which allows local users to obtain sensitive information by reading the log. + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1067265 + 57915 + RHSA-2014:0400 + + + + + + + + + + + + + The doFilter function in webapp/PushHandlerFilter.java in JBoss RichFaces 4.3.4, 4.3.5, and 5.x allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a large number of malformed atmosphere push requests. + + + + + + + + + https://issues.jboss.org/browse/RF-13250 + https://github.com/pslegr/core-1/commit/8131f15003f5bec73d475d2b724472e4b87d0757 + https://bugzilla.redhat.com/show_bug.cgi?id=1067268 + 57053 + + + + + + + + + + + + + + + + + The SPDY implementation in the ngx_http_spdy_module module in nginx 1.5.10 before 1.5.11, when running on a 32-bit platform, allows remote attackers to execute arbitrary code via a crafted request. + + + + + + + + + + + [nginx-announce] 20140304 nginx security advisory (CVE-2014-0088) + 1030150 + + + + + + + + + + Cross-site scripting (XSS) vulnerability in app/views/common/500.html.erb in Foreman 1.4.x before 1.4.2 allows remote authenticated users to inject arbitrary web script or HTML via the bookmark name when adding a bookmark. + + + + + + + + + + http://projects.theforeman.org/issues/4456 + https://bugzilla.redhat.com/show_bug.cgi?id=1071741 + http://theforeman.org/security.html + 57575 + + + + + + + + + + + lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate. + + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1069865 + USN-2127-1 + DSA-2869 + 57321 + 57274 + 57260 + 57254 + 57204 + 57103 + 56933 + RHSA-2014:0339 + RHSA-2014:0288 + RHSA-2014:0247 + RHSA-2014:0246 + SUSE-SU-2014:0445 + openSUSE-SU-2014:0346 + openSUSE-SU-2014:0328 + openSUSE-SU-2014:0325 + SUSE-SU-2014:0324 + SUSE-SU-2014:0323 + SUSE-SU-2014:0322 + SUSE-SU-2014:0321 + SUSE-SU-2014:0320 + SUSE-SU-2014:0319 + http://gnutls.org/security.html#GNUTLS-SA-2014-2 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.2, when using a Java Security Manager (JSM), does not properly apply permissions defined by a policy file, which causes applications to be granted the java.security.AllPermission permission and allows remote attackers to bypass intended access restrictions. + + + + + + + + + + 57675 + RHSA-2014:0345 + RHSA-2014:0344 + RHSA-2014:0343 + + + + + + + + + + The ParametersInterceptor in Apache Struts before 2.3.16.1 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method. + + + + + + + + + 1029876 + 65999 + 20140306 [ANN] Struts 2.3.16.1 GA release available - security fix + http://struts.apache.org/release/2.3.x/docs/s2-020.html + 56440 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled during truncation. + + + + + + + + + http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/loggers/mod_log_config.c?r1=1575394&r2=1575400&diff_format=h + USN-2152-1 + http://www.apache.org/dist/httpd/CHANGES_2.4.9 + http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/loggers/mod_log_config.c + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Race condition in the inet_frag_intern function in net/ipv4/inet_fragment.c in the Linux kernel through 3.13.6 allows remote attackers to cause a denial of service (use-after-free error) or possibly have unspecified other impact via a large series of fragmented ICMP Echo Request packets to a system with a heavy CPU load. + + + + + + + + + + + [oss-security] 20140304 CVE-2014-0100 -- Linux kernel: net: inet frag code race condition leading to user-after-free + https://bugzilla.redhat.com/show_bug.cgi?id=1070618 + http://patchwork.ozlabs.org/patch/325844/ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an SCTP handshake with a modified INIT chunk and a crafted AUTH chunk before a COOKIE_ECHO chunk. + + + + + + + + + [oss-security] 20140304 CVE-2014-0101 -- Linux kernel: net: sctp: null pointer dereference when processing authenticated cookie_echo chunk + https://github.com/torvalds/linux/commit/ec0223ec48a90cb605244b45f7c62de856403729 + https://bugzilla.redhat.com/show_bug.cgi?id=1070705 + RHSA-2014:0328 + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ec0223ec48a90cb605244b45f7c62de856403729 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The keyring_detect_cycle_iterator function in security/keys/keyring.c in the Linux kernel through 3.13.6 does not properly determine whether keyrings are identical, which allows local users to cause a denial of service (OOPS) via crafted keyctl commands. + + + + + + + + + [oss-security] 20140304 CVE-2014-0102 -- Linux kernel: security: keyring cycle detector DoS + https://bugzilla.redhat.com/show_bug.cgi?id=1072419 + http://www.kernelhub.org/?msg=425013&p=2 + [linux-kernel] 20140227 kernel BUG at security/keys/keyring.c:1003! + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached." + + + + + + + + + + + [oss-security] 20140327 [OSSA 2014-007] Potential context confusion in Keystone middleware (CVE-2014-0105) + https://bugs.launchpad.net/python-keystoneclient/+bug/1282865 + RHSA-2014:0382 + + + + + + + + + + + + + + + + Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable. + + + + + + + + + + + http://www.sudo.ws/sudo/alerts/env_add.html + USN-2146-1 + [oss-security] 20140305 sudo: security policy bypass when env_reset is disabled + RHSA-2014:0266 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function. + + + + + + + + + + + http://www.ocert.org/advisories/ocert-2014-002.html + http://svn.apache.org/viewvc?view=revision&revision=1581058 + https://issues.apache.org/jira/browse/XALANJ-2435 + apache-xalanjava-cve20140107-sec-bypass(92023) + 66397 + 57563 + + + + + + + + + + + + + + + + + + + + + + Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, "derived schema definition," "user / role templates," and "account links of resource mappings." + + + + + + + + + + + 20140415 [SECURITY] CVE-2014-0111 Apache Syncope + http://syncope.apache.org/security.html + [www-announce] 20140415 [SECURITY] CVE-2014-0111 Apache Syncope + + + + + + + + + + + + + + + + + + + + + + + + + ParametersInterceptor in Apache Struts before 2.3.16.2 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094. + + + + + + + + + + + https://cwiki.apache.org/confluence/display/WW/S2-021 + https://bugzilla.redhat.com/show_bug.cgi?id=1091939 + JVNDB-2014-000045 + JVN#19294237 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + CookieInterceptor in Apache Struts before 2.3.16.2, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094. + + + + + + + + + + + https://cwiki.apache.org/confluence/display/WW/S2-021 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The ActionForm object in Apache Struts 1.x through 1.3.10 allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, which is passed to the getClass method. + + + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1091938 + + + + + + + + + + + + + + + + + + + + + + + + + mod/chat/chat_ajax.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly check for the mod/chat:chat capability during chat sessions, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by remaining in a chat session after an intra-session capability removal by an administrator. + + + + + + + + + + https://moodle.org/mod/forum/discuss.php?d=256418 + [oss-security] 20140317 Moodle security notifications public + http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-44082 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The wiki subsystem in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly restrict (1) view and (2) edit access, which allows remote authenticated users to perform wiki operations by leveraging the student role and using the Recent Activity block to reach the individual wiki of an arbitrary student. + + + + + + + + + + https://moodle.org/mod/forum/discuss.php?d=256419 + [oss-security] 20140317 Moodle security notifications public + http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39990 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The identity-reporting implementations in mod/forum/renderer.php and mod/quiz/override_form.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 do not properly restrict the display of e-mail addresses, which allows remote authenticated users to obtain sensitive information by using the (1) Forum or (2) Quiz module. + + + + + + + + + https://moodle.org/mod/forum/discuss.php?d=256421 + [oss-security] 20140317 Moodle security notifications public + http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43916 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + repository/alfresco/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 places a session key in a URL, which allows remote attackers to bypass intended Alfresco Repository file restrictions by impersonating a file's owner. + + + + + + + + + + https://moodle.org/mod/forum/discuss.php?d=256422 + [oss-security] 20140317 Moodle security notifications public + http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-29409 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site request forgery (CSRF) vulnerability in enrol/imsenterprise/importnow.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to hijack the authentication of administrators for requests that import an IMS Enterprise file. + + + + + + + + + + + + https://moodle.org/mod/forum/discuss.php?d=256423 + [oss-security] 20140317 Moodle security notifications public + http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43146 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The time-validation implementation in (1) mod/feedback/complete.php and (2) mod/feedback/complete_guest.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote authenticated users to bypass intended restrictions on starting a Feedback activity by choosing an unavailable time. + + + + + + + + + + https://moodle.org/mod/forum/discuss.php?d=256417 + [oss-security] 20140317 Moodle security notifications public + http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43656 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request, related to state management. + + + + + + + + + 57288 + http://www.squid-cache.org/Advisories/SQUID-2014_1.txt + 57889 + openSUSE-SU-2014:0513 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + badges/mybadges.php in Moodle 2.5.x before 2.5.5 and 2.6.x before 2.6.2 does not properly track the user to whom a badge was issued, which allows remote authenticated users to modify the visibility of an arbitrary badge via unspecified vectors. + + + + + + + + + https://moodle.org/mod/forum/discuss.php?d=256424 + [oss-security] 20140317 Moodle security notifications public + http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-44140 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Use-after-free vulnerability in the skb_segment function in net/core/skbuff.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation. + + + + + + + + + https://github.com/torvalds/linux/commit/1fd819ecb90cc9b822cd84d3056ddba315d3340f + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1fd819ecb90cc9b822cd84d3056ddba315d3340f + https://bugzilla.redhat.com/show_bug.cgi?id=1074589 + [netdev] 20140310 [PATCH 5/5] skbuff: skb_segment: orphan frags before copying + [netdev] 20140310 [PATCH 0/5] skbuff: fix skb_segment with zero copy skbs + [oss-security] 20140310 CVE-2014-0131 -- kernel: net: use-after-free during segmentation with zerocopy + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The SASL authentication functionality in 389 Directory Server before 1.2.11.26 allows remote authenticated users to connect as an arbitrary user and gain privileges via the authzid parameter in a SASL/GSSAPI bind. + + + + + + + + + + + https://fedorahosted.org/389/ticket/47739 + https://fedorahosted.org/389/changeset/76acff12a86110d4165f94e2cba13ef5c7ebc38a/ + 57427 + 57412 + RHSA-2014:0292 + + + + + + + + + + + + + + + + + + + + + + + + + + + Heap-based buffer overflow in the SPDY implementation in nginx 1.3.15 before 1.4.7 and 1.5.x before 1.5.12 allows remote attackers to execute arbitrary code via a crafted request. + + + + + + + + + + + [nginx-announce] 20140318 nginx security advisory (CVE-2014-0133) + openSUSE-SU-2014:0450 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context-dependent attackers to connect as other users via a request, a similar issue to CVE-2014-0015. + + + + + + + + + + http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/ + http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/ + http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/ + DSA-2902 + 57968 + 57966 + 57836 + http://curl.haxx.se/docs/adv_20140326A.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recognize a wildcard IP address in the subject's Common Name (CN) field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. + + + + + + + + + + http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/ + http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/ + http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/ + DSA-2902 + 57968 + 57966 + 57836 + http://curl.haxx.se/docs/adv_20140326B.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Integer overflow in the virtio_net_handle_mac function in hw/net/virtio-net.c in QEMU 2.0 and earlier allows local guest users to execute arbitrary code via a MAC addresses table update request, which triggers a heap-based buffer overflow. + + + + + + + + + + + [Qemu-devel] 20140411 [PATCH for-2.0] virtio-net: fix guest-triggerable buffer overrun + https://bugzilla.redhat.com/show_bug.cgi?id=1078846 + 57878 + [Qemu-devel] 20140411 Re: [PATCH for-2.0] virtio-net: fix guest-triggerable buffer overrun + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The ioapic_deliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly validate the kvm_irq_delivery_to_apic return value, which allows guest OS users to cause a denial of service (host OS crash) via a crafted entry in the redirection table of an I/O APIC. NOTE: the affected code was moved to the ioapic_service function before the vulnerability was announced. + + + + + + + + + http://git.kernel.org/cgit/virt/kvm/kvm.git/commit/?id=5678de3f15010b9022ee45673f33bcfc71d47b60 + https://bugzilla.redhat.com/show_bug.cgi?id=1081589 + [oss-security] 20140407 CVE-2014-0155 -- kernel: kvm: BUG caused by invalid entry in guest ioapic redirection table + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the Horizon Orchestration dashboard in OpenStack Dashboard (aka Horizon) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to inject arbitrary web script or HTML via the description field of a Heat template. + + + + + + + + + + [oss-security] 20140408 [OSSA 2014-010] XSS in Horizon orchestration dashboard (CVE-2014-0157) + https://launchpad.net/bugs/1289033 + + + + + + + + + + + + + Buffer overflow in the GetStatistics64 remote procedure call (RPC) in OpenAFS 1.4.8 before 1.6.7 allows remote attackers to cause a denial of service (crash) via a crafted statsVersion argument. + + + + + + + + + http://www.openafs.org/frameset/dl/openafs/1.6.7/ChangeLog + DSA-2899 + 57832 + 57779 + http://openafs.org/pages/security/OPENAFS-SA-2014-001.txt + + + + + + + + + + + + + + + + + + + + + + + + + + + The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug. + + + CVSS V2 scoring evaluates the impact of the vulnerability on the host where the vulnerability is located. When evaluating the impact of this vulnerability to your organization, take into account the nature of the data that is being protected and act according to your organizationā€™s risk acceptance. While CVE-2014-0160 does not allow unrestricted access to memory on the targeted host, a successful exploit does leak information from memory locations which have the potential to contain particularly sensitive information, e.g., cryptographic keys and passwords. Theft of this information could enable other attacks on the information system, the impact of which would depend on the sensitivity of the data and functions of that system. + + + + + + + + + TA14-098A + VU#720951 + https://www.cert.fi/en/reports/2014/vulnerability788210.html + [syslog-ng-announce] 20140411 syslog-ng Premium Edition 5 LTS (5.0.4a) has been released + https://gist.github.com/chapmajs/10473815 + https://code.google.com/p/mod-spdy/issues/detail?id=85 + https://bugzilla.redhat.com/show_bug.cgi?id=1084875 + https://blog.torproject.org/blog/openssl-bug-cve-2014-0160 + http://www.splunk.com/view/SP-CAAAMB3 + 1030082 + 1030081 + 1030080 + 1030079 + 1030078 + 1030077 + 1030074 + 1030026 + 66690 + http://www.oracle.com/technetwork/topics/security/opensslheartbleedcve-2014-0160-2188454.html + http://www.openssl.org/news/secadv_20140407.txt + http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/ + http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/ + http://www.getchef.com/blog/2014/04/09/chef-server-heartbleed-cve-2014-0160-releases/ + http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/ + http://www.f-secure.com/en/web/labs_global/fsc-2014-1 + 32764 + 32745 + DSA-2896 + http://www.blackberry.com/btsc/KB35882 + http://www-01.ibm.com/support/docview.wss?uid=swg21670161 + 20140409 OpenSSL Heartbeat Extension Vulnerability in Multiple Cisco Products + 57968 + 57966 + 57836 + 57721 + 57483 + 57347 + 20140408 Re: heartbleed OpenSSL bug CVE-2014-0160 + 20140408 heartbleed OpenSSL bug CVE-2014-0160 + 20140412 Re: heartbleed OpenSSL bug CVE-2014-0160 + 20140411 MRI Rubies may contain statically linked, vulnerable OpenSSL + 20140409 Re: heartbleed OpenSSL bug CVE-2014-0160 + RHSA-2014:0396 + RHSA-2014:0378 + RHSA-2014:0377 + RHSA-2014:0376 + HPSBMU02995 + SUSE-SA:2014:002 + openSUSE-SU-2014:0492 + FEDORA-2014-4910 + FEDORA-2014-4879 + http://heartbleed.com/ + http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=96db9023b881d7cd9f379b0c154650d6c108e9a3 + http://blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/ + + + + + + + + + + + + + + + + + + + The Sheepdog backend in OpenStack Image Registry and Delivery Service (Glance) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote authenticated users with permission to insert or modify an image to execute arbitrary commands via a crafted location. + + + + + + + + + + + https://launchpad.net/bugs/1298698 + [oss-security] 20140410 [OSSA 2014-012] Remote code execution in Glance Sheepdog backend (CVE-2014-0162) + + + + + + + + + + + + + + + + WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php. + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1085866 + http://core.trac.wordpress.org/changeset/27976 + http://codex.wordpress.org/Version_3.8.2 + http://codex.wordpress.org/Version_3.7.2 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determine the validity of authentication cookies, which makes it easier for remote attackers to obtain access via a forged cookie. + + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1085858 + http://core.trac.wordpress.org/changeset/28054 + http://codex.wordpress.org/Version_3.8.2 + http://codex.wordpress.org/Version_3.7.2 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not enforce RBAC policies for (1) add_rules, (2) remove_rules, (3) destroy, and other unspecified methods in compute/api.py when using non-default policies, which allows remote authenticated users to gain privileges via these API requests. + + + + + + + + + + + [oss-security] 20140409 [OSSA 2014-011] RBAC policy not properly enforced in Nova EC2 API (CVE-2014-0167) + https://launchpad.net/bugs/1290537 + + + + + + + + + + + + + + + + + + + + Integer overflow in the check_section function in dwarf_begin_elf.c in the libdw library, as used in elfutils 0.153 and possibly through 0.158 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed compressed debug section in an ELF file, which triggers a heap-based buffer overflow. + + + + + + + + + + + [elfutils-devel] 20140409 [PATCH] CVE-2014-0172 Check for overflow before calling malloc to uncompress data. + https://bugzilla.redhat.com/show_bug.cgi?id=1085663 + 66714 + [oss-security] 20140409 Heap-based buffer overflow in libdw/elfutils (CVE-2014-0172) + + + + + + + + + + + + + + + The Jetpack plugin before 1.9 before 1.9.4, 2.0.x before 2.0.9, 2.1.x before 2.1.4, 2.2.x before 2.2.7, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.2, 2.6.x before 2.6.3, 2.7.x before 2.7.2, 2.8.x before 2.8.2, and 2.9.x before 2.9.3 for WordPress does not properly restrict access to the XML-RPC service, which allows remote attackers to bypass intended restrictions and publish posts via unspecified vectors. NOTE: some of these details are obtained from third party information. + + + + + + + + + + jetpack-wordpress-cve20140173-sec-bypass(92560) + 66789 + 57729 + http://jetpack.me/2014/04/10/jetpack-security-update/ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The Netlink implementation in the Linux kernel through 3.14.1 does not provide a mechanism for authorizing socket operations based on the opener of a socket, which allows local users to bypass intended access restrictions and modify network configurations by using a Netlink socket for the (1) stdout or (2) stderr of a setuid program. + + + + + + + + + https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=90f62cf30a78721641e08737bda787552428061e + [oss-security] 20140423 Re: CVE-2014-0181: Linux network reconfiguration due to incorrect netlink checks + [netdev] 20140423 [PATCH 0/5]: Preventing abuse when passing file descriptors + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The openvswitch-agent process in OpenStack Neutron 2013.1 before 2013.2.4 and 2014.1 before 2014.1.1 allows remote authenticated users to bypass security group restrictions via an invalid CIDR in a security group rule, which prevents further rules from being applied. + + + + + + + + + + + https://bugs.launchpad.net/neutron/+bug/1300785 + [oss-security] 20140422 [OSSA 2014-014] Neutron security groups bypass through invalid CIDR (CVE-2014-0187) + + + + + + + + + + + + + + + + + + + + The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to a passthrough trigger. + + + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1090120 + RHSA-2014:0423 + RHSA-2014:0422 + + + + + + + + + + + + + + + + + + + + + + + + + virt-who uses world-readable permissions for /etc/sysconfig/virt-who, which allows local users to obtain password for hypervisors by reading the file. + + + https://bugzilla.redhat.com/show_bug.cgi?id=1088732 + https://bugzilla.redhat.com/show_bug.cgi?id=1081286 + 67089 + [oss-security] 20140428 CVE-2014-0189: /etc/sysconfig/virt-who is world-readable (contains unencrypted passwords) + + + + + Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1751 and CVE-2014-1755. + + + + + + + + + + + + MS14-018 + + + + + + + + + + Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine TCP connection states, which allows remote attackers to cause a denial of service (ASP.NET daemon hang) via crafted HTTP requests that trigger persistent resource consumption for a (1) stale or (2) closed connection, as exploited in the wild in February 2014, aka "POST Request DoS Vulnerability." + + + + + + + + + MS14-009 + + + + + + + + + + + + + + + + The IPv6 implementation in Microsoft Windows 8, Windows Server 2012, and Windows RT does not properly validate packets, which allows remote attackers to cause a denial of service (system hang) via crafted ICMPv6 Router Advertisement packets, aka "TCP/IP Version 6 (IPv6) Denial of Service Vulnerability." + + + + + + + + + MS14-006 + + + + + + + + + + + + + + + + + Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine whether it is safe to execute a method, which allows remote attackers to execute arbitrary code via (1) a crafted web site or (2) a crafted .NET Framework application that exposes a COM server endpoint, aka "Type Traversal Vulnerability." + + + + + + + + + + + + MS14-009 + + + + + + + + + + + + + + + + + Microsoft Word 2003 SP3 and 2007 SP3, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability." + + + + + + + + + + + + MS14-001 + 1029599 + 1029598 + + + + + + + + + + + + + + + + + Microsoft Word 2007 SP3 and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability." + + + + + + + + + + + + MS14-001 + 1029599 + 1029598 + + + + + + + + + + + + + Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office Compatibility Pack SP3; Word Viewer; SharePoint Server 2010 SP1 and SP2 and 2013; Office Web Apps 2010 SP1 and SP2; and Office Web Apps Server 2013 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability." + + + + + + + + + + + + MS14-001 + 1029599 + 1029598 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Microsoft Dynamics AX 4.0 SP2, 2009 SP1, 2012, and 2012 R2 allows remote authenticated users to cause a denial of service (instance outage) via crafted data to an Application Object Server (AOS) instance, aka "Query Filter DoS Vulnerability." + + + + + + + + + MS14-004 + 1029601 + + + + + + + + + + + + win32k.sys in the kernel-mode drivers in Microsoft Windows 7 SP1 and Server 2008 R2 SP1 does not properly consider thread-owned objects during the processing of window handles, which allows local users to gain privileges via a crafted application, aka "Win32k Window Handle Vulnerability." + + + + + + + + + + + MS14-003 + 1029600 + 64725 + + + + + + + + + + + + + + + The Direct2D implementation in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a large 2D geometric figure that is encountered with Internet Explorer, aka "Microsoft Graphics Component Memory Corruption Vulnerability." + + + + + + + + + + + + MS14-007 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The XMLHTTP ActiveX controls in XML Core Services 3.0 in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to bypass the Same Origin Policy via a web page that is visited in Internet Explorer, aka "MSXML Information Disclosure Vulnerability." + + + + + + + + + + MS14-005 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0289 and CVE-2014-0290. + + + + + + + + + + + + MS14-010 + + + + + + + + + + Microsoft Internet Explorer 8 through 11 does not properly restrict file installation and registry-key creation, which allows remote attackers to bypass the Mandatory Integrity Control protection mechanism via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability." + + + + + + + + + + MS14-010 + + + + + + + + + + + + + Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." + + + + + + + + + + + + MS14-010 + + + + + + + + + + + + + + Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0273, CVE-2014-0274, and CVE-2014-0288. + + + + + + + + + + + + MS14-010 + + + + + + + + + + + + The VBScript engine in Microsoft Internet Explorer 6 through 11, and VBScript 5.6 through 5.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "VBScript Memory Corruption Vulnerability." + + + + + + + + + + + + MS14-011 + MS14-010 + + + + + + + + + + + + + + + + + + + + Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." + + + + + + + + + + + + MS14-010 + + + + + + + + + + + + Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0270, CVE-2014-0274, and CVE-2014-0288. + + + + + + + + + + + + MS14-010 + + + + + + + + + + + + Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0270, CVE-2014-0273, and CVE-2014-0288. + + + + + + + + + + + MS14-010 + + + + + + + + + + + + Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0285 and CVE-2014-0286. + + + + + + + + + + + + MS14-010 + + + + + + + + + + + + + + + Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." + + + + + + + + + + + + MS14-010 + + + + + + + + + + + Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0278 and CVE-2014-0279. + + + + + + + + + + + MS14-010 + + + + + + + + + + Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0277 and CVE-2014-0279. + + + + + + + + + + + MS14-010 + + + + + + + + + + Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0277 and CVE-2014-0278. + + + + + + + + + + + MS14-010 + + + + + + + + + + Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." + + + + + + + + + + + + MS14-010 + + + + + + + + + + + + Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0287. + + + + + + + + + + + MS14-010 + + + + + + + + + + + + + Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." + + + + + + + + + + + MS14-010 + + + + + + + + + + Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." + + + + + + + + + + + MS14-010 + + + + + + + + + + + Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0275 and CVE-2014-0286. + + + + + + + + + + + MS14-010 + + + + + + + + + + + + + + + Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0275 and CVE-2014-0285. + + + + + + + + + + + MS14-010 + + + + + + + + + + + + + + + Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0281. + + + + + + + + + + + MS14-010 + + + + + + + + + + + + + Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0270, CVE-2014-0273, and CVE-2014-0274. + + + + + + + + + + + MS14-010 + + + + + + + + + + + + Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0267 and CVE-2014-0290. + + + + + + + + + + + MS14-010 + + + + + + + + + + Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0267 and CVE-2014-0289. + + + + + + + + + + + MS14-010 + + + + + + + + + + Microsoft Internet Explorer 9 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Internet Explorer Cross-domain Information Disclosure Vulnerability." + + + + + + + + + MS14-010 + + + + + + + + + + + + Microsoft Forefront Protection 2010 for Exchange Server does not properly parse e-mail content, which might allow remote attackers to execute arbitrary code via a crafted message, aka "RCE Vulnerability." + + + + + + + + + + + MS14-008 + + + + + + + + + + VsaVb7rt.dll in Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not implement the ASLR protection mechanism, which makes it easier for remote attackers to execute arbitrary code via a crafted web site, as exploited in the wild in February 2014, aka "VSAVB7RT ASLR Vulnerability." + + + + + + + + + + MS14-009 + http://www.greyhathacker.net/?p=585 + + + + + + + + + + + Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0308, CVE-2014-0312, and CVE-2014-0324. + + + + + + + + + + + + MS14-012 + + + + + + + + + + + + + Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." + + + + + + + + + + + + MS14-012 + + + + + + + + + + + + Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0305 and CVE-2014-0311. + + + + + + + + + + + + MS14-012 + + + + + + + + + + + + + + + win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability." + + + + + + + + + + + MS14-015 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Double free vulnerability in qedit.dll in DirectShow in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via a crafted JPEG image, aka "DirectShow Memory Corruption Vulnerability." + + + + + + + + + + + + MS14-013 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0303. + + + + + + + + + + + + MS14-012 + + + + + + + + + + + + Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0302. + + + + + + + + + + + + MS14-012 + + + + + + + + + + + + Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." + + + + + + + + + + + + MS14-012 + + + + + + + + + + Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0299 and CVE-2014-0311. + + + + + + + + + + + + MS14-012 + + + + + + + + + + + + + + + Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." + + + + + + + + + + + + MS14-012 + + + + + + + + + + + Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a certain sequence of manipulations of a TextRange element, aka "Internet Explorer Memory Corruption Vulnerability." + + + + + + + + + + + + MS14-012 + 32438 + + + + + + + + + + Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0297, CVE-2014-0312, and CVE-2014-0324. + + + + + + + + + + + + MS14-012 + + + + + + + + + + + + + Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." + + + + + + + + + + + + MS14-012 + + + + + + + + + + + + Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0299 and CVE-2014-0305. + + + + + + + + + + + + MS14-012 + + + + + + + + + + + + + + + Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0297, CVE-2014-0308, and CVE-2014-0324. + + + + + + + + + + + + MS14-012 + + + + + + + + + + + + + Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0321. + + + + + + + + + + + + MS14-012 + + + + + + + + + + + Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." + + + + + + + + + + + + MS14-012 + + + + + + + + + + + Untrusted search path vulnerability in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a Trojan horse cmd.exe file in the current working directory, as demonstrated by a directory that contains a .bat or .cmd file, aka "Windows File Handling Vulnerability." + Per: http://cwe.mitre.org/data/definitions/426.html "CWE-426: Untrusted Search Path" + + + + + + + + + + + MS14-019 + http://blogs.technet.com/b/srd/archive/2014/04/08/ms14-019-fixing-a-binary-hijacking-via-cmd-or-bat-file.aspx + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The Security Account Manager Remote (SAMR) protocol implementation in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 Gold and R2 does not properly determine the user-lockout state, which makes it easier for remote attackers to bypass the account lockout policy and obtain access via a brute-force attack, aka "SAMR Security Feature Bypass Vulnerability." + + + + + + + + + MS14-016 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Microsoft Silverlight 5 before 5.1.30214.0 and Silverlight 5 Developer Runtime before 5.1.30214.0 allow attackers to bypass the DEP and ASLR protection mechanisms via unspecified vectors, aka "Silverlight DEP/ASLR Bypass Vulnerability." + + + + + + + + + + MS14-014 + + + + + + + + + + + + + + + + Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0313. + + + + + + + + + + + + MS14-012 + + + + + + + + + + + Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, as exploited in the wild in January and February 2014. + + + + + + + + + + + + VU#732479 + https://www.dropbox.com/s/pyxjgycmudirbqe/CVE-2014-0322.zip + http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html + http://www.fireeye.com/blog/technical/cyber-exploits/2014/02/new-ie-zero-day-found-in-watering-hole-attack-2.html + http://twitter.com/nanoc0re/statuses/434251658344673281 + MS14-012 + http://technet.microsoft.com/security/advisory/2934088 + http://community.websense.com/blogs/securitylabs/archive/2014/02/13/msie-0-day-exploit-cve-2014-0322-possibly-targeting-french-aerospace-organization.aspx + + + + + + + + + + win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (system hang) via a crafted application, aka "Win32k Information Disclosure Vulnerability." + + + + + + + + + + MS14-015 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0297, CVE-2014-0308, and CVE-2014-0312. + + + + + + + + + + + + MS14-012 + + + + + + + + + + + + + The TELNET service on the ZTE ZXV10 W300 router 2.1.0 has a hardcoded password ending with airocon for the admin account, which allows remote attackers to obtain administrative access by leveraging knowledge of the MAC address characters present at the beginning of the password. + + + + + + + + + + + VU#228886 + zxv10-w300-cve20140329-sec-bypass(90958) + 65310 + http://packetstormsecurity.com/files/125142/ZTE-ZXV10-W300-Hardcoded-Credentials.html + 102816 + http://blog.alguien.at/2014/02/hackeando-el-router-zte-zxv10-w300-v21.html + + + + + + + + + + Cross-site scripting (XSS) vulnerability in adminui/user_list.php on the Dell KACE K1000 management appliance 5.5.90545 allows remote attackers to inject arbitrary web script or HTML via the LABEL_ID parameter. + + + + + + + + + + VU#813382 + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the web administration interface in FortiADC with firmware before 3.2.1 allows remote attackers to inject arbitrary web script or HTML via the locale parameter to gui_partA/. + + + + + + + + + + http://www.fortiguard.com/advisory/FG-IR-14-004 + 20140403 XSS Reflected vulnerabilities in OS of FortiADC v3.2 (CVE-2014-0331) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in mainPage in Dell SonicWALL GMS before 7.1 SP2, SonicWALL Analyzer before 7.1 SP2, and SonicWALL UMA E5000 before 7.1 SP2 might allow remote attackers to inject arbitrary web script or HTML via the node_id parameter in a ScreenDisplayManager genNetwork action. + + + + + + + + + + VU#727318 + sonicwall-cve20140332-nodeid-xss(91062) + http://www.sonicwall.com/us/shared/download/Support_Bulletin_GMS_Vulnerability_XSS_Resolved_in_7.1_SP2_and_7.2.pdf + + + + + + + + + + + + + + + + + + + The png_push_read_chunk function in pngpread.c in the progressive decoder in libpng 1.6.x through 1.6.9 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an IDAT chunk with a length of zero. + + + + + + + + + VU#684412 + ftp://ftp.simplesystems.org/pub/png/src/libpng16/patch-libpng16-vu684412.diff + https://sourceforge.net/projects/libpng/files/libpng16/patch-libpng16-vu684412.diff + openSUSE-SU-2014:0358 + + + + + + + + + + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple allow remote authenticated users to inject arbitrary web script or HTML via (1) the group parameter to admin/addgroup.php, (2) the htmlblob parameter to admin/addhtmlblob.php, the (3) title or (4) url parameter to admin/addbookmark.php, (5) the stylesheet_name parameter to admin/copystylesheet.php, (6) the template_name parameter to admin/copytemplate.php, the (7) title or (8) url parameter to admin/editbookmark.php, (9) the template parameter to admin/listtemplates.php, or (10) the css_name parameter to admin/listcss.php, a different issue than CVE-2014-2092. + + + + + + + + + + VU#526062 + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in the web client in Serena Dimensions CM 12.2 build 7.199.0 allow remote attackers to inject arbitrary web script or HTML via the (1) DB_CONN, (2) DB_NAME, (3) DM_HOST, (4) MAN_DB_NAME, (5) framecmd, (6) identifier, (7) merant.adm.adapters.AdmDialogPropertyMgr, (8) nav_frame, (9) nav_jsp, (10) target_frame, (11) id, or (12) type parameter to the dimensions/ URI. + + + + + + + + + + VU#823452 + + + + + + + + + + Cross-site request forgery (CSRF) vulnerability in the web client in Serena Dimensions CM 12.2 build 7.199.0 allows remote attackers to hijack the authentication of administrators for requests that use the user_new_master parameter to the adminconsole/ URI. + + + + + + + + + + + + VU#823452 + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the web interface on Huawei Echo Life HG8247 routers with software before V100R006C00SPC127 allows remote attackers to inject arbitrary web script or HTML via an invalid TELNET connection attempt with a crafted username that is not properly handled during construction of the "failed log-in attempts over telnet" log view. + + + + + + + + + + VU#917700 + + + + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in the firewall policy management pages in WatchGuard Fireware XTM before 11.8.3 allow remote attackers to inject arbitrary web script or HTML via the pol_name parameter. + + + + + + + + + + VU#807134 + http://watchguardsecuritycenter.com/2014/03/13/fireware-xtm-11-8-3-update-corrects-xss-flaw/ + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in view.cgi in Webmin before 1.680 allows remote attackers to inject arbitrary web script or HTML via the search parameter. + + + + + + + + + + VU#381692 + http://www.webmin.com/changes.html + + + + + + + + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in PivotX before 2.3.9 allow remote authenticated users to inject arbitrary web script or HTML via the title field to (1) templates_internal/pages.tpl, (2) templates_internal/home.tpl, or (3) templates_internal/entries.tpl; (4) an event field to objects.php; or the (5) email or (6) nickname field to pages.php, related to templates_internal/users.tpl. + + + + + + + + + + VU#901156 + http://sourceforge.net/p/pivot-weblog/code/4349/ + http://sourceforge.net/p/pivot-weblog/code/4345/ + http://pivotx.net/page/security + http://blog.pivotx.net/archive/2014/03/03/pivotx-239-released + + + + + + + + + + + + + + + + + + + + + + + + + + Multiple unrestricted file upload vulnerabilities in fileupload.php in PivotX before 2.3.9 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) .php or (2) .php# extension, and then accessing it via unspecified vectors. + Per: http://cwe.mitre.org/data/definitions/434.html + +"CWE-434: Unrestricted Upload of File with Dangerous Type" + + + + + + + + + + + VU#901156 + http://sourceforge.net/p/pivot-weblog/code/4347/ + http://pivotx.net/page/security + http://blog.pivotx.net/archive/2014/03/03/pivotx-239-released + + + + + + + + + + + + + + + + + + + + + + + + + + The web interface on Virtual Access GW6110A routers with software 9.00 before 9.09.27, 9.50 before 9.50.21, and 10.00 before 10.00.21 allows remote authenticated users to gain privileges via a modified JavaScript variable. + + + Per: http://cwe.mitre.org/data/definitions/472.html + +"CWE-472: External Control of Assumed-Immutable Web Parameter" + + + + + + + + + + + VU#213046 + + + + + + + + + + + + + + + Properties.do in ZOHO ManageEngine OpStor before build 8500 does not properly check privilege levels, which allows remote authenticated users to obtain Admin access by using the name parameter in conjunction with a true value of the edit parameter. + + + + + + + + + + + VU#140886 + + + + + + + + + + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-0160. Reason: This candidate is a reservation duplicate of CVE-2014-0160. Notes: All CVE users should reference CVE-2014-0160 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. + + + + + + The Settings module in Websense Triton Unified Security Center 7.7.3 before Hotfix 31, Web Filter 7.7.3 before Hotfix 31, Web Security 7.7.3 before Hotfix 31, Web Security Gateway 7.7.3 before Hotfix 31, and Web Security Gateway Anywhere 7.7.3 before Hotfix 31 allows remote authenticated users to read cleartext passwords by replacing type="password" with type="text" in an INPUT element in the (1) Log Database or (2) User Directories component. + + + + + + + + + VU#568252 + https://www.websense.com/content/mywebsense-hotfixes.aspx?patchid=894&prodidx=20&osidx=0&intidx=0&versionidx=0 + + + + + + + + + + + + + + + + + + + + + + The Artiva Agency Single Sign-On (SSO) implementation in Artiva Workstation 1.3.x before 1.3.9, Artiva Rm 3.1 MR7, Artiva Healthcare 5.2 MR5, and Artiva Architect 3.2 MR5, when the domain-name option is enabled, allows remote attackers to login to arbitrary domain accounts by using the corresponding username on a Windows client machine. + + + + + + + + + VU#215284 + + + + + + + + + + + + + + + + + + + Multiple unspecified vulnerabilities in J2k-Codec allow remote attackers to execute arbitrary code via a crafted JPEG 2000 file. + + + + + + + + + + + VU#345337 + + + + + + + + + + The Poco::Net::X509Certificate::verify method in the NetSSL library in POCO C++ Libraries before 1.4.6p4 allows man-in-the-middle attackers to spoof SSL servers via crafted DNS PTR records that are requested during comparison of a server name to a wildcard domain name in an X.509 certificate. + + + + + + + + + + VU#118748 + https://raw.githubusercontent.com/pocoproject/poco/poco-1.4.6p4-release/CHANGELOG + + + + + + + + + + + + + + The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allows remote attackers to bypass authentication by using %2F sequences in place of / (slash) characters. + + + + + + + + + VU#939260 + + + + + + + + + + + + + The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 has a hardcoded password of qweasdzxc for an unspecified account, which allows remote attackers to obtain index.asp login access via an HTTP request. + + + + + + + + + + VU#939260 + + + + + + + + + + + + + Multiple stack-based buffer overflows on the ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allow man-in-the-middle attackers to execute arbitrary code via (1) a long temp attribute in a yweather:condition element in a forecastrss file that is processed by the checkWeather function; the (2) WeatherCity or (3) WeatherDegree variable to the detectWeather function; unspecified input to the (4) UpnpAddRunRLQoS, (5) UpnpDeleteRunRLQoS, or (6) UpnpDeletePortCheckType function; or (7) the SET COUNTRY udps command. + + + + + + + + + + + VU#939260 + + + + + + + + + + + + + The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allows remote attackers to execute arbitrary code via shell metacharacters in input to the (1) detectWeather, (2) set_language, (3) SystemCommand, or (4) NTPSyncWithHost function in management.c, or a (5) SET COUNTRY, (6) SET WLAN SSID, (7) SET WLAN CHANNEL, (8) SET WLAN STATUS, or (9) SET WLAN COUNTRY udps command. + + + + + + + + + + + VU#939260 + + + + + + + + + + + + + Amtelco miSecureMessages allows remote attackers to read the messages of arbitrary users via an XML request containing a valid license key and a modified contactID value, as demonstrated by a request from the iOS or Android application. + + + + + + + + + VU#251628 + + + + + + + + + + Multiple directory traversal vulnerabilities in Xangati XSR before 11 and XNR before 7 allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the file parameter in a getUpgradeStatus action to servlet/MGConfigData, (2) the download parameter in a download action to servlet/MGConfigData, (3) the download parameter in a port_svc action to servlet/MGConfigData, (4) the file parameter in a getfile action to servlet/Installer, or (5) the binfile parameter to servlet/MGConfigData. + + + + + + + + + VU#657622 + + + + + + + + + + + + + Xangati XSR before 11 and XNR before 7 allows remote attackers to execute arbitrary commands via shell metacharacters in a gui_input_test.pl params parameter to servlet/Installer. + + + + + + + + + + + VU#657622 + + + + + + + + + + + + + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-2741. Reason: This candidate is a duplicate of CVE-2014-2741. Notes: All CVE users should reference CVE-2014-2741 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. + + + + + + The default configuration of IBM 4690 OS, as used in Toshiba Global Commerce Solutions 4690 POS and other products, hashes passwords with the ADXCRYPT algorithm, which makes it easier for context-dependent attackers to obtain sensitive information via a brute-force attack against an ADXCSOUF.DAT file. + + + + + + + + + + VU#622950 + http://www-01.ibm.com/support/docview.wss?uid=pos1R1005054 + + + + + + + + + + + + The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate chain. + Per: http://cwe.mitre.org/data/definitions/358.html + +"CWE-358: Improperly Implemented Security Check for Standard" + + + + + + + + + + VU#489228 + http://issues.igniterealtime.org/browse/SMACK-410 + http://community.igniterealtime.org/blogs/ignite/2014/04/17/asmack-400-rc1-has-been-released + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to spoof IQ responses via a crafted attribute. + Per: http://cwe.mitre.org/data/definitions/345.html + +"CWE-345: Insufficient Verification of Data Authenticity" + + + + + + + + + VU#489228 + http://community.igniterealtime.org/blogs/ignite/2014/04/17/asmack-400-rc1-has-been-released + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, and 12.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Attachments. + + + + + + + + + 1029619 + 64828 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56471 + 102090 + + + + + + + + + + + + + Unspecified vulnerability in the Hyperion Essbase Administration Services component in Oracle Hyperion 11.1.2.1, 11.1.2.2, and 11.1.2.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Admin Console. + + + + + + + + + + 64814 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56469 + 102114 + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45, and Java SE Embedded 7u45, allows remote attackers to affect confidentiality via unknown vectors related to Networking. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to incorrect permission checks when listening on a socket, which allows attackers to escape the sandbox. + Per: http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + +"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets." + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1052919 + USN-2124-1 + USN-2089-1 + 1029608 + 64930 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56535 + 56486 + 56485 + 56432 + RHSA-2014:0136 + RHSA-2014:0135 + RHSA-2014:0134 + RHSA-2014:0097 + RHSA-2014:0030 + RHSA-2014:0027 + RHSA-2014:0026 + SSRT101455 + HPSBUX02973 + HPSBUX02972 + SSRT101454 + openSUSE-SU-2014:0180 + openSUSE-SU-2014:0177 + openSUSE-SU-2014:0174 + SUSE-SU-2014:0451 + SUSE-SU-2014:0266 + SUSE-SU-2014:0246 + http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/e6160aedadd5 + + + + + + + + + + + + + + + + + Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Java Integration. + + + + + + + + + 1029622 + 64832 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56480 + 102107 + + + + + + + + + + + Unspecified vulnerability in the Siebel Life Sciences component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect availability via unknown vectors related to Clinical Trip Report. + + + + + + + + + 1029622 + 64837 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56481 + 102108 + + + + + + + + + + + Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 7.2.0.3 SQL-Server, 7.3.0.x, 7.3.1.x, 12.2.0, 12.2.1, and 12.2.2 allows remote authenticated users to affect integrity via unknown vectors related to DM Others. + + + + + + + + + 1029620 + 64886 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56474 + 102098 + + + + + + + + + + + + + + + + + Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 7.2.0.3 SQL-Server, 7.3.0, 7.3.1, 12.2.1, and 12.2.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to DM Others. + + + + + + + + + + 1029620 + 64826 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56474 + 102103 + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serviceability. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to throwing of an incorrect exception when SnmpStatusException should have been used in the SNMP implementation, which allows attackers to escape the sandbox. + per http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + +Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets + + + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1051699 + USN-2124-1 + USN-2089-1 + 1029608 + 64922 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56535 + 56485 + 56432 + RHSA-2014:0136 + RHSA-2014:0135 + RHSA-2014:0134 + RHSA-2014:0097 + RHSA-2014:0030 + RHSA-2014:0027 + RHSA-2014:0026 + SSRT101455 + HPSBUX02973 + HPSBUX02972 + SSRT101454 + openSUSE-SU-2014:0180 + openSUSE-SU-2014:0177 + openSUSE-SU-2014:0174 + SUSE-SU-2014:0451 + SUSE-SU-2014:0266 + SUSE-SU-2014:0246 + http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/496c51673dec + + + + + + + + + + + + + + + + + Unspecified vulnerability in the Oracle Portal component in Oracle Fusion Middleware 11.1.1.6 allows remote attackers to affect integrity via unknown vectors related to Page Parameters and Events. + + + + + + + + + 1029613 + 64830 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56464 + 102093 + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5898 and CVE-2014-0403. + per: http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + +Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. + + + + + + + + + + oracle-cpujan2014-cve20140375(90339) + 1029608 + 64916 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56535 + 56485 + RHSA-2014:0135 + RHSA-2014:0134 + RHSA-2014:0030 + 102007 + SSRT101455 + HPSBUX02973 + HPSBUX02972 + SSRT101454 + SUSE-SU-2014:0451 + SUSE-SU-2014:0266 + SUSE-SU-2014:0246 + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect integrity via vectors related to JAXP. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to an improper check for "code permissions when creating document builder factories." + per: http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + + +Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1051923 + oracle-cpujan2014-cve20140376(90350) + USN-2124-1 + USN-2089-1 + 1029608 + 64907 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56535 + 56486 + 56485 + 56432 + RHSA-2014:0136 + RHSA-2014:0135 + RHSA-2014:0134 + RHSA-2014:0097 + RHSA-2014:0030 + RHSA-2014:0027 + RHSA-2014:0026 + 102018 + SSRT101455 + HPSBUX02973 + HPSBUX02972 + SSRT101454 + openSUSE-SU-2014:0180 + openSUSE-SU-2014:0177 + openSUSE-SU-2014:0174 + SUSE-SU-2014:0451 + SUSE-SU-2014:0266 + SUSE-SU-2014:0246 + http://hg.openjdk.java.net/jdk7u/jdk7u/jaxp/rev/783ceae9b736 + http://hg.openjdk.java.net/jdk7u/jdk7u/jaxp/rev/42be8e6266ab + + + + + + + + + + + + + + + + + Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, and 12.1.0.1 allows remote authenticated users to affect confidentiality via vectors related to SYS tables. + + + + + + + + + 1029607 + 64824 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56452 + 102081 + SUSE-SU-2014:0130 + + + + + + + + + + + + + Unspecified vulnerability in the Spatial component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, and 12.1.0.1 allows local users to affect confidentiality, integrity, and availability via unknown vectors. + + + + + + + + + + + 1029607 + 64812 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56452 + 102080 + SUSE-SU-2014:0130 + + + + + + + + + + + + + Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 7.2.0.3 SQL-Server, 7.3.0.x, 7.3.1.x, 12.2.0, 12.2.1, and 12.2.2 allows remote attackers to affect integrity via unknown vectors related to DM Others. + + + + + + + + + 1029620 + 64857 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56474 + 102097 + + + + + + + + + + + + + + + + + Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect integrity via vectors related to MultiChannel Framework (MCF). + + + + + + + + + 1029623 + 64865 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56478 + 102037 + + + + + + + + + + + Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect integrity via vectors related to PIA Core Technology, a different vulnerability than CVE-2014-0445. + + + + + + + + + 1029623 + 64892 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56478 + 102045 + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 7u45 and JavaFX 2.2.45 allows remote attackers to affect availability via unknown vectors related to JavaFX. + Per: http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + +"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets." + + + + + + + + + oracle-cpujan2014-cve20140382(90355) + 1029608 + 64936 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56535 + 56485 + 56484 + RHSA-2014:0030 + 102026 + SSRT101454 + HPSBUX02972 + + + + + + + + + + + + + + + + Unspecified vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.2.0 and 11.1.2.1 allows remote authenticated users to affect confidentiality via unknown vectors related to Identity Console. + + + + + + + + + 1029613 + 64842 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56459 + 102102 + + + + + + + + + + + Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.35 and earlier and 5.6.15 and earlier allows remote authenticated users to affect availability via vectors related to XML. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 7u45, when installing on OS X, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Install. + per: +http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + +Applies to installation process on client deployment of Java. + + + + + + + + + + + 1029608 + 64901 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56485 + 101998 + + + + + + + + + + + + + Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.71 and earlier, 5.5.33 and earlier, and 5.6.13 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. + + + + + + + + + oracle-cpujan2014-cve20140386(90380) + 64904 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + DSA-2848 + DSA-2845 + USN-2086-1 + 56580 + 56541 + 56491 + RHSA-2014:0189 + RHSA-2014:0186 + RHSA-2014:0173 + RHSA-2014:0164 + 102069 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 6u65 and Java SE 7u45, when running on Firefox, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. + Per: http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + +"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets." + + + + + + + + + + + 1029608 + 64882 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56535 + 56485 + RHSA-2014:0135 + RHSA-2014:0134 + RHSA-2014:0030 + 102002 + SSRT101455 + HPSBUX02973 + HPSBUX02972 + SSRT101454 + SUSE-SU-2014:0451 + SUSE-SU-2014:0266 + SUSE-SU-2014:0246 + + + + + + + + + + + + + + + Unspecified vulnerability in the PeopleSoft Enterprise HRMS Human Resources component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Org and Workforce Dev. + + + + + + + + + 1029623 + 64878 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56477 + 102040 + + + + + + + + + + + Unspecified vulnerability in Oracle iLearning 6.0 allows remote attackers to affect integrity via unknown vectors related to Learner Pages. + + + + + + + + + 1029621 + 64845 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56482 + 102109 + + + + + + + + + + Unspecified vulnerability in Oracle Solaris 10 allows remote attackers to affect integrity via unknown vectors related to Java Web Console. + + + + + + + + + oracle-cpujan2014-cve20140390(90362) + 64859 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56488 + 102052 + + + + + + + + + + Unspecified vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.1.2.0, and 11.1.2.1 allows remote attackers to affect confidentiality via unknown vectors related to End User Self Service. + + + + + + + + + 1029613 + 64829 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56459 + 102099 + + + + + + + + + + + + + Unspecified vulnerability in the PeopleSoft Enterprise HRMS component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Security. + + + + + + + + + 1029623 + 64874 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56477 + 102039 + + + + + + + + + + + Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.71 and earlier, 5.5.33 and earlier, and 5.6.13 and earlier allows remote authenticated users to affect integrity via unknown vectors related to InnoDB. + + + + + + + + + oracle-cpujan2014-cve20140393(90386) + 64877 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + DSA-2848 + DSA-2845 + USN-2086-1 + 56580 + 56541 + 56491 + RHSA-2014:0189 + RHSA-2014:0186 + RHSA-2014:0173 + RHSA-2014:0164 + 102075 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Updates Environment Mgmt, a different vulnerability than CVE-2014-0395. + + + + + + + + + 1029623 + 64848 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56478 + 102033 + + + + + + + + + + + Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Updates Environment Mgmt, a different vulnerability than CVE-2014-0394. + + + + + + + + + 1029623 + 64852 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56478 + 102034 + + + + + + + + + + + Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Portal - Web Services. + + + + + + + + + 1029623 + 64841 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56478 + 102031 + + + + + + + + + + + Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, and 12.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Discoverer. + + + + + + + + + 1029619 + 64818 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56471 + 102105 + + + + + + + + + + + + + Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.2, 6.3, 6.3.1, and 6.3.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Data, Domain & Function Security. + + + + + + + + + 1029620 + 64861 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 102085 + + + + + + + + + + + + + Unspecified vulnerability in the Oracle Internet Directory component in Oracle Fusion Middleware 11.1.1.6 and 11.1.1.7 allows remote authenticated users to affect confidentiality via vectors related to OID LDAP server. + + + + + + + + + 1029618 + 64822 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56460 + 102112 + + + + + + + + + + + Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors. + + + + + + + + + oracle-cpujan2014-cve20140401(90382) + 64898 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + DSA-2848 + DSA-2845 + USN-2086-1 + 56580 + 56541 + 56491 + RHSA-2014:0189 + RHSA-2014:0186 + RHSA-2014:0173 + RHSA-2014:0164 + 102071 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.71 and earlier, 5.5.33 and earlier, and 5.6.13 and earlier allows remote authenticated users to affect availability via unknown vectors related to Locking. + + + + + + + + + oracle-cpujan2014-cve20140402(90379) + 64908 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + DSA-2848 + DSA-2845 + USN-2086-1 + 56580 + 56541 + 56491 + RHSA-2014:0189 + RHSA-2014:0186 + RHSA-2014:0173 + RHSA-2014:0164 + 102068 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5898 and CVE-2014-0375. + Per: http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + +"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets." + + + + + + + + + + oracle-cpujan2014-cve20140403(90338) + 1029608 + 64920 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56535 + 56485 + RHSA-2014:0135 + RHSA-2014:0134 + RHSA-2014:0030 + 102006 + SSRT101455 + HPSBUX02973 + HPSBUX02972 + SSRT101454 + SUSE-SU-2014:0451 + SUSE-SU-2014:0266 + SUSE-SU-2014:0246 + + + + + + + + + + + + + + + Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect integrity and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0406. + + + + + + + + + + oracle-cpujan2014-cve20140404(90372) + 1029610 + 64911 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + DSA-2878 + 56490 + 102061 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core. + + + + + + + + + + + oracle-cpujan2014-cve20140405(90370) + 1029610 + 64900 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56490 + 102059 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect integrity and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0404. + + + + + + + + + + oracle-cpujan2014-cve20140406(90371) + 1029610 + 64905 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + DSA-2878 + 56490 + 102060 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core. + + + + + + + + + + + oracle-cpujan2014-cve20140407(90369) + 1029610 + 64913 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + DSA-2878 + 56490 + 102058 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 7u45, when running on OS X, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. + Per: http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + +"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets." + + + + + + + + + + + USN-2089-1 + 1029608 + 64910 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56485 + 101999 + openSUSE-SU-2014:0180 + openSUSE-SU-2014:0177 + openSUSE-SU-2014:0174 + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5889, CVE-2013-5902, CVE-2014-0415, CVE-2014-0418, and CVE-2014-0424. + + + + + + + + + + + 1029608 + 64915 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56535 + 56485 + RHSA-2014:0135 + RHSA-2014:0134 + RHSA-2014:0030 + 102024 + SSRT101455 + HPSBUX02973 + HPSBUX02972 + SSRT101454 + SUSE-SU-2014:0451 + SUSE-SU-2014:0266 + SUSE-SU-2014:0246 + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that this issue allows remote attackers to obtain sensitive information about encryption keys via a timing discrepancy during the TLS/SSL handshake. + + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1053010 + oracle-cpujan2014-cve20140411(90357) + USN-2124-1 + USN-2089-1 + 1029608 + 64918 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56535 + 56487 + 56486 + 56485 + 56432 + RHSA-2014:0136 + RHSA-2014:0135 + RHSA-2014:0134 + RHSA-2014:0097 + RHSA-2014:0030 + RHSA-2014:0027 + RHSA-2014:0026 + 102028 + SSRT101455 + HPSBUX02973 + HPSBUX02972 + SSRT101454 + openSUSE-SU-2014:0180 + openSUSE-SU-2014:0177 + openSUSE-SU-2014:0174 + SUSE-SU-2014:0451 + SUSE-SU-2014:0266 + SUSE-SU-2014:0246 + http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/d533e96c7acc + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB. + + + + + + + + + oracle-cpujan2014-cve20140412(90378) + 64880 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + DSA-2848 + DSA-2845 + USN-2086-1 + 56580 + 56541 + 56491 + RHSA-2014:0189 + RHSA-2014:0186 + RHSA-2014:0173 + RHSA-2014:0164 + 102067 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect integrity via vectors related to HTTP Request Handling, a different vulnerability than CVE-2014-0426. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect confidentiality via vectors related to HTTP Request Handling. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5889, CVE-2013-5902, CVE-2014-0410, CVE-2014-0418, and CVE-2014-0424. + + + + + + + + + + + 1029608 + 64899 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56535 + 56485 + RHSA-2014:0135 + RHSA-2014:0134 + RHSA-2014:0030 + 102025 + SSRT101455 + HPSBUX02973 + HPSBUX02972 + SSRT101454 + SUSE-SU-2014:0451 + SUSE-SU-2014:0266 + SUSE-SU-2014:0246 + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect integrity via vectors related to JAAS. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to how principals are set for the Subject class, which allows attackers to escape the sandbox using deserialization of a crafted Subject instance. + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1051912 + oracle-cpujan2014-cve20140416(90349) + USN-2124-1 + USN-2089-1 + 1029608 + 64937 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56535 + 56486 + 56485 + 56432 + RHSA-2014:0136 + RHSA-2014:0135 + RHSA-2014:0134 + RHSA-2014:0097 + RHSA-2014:0030 + RHSA-2014:0027 + RHSA-2014:0026 + 102017 + SSRT101455 + HPSBUX02973 + HPSBUX02972 + SSRT101454 + openSUSE-SU-2014:0180 + openSUSE-SU-2014:0177 + openSUSE-SU-2014:0174 + SUSE-SU-2014:0451 + SUSE-SU-2014:0266 + SUSE-SU-2014:0246 + http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/abe1cb2d27cb + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JavaFX 2.2.45; and Java SE Embedded 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. + + + + + + + + + + + 1029608 + 64932 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56535 + 56486 + 56485 + 56484 + RHSA-2014:0136 + RHSA-2014:0135 + RHSA-2014:0134 + RHSA-2014:0030 + 102001 + SSRT101455 + HPSBUX02973 + HPSBUX02972 + SSRT101454 + SUSE-SU-2014:0451 + SUSE-SU-2014:0266 + SUSE-SU-2014:0246 + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5889, CVE-2013-5902, CVE-2014-0410, CVE-2014-0415, and CVE-2014-0424. + + + + + + + + + + + oracle-cpujan2014-cve20140418(90344) + 1029608 + 64917 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56535 + 56485 + RHSA-2014:0030 + 102012 + SSRT101455 + HPSBUX02973 + HPSBUX02972 + SSRT101454 + + + + + + + + + + + + + + + Unspecified vulnerability in the Oracle Secure Global Desktop (SGD) component in Oracle Virtualization SGD before 4.63 with December 2013 PSU, 4.71, 5.0 with December 2013 PSU, and 5.10 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Administration Console and Workspace Web Applications. + + + + + + + + + + + oracle-cpujan2014-cve20140419(90367) + 1029610 + 64902 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 102110 + + + + + + + + + + + + + Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.34 and earlier, and 5.6.14 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Replication. + + + + + + + + + oracle-cpujan2014-cve20140420(90388) + 64888 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + DSA-2848 + USN-2086-1 + 56580 + 56491 + RHSA-2014:0189 + RHSA-2014:0186 + RHSA-2014:0173 + 102077 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Solaris 10, when running on the SPARC64-X Platform, allows local users to affect confidentiality, integrity, and availability via unknown vectors. + + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JNDI. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to missing package access checks in the Naming / JNDI component, which allows attackers to escape the sandbox. + + + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1051528 + USN-2124-1 + USN-2089-1 + 1029608 + 64921 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56535 + 56486 + 56485 + 56432 + RHSA-2014:0136 + RHSA-2014:0135 + RHSA-2014:0134 + RHSA-2014:0097 + RHSA-2014:0030 + RHSA-2014:0027 + RHSA-2014:0026 + 101997 + SSRT101455 + HPSBUX02973 + HPSBUX02972 + SSRT101454 + openSUSE-SU-2014:0180 + openSUSE-SU-2014:0177 + openSUSE-SU-2014:0174 + SUSE-SU-2014:0451 + SUSE-SU-2014:0266 + SUSE-SU-2014:0246 + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote authenticated users to affect confidentiality and availability via unknown vectors related to Beans. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability in DocumentHandler.java, related to Beans decoding. + Per: http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + +"Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service." + + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1053066 + oracle-cpujan2014-cve20140423(90340) + USN-2124-1 + USN-2089-1 + 1029608 + 64914 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56535 + 56487 + 56486 + 56485 + 56432 + RHSA-2014:0136 + RHSA-2014:0135 + RHSA-2014:0134 + RHSA-2014:0097 + RHSA-2014:0030 + RHSA-2014:0027 + RHSA-2014:0026 + SSRT101455 + HPSBUX02973 + HPSBUX02972 + SSRT101454 + openSUSE-SU-2014:0180 + openSUSE-SU-2014:0177 + openSUSE-SU-2014:0174 + SUSE-SU-2014:0451 + SUSE-SU-2014:0266 + SUSE-SU-2014:0246 + http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/995b32f013f5 + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5889, CVE-2013-5902, CVE-2014-0410, CVE-2014-0415, and CVE-2014-0418. + Per: http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + +"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets." + + + + + + + + + + + 1029608 + 64919 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56535 + 56485 + RHSA-2014:0135 + RHSA-2014:0134 + RHSA-2014:0030 + 102004 + SSRT101455 + HPSBUX02973 + HPSBUX02972 + SSRT101454 + SUSE-SU-2014:0451 + SUSE-SU-2014:0266 + SUSE-SU-2014:0246 + + + + + + + + + + + + + + + Unspecified vulnerability in the PeopleSoft Enterprise SCM Services Procurement component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Security. + + + + + + + + + 1029623 + 64889 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56479 + 102044 + + + + + + + + + + Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect integrity via vectors related to HTTP Request Handling, a different vulnerability than CVE-2014-0413. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.13 and earlier allows remote authenticated users to affect availability via vectors related to FTS. + + + + + + + + + oracle-cpujan2014-cve20140427(90383) + 64868 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56491 + 102072 + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to "insufficient security checks in IIOP streams," which allows attackers to escape the sandbox. + Per: http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + +"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets." + + + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1051519 + USN-2124-1 + USN-2089-1 + 1029608 + 64935 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56535 + 56486 + 56485 + 56432 + RHSA-2014:0136 + RHSA-2014:0135 + RHSA-2014:0134 + RHSA-2014:0097 + RHSA-2014:0030 + RHSA-2014:0027 + RHSA-2014:0026 + 101996 + SSRT101455 + HPSBUX02973 + HPSBUX02972 + SSRT101454 + openSUSE-SU-2014:0180 + openSUSE-SU-2014:0177 + openSUSE-SU-2014:0174 + SUSE-SU-2014:0451 + SUSE-SU-2014:0266 + SUSE-SU-2014:0246 + http://hg.openjdk.java.net/jdk7u/jdk7u/corba/rev/0a879f00b698 + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. + Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + +"Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service." + + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.13 and earlier allows remote authenticated users to affect availability via unknown vectors related to Performance Schema. + + + + + + + + + oracle-cpujan2014-cve20140430(90387) + 64893 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56491 + 102076 + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB, a different vulnerability than CVE-2013-5881. + + + + + + + + + oracle-cpujan2014-cve20140431(90384) + 64897 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56491 + 102073 + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-0455 and CVE-2014-2402. + + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.13 and earlier allows remote attackers to affect availability via unknown vectors related to Thread Pooling. + + + + + + + + + oracle-cpujan2014-cve20140433(90375) + 64895 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56491 + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in the Oracle Agile Product Lifecycle Management for Process component in Oracle Supply Chain Products Suite 6.0, 6.1, and 6.1.1 allows remote attackers to affect integrity via unknown vectors related to Installation. + + + + + + + + + 1029620 + 64851 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56472 + 102084 + + + + + + + + + + + + Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3, 6.3.1, and 6.3.2 allows remote authenticated users to affect availability via unknown vectors related to Data, Domain & Function Security. + + + + + + + + + 1029620 + 64869 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 102086 + + + + + + + + + + + + + + Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. + + + + + + + + + oracle-cpujan2014-cve20140437(90385) + 64849 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + DSA-2848 + DSA-2845 + USN-2086-1 + 56580 + 56541 + 56491 + RHSA-2014:0189 + RHSA-2014:0186 + RHSA-2014:0173 + RHSA-2014:0164 + 102074 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote authenticated users to affect confidentiality via unknown vectors related to Panel Processor. + + + + + + + + + 1029623 + 64887 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56478 + 102043 + + + + + + + + + + + Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote authenticated users to affect integrity via unknown vectors related to Report Distribution. + + + + + + + + + 1029623 + 64884 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56478 + 102042 + + + + + + + + + + + Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote authenticated users to affect availability via vectors related to PIA Core Technology. + + + + + + + + + 1029623 + 64881 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56478 + 102041 + + + + + + + + + + + Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect availability via unknown vectors related to Integration Broker. + + + + + + + + + 1029623 + 64839 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56478 + 102047 + + + + + + + + + + + Unspecified vulnerability in Oracle Solaris 9, 10, and 11.1 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Print Filter Utility. + + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 allows remote attackers to affect integrity via unknown vectors related to Security. + + + + + + + + + 1029623 + 64844 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56478 + 102032 + + + + + + + + + + Unspecified vulnerability in the Oracle AutoVue Electro-Mechanical Professional component in Oracle Supply Chain Products Suite 20.1.1 allows remote authenticated users to affect confidentiality via unknown vectors related to Web General, a different vulnerability than CVE-2013-5868 and CVE-2013-5871. + + + + + + + + + 1029620 + 64883 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56473 + 102089 + + + + + + + + + + Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect integrity via vectors related to PIA Core Technology, a different vulnerability than CVE-2014-0381. + + + + + + + + + 1029623 + 64867 + 64758 + http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html + 56478 + 102038 + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. + + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Solaris 10 and 11.1 allows local users to affect availability via unknown vectors related to Kernel. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 7u51 and 8 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. + + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality via unknown vectors related to Deployment. + Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + +"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets." + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + Unspecified vulnerability in the Oracle WebCenter Portal component in Oracle Fusion Middleware 11.1.1.7 and 11.1.1.8 allows remote attackers to affect confidentiality via unknown vectors related to People Connection. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT, a different vulnerability than CVE-2014-2412. + Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + +"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets." + + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0458 and CVE-2014-2423. + + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security. + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Security. + Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + +"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets." + + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-0432 and CVE-2014-2402. + Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + +"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets." + + + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. + + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 5.0u61, SE 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. + + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0452 and CVE-2014-2423. + per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + +Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. + + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect availability via unknown vectors related to 2D. + Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + +"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets." + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality and integrity via vectors related to JNDI. + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. + Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + +"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets." + + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 8 allows remote attackers to affect confidentiality via unknown vectors related to Scripting, a different vulnerability than CVE-2014-0464. + Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + +"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets." + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 8 allows remote attackers to affect confidentiality via unknown vectors related to Scripting, a different vulnerability than CVE-2014-0463. + Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + +"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets." + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + Unspecified vulnerability in the Oracle OpenSSO component in Oracle Fusion Middleware 8.0 Update 2 Patch 5 allows remote authenticated users to affect integrity via unknown vectors related to Admin Console. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + The fixps script in a2ps 4.14 does not use the -dSAFER option when executing gs, which allows context-dependent attackers to delete arbitrary files or execute arbitrary commands via a crafted PostScript file. + + + + + + + + + + + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742902 + DSA-2892 + + + + + + + + + + Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of service (crash) via a crafted RFC2047 header line, related to address expansion. + + + + + + + + + USN-2147-1 + http://www.mutt.org/doc/devel/ChangeLog + DSA-2874 + RHSA-2014:0304 + openSUSE-SU-2014:0436 + openSUSE-SU-2014:0434 + SUSE-SU-2014:0471 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + super.c in Super 3.30.0 does not check the return value of the setuid function when the -F flag is set, which allows local users to gain privileges via unspecified vectors, aka an RLIMIT_NPROC attack. + + + + + + + + + + + + [oss-security] 20140428 super unchecked setuid (CVE-2014-0470) + DSA-2917 + + + + + + + + + + Directory traversal vulnerability in the unpacking functionality in dpkg before 1.15.9, 1.16.x before 1.16.13, and 1.17.x before 1.17.8 allows remote attackers to write arbitrary files via a crafted source package, related to "C-style filename quoting." + + + + + + + + + + + + USN-2183-1 + DSA-2915 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a "dotted Python path." + + + + + + + + + + + https://www.djangoproject.com/weblog/2014/apr/21/security/ + USN-2169-1 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users. + + + + + + + + + https://www.djangoproject.com/weblog/2014/apr/21/security/ + USN-2169-1 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, related to "MySQL typecasting." + + + + + + + + + + + https://www.djangoproject.com/weblog/2014/apr/21/security/ + USN-2169-1 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Adobe Flash Player before 11.7.700.260 and 11.8.x and 11.9.x before 12.0.0.38 on Windows and Mac OS X and before 11.2.202.335 on Linux, Adobe AIR before 4.0.0.1390, Adobe AIR SDK before 4.0.0.1390, and Adobe AIR SDK & Compiler before 4.0.0.1390 allow attackers to bypass unspecified protection mechanisms via unknown vectors. + + + + + + + + + + + http://helpx.adobe.com/security/products/flash-player/apsb14-02.html + 1029602 + 56636 + 56516 + RHSA-2014:0028 + openSUSE-SU-2014:0128 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Adobe Flash Player before 11.7.700.260 and 11.8.x and 11.9.x before 12.0.0.38 on Windows and Mac OS X and before 11.2.202.335 on Linux, Adobe AIR before 4.0.0.1390, Adobe AIR SDK before 4.0.0.1390, and Adobe AIR SDK & Compiler before 4.0.0.1390 allow attackers to defeat the ASLR protection mechanism by leveraging an "address leak." + + + + + + + + + + + http://helpx.adobe.com/security/products/flash-player/apsb14-02.html + 1029602 + 56636 + 56516 + RHSA-2014:0028 + openSUSE-SU-2014:0128 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0495. + + + + + + + + + + + 1029604 + http://helpx.adobe.com/security/products/acrobat/apsb14-01.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Adobe Digital Editions 2.0.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors. + + + + + + + + + + + adobe-digital-cve20140494-code-exec(90648) + 1029680 + 65091 + 56578 + 102364 + http://helpx.adobe.com/security/products/Digital-Editions/apsb14-03.html + + + + + + + + + + Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0493. + + + + + + + + + + + 1029604 + http://helpx.adobe.com/security/products/acrobat/apsb14-01.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecified vectors. + + + + + + + + + + + 1029604 + http://helpx.adobe.com/security/products/acrobat/apsb14-01.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors. + + + + + + + + + + + http://helpx.adobe.com/security/products/flash-player/apsb14-04.html + RHSA-2014:0137 + SUSE-SU-2014:0221 + openSUSE-SU-2014:0203 + openSUSE-SU-2014:0197 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Stack-based buffer overflow in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 allows attackers to execute arbitrary code via unspecified vectors. + + + + + + + + + + + http://helpx.adobe.com/security/products/flash-player/apsb14-07.html + RHSA-2014:0196 + SUSE-SU-2014:0290 + openSUSE-SU-2014:0278 + openSUSE-SU-2014:0277 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 do not prevent access to address information, which makes it easier for attackers to bypass the ASLR protection mechanism via unspecified vectors. + + + + + + + + + http://helpx.adobe.com/security/products/flash-player/apsb14-07.html + RHSA-2014:0196 + SUSE-SU-2014:0290 + openSUSE-SU-2014:0278 + openSUSE-SU-2014:0277 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Adobe Shockwave Player before 12.0.9.149 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0501. + + + + + + + + + + + http://helpx.adobe.com/security/products/shockwave/apsb14-06.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Adobe Shockwave Player before 12.0.9.149 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0500. + + + + + + + + + + + http://helpx.adobe.com/security/products/shockwave/apsb14-06.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2014. + + + + + + + + + + + http://helpx.adobe.com/security/products/flash-player/apsb14-07.html + http://www.alienvault.com/open-threat-exchange/blog/analysis-of-an-attack-exploiting-the-adobe-zero-day-cve-2014-0502/ + RHSA-2014:0196 + SUSE-SU-2014:0290 + openSUSE-SU-2014:0278 + openSUSE-SU-2014:0277 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Adobe Flash Player before 11.7.700.272 and 11.8.x through 12.0.x before 12.0.0.77 on Windows and OS X, and before 11.2.202.346 on Linux, allows remote attackers to bypass the Same Origin Policy via unspecified vectors. + + + + + + + + + + RHSA-2014:0289 + SUSE-SU-2014:0387 + openSUSE-SU-2014:0379 + http://helpx.adobe.com/security/products/flash-player/apsb14-08.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Adobe Flash Player before 11.7.700.272 and 11.8.x through 12.0.x before 12.0.0.77 on Windows and OS X, and before 11.2.202.346 on Linux, allows attackers to read the clipboard via unspecified vectors. + + + + + + + + + RHSA-2014:0289 + SUSE-SU-2014:0387 + openSUSE-SU-2014:0379 + http://helpx.adobe.com/security/products/flash-player/apsb14-08.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Adobe Shockwave Player before 12.1.0.150 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. + + + + + + + + + + + http://helpx.adobe.com/security/products/shockwave/apsb14-10.html + + + + + + + + + + + + + + + + Use-after-free vulnerability in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK & Compiler before 13.0.0.83 allows remote attackers to execute arbitrary code, and possibly bypass an Internet Explorer sandbox protection mechanism, via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014. + + + + + + + + + + + http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/ + http://twitter.com/thezdi/statuses/443886338077495296 + http://helpx.adobe.com/security/products/flash-player/apsb14-09.html + + + + + + + + + + Buffer overflow in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK & Compiler before 13.0.0.83 allows attackers to execute arbitrary code via unspecified vectors. + + + + + + + + + + + + http://helpx.adobe.com/security/products/flash-player/apsb14-09.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK & Compiler before 13.0.0.83 allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors. + + + + + + + + + http://helpx.adobe.com/security/products/flash-player/apsb14-09.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK & Compiler before 13.0.0.83 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + http://helpx.adobe.com/security/products/flash-player/apsb14-09.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Heap-based buffer overflow in Adobe Flash Player 12.0.0.77 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors, as demonstrated by Zeguang Zhao and Liang Chen during a Pwn2Own competition at CanSecWest 2014. + + + + + + + + + + + 66241 + http://www.pwn2own.com/2014/03/pwn2own-results-thursday-day-two/ + http://twitter.com/thezdi/statuses/444262022444621824 + + + + + + + + + + Heap-based buffer overflow in Adobe Reader 11.0.06 allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014. + + + + + + + + + + + http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/ + http://twitter.com/thezdi/statuses/443827076580122624 + + + + + + + + + + Adobe Reader 11.0.06 allows attackers to bypass a PDF sandbox protection mechanism via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014. + + + + + + + + + + + http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/ + http://twitter.com/thezdi/statuses/443827076580122624 + + + + + + + + + + The Adobe Reader Mobile application before 11.2 for Android does not properly restrict use of JavaScript, which allows remote attackers to execute arbitrary code via a crafted PDF document, a related issue to CVE-2012-6636. + + + + + + + + + + + + http://helpx.adobe.com/security/products/reader-mobile/apsb14-12.html + 66798 + 20140413 Adobe Reader for Android exposes insecure Javascript interfaces + http://www.securify.nl/advisory/SFY20140401/adobe_reader_for_android_exposes_insecure_javascript_interfaces.html + 20140413 Adobe Reader for Android exposes insecure Javascript interfaces + + + + + + + + + + + Buffer overflow in Adobe Flash Player before 11.7.700.279 and 11.8.x through 13.0.x before 13.0.0.206 on Windows and OS X, and before 11.2.202.356 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in April 2014. + + + Per: http://helpx.adobe.com/security/products/flash-player/apsb14-13.html + +"Affected software versions + + Adobe Flash Player 13.0.0.182 and earlier versions for Windows + Adobe Flash Player 13.0.0.201 and earlier versions for Macintosh + Adobe Flash Player 11.2.202.350 and earlier versions for Linux" + + + + + + + + + + + http://helpx.adobe.com/security/products/flash-player/apsb14-13.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The query_findclosestnsec3 function in query.c in named in ISC BIND 9.6, 9.7, and 9.8 before 9.8.6-P2 and 9.9 before 9.9.4-P2, and 9.6-ESV before 9.6-ESV-R10-P2, allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via a crafted DNS query to an authoritative nameserver that uses the NSEC3 signing feature. + + + + + + + + + https://kb.isc.org/article/AA-01085 + https://kb.isc.org/article/AA-01078 + https://bugzilla.redhat.com/show_bug.cgi?id=1051717 + USN-2081-1 + SSA:2014-028-01 + 1029589 + 64801 + MDVSA-2014:002 + FreeBSD-SA-14:04 + 56574 + 56522 + 56493 + 56442 + 56427 + 56425 + RHSA-2014:0043 + 101973 + SSRT101420 + HPSBUX02961 + openSUSE-SU-2014:0202 + openSUSE-SU-2014:0199 + FEDORA-2014-0811 + FEDORA-2014-0858 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Barclamp (aka barclamp-network) 1.7 for the Crowbar Framework, as used in SUSE Cloud 3, does not enable netfilter on bridges when creating new instances, which allows remote attackers to bypass security group restrictions via unspecified vectors, related to floating IPs. + + + + + + + + + + + SUSE-SU-2014:0452 + https://github.com/crowbar/barclamp-network/pull/269 + https://bugzilla.novell.com/show_bug.cgi?id=864183 + 66519 + 57509 + + + + + + + + + + + + + Unspecified vulnerability in Juniper Junos before 11.4R10-S1, before 11.4R11, 12.1X44 before 12.1X44-D26, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, and 12.1X46 before 12.1X46-D10, when Dynamic IPsec VPN is configured, allows remote attackers to cause a denial of service (new Dynamic VPN connection failures and CPU and disk consumption) via unknown vectors. + + + + + + + + + 66759 + 1030057 + 57845 + http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10620 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The XNM command processor in Juniper Junos 10.4 before 10.4R16, 11.4 before 11.4R10, 12.1R before 12.1R8-S2, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, 12.1X46 before 12.1X46-D10, 12.2 before 12.2R7, 12.3 before 12.3R5, 13.1 before 13.1R3-S1, 13.2 before 13.2R2-S2, and 13.3 before 13.3R1, when xnm-ssl or xnm-clear-text is enabled, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors. + + + + + + + + + 1029586 + 101861 + http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10607 + + + + + + + + + + + + + + + + + + + + Juniper Junos 13.2 before 13.2R3 and 13.3 before 13.3R1, when PIM is enabled, allows remote attackers to cause a denial of service (kernel panic and crash) via a large number of crafted IGMP packets. + + + + + + + + + 66762 + 1030062 + 57819 + http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10618 + + + + + + + + + + + Juniper Junos 10.4 before 10.4R16, 11.4 before 11.4R10, 12.1R before 12.1R8-S2, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, 12.1X46 before 12.1X46-D10, 12.2 before 12.2R7, 12.3 before 12.3R5, 13.1 before 13.1R3-S1, 13.2 before 13.2R2, and 13.3 before 13.3R1 allows local users to gain privileges via vectors related to "certain combinations of Junos OS CLI commands and arguments." + + + + + + + + + + + 1029585 + 64762 + 101862 + http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10608 + + + + + + + + + + + + + + + + + + + + Juniper Junos 10.4 before 10.4R16, 11.4 before 11.4R10, 12.1R before 12.1R8-S2, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, 12.1X46 before 12.1X46-D10, 12.2 before 12.2R7, 12.3 before 12.3R4-S2, 13.1 before 13.1R3-S1, 13.2 before 13.2R2, and 13.3 before 13.3R1 allows remote attackers to cause a denial of service (rdp crash) via a large BGP UPDATE message which immediately triggers a withdraw message to be sent, as demonstrated by a long AS_PATH and a large number of BGP Communities. + + + + + + + + + 1029582 + 64766 + 101868 + http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10609 + + + + + + + + + + + + + + + + + + + + Juniper Junos 10.4S before 10.4S15, 10.4R before 10.4R16, 11.4 before 11.4R9, and 12.1R before 12.1R7 on SRX Series service gateways allows remote attackers to cause a denial of service (flowd crash) via a crafted IP packet. + + + + + + + + + 1029583 + 64764 + 101863 + http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10610 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Juniper Junos before 10.4 before 10.4R16, 11.4 before 11.4R8, 12.1R before 12.1R7, 12.1X44 before 12.1X44-D20, and 12.1X45 before 12.1X45-D10 on SRX Series service gateways, when used as a UAC enforcer and captive portal is enabled, allows remote attackers to cause a denial of service (flowd crash) via a crafted HTTP message. + + + + + + + + + https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10611 + juniper-junos-srx-cve20140618-dos(90238) + 1029584 + 64769 + 101864 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in Technicolor (formerly Thomson) TC7200 STD6.01.12 allow remote attackers to inject arbitrary web script or HTML via the (1) ADDNewDomain parameter to parental/website-filters.asp or (2) VmTracerouteHost parameter to goform/status/diagnostics-route. + + + + + + + + + + 30668 + + + + + + + + + + Multiple cross-site request forgery (CSRF) vulnerabilities in Technicolor (formerly Thomson) TC7200 STD6.01.12 allow remote attackers to hijack the authentication of administrators for requests that (1) perform a factory reset via a request to goform/system/factory, (2) disable advanced options via a request to goform/advanced/options, (3) remove ip-filters via the IpFilterAddressDelete1 parameter to goform/advanced/ip-filters, or (4) remove firewall settings via the cbFirewall parameter to goform/advanced/firewall. + + + + + + + + + + + + 30667 + + + + + + + + + + The web service in EMC Documentum Foundation Services (DFS) 6.5 through 6.7 before 6.7 SP1 P22, 6.7 SP2 before P08, 7.0 before P12, and 7.1 before P01 does not properly implement content uploading, which allows remote authenticated users to bypass intended content access restrictions via unspecified vectors. + + + + + + + + + + + 20140205 ESA-2014-005: EMC Documentum Foundation Services (DFS) Content Access Vulnerability + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the Self-Service Console in EMC RSA Authentication Manager 7.1 before SP4 P32 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "cross frame scripting" issue. + + + + + + + + + + 20140326 ESA-2014-015: RSA Authentication Manager Cross Frame Scripting Vulnerability + + + + + + + + + + + EMC RSA Data Loss Prevention (DLP) 9.x before 9.6-SP2 does not properly manage sessions, which allows remote authenticated users to gain privileges and bypass intended content-reading restrictions via unspecified vectors. + + + + + + + + + 20140228 ESA-2014-003: RSA Data Loss Prevention Improper Session Management Vulnerability + + + + + + + + + + + + The SSLSocket implementation in the (1) JSAFE and (2) JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to cause a denial of service (memory consumption) by triggering application-data processing during the TLS handshake, a time at which the data is internally buffered. + + + + + + + + + 20140214 ESA-2014-009: RSA BSAFE SSL-J Multiple Vulnerabilities + + + + + + + + + + + + + + + The (1) JSAFE and (2) JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 make it easier for remote attackers to bypass intended cryptographic protection mechanisms by triggering application-data processing during the TLS handshake, a time at which the data is both unencrypted and unauthenticated. + + + + + + + + + 20140214 ESA-2014-009: RSA BSAFE SSL-J Multiple Vulnerabilities + + + + + + + + + + + + + + + The SSLEngine API implementation in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to trigger the selection of a weak cipher suite by using the wrap method during a certain incomplete-handshake state. + + + + + + + + + 20140214 ESA-2014-009: RSA BSAFE SSL-J Multiple Vulnerabilities + + + + + + + + + + + + + + + The server in EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.5 does not properly process certificate chains, which allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors. + + + + + + + + + 20140324 ESA-2014-011: RSA BSAFE Micro Edition Suite Server Crash Vulnerability + + + + + + + + + + + + + + EMC Documentum TaskSpace (TSP) 6.7SP1 before P25 and 6.7SP2 before P11 does not properly handle the interaction between the dm_world group and the dm_superusers_dynamic group, which allows remote authenticated users to obtain sensitive information and gain privileges in opportunistic circumstances by leveraging an incorrect group-addition implementation. + + + + + + + + + + + 20140305 ESA-2014-012: EMC Documentum TaskSpace Multiple Vulnerabilities + + + + + + + + + + + EMC Documentum TaskSpace (TSP) 6.7SP1 before P25 and 6.7SP2 before P11 allows remote authenticated users to read arbitrary files via a modified imaging-service URL. + + + + + + + + + 20140305 ESA-2014-012: EMC Documentum TaskSpace Multiple Vulnerabilities + + + + + + + + + + + Directory traversal vulnerability in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 allows remote authenticated users to execute arbitrary code via unspecified vectors. + + + + + + + + + + + 20140326 ESA-2014-016: EMC VPLEX Multiple Vulnerabilities + + + + + + + + + + + + + + The GUI in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 does not properly validate session-timeout values, which might make it easier for remote attackers to execute arbitrary code by leveraging an unattended workstation. + + + + + + + + + + + 20140326 ESA-2014-016: EMC VPLEX Multiple Vulnerabilities + + + + + + + + + + + + + + EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 does not include the HTTPOnly flag in a Set-Cookie header for an unspecified cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie. + + + + + + + + + + + 20140326 ESA-2014-016: EMC VPLEX Multiple Vulnerabilities + + + + + + + + + + + + + + Session fixation vulnerability in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 allows remote attackers to hijack web sessions via unspecified vectors. + + + + + + + + + + + 20140326 ESA-2014-016: EMC VPLEX Multiple Vulnerabilities + + + + + + + + + + + + + + EMC RSA BSAFE Micro Edition Suite (MES) 3.2.x before 3.2.6 and 4.0.x before 4.0.5 does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate chain. + + + + + + + + + + 20140411 ESA-2014-019: RSA BSAFE Micro Edition Suite Certificate Chain Processing Vulnerability + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the back-office case-management application in RSA Adaptive Authentication (On-Premise) 6.x and 7.x before 7.1 SP0 P2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + 20140401 ESA-2014-020: RSA Adaptive Authentication (On-Premise) Multiple Vulnerabilities + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in RSA Adaptive Authentication (On-Premise) 6.x and 7.x before 7.1 SP0 P2 allows remote attackers to inject arbitrary web script or HTML via vectors involving FRAME elements, related to a "cross-frame scripting" issue. + + + + + + + + + + 20140401 ESA-2014-020: RSA Adaptive Authentication (On-Premise) Multiple Vulnerabilities + + + + + + + + + + + + + + + + + + EMC Documentum Content Server before 6.7 SP1 P26, 6.7 SP2 before P13, 7.0 before P13, and 7.1 before P02 allows remote authenticated users to bypass intended access restrictions and read metadata from certain folders via unspecified vectors. + + + + + + + + + + http://twitter.com/artika4biz/statuses/455358950116823040 + 20140411 ESA-2014-026: EMC Documentum Content Server Information Disclosure Vulnerability + + + + + + + + + + + + + + + + + + + EMC Cloud Tiering Appliance (CTA) 10 through SP1 allows remote attackers to read arbitrary files via an api/login request containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, as demonstrated by reading the /etc/shadow file. + + + + + + + + + https://gist.github.com/brandonprry/9895721 + 20140331 EMC CTA v10.0 unauthenticated XXE with root perms + 20140416 ESA-2014-028: EMC Cloud Tiering Appliance XML External Entity (XXE) and Information Disclosure Vulnerabilities + + + + + + + + + + + + + + EMC Cloud Tiering Appliance (CTA) 9.x through 10 SP1 and File Management Appliance (FMA) 7.x store DES password hashes for the root, super, and admin accounts, which makes it easier for context-dependent attackers to obtain sensitive information via a brute-force attack. + + + + + + + + + https://gist.github.com/brandonprry/9895721 + 20140331 EMC CTA v10.0 unauthenticated XXE with root perms + 20140416 ESA-2014-028: EMC Cloud Tiering Appliance XML External Entity (XXE) and Information Disclosure Vulnerabilities + + + + + + + + + + + + + + + + + + + + + The runtime WS component in the server in EMC RSA Access Manager 6.1.3 before 6.1.3.39, 6.1.4 before 6.1.4.22, 6.2.0 before 6.2.0.11, and 6.2.1 before 6.2.1.03, when INFO logging is enabled, allows local users to discover cleartext passwords by reading log files. + + + + + + + + + + + 20140430 ESA-2014-029: RSA Access Manager Sensitive Information Disclosure Vulnerability + + + + + + + + + + + + + The Starbucks 2.6.1 application for iOS stores sensitive information in plaintext in the Crashlytics log file (/Library/Caches/com.crashlytics.data/com.starbucks.mystarbucks/session.clslog), which allows attackers to discover usernames, passwords, and e-mail addresses via an application that reads session.clslog. + + + + + + + + + https://itunes.apple.com/us/app/starbucks/id331177714?mt=8 + starbucks-cve20140647-info-disclosure(90412) + http://www.zdnet.com/the-starbucks-bug-not-as-awful-as-reported-7000025269/ + http://www.zdnet.com/starbucks-fixes-ios-app-bugs-7000025323/ + 64942 + 20140114 [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application + 102514 + 20140113 [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application + 20140117 Re: [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application + + + + + + + + + + The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authentication and authorization requirements, which allows remote attackers to obtain administrative access via a request to this interface, aka Bug ID CSCud75187. + + + + + + + + + + + cisco-acs-cve20140648-unauth-access(90431) + 1029634 + 64962 + http://tools.cisco.com/security/center/viewAlert.x?alertId=32379 + 20140115 Multiple Vulnerabilities in Cisco Secure Access Control System + 56213 + 102117 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authorization requirements, which allows remote authenticated users to obtain superadmin access via a request to this interface, aka Bug ID CSCud75180. + + + + + + + + + + + cisco-acs-cve20140649-priv-esc(90430) + 1029634 + 64958 + http://tools.cisco.com/security/center/viewAlert.x?alertId=32378 + 20140115 Multiple Vulnerabilities in Cisco Secure Access Control System + 56213 + 102116 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The web interface in Cisco Secure Access Control System (ACS) 5.x before 5.4 Patch 3 allows remote attackers to execute arbitrary operating-system commands via a request to this interface, aka Bug ID CSCue65962. + + + + + + + + + + + cisco-acs-cve20140650-command-exec(90432) + 1029634 + 64964 + http://tools.cisco.com/security/center/viewAlert.x?alertId=32380 + 20140115 Multiple Vulnerabilities in Cisco Secure Access Control System + 56213 + 102115 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The administrative interface in Cisco Context Directory Agent (CDA) does not properly enforce authorization requirements, which allows remote authenticated users to obtain administrative access by hijacking a session, aka Bug ID CSCuj45347. + + + + + + + + + + cisco-cda-cve20140651-priv-esc(90166) + 1029573 + 64706 + http://tools.cisco.com/security/center/viewAlert.x?alertId=32364 + 20140107 Cisco Context Directory Agent Privilege Escalation Vulnerability + 56365 + 101809 + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the Mappings page in Cisco Context Directory Agent (CDA) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuj45358. + + + + + + + + + + cisco-cda-cve20140652-xss(90167) + 1029572 + 64703 + http://tools.cisco.com/security/center/viewAlert.x?alertId=32365 + 20140107 Cisco Context Directory Agent Mappings Page Cross-Site Scripting Vulnerability + 56365 + 101803 + + + + + + + + + + The Identity Firewall (IDFW) functionality in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to trigger authentication-state modifications via a crafted NetBIOS logout probe response, aka Bug ID CSCuj45340. + + + + + + + + + cisco-asa-cve20140653-sec-bypass(90165) + 1029570 + 64708 + http://tools.cisco.com/security/center/viewAlert.x?alertId=32363 + 20140107 Cisco Adaptive Security Appliance Identity Firewall NetBIOS Logout Probe Auth State Change Vulnerability + 56366 + 101834 + + + + + + + + + + Cisco Context Directory Agent (CDA) allows remote attackers to modify the cache via a replay attack involving crafted RADIUS accounting messages, aka Bug ID CSCuj45383. + + + + + + + + + + cisco-cda-cve20140654-sec-bypass(90168) + 1029574 + 64709 + http://tools.cisco.com/security/center/viewAlert.x?alertId=32366 + 20140107 Cisco Context Directory Agent Replayed RADIUS Accounting Message Vulnerability + 56365 + 101802 + + + + + + + + + + The Identity Firewall (IDFW) functionality in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to change the user-cache contents via a replay attack involving crafted RADIUS Change of Authorization (CoA) messages, aka Bug ID CSCuj45332. + + + + + + + + + + cisco-asa-cve20140655-sec-bypass(90164) + 1029575 + 64700 + http://tools.cisco.com/security/center/viewAlert.x?alertId=32362 + 20140107 Cisco Adaptive Security Appliance RADIUS Change of Authorization Message Replay Vulnerability + 56366 + 101838 + + + + + + + + + + Cisco Context Directory Agent (CDA) allows remote authenticated users to trigger the omission of certain user-interface data via crafted field values, aka Bug ID CSCuj45353. + + + + + + + + + cisco-cda-cve20140656-sec-bypass(90169) + 1029569 + 64701 + 20140107 Cisco Context Directory Agent Hidden Input Vulnerability + 101801 + + + + + + + + + + The administration portal in Cisco Unified Communications Manager (Unified CM) 9.1(1) and earlier does not properly handle role restrictions, which allows remote authenticated users to bypass role-based access control via multiple visits to a forbidden portal URL, aka Bug ID CSCuj83540. + + + + + + + + + cisco-ucm-cve20140657-sec-bypass(90120) + 1029571 + 64690 + http://tools.cisco.com/security/center/viewAlert.x?alertId=32341 + 20140107 Cisco Unified Communications Manager Role Bypass Vulnerability + 56368 + 101800 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cisco 9900 Unified IP phones allow remote attackers to cause a denial of service (unregistration) via a crafted SIP header, aka Bug ID CSCul24898. + + + + + + + + + cisco-unified-cve20140658-dos(90236) + 1029596 + 64770 + http://tools.cisco.com/security/center/viewAlert.x?alertId=32402 + 20140110 Cisco 9900 Series IP Phone Crafted Header Unregister Vulnerability + 56384 + 101913 + + + + + + + + + + + + + + + + The Cisco WAP4410N access point with firmware through 2.0.6.1, WRVS4400N router with firmware 1.x through 1.1.13 and 2.x through 2.0.2.1, and RVS4000 router with firmware through 2.0.3.2 allow remote attackers to read credential and configuration data, and execute arbitrary commands, via requests to the test interface on TCP port 32764, aka Bug IDs CSCum37566, CSCum43693, CSCum43700, and CSCum43685. + + + + + + + + + + + https://github.com/elvanderb/TCP-32764 + cisco-small-cve20140659-priv-esc(90233) + 1029580 + 1029579 + 64776 + http://tools.cisco.com/security/center/viewAlert.x?alertId=32381 + 20140110 Undocumented Test Interface in Cisco Small Business Devices + 56292 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cisco TelePresence ISDN Gateway with software before 2.2(1.92) allows remote attackers to cause a denial of service (D-channel call outage) via a crafted Q.931 STATUS message, aka Bug ID CSCui50360. + + + + + + + + + cisco-isdn-cve20140660-dos(90622) + 1029657 + 65072 + http://tools.cisco.com/security/center/viewAlert.x?alertId=32460 + 20140122 Cisco TelePresence ISDN Gateway D-Channel Denial of Service Vulnerability + 56591 + 102361 + + + + + + + + + + + + + The System Status Collection Daemon (SSCD) in Cisco TelePresence System 500-37, 1000, 1300-65, and 3xxx before 1.10.2(42), and 500-32, 1300-47, TX1310 65, and TX9xxx before 6.0.4(11), allows remote attackers to execute arbitrary commands or cause a denial of service (stack memory corruption) via a crafted XML-RPC message, aka Bug ID CSCui32796. + + + + + + + + + + + cisco-telepresence-cve20140661-command-exec(90624) + 1029656 + 65071 + 20140122 Cisco TelePresence System Software Command Execution Vulnerability + 56533 + 102362 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The SIP module in Cisco TelePresence Video Communication Server (VCS) before 8.1 allows remote attackers to cause a denial of service (process failure) via a crafted SDP message, aka Bug ID CSCue97632. + + + + + + + + + cisco-vcs-cve20140662-dos(90621) + 1029655 + 65076 + http://tools.cisco.com/security/center/viewAMBAlert.x?alertId=32409 + 20140122 Cisco TelePresence Video Communication Server SIP Denial of Service Vulnerability + 56592 + 102363 + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the web framework in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCum03625. + + + + + + + + + + cisco-acs-cve20140663-xss(90232) + 1029595 + 64773 + http://tools.cisco.com/security/center/viewAlert.x?alertId=32403 + 20140110 Cisco Secure Access Control System Cross-Site Scripting Vulnerability + 56382 + 101914 + + + + + + + + + + The server in Cisco Unity Connection allows remote authenticated users to cause a denial of service (CPU consumption) via unspecified IMAP commands, aka Bug ID CSCul49976. + + + + + + + + + cisco-unity-cve20140664-dos(90234) + 1029593 + 64772 + 20140110 Cisco Unity Connection Internet Message Access Protocol Denial of Service Vulnerability + 56370 + 101915 + + + + + + + + + + The RBAC implementation in Cisco Identity Services Engine (ISE) Software does not properly verify privileges for support-bundle downloads, which allows remote authenticated users to obtain sensitive information via a download action, as demonstrated by obtaining read access to the user database, aka Bug ID CSCul83904. + + + + + + + + + cisco-ise-cve2040665-unsuth-access(90463) + 1029624 + 64939 + http://tools.cisco.com/security/center/viewAlert.x?alertId=32448 + 20140115 Cisco ISE Unprivileged Support Bundle Download Vulnerability + 56439 + 102118 + + + + + + + + + + Directory traversal vulnerability in the Send Screen Capture implementation in Cisco Jabber 9.2(.1) and earlier on Windows allows remote attackers to upload arbitrary types of files, and consequently execute arbitrary code, via modified packets, aka Bug ID CSCug48056. + + + + + + + + + cisco-jabber-cve20140666-code-exec(90435) + 1029635 + 64965 + http://tools.cisco.com/security/center/viewAlert.x?alertId=32451 + 20140115 Cisco Jabber for Windows Remote Code Execution Vulnerability + 56331 + 102122 + + + + + + + + + + + + + + + + + + + + + + + + + + The RMI interface in Cisco Secure Access Control System (ACS) does not properly enforce authorization requirements, which allows remote authenticated users to read arbitrary files via a request to this interface, aka Bug ID CSCud75169. + + + + + + + + + cisco-acs-cve20140667-info-disc(90497) + 1029641 + 64983 + http://tools.cisco.com/security/center/viewAlert.x?alertId=32468 + 20140116 Cisco Secure ACS RMI Arbitrary File Read Vulnerability + 102168 + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the portal in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCue65949. + + + + + + + + + + cisco-acs-cve20140668-xss(90561) + 1029654 + 65016 + http://tools.cisco.com/security/center/viewAlert.x?alertId=32489 + 20140117 Cisco Secure ACS Portal Cross-Site Scripting Vulnerability + 56543 + 102256 + + + + + + + + + + The Wireless Session Protocol (WSP) feature in the Gateway GPRS Support Node (GGSN) component on Cisco ASR 5000 series devices allows remote attackers to bypass intended Top-Up payment restrictions via unspecified WSP packets, aka Bug ID CSCuh28371. + + + + + + + + + cisco-ggsn-cve20140669-sec-bypass(90614) + 1029666 + 65052 + http://tools.cisco.com/security/center/viewAlert.x?alertId=32513 + 20140121 Cisco ASR 5000 Series Gateway GPRS Support Node Traffic Bypass Vulnerability + 56546 + 102318 + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the Search and Play interface in Cisco MediaSense allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCum16686. + + + + + + + + + + cisco-mediasense-cve20140670-xss(90615) + 1029667 + 65053 + http://tools.cisco.com/security/center/viewAlert.x?alertId=32514 + 20140121 Cisco MediaSense Search and Play Cross-Site Scripting Vulnerability + 56563 + 102319 + + + + + + + + + + Open redirect vulnerability in Cisco MediaSense allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter, aka Bug ID CSCum16749. + + + + + + + + + + cisco-mediasense-cve20140671-open-redirect(90617) + 1029669 + 65055 + http://tools.cisco.com/security/center/viewAlert.x?alertId=32517 + 20140121 Cisco MediaSense Open Redirection Vulnerability + 56544 + 102341 + + + + + + + + + + The Search and Play interface in Cisco MediaSense does not properly enforce authorization requirements, which allows remote authenticated users to download arbitrary recordings via a request to this interface. + + + + + + + + + cisco-mediasense-cve20140672-info-disc(90616) + 1029668 + 65054 + http://tools.cisco.com/security/center/viewAlert.x?alertId=32516 + 20140121 Cisco MediaSense Search and Play Authorization Vulnerability + 56600 + 102342 + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in the web interface on Cisco Video Surveillance 5000 HD IP Dome cameras allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug IDs CSCud10943 and CSCud10950. + + + + + + + + + + cisco-video-cve20140673-xss(90733) + 1029689 + 65145 + http://tools.cisco.com/security/center/viewAlert.x?alertId=32568 + 20140124 Cisco Video Surveillance 5000 Series HD IP Dome Camera Multiple Cross-Site Scripting Vulnerabilities + 56552 + 102557 + + + + + + + + + + + Cisco Video Surveillance Operations Manager (VSOM) does not require authentication for MySQL database connections, which allows remote attackers to obtain sensitive information, modify data, or cause a denial of service by leveraging network connectivity from a client system with a crafted host name, aka Bug ID CSCud10992. + + + + + + + + + + + cisco-vsom-cve20140674-unauth-access(90651) + 1029692 + 65111 + 20140123 Cisco Video Surveillance Operations Manager MySQL Database Insufficient Authentication Controls + 56619 + 102409 + + + + + + + + + + The Expressway component in Cisco TelePresence Video Communication Server (VCS) uses the same default X.509 certificate across different customers' installations, which makes it easier for remote attackers to conduct man-in-the-middle attacks against SSL sessions by leveraging the certificate's trust relationship, aka Bug ID CSCue07471. + + + + + + + + + + cisco-telepresence-cve20140675-mitm(90650) + 1029682 + 65101 + http://tools.cisco.com/security/center/viewAlert.x?alertId=32540 + 20140122 Cisco TelePresence Video Communication Server Expressway Default SSL Certificate Vulnerability + 56621 + 102377 + + + + + + + + + + Cisco NX-OS allows local users to bypass intended TACACS+ command restrictions via a series of multiple commands, aka Bug ID CSCum47367. + + + + + + + + + + + cisco-nxos-cve20140676-priv-esc(90627) + 1029690 + 65083 + http://tools.cisco.com/security/center/viewAlert.x?alertId=32531 + 20140122 Cisco NX-OS Software TACACS+ Command Authorization Vulnerability + 56597 + 102366 + + + + + + + + + + The Label Distribution Protocol (LDP) functionality in Cisco NX-OS allows remote attackers to cause a denial of service (temporary LDP session outage) via LDP discovery traffic containing malformed Hello messages, aka Bug ID CSCul88851. + + + + + + + + + cisco-nxos-cve20140677-dos(90623) + 1029691 + 65074 + http://tools.cisco.com/security/center/viewAlert.x?alertId=32532 + 20140122 Cisco NX-OS Software Label Distribution Protocol Message Vulnerability + 56611 + 102368 + + + + + + + + + + The portal interface in Cisco Secure Access Control System (ACS) does not properly manage sessions, which allows remote authenticated users to hijack sessions and gain privileges via unspecified vectors, aka Bug ID CSCue65951. + + + + + + + + + + cisco-acs-cve20140678-unauth-access(90732) + 1029688 + 65144 + http://tools.cisco.com/security/center/viewAlert.x?alertId=32567 + 20140124 Cisco Secure ACS Portal Session Management Vulnerability + 56540 + 102558 + + + + + + + + + + Cisco Prime Infrastructure 1.2 and 1.3 before 1.3.0.20-2, 1.4 before 1.4.0.45-2, and 2.0 before 2.0.0.0.294-2 allows remote authenticated users to execute arbitrary commands with root privileges via an unspecified URL, aka Bug ID CSCum71308. + + + + + + + + + + + 20140226 Cisco Prime Infrastructure Command Execution Vulnerability + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the HTTP control interface in the NAC Web Agent component in Cisco Identity Services Engine (ISE) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCui15038. + + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=32617 + 20140128 Cisco Identity Services Engine HTTP Control Interface for NAC Web Agent Cross-Site Scripting Vulnerability + 56672 + 102588 + + + + + + + + + + Cross-site scripting (XSS) vulnerability in Cisco Identity Services Engine (ISE) 1.2 patch 2 and earlier allows remote attackers to inject arbitrary web script or HTML via a report containing a crafted URL that is not properly handled during generation of report-output pages, aka Bug ID CSCui15064. + + + + + + + + + + 65183 + http://tools.cisco.com/security/center/viewAlert.x?alertId=32609 + 20140128 Cisco Identity Services Engine Reports Output Cross-Site Scripting Vulnerability + 56714 + 102589 + + + + + + + + + + Cisco WebEx Meetings Server allows remote authenticated users to bypass authorization checks and (1) join arbitrary meetings, or (2) terminate a meeting without having a host role, via a crafted URL, aka Bug ID CSCuj42346. + + + + + + + + + + 65198 + 20140128 Cisco WebEx Meetings Server Unauthorized Meeting Actions Vulnerability + 102590 + + + + + + + + + + The web management interface on the Cisco RV110W firewall with firmware 1.2.0.9 and earlier, RV215W router with firmware 1.1.0.5 and earlier, and CVR100W router with firmware 1.0.1.19 and earlier does not prevent replaying of modified authentication requests, which allows remote attackers to obtain administrative access by leveraging the ability to intercept requests, aka Bug IDs CSCul94527, CSCum86264, and CSCum86275. + + + + + + + + + + + 20140305 Cisco Small Business Router Password Disclosure Vulnerability + + + + + + + + + + + + + + + + + + + + + + + + + Cisco Unified Communications Manager (aka Unified CM) 9.1 (2.10000.28) and earlier allows local users to gain privileges by leveraging incorrect file permissions, aka Bug IDs CSCul24917 and CSCul24908. + + + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=32683 + 20140131 Cisco Unified Communications Manager Operating System-Level Privilege Escalation Vulnerability + + + + + + + + + + + + Intelligent Automation for Cloud (IAC) in Cisco Cloud Portal 9.4.1 and earlier includes a cryptographic key in binary files, which makes it easier for remote attackers to obtain cleartext data from an arbitrary IAC installation by leveraging knowledge of this key, aka Bug IDs CSCui34764, CSCui34772, CSCui34776, CSCui34798, CSCui34800, CSCui34805, CSCui34809, CSCui34810, CSCui34813, CSCui34814, and CSCui34818. + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=33336 + 20140312 Cisco Intelligent Automation for Cloud Cryptographic Implementation Issues + + + + + + + + + + + + + + + + + Cisco Wireless LAN Controller (WLC) devices 7.0 before 7.0.250.0, 7.2, 7.3, and 7.4 before 7.4.110.0 do not properly deallocate memory, which allows remote attackers to cause a denial of service (reboot) by sending WebAuth login requests at a high rate, aka Bug ID CSCuf52361. + + + + + + + + + 20140305 Multiple Vulnerabilities in Cisco Wireless LAN Controllers + + + + + + + + + + + + + + + + + + + Cisco Wireless LAN Controller (WLC) devices 7.4 before 7.4.110.0 distribute Aironet IOS software with a race condition in the status of the administrative HTTP server, which allows remote attackers to bypass intended access restrictions by connecting to an Aironet access point on which this server had been disabled ineffectively, aka Bug ID CSCuf66202. + + + + + + + + + + + 20140305 Multiple Vulnerabilities in Cisco Wireless LAN Controllers + + + + + + + + + + + + + + The IGMP implementation on Cisco Wireless LAN Controller (WLC) devices 4.x, 5.x, 6.x, 7.0 before 7.0.250.0, 7.1, 7.2, and 7.3, when IGMPv3 Snooping is enabled, allows remote attackers to cause a denial of service (memory over-read and device restart) via a crafted field in an IGMPv3 message, aka Bug ID CSCuh33240. + + + + + + + + + 20140305 Multiple Vulnerabilities in Cisco Wireless LAN Controllers + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The multicast listener discovery (MLD) service on Cisco Wireless LAN Controller (WLC) devices 7.2, 7.3, 7.4 before 7.4.121.0, and 7.5, when MLDv2 Snooping is enabled, allows remote attackers to cause a denial of service (device restart) via a malformed IPv6 MLDv2 packet, aka Bug ID CSCuh74233. + + + + + + + + + 20140305 Multiple Vulnerabilities in Cisco Wireless LAN Controllers + + + + + + + + + + + + + + + + + + + + Cisco Wireless LAN Controller (WLC) devices 7.2 before 7.2.115.2, 7.3, and 7.4 before 7.4.110.0 allow remote attackers to cause a denial of service (device restart) via a crafted 802.11 Ethernet frame, aka Bug ID CSCue87929. + + + + + + + + + 20140305 Multiple Vulnerabilities in Cisco Wireless LAN Controllers + + + + + + + + + + + + + + + + + + + Cisco Wireless LAN Controller (WLC) devices 7.2, 7.3, and 7.4 before 7.4.110.0 allow remote attackers to cause a denial of service (device restart) via a crafted 802.11 Ethernet frame, aka Bug ID CSCuf80681. + + + + + + + + + 20140305 Multiple Vulnerabilities in Cisco Wireless LAN Controllers + + + + + + + + + + + + + + + + + + + WebEx Meeting Center in Cisco WebEx Business Suite does not properly compose URLs for HTTP GET requests, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) a browser's history, aka Bug ID CSCul98272. + + + + + + + + + 20140318 Cisco WebEx Business Suite HTTP GET Parameters Include Sensitive Information + + + + + + + + + + Cisco UCS Director (formerly Cloupia) before 4.0.0.3 has a hardcoded password for the root account, which makes it easier for remote attackers to obtain administrative access via an SSH session to the CLI interface, aka Bug ID CSCui73930. + + + + + + + + + + + + 20140219 Cisco UCS Director Default Credentials Vulnerability + + + + + + + + + + + + Race condition in the cut-through proxy feature in Cisco Firewall Services Module (FWSM) Software 3.x before 3.2(28) and 4.x before 4.1(15) allows remote attackers to cause a denial of service (device reload) via certain matching traffic, aka Bug ID CSCuj16824. + + + + + + + + + 20140219 Cisco Firewall Services Module Cut-Through Proxy Denial of Service Vulnerability + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The produce-verbose-alert feature in Cisco IPS Software 7.1 before 7.1(8)E4 and 7.2 before 7.2(2)E4 allows remote attackers to cause a denial of service (Analysis Engine process outage) via fragmented packets, aka Bug ID CSCui91266. + + + + + + + + + 20140219 Multiple Vulnerabilities in Cisco IPS Software + + + + + + + + + + + + + + + + + The control-plane access-list implementation in Cisco IPS Software before 7.1(8p2)E4 and 7.2 before 7.2(2)E4 allows remote attackers to cause a denial of service (MainApp process outage) via crafted packets to TCP port 7000, aka Bug ID CSCui67394. + + + + + + + + + 20140219 Multiple Vulnerabilities in Cisco IPS Software + + + + + + + + + + + + + + + + + Cisco IPS Software 7.1 before 7.1(8)E4 and 7.2 before 7.2(2)E4 allows remote attackers to cause a denial of service (Analysis Engine process outage) via a flood of jumbo frames, aka Bug ID CSCuh94944. + + + + + + + + + 20140219 Multiple Vulnerabilities in Cisco IPS Software + + + + + + + + + + + + + + + + + The Cisco Unified SIP Phone 3905 with firmware before 9.4(1) allows remote attackers to obtain root access via a session on the test interface on TCP port 7870, aka Bug ID CSCuh75574. + + + + + + + + + + + 20140219 Unauthorized Access Vulnerability in Cisco Unified SIP Phone 3905 + + + + + + + + + + The log4jinit web application in Cisco Unified Communications Manager (UCM) does not properly validate authentication, which allows remote attackers to cause a denial of service (performance degradation) via unspecified use of this application, aka Bug ID CSCum05347. + + + + + + + + + 20140211 Cisco Unified Communications Manager Unauthenticated log4jinit Access Vulnerability + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the IP Manager Assistant (IPMA) interface in Cisco Unified Communications Manager (UCM) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCum05343. + + + + + + + + + + 20140211 Cisco Unified Communications Manager IPMA Cross-Site Scripting Vulnerability + + + + + + + + + + The bulk administration interface in Cisco Unified Communications Manager (UCM) 10.0(1) and earlier allows remote attackers to bypass authentication and read arbitrary files by using an unspecified prompt, aka Bug ID CSCum05340. + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=32825 + 20140211 Cisco Unified Communications Manager Arbitrary File Read Vulnerability + + + + + + + + + + + Cisco Unified Communications Manager (UCM) does not require authentication for reading WAR files, which allows remote attackers to obtain sensitive information via unspecified access to a "file storage location," aka Bug ID CSCum05337. + + + + + + + + + 20140212 Cisco Unified Communications Manager WAR File Availability Vulnerability + + + + + + + + + + SQL injection vulnerability in the IP Manager Assistant (IPMA) interface in Cisco Unified Communications Manager (UCM) 10.0(1) and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05326. + + + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=32843 + 20140212 Cisco Unified Communications Manager IPMA Blind SQL Injection Vulnerability + + + + + + + + + + + SQL injection vulnerability in the CallManager Interactive Voice Response (CMIVR) interface in Cisco Unified Communications Manager (UCM) allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05318. + + + + + + + + + + + 20140212 Cisco Unified Communications Manager CMIVR Blind SQL Injection Vulnerability + + + + + + + + + + SQL injection vulnerability in the Java database interface in Cisco Unified Communications Manager (UCM) 10.0(1) and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05313. + + + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=32834 + 20140211 Cisco Unified Communications Manager Java Interface SQL Injection Vulnerability + + + + + + + + + + + SQL injection vulnerability in the Enterprise Mobility Application (EMApp) interface in Cisco Unified Communications Manager (UCM) allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05302. + + + + + + + + + + + 20140211 Cisco Unified Communications Manager Enterprise Mobility Application Blind SQL Injection Vulnerability + + + + + + + + + + Cisco Unified Computing System (UCS) Central Software 1.1 and earlier allows local users to gain privileges via a CLI copy command in a local-mgmt context, aka Bug ID CSCul53128. + + + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=32910 + 20140218 Cisco Unified Computing System Central Software Privilege Escalation Vulnerability + + + + + + + + + + + The administration interface in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to bypass authentication and read Java class files via a direct request, aka Bug ID CSCum46497. + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=32915 + 20140218 Cisco Unified Communications Manager Java Class File Availability Vulnerability + + + + + + + + + + + + + + + + + + + + + + + + + + + The Real Time Monitoring Tool (RTMT) web application in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier does not properly enforce authentication requirements, which allows remote attackers to read application files via a direct request to a URL, aka Bug ID CSCum46495. + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=32913 + 20140218 Cisco Unified Communications Manager Real Time Monitoring Tool Information Disclosure Vulnerability + + + + + + + + + + + + + + + + + + + + + + + + + + + The Enterprise License Manager (ELM) component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier does not properly enforce authentication requirements, which allows remote attackers to read ELM files via a direct request to a URL, aka Bug ID CSCum46494. + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=32914 + 20140218 Cisco Unified Communications Manager Enterprise License Manager Information Disclosure Vulnerability + + + + + + + + + + + + + + + + + + + + + + + + + + + SQL injection vulnerability in the Certificate Authority Proxy Function (CAPF) implementation in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum46483. + + + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=32916 + 20140218 Cisco Unified Communications Manager CAPF Unauthenticated Blind SQL Injection Vulnerability + + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the IP Manager Assistant (IPMA) interface in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCum46470. + + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=32912 + 20140218 Cisco Unified Communications Manager IPMA Reflected Cross-Site Scripting Vulnerability + + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site request forgery (CSRF) vulnerability in the Call Detail Records Analysis and Reporting (CAR) page in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make CAR modifications, aka Bug ID CSCum46468. + + + + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=32911 + 20140218 Cisco Unified Communications Manager CAR Page CSRF Vulnerability + + + + + + + + + + + + + + + + + + + + + + + + + + + The Cisco Unified IP Phone 7960G 9.2(1) and earlier allows remote attackers to bypass authentication and change trust relationships by injecting a Certificate Trust List (CTL) file, aka Bug ID CSCuj66795. + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=32957 + 20140220 Cisco Third-Generation IP Phone CTL Trust Chain Enforcement Vulnerability + + + + + + + + + + The Phone Proxy component in Cisco Adaptive Security Appliance (ASA) Software 9.1(.3) and earlier allows remote attackers to bypass authentication and change trust relationships by injecting a Certificate Trust List (CTL) file, aka Bug ID CSCuj66770. + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=32956 + 20140220 Cisco Adaptive Security Appliance Phone Proxy CTL Authentication Vulnerability + + + + + + + + + + Race condition in the Phone Proxy component in Cisco Adaptive Security Appliance (ASA) Software 9.1(.3) and earlier allows remote attackers to bypass sec_db authentication and provide certain pass-through services to untrusted devices via a crafted configuration-file TFTP request, aka Bug ID CSCuj66766. + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=32955 + 20140220 Cisco Adaptive Security Appliance Phone Proxy sec_db Race Condition Vulnerability + + + + + + + + + + Cross-site request forgery (CSRF) vulnerability in the Call Detail Records Analysis and Reporting (CAR) interface in the OS Administration component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to hijack the authentication of administrators for requests that make administrative changes, aka Bug ID CSCun00701. + + + + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=33049 + 20140225 Cisco Unified Communications Manager OS Administration CSRF Vulnerability + + + + + + + + + + + + + + + + + + + + + + + + + + + The certificate-import feature in the Certificate Authority Proxy Function (CAPF) CLI implementation in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows local users to read or modify arbitrary files via a crafted command, aka Bug ID CSCum95461. + + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=33046 + 20140225 Cisco Unified Communications Manager CAPF Certificate Import Arbitrary File Read/Write Vulnerability + + + + + + + + + + + + + + + + + + + + + + + + + + + The Certificate Authority Proxy Function (CAPF) CLI implementation in the CSR management feature in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows local users to read or modify arbitrary files via unspecified vectors, aka Bug ID CSCum95464. + + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=33045 + 20140225 Cisco Unified Communications Manager CAPF CSR Arbitrary File Read/Write Vulnerability + + + + + + + + + + + + + + + + + + + + + + + + + + + The Certificate Authority Proxy Function (CAPF) component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to bypass authentication and modify registered-device information via crafted data, aka Bug ID CSCum95468. + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=33044 + 20140225 Cisco Unified Communications Manager CAPF Unauthenticated Device Information Update Vulnerability + + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site request forgery (CSRF) vulnerability in the Unified Serviceability subsystem in Cisco Unified Contact Center Express (Unified CCX) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCum95502. + + + + + + + + + + + + 20140225 Cisco Unified Contact Center Express Serviceability Page CSRF Vulnerability + + + + + + + + + + The disaster recovery system (DRS) in Cisco Unified Contact Center Express (Unified CCX) allows remote authenticated users to obtain sensitive information by reading extraneous fields in an HTML document, aka Bug ID CSCum95536. + + + + + + + + + 20140225 Cisco Unified Contact Center Express DRS Sensitive Information Disclosure Vulnerability + + + + + + + + + + The Certificate Authority Proxy Function (CAPF) CLI implementation in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows local users to inject commands via unspecified CAPF programs, aka Bug ID CSCum95493. + + + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=33048 + 20140225 Cisco Unified Communications Manager CAPF CLI Command Injection Vulnerability + + + + + + + + + + + + + + + + + + + + + + + + + + + Directory traversal vulnerability in gefebt.exe in the WebView CimWeb components in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY through 8.2 SIM 24, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary code via a crafted HTTP request, aka ZDI-CAN-1622. + + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-023-01 + 65124 + http://support.ge-ip.com/support/index?page=kbchannel&id=KB15939 + + + + + + + + + + + + + + + + + + + + Directory traversal vulnerability in CimWebServer.exe (aka the WebView component) in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY before 8.2 SIM 24, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary code via a crafted message to TCP port 10212, aka ZDI-CAN-1623. + + + + + + + + + + + 65117 + http://support.ge-ip.com/support/index?page=kbchannel&id=KB15940 + http://ics-cert.us-cert.gov/advisories/ICSA-14-023-01 + + + + + + + + + + + + + + + + + + + + The SCADA server in Ecava IntegraXor before 4.1.4369 allows remote attackers to read arbitrary project backup files via a crafted URL. + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-008-01 + http://www.integraxor.com/blog/category/security/vulnerability-note/ + + + + + + + + + + + + + + + + + + + Stack-based buffer overflow in the SCADA server in Ecava IntegraXor before 4.1.4390 allows remote attackers to cause a denial of service (system crash) by triggering access to DLL code located in the IntegraXor directory. + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-016-01 + http://www.integraxor.com/blog/buffer-overflow-vulnerability-note/ + + + + + + + + + + + + + + + + + + + + + Rockwell Automation RSLogix 5000 7 through 20.01, and 21.0, does not properly implement password protection for .ACD files (aka project files), which allows local users to obtain sensitive information or modify data via unspecified vectors. + + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-021-01 + rslogix-cve20140755-info-disc(90981) + 65337 + 102858 + + + + + + + + + + + + + Smart Software Solutions (3S) CoDeSys Runtime Toolkit before 2.4.7.44 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors. + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-030-01 + 56713 + + + + + + + + + + An ActiveX control in GenLaunch.htm in ICONICS GENESIS32 8.0, 8.02, 8.04, and 8.05 allows remote attackers to execute arbitrary programs via a crafted HTML document. + + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-051-01 + + + + + + + + + + + + + Unquoted Windows search path vulnerability in Schneider Electric Floating License Manager 1.0.0 through 1.4.0 allows local users to gain privileges via a Trojan horse application with a name composed of an initial substring of a path that contains a space character. + Per: http://cwe.mitre.org/data/definitions/428.html + +"CWE-428: Unquoted Search Path or Element" + + + Per: http://ics-cert.us-cert.gov/advisories/ICSA-14-058-01 + +"This license manager is used in the following Schneider Electric products: + + Power Monitoring Expert, + Struxureware process Expert (PES), + Struxureware process Expert libraries, + Vijeo Citect (SCADA), and + Vijeo Citect Historian." + + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-058-01 + http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-015-01 + + + + + + + + + + + The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion provide an undocumented access method involving the FTP protocol, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors. + + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01 + + + + + + + + + + + + + + + + + + + Multiple SQL injection vulnerabilities in DBVisitor.dll in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary SQL commands via SOAP requests to unspecified functions. + + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03 + + + + + + + + + + + + + Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long NodeName parameter. + + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03 + + + + + + + + + + + + + Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long GotoCmd argument. + + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03 + + + + + + + + + + + + + Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long NodeName2 argument. + + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03 + + + + + + + + + + + + + Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long AccessCode argument. + + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03 + + + + + + + + + + + + + Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long AccessCode2 argument. + + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03 + + + + + + + + + + + + + The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion do not require authentication for connections to certain TCP ports, which allows remote attackers to (1) modify the configuration via a request to the debug service on port 4000 or (2) delete log entries via a request to the log service on port 4001. + + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01 + + + + + + + + + + + + + + + + + + + Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long UserName parameter. + + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03 + + + + + + + + + + + + + The OpenUrlToBuffer method in the BWOCXRUN.BwocxrunCtrl.1 ActiveX control in bwocxrun.ocx in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a file: URL. + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03 + + + + + + + + + + + + + The OpenUrlToBufferTimeout method in the BWOCXRUN.BwocxrunCtrl.1 ActiveX control in bwocxrun.ocx in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a file: URL. + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03 + + + + + + + + + + + + + The CreateProcess method in the BWOCXRUN.BwocxrunCtrl.1 ActiveX control in bwocxrun.ocx in Advantech WebAccess before 7.2 allows remote attackers to execute (1) setup.exe, (2) bwvbprt.exe, and (3) bwvbprtl.exe programs from arbitrary pathnames via a crafted argument, as demonstrated by a UNC share pathname. + CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') + + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03 + + + + + + + + + + + + + Stack-based buffer overflow in the C++ sample client in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 - 3.35, TLXCDSTOFS33 - 3.35, TLXCDLUOFS33 - 3.35, TLXCDLTOFS33 - 3.35, and TLXCDLFOFS33 - 3.35 allows local users to gain privileges via vectors involving a malformed configuration file. + + + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-058-02 + http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-031-01 + + + + + + + + + + + + + + + + + + + + + + + + + The Modbus slave/outstation driver in the OPC Drivers 1.0.20 and earlier in IOServer OPC Server allows remote attackers to cause a denial of service (out-of-bounds read and daemon crash) via a crafted packet. + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-100-01 + + + + + + + + + + + + + The TCPUploader module in Progea Movicon 11.4 before 11.4.1150 allows remote attackers to obtain potentially sensitive version information via network traffic to TCP port 10651. + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-105-01 + + + + + + + + + + The PLC driver in ServerMain.exe in the Kepware KepServerEX 4 component in Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R2 build 71.4165, 2010 R2.1 build 71.4325, 2010 R3 build 72.4560, 2010 R3.1 build 72.4644, 2013 R1 build 73.4729, 2013 R1.1 build 73.4832, 2013 R1.1a build 73.4903, 2013 R1.2 build 73.4955, and 2013 R2 build 74.5094 allows remote attackers to cause a denial of service (application crash) via a crafted OPF file (aka project file). + + + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-072-01 + http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-024-01 + + + + + + + + + + + + + + + + + + + + Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests. + + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-107-02 + + + + + + + + + + + + Heap-based buffer overflow in BKCLogSvr.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary code via crafted UDP packets. + + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-070-01 + + + + + + + + + + + + + + + + + + + + + Stack-based buffer overflow in BKHOdeq.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary code via a crafted TCP packet. + + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-070-01 + + + + + + + + + + + + + + + + + + + + + Stack-based buffer overflow in BKBCopyD.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary code via a crafted TCP packet. + + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-070-01 + + + + + + + + + + + + + + + + + + + + + Ecava IntegraXor before 4.1.4393 allows remote attackers to read cleartext credentials for administrative accounts via SELECT statements that leverage the guest role. + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-091-01 + http://www.integraxor.com/blog/category/security/vulnerability-note/ + + + + + + + + + + + + + + + Stack-based buffer overflow in WellinTech KingSCADA before 3.1.2.13 allows remote attackers to execute arbitrary code via a crafted packet. + + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-098-02 + + + + + + + + + + + Multiple buffer overflows in the OPC Automation 2.0 Server Object ActiveX control in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 3.5 and earlier, TLXCDSTOFS33 3.5 and earlier, TLXCDLUOFS33 3.5 and earlier, TLXCDLTOFS33 3.5 and earlier, and TLXCDLFOFS33 3.5 and earlier allow remote attackers to cause a denial of service via long arguments to unspecified functions. + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-093-01 + http://www.schneider-electric.com/corporate/en/support/cybersecurity/viewer-news.page?c_filepath=/templatedata/Content/News/data/en/local/cybersecurity/general_information/2014/03/20140325_vulnerability_disclosure_opc_factory_server.xml + + + + + + + + + + + + + + + + + + + + + + Integer overflow in the license_read_scope_list function in libfreerdp/core/license.c in FreeRDP through 1.0.2 allows remote RDP servers to cause a denial of service (application crash) or possibly have unspecified other impact via a large ScopeCount value in a Scope List in a Server License Request packet. + + + + + + + + + + + https://github.com/sidhpurwala-huzaifa/FreeRDP/commit/e2745807c4c3e0a590c0f69a9b655dc74ebaa03e + https://github.com/FreeRDP/FreeRDP/pull/1649 + https://bugzilla.redhat.com/show_bug.cgi?id=998941 + [oss-security] 20140103 Re: CVE for freerdp int overflow? + [oss-security] 20140102 CVE for freerdp int overflow? + + + + + + + + + + + + Sonatype Nexus 1.x and 2.x before 2.7.1 allows remote attackers to create arbitrary objects and execute arbitrary code via unspecified vectors related to unmarshalling of unintended Object types. + + + + + + + + + + + https://support.sonatype.com/entries/37828023-Nexus-Security-Vulnerability + http://www.sonatype.org/advisories/archive/2014-01-13-Nexus + https://sonatype.zendesk.com/entries/37551958-Configuring-Xstream-Whitelist + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in the StackIdeas Komento (com_komento) component before 1.7.3 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) website or (2) latitude parameter in a comment to the default URI. + + + + + + + + + + https://www.htbridge.com/advisory/HTB23194 + 20140123 Cross-Site Scripting (XSS) in Komento Joomla Extension + 31174 + http://stackideas.com/downloads/changelog/komento + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in JV Comment (com_jvcomment) 3.0.2 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the id parameter in a comment.like action. + + + + + + + + + + https://www.htbridge.com/advisory/HTB23195 + joomla-jvcomment-unspecified-sql-injection(90532) + 64661 + 20140123 SQL Injection in JV Comment Joomla Extension + 101960 + 31175 + http://extensions.joomla.org/extensions/contacts-and-feedback/articles-comments/23394 + + + + + + + + + + Directory traversal vulnerability in the aokitaka ZIP with Pass application 4.5.7 and earlier, and ZIP with Pass Pro application 6.3.8 and earlier, for Android allows attackers to overwrite or create arbitrary files via unspecified vectors. + + + + + + + + + + JVNDB-2014-000001 + JVN#88313872 + + + + + + + + + + + + + + + + + + + Directory traversal vulnerability in the tetra filer application 2.3.1 and earlier for Android 4.0.3, tetra filer free application 2.3.1 and earlier for Android 4.0.3, tetra filer application 1.5.1 and earlier for Android before 4.0.3, and tetra filer free application 1.5.1 and earlier for Android before 4.0.3 allows attackers to overwrite or create arbitrary files via unspecified vectors. + + + + + + + + + + https://play.google.com/store/apps/details?id=jp.main.brits.android.filer.free + https://play.google.com/store/apps/details?id=jp.main.brits.android.filer.app + JVNDB-2014-000002 + JVN#51285738 + + + + + + + + + + + + + + + Directory traversal vulnerability in the CGENE Security File Manager Pro application 1.0.6 and earlier, and Security File Manager Trial application 1.0.6 and earlier, for Android allows attackers to overwrite or create arbitrary files via unspecified vectors. + + + + + + + + + + https://play.google.com/store/apps/details?id=com.cgene.android.secret.filelock.pro + https://play.google.com/store/apps/details?id=com.cgene.android.secret.filelock.free + JVNDB-2014-000003 + JVN#44392991 + + + + + + + + + + + Directory traversal vulnerability in the NeoFiler application 5.4.3 and earlier, NeoFiler Free application 5.4.3 and earlier, and NeoFiler Lite application 2.4.2 and earlier for Android allows attackers to overwrite or create arbitrary files via unspecified vectors. + + + + + + + + + + https://play.google.com/store/apps/details?id=com.skyarts.android.neofilerlite + https://play.google.com/store/apps/details?id=com.skyarts.android.neofilerfree + https://play.google.com/store/apps/details?id=com.skyarts.android.neofiler + http://www.skyarts.com/products/android/neofiler/index.html + JVNDB-2014-000004 + JVN#85716574 + + + + + + + + + + + + The Sleipnir Mobile application 2.12.1 and earlier and Sleipnir Mobile Black Edition application 2.12.1 and earlier for Android provide Geolocation API data without verifying user consent, which allows remote attackers to obtain sensitive location information via a web site that makes API calls. + + + + + + + + + JVNDB-2014-000007 + JVN#81637882 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + data/class/pages/shopping/LC_Page_Shopping_Deliv.php in LOCKON EC-CUBE 2.4.4 and earlier, and 2.11.0 through 2.12.2, allows remote attackers to modify data via unspecified vectors. + + + + + + + + + + http://www.ec-cube.net/info/weakness/weakness.php?id=56 + JVNDB-2014-000005 + JVN#17849447 + + + + + + + + + + + + + + + + + + + + + + + + The lfCheckError function in data/class/pages/shopping/LC_Page_Shopping_Multiple.php in LOCKON EC-CUBE 2.11.0 through 2.12.2 allows remote attackers to obtain sensitive shipping information via unspecified vectors. + + + + + + + + + http://www.ec-cube.net/info/weakness/weakness.php?id=57 + JVNDB-2014-000006 + JVN#51770585 + + + + + + + + + + + + + + + + + + + Directory traversal vulnerability in the Gapless Player SimZip (aka Simple Zip Viewer) application before 1.2.1 for Android allows remote attackers to overwrite or create arbitrary files via a crafted filename. + + + + + + + + + https://play.google.com/store/apps/details?id=com.acidzazz.simzip + simple-zip-cve20140809-dir-traversal(90980) + JVNDB-2014-000008 + JVN#49384502 + + + + + + + + + + + Unspecified vulnerability in JustSystems Sanshiro 2007 before update 3, 2008 before update 5, 2009 before update 6, and 2010 before update 6, and Sanshiro Viewer before 2.0.2.0, allows remote attackers to execute arbitrary code via a crafted document. + + + + + + + + + + + http://www.justsystems.com/jp/info/js14001.html + JVNDB-2014-000011 + JVN#28011378 + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in Blackboard Vista/CE 8.0 SP6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + JVNDB-2014-000012 + JVN#24730765 + + + + + + + + + + Cross-site scripting (XSS) vulnerability in KENT-WEB Joyful Note 2.8 and earlier, when Internet Explorer 7 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + http://www.kent-web.com/bbs/joyful.html + JVNDB-2014-000013 + JVN#30718178 + + + + + + + + + + Cross-site request forgery (CSRF) vulnerability in phpMyFAQ before 2.8.6 allows remote attackers to hijack the authentication of arbitrary users for requests that modify settings. + + + + + + + + + + + + http://www.phpmyfaq.de/advisory_2014-02-04.php + phpmyfaq-cve20140813-csrf(90963) + 65368 + 56006 + 102939 + JVNDB-2014-000016 + JVN#50943964 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in phpMyFAQ before 2.8.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + http://www.phpmyfaq.de/advisory_2014-02-04.php + 65368 + 56006 + 102940 + JVNDB-2014-000015 + JVN#30050348 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The intent: URL implementation in Opera before 18 on Android allows attackers to read local files by leveraging an interaction error, as demonstrated by reading stored cookies. + + + + + + + + + + opera-android-cve20140815-info-disc(91090) + 65391 + JVNDB-2014-000014 + JVN#23256725 + http://blogs.opera.com/security/2014/01/security-changes-features-opera-19/ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in Norman Security Suite 10.1 and earlier allows local users to gain privileges via unknown vectors. + + + + + + + + + + + JVNDB-2014-000026 + JVN#02017463 + http://jvn.jp/en/jp/JVN02017463/995510/index.html + + + + + + + + + + + + Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 does not properly manage sessions, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors. + + + + + + + + + + https://support.cybozu.com/ja-jp/article/7992 + JVNDB-2014-000021 + JVN#24035499 + http://cs.cybozu.co.jp/information/gr20140225up03.php + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Untrusted search path vulnerability in Autodesk AutoCAD before 2014 allows local users to gain privileges and execute arbitrary VBScript code via a Trojan horse FAS file in the FAS file search path. + + + + + + + + + + + JVNDB-2014-000019 + JVN#33382534 + + + + + + + + + + + + + + + + Untrusted search path vulnerability in Autodesk AutoCAD before 2014 allows local users to gain privileges via a Trojan horse DLL in the current working directory. + + + + + + + + + + + + JVNDB-2014-000020 + JVN#43254599 + + + + + + + + + + + + + + + + Directory traversal vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to read arbitrary files via unspecified vectors. + + + + + + + + + https://support.cybozu.com/ja-jp/article/7994 + JVNDB-2014-000023 + JVN#26393529 + http://cs.cybozu.co.jp/information/gr20140225up05.php + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + SQL injection vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2013-6930 and CVE-2013-6931. + + + + + + + + + + + https://support.cybozu.com/ja-jp/article/7993 + JVNDB-2014-000024 + JVN#71045461 + http://cs.cybozu.co.jp/information/gr20140225up04.php + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The IMAP server in IBM Domino 8.5.x before 8.5.3 FP6 IF1 and 9.0.x before 9.0.1 FP1 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, aka SPR KLYH9F4S2Z. + + + + + + + + + ibm-domino-cve20140822-dos(90235) + http://www-01.ibm.com/support/docview.wss?uid=swg21663023 + + + + + + + + + + + + + + + + IBM WebSphere Application Server (WAS) 8.x before 8.0.0.9 and 8.5.x before 8.5.5.2 allows remote attackers to read arbitrary files via a crafted URL. + + + + + + + + + ibm-was-cve20140823-viewfiles(90498) + http://www-01.ibm.com/support/docview.wss?uid=swg21669554 + PI05324 + + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in IBM InfoSphere Optim Workload Replay 1.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. + + + + + + + + + + ibm-infosphere-cve20140827-xss(90503) + http://www-01.ibm.com/support/docview.wss?uid=swg21669093 + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the WCM (Web Content Manager) UI in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF27, and 8.0.0.x before 8.0.0.1 CF11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + ibm-wsportal-cve20140828-wcm-xss(90566) + http://www-01.ibm.com/support/docview.wss?uid=swg21667016 + PI10734 + + + + + + + + + + + + + + + + + + + + + + + + + Multiple buffer overflows in IBM Rational ClearCase 7.x before 7.1.2.13, 8.0.0.x before 8.0.0.10, and 8.0.1.x before 8.0.1.3 allow remote authenticated users to obtain privileged access via unspecified vectors. + + + + + + + + + + + http://www-01.ibm.com/support/docview.wss?&uid=swg21662086 + ibm-clearcase-cve20140829-bo(90568) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Directory traversal vulnerability in the table-export implementation in the OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 and 2.1 before 2.1.0.1 allows remote authenticated users to read arbitrary files via a modified pathname. + + + + + + + + + ibm-ftm-cve20140830-trav(90584) + http://www-01.ibm.com/support/docview.wss?uid=swg21662714 + + + + + + + + + + + + + Cross-site request forgery (CSRF) vulnerability in the OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 allows remote attackers to hijack the authentication of arbitrary users for requests that modify configuration data. + + + + + + + + + + + + ibm-ftm-cve20140831-csrf(90585) + http://www-01.ibm.com/support/docview.wss?uid=swg21662714 + + + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in configuration-details screens in the OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 allow remote authenticated users to inject arbitrary web script or HTML via a crafted text value. + + + + + + + + + + ibm-ftm-cve20140832-xss(90586) + http://www-01.ibm.com/support/docview.wss?uid=swg21662714 + + + + + + + + + + + + The OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 does not properly enforce operator-intervention requirements, which allows remote authenticated users to bypass intended access restrictions via an unspecified process step. + + + + + + + + + + ibm-ftm-cve20140833-auth(90612) + http://www-01.ibm.com/support/docview.wss?uid=swg21662714 + + + + + + + + + + + + IBM General Parallel File System (GPFS) 3.4 through 3.4.0.27 and 3.5 through 3.5.0.16 allows attackers to cause a denial of service (daemon crash) via crafted arguments to a setuid program. + + + + + + + + + ibm-gpfs-cve20140834-dos(90647) + 65297 + IV54381 + IV52863 + http://www-01.ibm.com/support/docview.wss?uid=isg3T1020542 + 102765 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site request forgery (CSRF) vulnerability in IBM Security QRadar SIEM 7.2 MR1 and earlier allows remote attackers to hijack the authentication of administrators for requests that modify console Auto Update settings. + + + + + + + + + + + + ibm-qradar-cve20140835-csrf(90678) + 65127 + http://www-01.ibm.com/support/docview.wss?uid=swg21663066 + http://thomaspollet.blogspot.be/2014/01/ibm-qradar-siem-csrf-xss-mitm-rce.html + 56653 + 20140124 ADV: IBM QRadar SIEM + 102554 + + + + + + + + + + Cross-site scripting (XSS) vulnerability in IBM Security QRadar SIEM 7.2 MR1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL. + + + + + + + + + + ibm-qradar-cve20140836-xss(90679) + 65127 + http://www-01.ibm.com/support/docview.wss?uid=swg21663066 + 56653 + 20140124 ADV: IBM QRadar SIEM + 102555 + + + + + + + + + + The AutoUpdate process in IBM Security QRadar SIEM 7.2 MR1 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate. + + + + + + + + + + ibm-qradar-cve20140837-mitm(90680) + 65127 + http://www-01.ibm.com/support/docview.wss?uid=swg21663066 + 56653 + 20140124 ADV: IBM QRadar SIEM + 102552 + + + + + + + + + + The AutoUpdate package before 6.4 for IBM Security QRadar SIEM 7.2 MR1 and earlier allows remote attackers to execute arbitrary console commands by leveraging control of the server. + + + + + + + + + + + ibm-qradar-cve20140838-command-exec(90681) + 65127 + http://www-01.ibm.com/support/docview.wss?uid=swg21663066 + 102553 + + + + + + + + + + IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 allows remote authenticated users to modify data via vectors involving a direct object reference. + + + + + + + + + http://www-01.ibm.com/support/docview.wss?uid=swg21665005 + ibm-focalpoint-cve20140839-sec-bypass(90696) + + + + + + + + + + + + + + + + + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + http://www-01.ibm.com/support/docview.wss?uid=swg21665005 + ibm-focalpoint-cve20140840-xss(90698) + + + + + + + + + + + + + + + + + + + + + + + + + + The account-creation functionality in IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 places the new user's default password within the creation page, which allows remote attackers to obtain sensitive information by reading the HTML source code. + + + + + + + + + http://www-01.ibm.com/support/docview.wss?uid=swg21665005 + ibm-focalpoint-cve20140842-default-pw(90706) + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 allows remote authenticated users to inject arbitrary web script or HTML by uploading a file. + + + + + + + + + + http://www-01.ibm.com/support/docview.wss?uid=swg21665005 + ibm-focalpoint-cve20140843-file-upload(90714) + + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in IBM Rational Requirements Composer 3.x before 3.0.1.6 iFix2 and 4.x before 4.0.6, and Rational DOORS Next Generation 4.x before 4.0.6, allows remote authenticated users to read arbitrary data via unknown vectors. + + + + + + + + + ibm-rrc-cve20140844-retrieval(90718) + http://www-01.ibm.com/support/docview.wss?uid=swg21664412 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Open redirect vulnerability in IBM Rational Requirements Composer 3.x before 3.0.1.6 iFix2 and 4.x before 4.0.6, and Rational DOORS Next Generation 4.x before 4.0.6, allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL. + + + + + + + + + + + ibm-rrc-cve20140845-redirect(90719) + http://www-01.ibm.com/support/docview.wss?uid=swg21664412 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in IBM Rational Requirements Composer 3.x before 3.0.1.6 iFix2 and 4.x before 4.0.6, and Rational DOORS Next Generation 4.x before 4.0.6, allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. + + + + + + + + + + ibm-rrc-cve20140846-xss(90720) + http://www-01.ibm.com/support/docview.wss?uid=swg21664412 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The (1) ssl.conf and (2) httpd.conf files in the Apache HTTP Server component in IBM Netezza Performance Portal 2.0 before 2.0.0.4 have weak SSLCipherSuite values, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack. + + + + + + + + + ibm-netezza-cve20140848-weak-sec(90723) + http://www-01.ibm.com/support/docview.wss?uid=swg21665278 + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in IBM InfoSphere Master Data Management Reference Data Management (RDM) Hub 10.1 and 11.0 before 11.0.0.0-MDM-IF008 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. + + + + + + + + + + ibm-mdm-rdm-cve20140850-xss(90751) + http://www-01.ibm.com/support/docview.wss?uid=swg21666119 + + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in the (1) ForwardController and (2) AttributeEditor scripts in IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + http://www-01.ibm.com/support/docview.wss?uid=swg21665005 + ibm-focalpoint-cve20140853-xss(90754) + + + + + + + + + + + + + + + + + + + + + + + + + + The server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1 before IF6, 10.1.1 before IF5, 10.2 before IF7, 10.2.1 before IF4, and 10.2.1.1 before IF4 allows remote authenticated users to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. + + + + + + + + + ibm-cognos-cve20140854-xxe(90794) + http://www-01.ibm.com/support/docview.wss?uid=swg21662856 + + + + + + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in IBM Connections Portlets 4.x before 4.5.1 FP1 for IBM WebSphere Portal 7.0.0.2 and 8.0.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + ibm-websphere-cve20140855-xss(90802) + http://www-01.ibm.com/support/docview.wss?uid=swg21663921 + + + + + + + + + + + + The Administrative Console in IBM WebSphere Application Server (WAS) 8.x before 8.0.0.9 and 8.5.x before 8.5.5.2 allows remote authenticated users to obtain sensitive information via a crafted request. + + + + + + + + + ibm-was-cve20140857-info-disc(90863) + http://www-01.ibm.com/support/docview.wss?uid=swg21669554 + PI07808 + + + + + + + + + + + + + + + + + + + + + + + IBM Content Navigator 2.x before 2.0.2.2-ICN-FP002 allows remote authenticated users to bypass intended access restrictions and conduct deleteAction attacks via a modified URL. + + + + + + + + + ibm-navigator-cve20140858-xss(90864) + http://www-01.ibm.com/support/docview.wss?uid=swg21665358 + + + + + + + + + + + + The web-server plugin in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.33, 8.x before 8.0.0.9, and 8.5.x before 8.5.5.2, when POST retries are enabled, allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors. + + + + + + + + + ibm-was-cve20140859-retry(90879) + http://www-01.ibm.com/support/docview.wss?uid=swg21669554 + PI08892 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1 before IF6, 10.1.1 before IF5, 10.2 before IF7, 10.2.1 before IF4, and 10.2.1.1 before IF4 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter that is not properly handled during use of the Back button. + + + + + + + + + + http://www-01.ibm.com/support/docview.wss?uid=swg21662856 + + + + + + + + + + + + + + + Unspecified vulnerability in Jazz Team Server in IBM Rational Collaborative Lifecycle Management (CLM) 3.x before 3.0.1.6 iFix 2 and 4.x before 4.0.6 allows remote attackers to execute arbitrary code via unknown vectors. + + + + + + + + + + + ibm-rationalclm-cve20140862-rce(90895) + http://www-01.ibm.com/support/docview.wss?uid=swg21664566 + + + + + + + + + + + + + + + + + + + + + + + Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) Data Stewardship, (2) Business Admin, and (3) Product interfaces in IBM InfoSphere Master Data Management (MDM) Server 8.5 before 8.5.0.82, 9.0.1 before 9.0.1.38, 9.0.2 before 9.0.2.35, 10.0 before 10.0.0.0.26, and 10.1 before 10.1.0.0.15 allow remote attackers to hijack the authentication of arbitrary users. + + + + + + + + + + + + ibm-infosphere-cve20140873-csrf(90994) + http://www-01.ibm.com/support/docview.wss?uid=swg21666462 + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in IBM Content Navigator 2.x before 2.0.2.2-ICN-FP002 allows remote authenticated users to inject arbitrary web script or HTML via an unspecified parameter. + + + + + + + + + + ibm-cn-cve20140874-xss(91002) + http://www-01.ibm.com/support/docview.wss?uid=swg21665362 + + + + + + + + + + + + Stack-based buffer overflow in the Taskmaster Capture ActiveX control in IBM Datacap Taskmaster Capture 8.0.1, and 8.1 before FP2, allows remote attackers to execute arbitrary code via unspecified vectors. + + + + + + + + + + + + http://www-01.ibm.com/support/docview.wss?uid=swg21666888 + ibm-taskmaster-cve20140879-code-exec(91115) + + + + + + + + + + + IBM SAN Volume Controller; Storwize V3500, V3700, V5000, and V7000; and Flex System V7000 with software 6.3 and 6.4 before 6.4.1.8, and 7.1 and 7.2 before 7.2.0.3, allow remote attackers to obtain CLI access, and consequently cause a denial of service, via unspecified traffic to the administrative IP address. + + + + + + + + + + + ibm-storwize-cve20140880-cli(91145) + http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004570 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + ibm-lpms-cve20140884-xss(91170) + http://www-01.ibm.com/support/docview.wss?uid=swg21668124 + + + + + + + + + + + Cross-site request forgery (CSRF) vulnerability in the Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors. + + + + + + + + + + + + ibm-lpms-cve20140885-csrf(91171) + http://www-01.ibm.com/support/docview.wss?uid=swg21668124 + + + + + + + + + + + The Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to bypass intended access restrictions and execute arbitrary commands via unspecified vectors. + + + + + + + + + + + ibm-lpms-cve20140886-command(91172) + http://www-01.ibm.com/support/docview.wss?uid=swg21668124 + + + + + + + + + + + The Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors. + + + + + + + + + + + ibm-lpms-cve20140887-command-root(91173) + http://www-01.ibm.com/support/docview.wss?uid=swg21668124 + + + + + + + + + + + The Connect client in IBM Sametime 8.5.1, 8.5.1.1, 8.5.1.2, 8.5.2, 8.5.2.1, 9.0, and 9.0.0.1, when a certain com.ibm.collaboration.realtime.telephony.*.level setting is used, logs cleartext passwords during Audio/Video chat sessions, which allows local users to obtain sensitive information by reading a log file. + + + + + + + + + ibm-lotus-cve20148090-info-disc(91282) + http://www-01.ibm.com/support/docview.wss?uid=swg21665658 + + + + + + + + + + + + + + + + IBM Notes and Domino 8.5.x before 8.5.3 FP6 IF3 and 9.x before 9.0.1 FP1 on 32-bit Linux platforms use incorrect gcc options, which makes it easier for remote attackers to execute arbitrary code by leveraging the absence of the NX protection mechanism and placing crafted x86 code on the stack, aka SPR KLYH9GGS9W. + + + + + + + + + VU#350089 + ibm-notes-cve20140892-linux32-rce(91286) + http://www-01.ibm.com/support/docview.wss?uid=swg21670264 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Buffer overflow in the vsflex8l ActiveX control in IBM SPSS SamplePower 3.0.1 before FP1 3.0.1-IM-S3SAMPC-WIN32-FP001-IF02 allows remote attackers to execute arbitrary code via a crafted ComboList property value. + + + + + + + + + + + ibm-spss-cve20140895-code-exec(91314) + http://www-01.ibm.com/support/docview.wss?uid=swg21666790 + PI09800 + + + + + + + + + + IBM WebSphere Application Server (WAS) Liberty Profile 8.5.x before 8.5.5.2 allows remote attackers to obtain sensitive information via a crafted request. + + + + + + + + + ibm-was-cve20140896-info-disc(91326) + http://www-01.ibm.com/support/docview.wss?uid=swg21669554 + PI10134 + + + + + + + + + + + + + + ftpd in IBM AIX 7.1.1 before SP10 and 7.1.2 before SP5, when a Workload Partition (aka WPAR) for AIX 5.2 or 5.3 is used, allows remote authenticated users to bypass intended permission settings and modify arbitrary files via FTP commands. + + + + + + + + + + + ibm-aix-wpar-ftpd(91396) + IV51421 + IV51420 + http://aix.software.ibm.com/aix/efixes/security/wparcre_advisory.asc + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the Social Rendering implementation in the IBM Connections integration in IBM WebSphere Portal 8.0.0.x before 8.0.0.1 CF11 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + ibm-wsportal-cve20140901-sr-xss(91398) + http://www-01.ibm.com/support/docview.wss?uid=swg21667016 + PI12659 + + + + + + + + + + + The update process in IBM Security AppScan Standard 7.9 through 8.8 does not require integrity checks of downloaded files, which allows remote attackers to execute arbitrary code via a crafted file. + + + + + + + + + + + ibm-appscan-cve20140904-code-exec(91536) + http://www-01.ibm.com/support/docview.wss?uid=swg21666775 + + + + + + + + + + + + + + + The User Attribute implementation in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.2, and 8.5.x through 8.5.0.1 does not verify authorization for read or write access to attribute values, which allows remote authenticated users to obtain sensitive information, configure e-mail notifications, or modify task assignments via REST API calls. + + + + + + + + + + + ibm-bpm-cve20140908-priv-escalation(91870) + http://www-01.ibm.com/support/docview.wss?uid=swg21669330 + JR49505 + + + + + + + + + + + + + + + + + + + + IBM SPSS Analytic Server 1.0 before IF002 and 1.0.1 before IF004 logs cleartext passwords, which allows remote authenticated users to obtain sensitive information via unspecified vectors. + + + + + + + + + ibm-spssas-cve20140920-plaintext-pw(92073) + http://www-01.ibm.com/support/docview.wss?uid=swg21669506 + PI13527 + + + + + + + + + + + The server in IBM MessageSight 1.x before 1.1.0.0-IBM-IMA-IT01015 allows remote attackers to cause a denial of service (daemon crash and message data loss) via malformed headers during a WebSockets connection upgrade. + + + + + + + + + ibm-messagesight-cve20140921-dos(92074) + http://www-01.ibm.com/support/docview.wss?uid=swg21670278 + IC98583 + + + + + + + + + + + + + + + IBM MessageSight 1.x before 1.1.0.0-IBM-IMA-IT01015 allows remote attackers to cause a denial of service (resource consumption) via WebSockets MQ Telemetry Transport (MQTT) data. + + + + + + + + + ibm-messagesight-cve20140922-dos(92075) + http://www-01.ibm.com/support/docview.wss?uid=swg21670278 + IC98692 + + + + + + + + + + + + + + + IBM MessageSight 1.x before 1.1.0.0-IBM-IMA-IT01015 allows remote attackers to cause a denial of service (daemon restart) via crafted MQ Telemetry Transport (MQTT) authentication data. + + + + + + + + + ibm-messagesight-cve20140923-dos(92076) + http://www-01.ibm.com/support/docview.wss?uid=swg21670278 + IT00582 + + + + + + + + + + + + + + + IBM MessageSight 1.x before 1.1.0.0-IBM-IMA-IT01015 does not verify that all of the characters of a password are correct, which makes it easier for remote authenticated users to bypass intended access restrictions by leveraging knowledge of a password substring. + + + + + + + + + + + ibm-messagesight-cve20140924-sec-bypass(92077) + http://www-01.ibm.com/support/docview.wss?uid=swg21670278 + IT00583 + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in IBM Sterling Order Management 8.5 before HF105 and Sterling Selling and Fulfillment Foundation 9.0 before HF85 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. + + + + + + + + + + ibm-sterlingom-cve20140932-xss(92264) + http://www-01.ibm.com/support/docview.wss?uid=swg21670912 + IT00419 + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in webtop/eventviewer/eventViewer.jsp in the Web GUI in IBM Netcool/OMNIbus 7.4.0 before FP2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2014-0942. + + + + + + + + + + ibm-netcoolomnibus-cve20140941-xss(92400) + http://www-01.ibm.com/support/docview.wss?uid=swg21671686 + + + + + + + + + + Cross-site scripting (XSS) vulnerability in webtop/eventviewer/eventViewer.jsp in the Web GUI in IBM Netcool/OMNIbus 7.4.0 before FP2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2014-0941. + + + + + + + + + + ibm-netcoolomnibus-cve20140942-xss(92401) + http://www-01.ibm.com/support/docview.wss?uid=swg21671686 + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the Rich Text Editor in Movable Type 5.0x, 5.1x before 5.161, 5.2.x before 5.2.9, and 6.0.x before 6.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + movabletype-richtexteditor-xss(90095) + 1029588 + 64657 + DSA-2841 + 56405 + 56295 + [oss-security] 20140107 Re: CVE Request: cross-site scripting vulnerabilities in movable type 6.0.1, 5.2.9, and 5.161 + [oss-security] 20140106 CVE Request: cross-site scripting vulnerabilities in movable type 6.0.1, 5.2.9, and 5.161 + http://movabletype.org/news/2013/11/movable_type_601_529_and_5161_released_to_close_security_vul.html + http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=734304 + + + + + + + + + + + + + + + + + + + + + + + + + + Stack-based buffer overflow in the yyerror function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via a long line in a dot file. + + + + + + + + + + + + https://github.com/ellson/graphviz/commit/7aaddf52cd98589fb0c3ab72a393f8411838438a + https://bugzilla.redhat.com/show_bug.cgi?id=1049165 + https://bugs.gentoo.org/show_bug.cgi?id=497274 + graphviz-yyerror-bo(90085) + 64674 + MDVSA-2014:024 + DSA-2843 + 56244 + 55666 + [oss-security] 20140107 Re: CVE Request: graphviz: stack-based buffer overflow in yyerror() + [oss-security] 20140107 CVE Request: graphviz: stack-based buffer overflow in yyerror() + + + + + + + + + + The start_authentication function in lightdm-gtk-greeter.c in LightDM GTK+ Greeter before 1.7.1 does not properly handle the return value from the lightdm_greeter_get_authentication_user function, which allows local users to cause a denial of service (NULL pointer dereference) via an empty username. + Per: http://cwe.mitre.org/data/definitions/476.html + +"CWE-476: NULL Pointer Dereference" + + + + + + + + + https://bugzilla.novell.com/show_bug.cgi?id=857303 + https://bugs.launchpad.net/lightdm-gtk-greeter/+bug/1266449 + 64679 + [oss-security] 20140107 Re: CVE request: lightdm-gtk-greeter - local DOS due to NULL pointer dereference + 56423 + 56211 + openSUSE-SU-2014:0071 + FEDORA-2014-1648 + FEDORA-2014-1647 + + + + + + + + + + + + + + + + + + + + + + + + + + + + Buffer overflow in Poster Software PUBLISH-iT 3.6d allows remote attackers to execute arbitrary code via a crafted PUI file. + + + + + + + + + + + publishit-cve20140980-bo(90989) + 65366 + 20140205 CORE-2014-0001 - Publish-It Buffer Overflow Vulnerability + 31461 + http://www.coresecurity.com/advisories/publish-it-buffer-overflow-vulnerability + 56618 + 20140205 CORE-2014-0001 - Publish-It Buffer Overflow Vulnerability + http://packetstormsecurity.com/files/125089 + 102911 + + + + + + + + + + VBox/GuestHost/OpenGL/util/net.c in Oracle VirtualBox before 3.2.22, 4.0.x before 4.0.24, 4.1.x before 4.1.32, 4.2.x before 4.2.24, and 4.3.x before 4.3.8, when using 3D Acceleration allows local guest OS users to execute arbitrary code on the Chromium server via crafted Chromium network pointer in a (1) CR_MESSAGE_READBACK or (2) CR_MESSAGE_WRITEBACK message to the VBoxSharedCrOpenGL service, which triggers an arbitrary pointer dereference and memory corruption. NOTE: this issue was MERGED with CVE-2014-0982 because it is the same type of vulnerability affecting the same set of versions. All CVE users should reference CVE-2014-0981 instead of CVE-2014-0982. + + + + + + + + + + + https://www.virtualbox.org/changeset/50437/vbox + 20140311 CORE-2014-0002 - Oracle VirtualBox 3D Acceleration Multiple Memory Corruption Vulnerabilities + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + 32208 + http://www.coresecurity.com/advisories/oracle-virtualbox-3d-acceleration-multiple-memory-corruption-vulnerabilities + 57384 + 20140311 CORE-2014-0002 - Oracle VirtualBox 3D Acceleration Multiple Memory Corruption Vulnerabilities + + + + + + + + + + + + + + + + + + + + + + + + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-0981. Reason: This issue was MERGED into CVE-2014-0981 in accordance with CVE content decisions, because it is the same type of vulnerability and affects the same versions. Notes: All CVE users should reference CVE-2014-0981 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. + + + + + + Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D Acceleration, allow local guest OS users to execute arbitrary code on the Chromium server via certain CR_MESSAGE_OPCODES messages with a crafted index, which are not properly handled by the (1) CR_VERTEXATTRIB4NUBARB_OPCODE to the crServerDispatchVertexAttrib4NubARB function, (2) CR_VERTEXATTRIB1DARB_OPCODE to the crServerDispatchVertexAttrib1dARB function, (3) CR_VERTEXATTRIB1FARB_OPCODE to the crServerDispatchVertexAttrib1fARB function, (4) CR_VERTEXATTRIB1SARB_OPCODE to the crServerDispatchVertexAttrib1sARB function, (5) CR_VERTEXATTRIB2DARB_OPCODE to the crServerDispatchVertexAttrib2dARB function, (6) CR_VERTEXATTRIB2FARB_OPCODE to the crServerDispatchVertexAttrib2fARB function, (7) CR_VERTEXATTRIB2SARB_OPCODE to the crServerDispatchVertexAttrib2sARB function, (8) CR_VERTEXATTRIB3DARB_OPCODE to the crServerDispatchVertexAttrib3dARB function, (9) CR_VERTEXATTRIB3FARB_OPCODE to the crServerDispatchVertexAttrib3fARB function, (10) CR_VERTEXATTRIB3SARB_OPCODE to the crServerDispatchVertexAttrib3sARB function, (11) CR_VERTEXATTRIB4DARB_OPCODE to the crServerDispatchVertexAttrib4dARB function, (12) CR_VERTEXATTRIB4FARB_OPCODE to the crServerDispatchVertexAttrib4fARB function, and (13) CR_VERTEXATTRIB4SARB_OPCODE to the crServerDispatchVertexAttrib4sARB function. + + + + + + + + + + + https://www.virtualbox.org/changeset/50441/vbox + 20140311 CORE-2014-0002 - Oracle VirtualBox 3D Acceleration Multiple Memory Corruption Vulnerabilities + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + 32208 + http://www.coresecurity.com/advisories/oracle-virtualbox-3d-acceleration-multiple-memory-corruption-vulnerabilities + 57384 + 20140311 CORE-2014-0002 - Oracle VirtualBox 3D Acceleration Multiple Memory Corruption Vulnerabilities + + + + + + + + + + + + + + + + + + + + + + + + The passwordCheck function in SAP Router 721 patch 117, 720 patch 411, 710 patch 029, and earlier terminates validation of a Route Permission Table entry password upon encountering the first incorrect character, which allows remote attackers to obtrain passwords via a brute-force attack that relies on timing differences in responses to incorrect password guesses, aka a timing side-channel attack. + + + + + + + + + https://service.sap.com/sap/support/notes/1986895 + 20140416 [CORE-2014-0003] - SAP Router Password Timing Attack + 32919 + http://www.coresecurity.com/advisories/sap-router-password-timing-attack + http://scn.sap.com/docs/DOC-8218 + + + + + + + + + + + + Buffer overflow in the INetViewX ActiveX control in the Lorex Edge LH310 and Edge+ LH320 series with firmware 7-35-28-1B26E, Edge2 LH330 series with firmware 11.17.38-33_1D97A, and Edge3 LH340 series with firmware 11.19.85_1FE3A allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the HTTP_PORT parameter. + + + + + + + + + + + https://github.com/pedrib/PoC/blob/master/lorexActivex/lorex-testcase.html + https://github.com/pedrib/PoC/blob/master/lorexActivex/lorex-report.txt + lorex-cve20141201-bo(90223) + 20140110 [CVE -2014-1201] Lorex security DVR ActiveX control buffer overflow + 101903 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file. + + + + + + + + + + + + https://github.com/SmartBear/soapui/blob/master/RELEASENOTES.txt + http://www.youtube.com/watch?v=3lCLE64rsc0 + 30908 + http://packetstormsecurity.com/files/124773/SoapUI-Remote-Code-Execution.html + http://baraktawily.blogspot.com/2014/01/soapui-code-execution-vulnerability-cve.html + + + + + + + + + + + + + + + + + + + + + + + + + + + SQL injection vulnerability in Tableau Server 8.0.x before 8.0.7 and 8.1.x before 8.1.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. NOTE: this can be exploited by unauthenticated remote attackers if the guest user is enabled. + + + + + + + + + + + https://www.trustwave.com/spiderlabs/advisories/TWSL2014-003.txt + tableau-server-cve20141204-sql-injection(90730) + http://www.tableausoftware.com/support/releases/812 + http://www.tableausoftware.com/support/releases/8.0.7 + 1029706 + 65171 + 31578 + 56620 + 102568 + + + + + + + + + + + + + + + + + + SQL injection vulnerability in the password reset page in Open Web Analytics (OWA) before 1.5.5 allows remote attackers to execute arbitrary SQL commands via the owa_email_address parameter in a base.passwordResetRequest action to index.php. + + + + + + + + + + + 64774 + 20140214 [SWRX-2014-001] Open Web Analytics Pre-Auth SQL Injection + http://www.secureworks.com/advisories/SWRX-2014-001/SWRX-2014-001.pdf + 31738 + http://wiki.openwebanalytics.com/index.php?title=1.5.5 + 56350 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + VMware ESXi 4.0 through 5.1 and ESX 4.0 and 4.1 allow remote attackers to cause a denial of service (NULL pointer dereference) by intercepting and modifying Network File Copy (NFC) traffic. + Per: http://cwe.mitre.org/data/definitions/476.html + +"CWE-476: NULL Pointer Dereference" + + + + + + + + + vmware-esx-cve20141207-dos(90559) + http://www.vmware.com/security/advisories/VMSA-2014-0001.html + 1029643 + 64995 + 56499 + 102196 + + + + + + + + + + + + + + + + + + + + + + VMware Workstation 9.x before 9.0.1, VMware Player 5.x before 5.0.1, VMware Fusion 5.x before 5.0.1, VMware ESXi 4.0 through 5.1, and VMware ESX 4.0 and 4.1 allow guest OS users to cause a denial of service (VMX process disruption) by using an invalid port. + + + + + + + + + vmware-esx-cve20141208-dos(90558) + http://www.vmware.com/security/advisories/VMSA-2014-0001.html + 1029644 + 1029643 + 64994 + 56499 + 102197 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + VMware vSphere Client 4.0, 4.1, 5.0 before Update 3, and 5.1 before Update 2 does not properly validate updates to Client files, which allows remote attackers to trigger the downloading and execution of an arbitrary program via unspecified vectors. + + + + + + + + + + + + http://www.vmware.com/security/advisories/VMSA-2014-0003.html + + + + + + + + + + + + + VMware vSphere Client 5.0 before Update 3 and 5.1 before Update 2 does not properly validate X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate. + + + + + + + + + + http://www.vmware.com/security/advisories/VMSA-2014-0003.html + + + + + + + + + + + Cross-site request forgery (CSRF) vulnerability in VMware vCloud Director 5.1.x before 5.1.3 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout. + + + + + + + + + + + + vmware-vcloud-cve20141211-csrf(90560) + http://www.vmware.com/security/advisories/VMSA-2014-0001.html + 1029645 + 64993 + 102198 + + + + + + + + + + + + Sophos Anti-Virus engine (SAVi) before 3.50.1, as used in VDL 4.97G 9.7.x before 9.7.9, 10.0.x before 10.0.11, and 10.3.x before 10.3.1 does not set an ACL for certain global and session objects, which allows local users to bypass anti-virus protection, cause a denial of service (resource consumption, CPU consumption, and eventual crash) or spoof "ready for update" messages by performing certain operations on mutexes or events including (1) DataUpdateRequest, (2) MmfMutexSAV-****, (3) MmfMutexSAV-Info, (4) ReadyForUpdateSAV-****, (5) ReadyForUpdateSAV-Info, (6) SAV-****, (7) SAV-Info, (8) StateChange, (9) SuspendedSAV-****, (10) SuspendedSAV-Info, (11) UpdateComplete, (12) UpdateMutex, (13) UpdateRequest, or (14) SophosALMonSessionInstance, as demonstrated by triggering a ReadyForUpdateSAV event and modifying the UpdateComplete, UpdateMutex, and UpdateRequest objects. + + + + + + + + + + http://www.sophos.com/en-us/support/knowledgebase/2300/7200/1031/120401.aspx + 65286 + 20140131 CVE-2014-1213 - Denial of Service in Sophos Anti Virus + http://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1213/ + 20140131 CVE-2014-1213 - Denial of Service in Sophos Anti Virus + http://packetstormsecurity.com/files/125024/Sophos-Anti-Virus-Denial-Of-Service.html + 102762 + + + + + + + + + + + + + FitNesse Wiki 20131110, 20140201, and earlier allows remote attackers to execute arbitrary commands by defining a COMMAND_PATTERN and TEST_RUNNER in the pageContent parameter when editing a page. + Per: https://cwe.mitre.org/data/definitions/77.html + +"CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')" + + + + + + + + + + + https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1216/ + 32568 + + + + + + + + + + + Livetecs Timelive before 6.2.8 does not properly restrict access to systemsetting.aspx, which allows remote attackers to change configurations and obtain the database connection string and credentials via unspecified vectors. + + + + + + + + + + + https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1217/ + 67043 + 20140423 CVE-2014-1217 - Unauthenticated access to sensitive information and functionality in Livetecs Timelive + 20140423 CVE-2014-1217 - Unauthenticated access to sensitive information and functionality in Livetecs Timelive + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + CA 2E Web Option r8.1.2 accepts a predictable substring of a W2E_SSNID session token in place of the entire token, which allows remote attackers to hijack sessions by changing characters at the end of this substring, as demonstrated by terminating a session via a modified SSNID parameter to web2edoc/close.htm. + + + + + + + + + + + 65537 + http://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1219/ + + + + + + + + + + Cross-site scripting (XSS) vulnerability in controlpanel/loading.aspx in Telligent Evolution before 6.1.19.36103, 7.x before 7.1.12.36162, 7.5.x, and 7.6.x before 7.6.7.36651 allows remote attackers to inject arbitrary web script or HTML via the msg parameter. NOTE: some of these details are obtained from third party information. + + + + + + + + + + https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1223 + 20140221 CVE-2014-1223 - Cross-site Scripting in Telligent Evolution + 56779 + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the Foliopress WYSIWYG plugin before 2.6.8.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + http://wordpress.org/plugins/foliopress-wysiwyg/changelog + foliopress-unspecified-xss(90102) + 56261 + + + + + + + + + + + + + + The paratrooper-pingdom gem 1.0.0 for Ruby allows local users to obtain the App-Key, username, and password values by listing the curl process. + + + + + + + + + http://www.vapid.dhs.org/advisories/paratrooper-api-key-pingdom.html + [oss-security] 20140107 paratrooper-pingdom-1.0.0 ruby gem exposes API login credentials + + + + + + + + + + The paratrooper-newrelic gem 1.0.1 for Ruby allows local users to obtain the X-Api-Key value by listing the curl process. + + + + + + + + + http://www.vapid.dhs.org/advisories/paratrooper-newrelic-api.html + [oss-security] 20140107 Paratrooper-newrelic 1.0.1 Ruby Gem exposes API key + + + + + + + + + + Stack-based buffer overflow in the chkNum function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via vectors related to a "badly formed number" and a "long digit list." + + + + + + + + + + + https://github.com/ellson/graphviz/commit/1d1bdec6318746f6f19f245db589eddc887ae8ff + https://bugzilla.redhat.com/show_bug.cgi?id=1050872 + 64737 + MDVSA-2014:024 + DSA-2843 + 56244 + 55666 + [oss-security] 20140108 Re: CVE Request: graphviz: stack-based buffer overflow in yyerror() + [oss-security] 20140108 Re: Re: CVE Request: graphviz: stack-based buffer overflow in yyerror() + [oss-security] 20140108 Re: Re: CVE Request: graphviz: stack-based buffer overflow in yyerror() + + + + + + + + + + Cross-site scripting (XSS) vulnerability in synetics i-doit pro before 1.2.4 allows remote attackers to inject arbitrary web script or HTML via the call parameter. + + + + + + + + + + idoit-cve20141237-xss(90969) + 65353 + http://www.i-doit.com/en/company/news/single-news/?tx_ttnews%5Btt_news%5D=136 + http://www.csnc.ch/misc/files/advisories/CVE-2014-1237_i-doit_Cross-site_Scripting_-_XSS.txt + 56834 + 56802 + 20140205 CVE-2014-1237 (XSS in i-doit Pro) + http://packetstormsecurity.com/files/125062 + 102910 + + + + + + + + + + + + + + Apple iTunes before 11.1.4 uses HTTP for the iTunes Tutorials window, which allows man-in-the-middle attackers to spoof content by gaining control over the client-server data stream. + + + + + + + + + + apple-itunes-cve20141242-mitm(90653) + 1029671 + 65088 + http://support.apple.com/kb/HT6001 + 102410 + + + + + + + + + + + + + + + + + + + Apple QuickTime before 7.7.5 does not initialize an unspecified pointer, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted track list in a movie file. + + + + + + + + + + + + http://support.apple.com/kb/HT6151 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with H.264 encoding. + + + + + + + + + + + + http://support.apple.com/kb/HT6151 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Integer signedness error in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted stsz atom in a movie file. + + + + + + + + + + + + http://support.apple.com/kb/HT6151 + http://support.apple.com/kb/HT6150 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted ftab atom in a movie file. + + + + + + + + + + + + http://support.apple.com/kb/HT6151 + http://support.apple.com/kb/HT6150 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted dref atom in a movie file. + + + + + + + + + + + + http://support.apple.com/kb/HT6151 + http://support.apple.com/kb/HT6150 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted ldat atom in a movie file. + + + + + + + + + + + + http://support.apple.com/kb/HT6151 + http://support.apple.com/kb/HT6150 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PSD image. + + + + + + + + + + + + http://support.apple.com/kb/HT6151 + http://support.apple.com/kb/HT6150 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Apple QuickTime before 7.7.5 does not properly perform a byte-swapping operation, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds memory access and application crash) via a crafted ttfo element in a movie file. + + + + + + + + + + + + http://support.apple.com/kb/HT6151 + http://support.apple.com/kb/HT6150 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted clef atom in a movie file. + + + + + + + + + + + + http://support.apple.com/kb/HT6151 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Double free vulnerability in Apple Pages 2.x before 2.1 and 5.x before 5.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Microsoft Word file. + + + + + + + + + + + apple-pages-cve20141252-code-exec(90672) + 1029683 + 65113 + http://support.apple.com/kb/HT6162 + http://support.apple.com/kb/HT6150 + http://support.apple.com/kb/HT6117 + 56630 + 56615 + 102460 + + + + + + + + + + + + + + AppleMNT.sys in Apple Boot Camp 5 before 5.1 allows local users to cause a denial of service (kernel memory corruption) or possibly have unspecified other impact via a malformed header in a Portable Executable (PE) file. + + + + + + + + + http://support.apple.com/kb/HT6126 + APPLE-SA-2014-02-11-1 + + + + + + + + + + Apple Type Services (ATS) in Apple OS X before 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Type 1 font that is embedded in a document. + + + + + + + + + + + + http://support.apple.com/kb/HT6150 + + + + + + + + + + + + + + + + + Apple Type Services (ATS) in Apple OS X before 10.9.2 does not properly validate calls to the free function, which allows attackers to bypass the App Sandbox protection mechanism via crafted Mach messages. + + + + + + + + + + + http://support.apple.com/kb/HT6150 + + + + + + + + + + + Buffer overflow in Apple Type Services (ATS) in Apple OS X before 10.9.2 allows attackers to bypass the App Sandbox protection mechanism via crafted Mach messages. + + + + + + + + + + + http://support.apple.com/kb/HT6150 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + CFNetwork in Apple OS X through 10.8.5 does not remove session cookies upon a Safari reset action, which allows physically proximate attackers to bypass intended access restrictions by leveraging an unattended workstation. + + + + + + + + + + http://support.apple.com/kb/HT6150 + + + + + + + + + + + + + + + Heap-based buffer overflow in CoreAnimation in Apple OS X before 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted image. + + + + + + + + + + + + http://support.apple.com/kb/HT6150 + + + + + + + + + + + + + + + + + Buffer overflow in File Bookmark in Apple OS X before 10.9.2 allows attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted filename. + + + + + + + + + + + + http://support.apple.com/kb/HT6150 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + QuickLook in Apple OS X through 10.8.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Microsoft Office document. + + + + + + + + + + + + http://support.apple.com/kb/HT6150 + + + + + + + + + + + + + + + Integer signedness error in CoreText in Apple OS X before 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Unicode font. + + + + + + + + + + + http://support.apple.com/kb/HT6150 + + + + + + + + + + + Apple Type Services (ATS) in Apple OS X before 10.9.2 allows attackers to bypass the App Sandbox protection mechanism via crafted Mach messages that trigger memory corruption. + + + + + + + + + + + http://support.apple.com/kb/HT6150 + + + + + + + + + + + curl in Apple OS X 10.9.x before 10.9.2 does not verify X.509 certificates from HTTPS servers that are accessed using a numerical IP address, which allows man-in-the-middle attackers to spoof servers via a crafted certificate. + + + + + + + + + + https://gist.github.com/rmoriz/fb2b0a6a0ce10550ab73 + http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/ + http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/ + http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/ + http://twitter.com/okoeroo/statuses/437272014043496449 + http://twitter.com/agl__/statuses/437029812046422016 + http://support.apple.com/kb/HT6150 + 57968 + 57966 + 57836 + + + + + + + + + + + Finder in Apple OS X before 10.9.2 does not ensure ACL integrity after the viewing of file ACL information, which allows local users to bypass intended access restrictions in opportunistic circumstances via standard filesystem operations on a file with a damaged ACL. + + + + + + + + + + http://support.apple.com/kb/HT6150 + + + + + + + + + + + The systemsetup program in the Date and Time subsystem in Apple OS X before 10.9.2 allows local users to bypass intended access restrictions by changing the current time on the system clock. + + + + + + + + + + + http://support.apple.com/kb/HT6150 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The SSLVerifySignedServerKeyExchange function in libsecurity_ssl/lib/sslKeyExchange.c in the Secure Transport feature in the Data Security component in Apple iOS 6.x before 6.1.6 and 7.x before 7.0.6, Apple TV 6.x before 6.0.2, and Apple OS X 10.9.x before 10.9.2 does not check the signature in a TLS Server Key Exchange message, which allows man-in-the-middle attackers to spoof SSL servers by (1) using an arbitrary private key for the signing step or (2) omitting the signing step. + + + + + + + + + + + https://www.imperialviolet.org/2014/02/22/applebug.html + https://www.cs.columbia.edu/~smb/blog/2014-02/2014-02-24.html + https://www.cs.columbia.edu/~smb/blog/2014-02/2014-02-23.html + https://news.ycombinator.com/item?id=7281378 + http://support.apple.com/kb/HT6150 + http://support.apple.com/kb/HT6148 + http://support.apple.com/kb/HT6147 + http://support.apple.com/kb/HT6146 + http://it.slashdot.org/comments.pl?sid=4821073&cid=46310187 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The Configuration Profiles component in Apple iOS before 7.1 and Apple TV before 6.1 does not properly evaluate the expiration date of a mobile configuration profile, which allows attackers to bypass intended access restrictions by using a profile after the date has passed. + + + + + + + + + + http://support.apple.com/kb/HT6163 + http://support.apple.com/kb/HT6162 + + + + + + + + + + + + + + + + + + + + + WebKit, as used in Apple Safari before 6.1.2 and 7.x before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1269 and CVE-2014-1270. + + + + + + + + + + + + http://support.apple.com/kb/HT6145 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + WebKit, as used in Apple Safari before 6.1.2 and 7.x before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1268 and CVE-2014-1270. + + + + + + + + + + + + http://support.apple.com/kb/HT6163 + http://support.apple.com/kb/HT6162 + http://support.apple.com/kb/HT6145 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + WebKit, as used in Apple Safari before 6.1.2 and 7.x before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1268 and CVE-2014-1269. + + + + + + + + + + + + http://support.apple.com/kb/HT6163 + http://support.apple.com/kb/HT6162 + http://support.apple.com/kb/HT6145 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + CoreCapture in Apple iOS before 7.1 and Apple TV before 6.1 does not properly validate IOKit API calls, which allows attackers to cause a denial of service (assertion failure and device crash) via a crafted app. + + + + + + + + + http://support.apple.com/kb/HT6163 + http://support.apple.com/kb/HT6162 + + + + + + + + + + + + + + + + + + + + + CrashHouseKeeping in Crash Reporting in Apple iOS before 7.1 and Apple TV before 6.1 allows local users to change arbitrary file permissions by leveraging a symlink. + + + + + + + + + + http://support.apple.com/kb/HT6163 + http://support.apple.com/kb/HT6162 + + + + + + + + + + + + + + + + + + + + + dyld in Apple iOS before 7.1 and Apple TV before 6.1 allows attackers to bypass code-signing requirements by leveraging use of text-relocation instructions in a dynamic library. + + + + + + + + + + http://support.apple.com/kb/HT6163 + http://support.apple.com/kb/HT6162 + + + + + + + + + + + + + + + + + + + + + FaceTime in Apple iOS before 7.1 allows physically proximate attackers to obtain sensitive FaceTime contact information by using the lock screen for an invalid FaceTime call. + + + + + + + + + http://support.apple.com/kb/HT6162 + + + + + + + + + + + + + + + + Buffer overflow in ImageIO in Apple iOS before 7.1 and Apple TV before 6.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted JPEG2000 data in a PDF document. + + + + + + + + + + + + http://support.apple.com/kb/HT6163 + http://support.apple.com/kb/HT6162 + + + + + + + + + + + + + + + + + + + + + IOKit HID Event in Apple iOS before 7.1 allows attackers to conduct user-action monitoring attacks against arbitrary apps via a crafted app that accesses an IOKit framework interface. + + + + + + + + + http://support.apple.com/kb/HT6162 + + + + + + + + + + + + + + + + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-3948. Reason: This candidate is a duplicate of CVE-2013-3948. Notes: All CVE users should reference CVE-2013-3948 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. + + + + + + The ptmx_get_ioctl function in the ARM kernel in Apple iOS before 7.1 and Apple TV before 6.1 allows local users to gain privileges or cause a denial of service (out-of-bounds memory access and device crash) via a crafted call. + + + + + + + + + + + http://support.apple.com/kb/HT6163 + http://support.apple.com/kb/HT6162 + + + + + + + + + + + + + + + + + + + + + Apple TV before 6.1 does not properly restrict logging, which allows local users to obtain sensitive information by reading log data. + + + + + + + + + http://support.apple.com/kb/HT6163 + + + + + + + + + + + + Video Driver in Apple iOS before 7.1 and Apple TV before 6.1 allows remote attackers to cause a denial of service (NULL pointer dereference and device hang) via a crafted video file with MPEG-4 encoding. + Per: http://cwe.mitre.org/data/definitions/476.html + +"CWE-476: NULL Pointer Dereference" + + + + + + + + + + http://support.apple.com/kb/HT6163 + http://support.apple.com/kb/HT6162 + + + + + + + + + + + + + + + + + + + + + Photos Backend in Apple iOS before 7.1 does not properly manage the asset-library cache during deletions, which allows physically proximate attackers to obtain sensitive photo data by launching the Photos app and looking under a transparent image. + + + + + + + + + http://support.apple.com/kb/HT6162 + + + + + + + + + + + + + + + + The Profiles component in Apple iOS before 7.1 and Apple TV before 6.1 allows attackers to bypass intended configuration-profile visibility requirements via a long name. + + + + + + + + + + http://support.apple.com/kb/HT6163 + http://support.apple.com/kb/HT6162 + + + + + + + + + + + + + + + + + + + + + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-2019. Reason: This candidate is a duplicate of CVE-2014-2019. Notes: All CVE users should reference CVE-2014-2019 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. + + + + + + Springboard in Apple iOS before 7.1 allows physically proximate attackers to bypass intended access restrictions and read the home screen by leveraging an application crash during activation of an unactivated device. + + + + + + + + + + http://support.apple.com/kb/HT6162 + + + + + + + + + + + + + + + + SpringBoard Lock Screen in Apple iOS before 7.1 allows remote attackers to cause a denial of service (lock-screen hang) by leveraging a state-management error. + Per: https://cwe.mitre.org/data/definitions/361.html + +"CWE-361: Time and State" + + + + + + + + + http://support.apple.com/kb/HT6162 + + + + + + + + + + + + + + + + USB Host in Apple iOS before 7.1 and Apple TV before 6.1 allows physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted USB messages. + + + + + + + + + + + http://support.apple.com/kb/HT6163 + http://support.apple.com/kb/HT6162 + + + + + + + + + + + + + + + + + + + + + WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1290, CVE-2014-1291, CVE-2014-1292, CVE-2014-1293, and CVE-2014-1294. + + + + + + + + + + + + http://support.apple.com/kb/HT6163 + http://support.apple.com/kb/HT6162 + APPLE-SA-2014-04-01-1 + + + + + + + + + + + + + + + + + + + + + WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1291, CVE-2014-1292, CVE-2014-1293, and CVE-2014-1294. + + + + + + + + + + + + http://support.apple.com/kb/HT6163 + http://support.apple.com/kb/HT6162 + APPLE-SA-2014-04-01-1 + + + + + + + + + + + + + + + + + + + + + WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1292, CVE-2014-1293, and CVE-2014-1294. + + + + + + + + + + + + http://support.apple.com/kb/HT6163 + http://support.apple.com/kb/HT6162 + APPLE-SA-2014-04-01-1 + + + + + + + + + + + + + + + + + + + + + WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1291, CVE-2014-1293, and CVE-2014-1294. + + + + + + + + + + + + http://support.apple.com/kb/HT6163 + http://support.apple.com/kb/HT6162 + APPLE-SA-2014-04-01-1 + + + + + + + + + + + + + + + + + + + + + WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1291, CVE-2014-1292, and CVE-2014-1294. + + + + + + + + + + + + http://support.apple.com/kb/HT6163 + http://support.apple.com/kb/HT6162 + APPLE-SA-2014-04-01-1 + + + + + + + + + + + + + + + + + + + + + WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1291, CVE-2014-1292, and CVE-2014-1293. + + + + + + + + + + + + http://support.apple.com/kb/HT6163 + http://support.apple.com/kb/HT6162 + APPLE-SA-2014-04-01-1 + + + + + + + + + + + + + + + + + + + + + Secure Transport in Apple iOS before 7.1.1, Apple OS X 10.8.x and 10.9.x through 10.9.2, and Apple TV before 6.1.1 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which allows man-in-the-middle attackers to obtain sensitive information or modify TLS session data via a "triple handshake attack." + + + + + + + + + + + https://secure-resumption.com/ + APPLE-SA-2014-04-22-2 + APPLE-SA-2014-04-22-3 + APPLE-SA-2014-04-22-1 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + CFNetwork in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 does not ensure that a Set-Cookie HTTP header is complete before interpreting the header's value, which allows remote attackers to bypass intended access restrictions by triggering the closing of a TCP connection during transmission of a header, as demonstrated by an HTTPOnly restriction. + + + + + + + + + APPLE-SA-2014-04-22-2 + APPLE-SA-2014-04-22-3 + APPLE-SA-2014-04-22-1 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, does not properly validate WebProcess IPC messages, which allows remote attackers to bypass a sandbox protection mechanism and read arbitrary files by leveraging WebProcess access. + + + + + + + + + APPLE-SA-2014-04-01-1 + + + + + + + + + + + + + + + + + + + + + WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1. + + + + + + + + + + + + APPLE-SA-2014-04-22-2 + APPLE-SA-2014-04-22-3 + APPLE-SA-2014-04-01-1 + + + + + + + + + + + + + + + + + + + + + WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1. + + + + + + + + + + + + APPLE-SA-2014-04-22-2 + APPLE-SA-2014-04-22-3 + APPLE-SA-2014-04-01-1 + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in Apple Safari 7.0.2 on OS X allows remote attackers to execute arbitrary code with root privileges via unknown vectors, as demonstrated by Google during a Pwn4Fun competition at CanSecWest 2014. + + + + + + + + + + + http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/ + http://twitter.com/thezdi/statuses/443796547872903168 + APPLE-SA-2014-04-22-2 + APPLE-SA-2014-04-22-3 + APPLE-SA-2014-04-01-1 + + + + + + + + + + WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1. + + + + + + + + + + + + APPLE-SA-2014-04-01-1 + + + + + + + + + + + + + + + + + + + + + WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1. + + + + + + + + + + + + APPLE-SA-2014-04-22-2 + APPLE-SA-2014-04-22-3 + APPLE-SA-2014-04-01-1 + + + + + + + + + + + + + + + + + + + + + Heap-based buffer overflow in Apple Safari 7.0.2 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors, as demonstrated by Liang Chen during a Pwn2Own competition at CanSecWest 2014. + + + + + + + + + + + http://www.pwn2own.com/2014/03/pwn2own-results-thursday-day-two/ + http://twitter.com/thezdi/statuses/444157530139136000 + APPLE-SA-2014-04-22-2 + APPLE-SA-2014-04-22-3 + APPLE-SA-2014-04-01-1 + + + + + + + + + + WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1. + + + + + + + + + + + + APPLE-SA-2014-04-22-2 + APPLE-SA-2014-04-22-3 + APPLE-SA-2014-04-01-1 + + + + + + + + + + + + + + + + + + + + + WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1. + + + + + + + + + + + + APPLE-SA-2014-04-22-2 + APPLE-SA-2014-04-22-3 + APPLE-SA-2014-04-01-1 + + + + + + + + + + + + + + + + + + + + + WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1. + + + + + + + + + + + + APPLE-SA-2014-04-22-2 + APPLE-SA-2014-04-22-3 + APPLE-SA-2014-04-01-1 + + + + + + + + + + + + + + + + + + + + + WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1. + + + + + + + + + + + + APPLE-SA-2014-04-22-2 + APPLE-SA-2014-04-22-3 + APPLE-SA-2014-04-01-1 + + + + + + + + + + + + + + + + + + + + + WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1. + + + + + + + + + + + + APPLE-SA-2014-04-22-2 + APPLE-SA-2014-04-22-3 + APPLE-SA-2014-04-01-1 + + + + + + + + + + + + + + + + + + + + + WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1. + + + + + + + + + + + + APPLE-SA-2014-04-22-2 + APPLE-SA-2014-04-22-3 + APPLE-SA-2014-04-01-1 + + + + + + + + + + + + + + + + + + + + + WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1. + + + + + + + + + + + + APPLE-SA-2014-04-22-2 + APPLE-SA-2014-04-22-3 + APPLE-SA-2014-04-01-1 + + + + + + + + + + + + + + + + + + + + + WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1. + + + + + + + + + + + + APPLE-SA-2014-04-22-2 + APPLE-SA-2014-04-22-3 + APPLE-SA-2014-04-01-1 + + + + + + + + + + + + + + + + + + + + + WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1. + + + + + + + + + + + + APPLE-SA-2014-04-22-2 + APPLE-SA-2014-04-22-3 + APPLE-SA-2014-04-01-1 + + + + + + + + + + + + + + + + + + + + + WindowServer in Apple OS X through 10.9.2 does not prevent session creation by a sandboxed application, which allows attackers to bypass the sandbox protection mechanism and execute arbitrary code via a crafted application. + + + + + + + + + + + APPLE-SA-2014-04-22-1 + + + + + + + + + + + + + + + + + + Format string vulnerability in CoreServicesUIAgent in Apple OS X 10.9.x through 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a URL. + + + + + + + + + + + + APPLE-SA-2014-04-22-1 + + + + + + + + + + + + Heimdal, as used in Apple OS X through 10.9.2, allows remote attackers to cause a denial of service (abort and daemon exit) via ASN.1 data encountered in the Kerberos 5 protocol. + + + + + + + + + APPLE-SA-2014-04-22-1 + + + + + + + + + + + + The Intel Graphics Driver in Apple OS X through 10.9.2 does not properly validate a certain pointer, which allows attackers to execute arbitrary code via a crafted application. + + + + + + + + + + + APPLE-SA-2014-04-22-1 + + + + + + + + + + + + + + + + + + Buffer overflow in ImageIO in Apple OS X 10.9.x through 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JPEG image. + + + + + + + + + + + + APPLE-SA-2014-04-22-1 + + + + + + + + + + + + IOKit in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 places kernel pointers into an object data structure, which makes it easier for local users to bypass the ASLR protection mechanism by reading unspecified attributes of the object. + + + + + + + + + APPLE-SA-2014-04-22-2 + APPLE-SA-2014-04-22-3 + APPLE-SA-2014-04-22-1 + + + + + + + + + + + + + + + + + + + + + + + + + + + + Power Management in Apple OS X 10.9.x through 10.9.2 allows physically proximate attackers to bypass an intended transition into the locked-screen state by touching (1) a key or (2) the trackpad during a lid-close action. + + + + + + + + + + APPLE-SA-2014-04-22-1 + + + + + + + + + + + + The kernel in Apple OS X through 10.9.2 places a kernel pointer into an XNU object data structure accessible from user space, which makes it easier for local users to bypass the ASLR protection mechanism by reading an unspecified attribute of the object. + + + + + + + + + APPLE-SA-2014-04-22-1 + + + + + + + + + + + + Multiple SQL injection vulnerabilities in AuraCMS 2.3 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) search parameter to mod/content/content.php or (2) CLIENT_IP, (3) X_FORWARDED_FOR, (4) X_FORWARDED, (5) FORWARDED_FOR, or (6) FORWARDED HTTP header to index.php. + + + + + + + + + + + https://www.htbridge.com/advisory/HTB23196 + https://github.com/auracms/AuraCMS/commit/790f66ffbc4f23a6e13636fc79d0aa1a7d81e747 + https://github.com/auracms/AuraCMS/commit/4fe9d0d31a32df392f4d6ced8e5c25ed4af19ade + auracms-cve20141401-sql-injection(90965) + 20140205 Multiple SQL Injection Vulnerabilities in AuraCMS + 31520 + 56804 + http://packetstormsecurity.com/files/125079 + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in name.html in easyXDM before 2.4.19 allows remote attackers to inject arbitrary web script or HTML via the location.hash value. + + + + + + + + + + https://github.com/oyvindkinsey/easyXDM/releases/tag/2.4.19 + https://github.com/oyvindkinsey/easyXDM/commit/a3194d32c25a0d27a10a47304eb9c9be93ffbf13#diff-6489956f1e1f52236929b4d33cbeb2db + easyxdm-cve20141403-xss(90876) + 65291 + 56634 + 20140131 [CVE-2014-1403] DOM XSS in EasyXDM 2.4.18 + 102803 + http://blog.kotowicz.net/2014/01/xssing-with-shakespeare-name-calling.html + + + + + + + + + + + + + + + + + + + Multiple open redirect vulnerabilities on the Conceptronic C54APM access point with runtime code 1.26 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via (1) the submit-url parameter in a Refresh action to goform/formWlSiteSurvey or (2) the wlan-url parameter to goform/formWlanSetup. + + + + + + + + + + http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf + + + + + + + + + + CRLF injection vulnerability in goform/formWlSiteSurvey on the Conceptronic C54APM access point with runtime code 1.26 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the submit-url parameter in a Refresh action. + + + + + + + + + http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities on the Conceptronic C54APM access point with runtime code 1.26 allow remote attackers to inject arbitrary web script or HTML via (1) the submit-url parameter in a Refresh action to goform/formWlSiteSurvey or (2) the wlan-url parameter to goform/formWlanSetup. + + + + + + + + + + http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf + + + + + + + + + + The Conceptronic C54APM access point with runtime code 1.26 has a default password of admin for the admin account, which makes it easier for remote attackers to obtain access via an HTTP request, as demonstrated by stored XSS attacks. + + + + + + + + + http://download.conceptronic.net/manuals/C04-058_C54APM_v2.0_Quick_Guide_ML.pdf + http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf + + + + + + + + + + The restore_fpu_checking function in arch/x86/include/asm/fpu-internal.h in the Linux kernel before 3.12.8 on the AMD K7 and K8 platforms does not clear pending exceptions before proceeding to an EMMS instruction, which allows local users to cause a denial of service (task kill) or possibly gain privileges via a crafted application. + + + + + + + + + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=26bef1318adc1b3a530ecc807ef99346db2aa8b0 + [linux-kernel] 20140110 Re: Sanitize CPU-state when switching tasks (was sanitize CPU-state when switching from virtual-8086 mode to other task) + https://github.com/torvalds/linux/commit/26bef1318adc1b3a530ecc807ef99346db2aa8b0 + https://bugzilla.redhat.com/show_bug.cgi?id=1052914 + USN-2141-1 + USN-2139-1 + USN-2138-1 + USN-2136-1 + USN-2135-1 + USN-2134-1 + USN-2133-1 + USN-2117-1 + USN-2113-1 + 1029592 + 64781 + [oss-security] 20140114 Re: Linux kernel: missing CPU-state sanitation during task-switch causes DOS / privilege escalation + MDVSA-2014:038 + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.8 + http://www.halfdog.net/Security/2013/Vm86SyscallTaskSwitchKernelPanic/ + FEDORA-2014-1062 + FEDORA-2014-1072 + + + + + + + + + + + + + + + + + The libxml_disable_entity_loader function in runtime/ext/ext_simplexml.cpp in HipHop Virtual Machine for PHP (HHVM) before 2.4.0 and 2.3.x before 2.3.3 does not properly disable a certain libxml handler, which allows remote attackers to conduct XML External Entity (XXE) attacks. + CWE-611: Improper Restriction of XML External Entity Reference ('XXE') + + + + + + + + + https://github.com/facebook/hhvm/commit/95f96e7287effe2fcdfb9a5338d1a7e4f55b083b + hhvm-cve20141439-info-disc(90979) + http://www.hhvm.com/blog/3287/hhvm-2-4-0 + + + + + + + + + + + + + + + + + Core FTP Server 1.2 before build 515 allows remote attackers to cause a denial of service (reachable assertion and crash) via an AUTH SSL command with malformed data, as demonstrated by pressing the enter key twice. + + + + + + + + + 102966 + 56850 + 20140205 Core FTP Server Vulnerabilities + http://packetstormsecurity.com/files/125073/Core-FTP-Server-1.2-DoS-Traversal-Disclosure.html + http://coreftp.com/forums/viewtopic.php?t=2985707 + + + + + + + + + + Directory traversal vulnerability in Core FTP Server 1.2 before build 515 allows remote authenticated users to determine the existence of arbitrary files via a /../ sequence in an XCRC command. + + + + + + + + + 102967 + 56850 + 20140205 Core FTP Server Vulnerabilities + http://packetstormsecurity.com/files/125073/Core-FTP-Server-1.2-DoS-Traversal-Disclosure.html + http://coreftp.com/forums/viewtopic.php?t=2985707 + + + + + + + + + + Core FTP Server 1.2 before build 515 allows remote authenticated users to obtain sensitive information (password for the previous user) via a USER command with a specific length, possibly related to an out-of-bounds read. + + + + + + + + + 102968 + 56850 + 20140205 Core FTP Server Vulnerabilities + http://packetstormsecurity.com/files/125073/Core-FTP-Server-1.2-DoS-Traversal-Disclosure.html + http://coreftp.com/forums/viewtopic.php?t=2985707 + + + + + + + + + + The fst_get_iface function in drivers/net/wan/farsync.c in the Linux kernel before 3.11.7 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability for an SIOCWANDEV ioctl call. + + + + + + + + + https://github.com/torvalds/linux/commit/96b340406724d87e4621284ebac5e059d67b2194 + [oss-security] 20140115 Re: CVE request: assorted kernel infoleak security fixes + https://bugzilla.redhat.com/show_bug.cgi?id=1053610 + linux-kernel-cve20141444-info-disc(90443) + USN-2129-1 + USN-2128-1 + 64952 + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.11.7 + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=96b340406724d87e4621284ebac5e059d67b2194 + + + + + + + + + + + + + + + + The wanxl_ioctl function in drivers/net/wan/wanxl.c in the Linux kernel before 3.11.7 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via an ioctl call. + + + + + + + + + https://github.com/torvalds/linux/commit/2b13d06c9584b4eb773f1e80bbaedab9a1c344e1 + [oss-security] 20140115 Re: CVE request: assorted kernel infoleak security fixes + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2b13d06c9584b4eb773f1e80bbaedab9a1c344e1 + https://bugzilla.redhat.com/show_bug.cgi?id=1053613 + linux-kernel-cve20141445-info-disc(90444) + USN-2129-1 + USN-2128-1 + 64953 + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.11.7 + + + + + + + + + + + + + + + + The yam_ioctl function in drivers/net/hamradio/yam.c in the Linux kernel before 3.12.8 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability for an SIOCYAMGCFG ioctl call. + + + + + + + + + https://github.com/torvalds/linux/commit/8e3fbf870481eb53b2d3a322d1fc395ad8b367ed + https://bugzilla.redhat.com/show_bug.cgi?id=1053620 + linux-kernel-cve20141446-info-disc(90445) + USN-2141-1 + USN-2139-1 + USN-2138-1 + USN-2136-1 + USN-2135-1 + USN-2134-1 + USN-2133-1 + USN-2129-1 + USN-2128-1 + USN-2117-1 + USN-2113-1 + 64954 + [oss-security] 20140115 Re: CVE request: assorted kernel infoleak security fixes + MDVSA-2014:038 + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.8 + FEDORA-2014-1062 + FEDORA-2014-1072 + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8e3fbf870481eb53b2d3a322d1fc395ad8b367ed + + + + + + + + + + + + + + + + + Race condition in the virNetServerClientStartKeepAlive function in libvirt before 1.2.1 allows remote attackers to cause a denial of service (libvirtd crash) by closing a connection before a keepalive response is sent. + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1047577 + USN-2093-1 + 1029695 + DSA-2846 + 56446 + 56321 + RHSA-2014:0103 + openSUSE-SU-2014:0270 + openSUSE-SU-2014:0268 + http://libvirt.org/news.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-1447. Reason: This candidate is a reservation duplicate of CVE-2014-1447. Only one candidate was needed for the disclosure in question. Notes: All CVE users should reference CVE-2014-1447 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. + + + + + + Stack-based buffer overflow in lib/snmpagent.c in bsnmpd, as used in FreeBSD 8.3 through 10.0, allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a crafted GETBULK PDU request. + + + + + + + + + + + http://svnweb.freebsd.org/base?view=revision&amp;revision=260636 + 1029616 + FreeBSD-SA-14:01 + 56496 + + + + + + + + + + + + + + + + + + The NFS server (nfsserver) in FreeBSD 8.3 through 10.0 does not acquire locks in the proper order when converting a directory file handle to a vnode, which allows remote authenticated users to cause a denial of service (deadlock) via vectors involving a thread that uses the correct locking order. + + + + + + + + + 1030041 + 66726 + FreeBSD-SA-14:05 + 57760 + + + + + + + + + + + + + + + + + + + + SQL injection vulnerability in the password reset functionality in Pearson eSIS Enterprise Student Information System, possibly 3.3.0.13 and earlier, allows remote attackers to execute arbitrary SQL commands via the new password. + + + + + + + + + + + 20140406 Pearson eSIS Enterprise Student Information System SQL Injection + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the login page in Open Web Analytics (OWA) before 1.5.6 allows remote attackers to inject arbitrary web script or HTML via the owa_user_id parameter to index.php. + + + + + + + + + + owa-cve20141456-xss(91124) + http://www.secureworks.com/cyber-threat-intelligence/advisories/SWRX-2014-004 + http://www.openwebanalytics.com/?p=384 + 56885 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the web administration interface in FortiGuard FortiWeb 5.0.3 and earlier allows remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + fortiweb-cve20141458-xss(90978) + http://www.fortiguard.com/advisory/FG-IR-14-001/ + + + + + + + + + + SQL injection vulnerability in dg-admin/index.php in doorGets CMS 5.2 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the _position_down_id parameter. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands. + + + + + + + + + + + https://www.htbridge.com/advisory/HTB23197 + https://github.com/doorgets/doorGets/commit/6b81541fc1e5dd1c70614585c1a04d04ccdb3b19 + doorgets-cve20141459-sql-injection(90967) + 65439 + 20140205 SQL Injection in doorGets CMS + 31521 + http://packetstormsecurity.com/files/125078 + + + + + + + + + + + + SQL injection vulnerability in CSP MySQL User Manager 2.3 allows remote attackers to execute arbitrary SQL commands via the login field of the login page. + + + + + + + + + + + cpsmysql-login-sql-injection(90210) + 64731 + 56348 + http://packetstormsecurity.com/files/124724/cspmysql-sql.txt + 101867 + + + + + + + + + + BlackBerry Enterprise Service 10 before 10.2.1, Universal Device Service 6, Enterprise Server Express for Domino through 5.0.4, Enterprise Server Express for Exchange through 5.0.4, Enterprise Server for Domino through 5.0.4 MR6, Enterprise Server for Exchange through 5.0.4 MR6, and Enterprise Server for GroupWise through 5.0.4 MR6 log cleartext credentials during exception handling, which might allow context-dependent attackers to obtain sensitive information by reading a log file. + + + + + + + + + http://www.blackberry.com/btsc/KB35647 + + + + + + + + + + + + + + + + + + + + + + + + + SQL injection vulnerability in the StateGetStatesByType function in Kernel/System/State.pm in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allows remote attackers to execute arbitrary SQL commands via vectors related to a ticket search URL. + + + + + + + + + + + https://www.otrs.com/security-advisory-2014-02-sql-injection-issue + https://github.com/OTRS/otrs/commit/c4ec9205bde9c49770ddad94c1a980c006164949 + https://github.com/OTRS/otrs/commit/2997b36a7c84e933c4b025930cabe93efc4d261d + https://github.com/OTRS/otrs/commit/0680603a07b8dc37c2ddca6ff14e0236babefc82 + https://www.otrs.com/release-notes-otrs-help-desk-3-3-4 + [oss-security] 20140129 Re: CVE Request: otrs: CSRF issue in customer web interface + DSA-2867 + 56655 + 56644 + 102661 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in the Enterprise Manager in McAfee Vulnerability Manager (MVM) 7.5.5 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + https://kc.mcafee.com/corporate/index?page=content&id=SB10061 + mcafee-vm-unspec-xss(90244) + 1029591 + 64795 + 56394 + 101940 + + + + + + + + + + + + Multiple cross-site request forgery (CSRF) vulnerabilities in the Enterprise Manager in McAfee Vulnerability Manager (MVM) 7.5.5 and earlier allow remote attackers to hijack the authentication of users for requests that modify HTML via unspecified vectors related to the "response web page." + + + + + + + + + + + + https://kc.mcafee.com/corporate/index?page=content&id=SB10061 + mcafee-vm-unspec-csrf(90245) + 1029591 + 64795 + 56394 + 101939 + + + + + + + + + + + + The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to authenticate as other users via unspecified vectors. + + + + + + + + + + + https://drupal.org/SA-CORE-2014-001 + 64973 + MDVSA-2014:031 + DSA-2851 + DSA-2847 + 56601 + 56260 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The Taxonomy module in Drupal 7.x before 7.26, when upgraded from an earlier version of Drupal, does not properly restrict access to unpublished content, which allows remote authenticated users to obtain sensitive information via a listing page. + + + + + + + + + https://drupal.org/SA-CORE-2014-001 + 64973 + MDVSA-2014:031 + DSA-2847 + 56260 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=953114 + https://bugzilla.mozilla.org/show_bug.cgi?id=951366 + https://bugzilla.mozilla.org/show_bug.cgi?id=950438 + https://bugzilla.mozilla.org/show_bug.cgi?id=950000 + https://bugzilla.mozilla.org/show_bug.cgi?id=945939 + https://bugzilla.mozilla.org/show_bug.cgi?id=945334 + https://bugzilla.mozilla.org/show_bug.cgi?id=937697 + https://bugzilla.mozilla.org/show_bug.cgi?id=937132 + https://bugzilla.mozilla.org/show_bug.cgi?id=936808 + https://bugzilla.mozilla.org/show_bug.cgi?id=925896 + https://bugzilla.mozilla.org/show_bug.cgi?id=921470 + https://8pecxstudios.com/?page_id=44080 + USN-2119-1 + USN-2102-2 + USN-2102-1 + http://www.mozilla.org/security/announce/2014/mfsa2014-01.html + DSA-2858 + 56706 + RHSA-2014:0133 + RHSA-2014:0132 + openSUSE-SU-2014:0419 + SUSE-SU-2014:0248 + openSUSE-SU-2014:0213 + openSUSE-SU-2014:0212 + FEDORA-2014-2083 + FEDORA-2014-2041 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the MPostWriteBarrier class in js/src/jit/MIR.h and stack alignment in js/src/jit/AsmJS.cpp in OdinMonkey, and unknown other vectors. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=953373 + https://bugzilla.mozilla.org/show_bug.cgi?id=950452 + https://bugzilla.mozilla.org/show_bug.cgi?id=946733 + https://bugzilla.mozilla.org/show_bug.cgi?id=945585 + https://bugzilla.mozilla.org/show_bug.cgi?id=944851 + https://bugzilla.mozilla.org/show_bug.cgi?id=944321 + https://bugzilla.mozilla.org/show_bug.cgi?id=944278 + https://bugzilla.mozilla.org/show_bug.cgi?id=942940 + https://bugzilla.mozilla.org/show_bug.cgi?id=942152 + https://bugzilla.mozilla.org/show_bug.cgi?id=939472 + https://bugzilla.mozilla.org/show_bug.cgi?id=938431 + https://bugzilla.mozilla.org/show_bug.cgi?id=932162 + https://bugzilla.mozilla.org/show_bug.cgi?id=925308 + https://bugzilla.mozilla.org/show_bug.cgi?id=924348 + https://bugzilla.mozilla.org/show_bug.cgi?id=922603 + https://bugzilla.mozilla.org/show_bug.cgi?id=916635 + https://bugzilla.mozilla.org/show_bug.cgi?id=911845 + https://bugzilla.mozilla.org/show_bug.cgi?id=911707 + https://bugzilla.mozilla.org/show_bug.cgi?id=867597 + https://8pecxstudios.com/?page_id=44080 + USN-2102-2 + USN-2102-1 + http://www.mozilla.org/security/announce/2014/mfsa2014-01.html + 56706 + openSUSE-SU-2014:0419 + openSUSE-SU-2014:0213 + openSUSE-SU-2014:0212 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The System Only Wrapper (SOW) implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent certain cloning operations, which allows remote attackers to bypass intended restrictions on XUL content via vectors involving XBL content scopes. + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=911864 + https://8pecxstudios.com/?page_id=44080 + USN-2119-1 + USN-2102-2 + USN-2102-1 + http://www.mozilla.org/security/announce/2014/mfsa2014-02.html + DSA-2858 + 56706 + RHSA-2014:0133 + RHSA-2014:0132 + openSUSE-SU-2014:0419 + SUSE-SU-2014:0248 + openSUSE-SU-2014:0213 + openSUSE-SU-2014:0212 + FEDORA-2014-2083 + FEDORA-2014-2041 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The file-download implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 does not properly restrict the timing of button selections, which allows remote attackers to conduct clickjacking attacks, and trigger unintended launching of a downloaded file, via a crafted web site. + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=916726 + USN-2102-2 + USN-2102-1 + http://www.mozilla.org/security/announce/2014/mfsa2014-03.html + openSUSE-SU-2014:0419 + SUSE-SU-2014:0248 + openSUSE-SU-2014:0212 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow remote attackers to bypass intended restrictions on window objects by leveraging inconsistency in native getter methods across different JavaScript engines. + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=936056 + https://8pecxstudios.com/?page_id=44080 + USN-2119-1 + USN-2102-2 + USN-2102-1 + http://www.mozilla.org/security/announce/2014/mfsa2014-13.html + DSA-2858 + 56706 + RHSA-2014:0133 + RHSA-2014:0132 + openSUSE-SU-2014:0419 + SUSE-SU-2014:0248 + openSUSE-SU-2014:0213 + openSUSE-SU-2014:0212 + FEDORA-2014-2083 + FEDORA-2014-2041 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + RasterImage.cpp in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent access to discarded data, which allows remote attackers to execute arbitrary code or cause a denial of service (incorrect write operations) via crafted image data, as demonstrated by Goo Create. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=943803 + https://8pecxstudios.com/?page_id=44080 + USN-2119-1 + USN-2102-2 + USN-2102-1 + http://www.mozilla.org/security/announce/2014/mfsa2014-04.html + DSA-2858 + 56706 + RHSA-2014:0133 + RHSA-2014:0132 + openSUSE-SU-2014:0419 + SUSE-SU-2014:0248 + openSUSE-SU-2014:0213 + openSUSE-SU-2014:0212 + FEDORA-2014-2083 + FEDORA-2014-2041 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allow remote attackers to bypass the Same Origin Policy and obtain sensitive information by using an IFRAME element in conjunction with certain timing measurements involving the document.caretPositionFromPoint and document.elementFromPoint functions. + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=950427 + https://8pecxstudios.com/?page_id=44080 + USN-2102-2 + USN-2102-1 + http://www.mozilla.org/security/announce/2014/mfsa2014-05.html + 56706 + openSUSE-SU-2014:0419 + SUSE-SU-2014:0248 + openSUSE-SU-2014:0212 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Mozilla Firefox before 27.0 on Android 4.2 and earlier creates system-log entries containing profile paths, which allows attackers to obtain sensitive information via a crafted application. + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=953993 + http://www.mozilla.org/security/announce/2014/mfsa2014-06.html + SUSE-SU-2014:0248 + openSUSE-SU-2014:0212 + 20140326 Firefox for Android Profile Directory Derandomization and Data Exfiltration (CVE-2014-1484, CVE-2014-1506, CVE-2014-1515, CVE-2014-1516) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The Content Security Policy (CSP) implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 operates on XSLT stylesheets according to style-src directives instead of script-src directives, which might allow remote attackers to execute arbitrary XSLT code by leveraging insufficient style-src restrictions. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=910139 + https://8pecxstudios.com/?page_id=44080 + USN-2102-2 + USN-2102-1 + http://www.mozilla.org/security/announce/2014/mfsa2014-07.html + 56706 + openSUSE-SU-2014:0419 + SUSE-SU-2014:0248 + openSUSE-SU-2014:0212 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Use-after-free vulnerability in the imgRequestProxy function in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to execute arbitrary code via vectors involving unspecified Content-Type values for image data. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=942164 + https://8pecxstudios.com/?page_id=44080 + USN-2119-1 + USN-2102-2 + USN-2102-1 + http://www.mozilla.org/security/announce/2014/mfsa2014-08.html + DSA-2858 + 56706 + RHSA-2014:0133 + RHSA-2014:0132 + openSUSE-SU-2014:0419 + SUSE-SU-2014:0248 + openSUSE-SU-2014:0213 + openSUSE-SU-2014:0212 + FEDORA-2014-2083 + FEDORA-2014-2041 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The Web workers implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to bypass the Same Origin Policy and obtain sensitive authentication information via vectors involving error messages. + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=947592 + https://8pecxstudios.com/?page_id=44080 + USN-2119-1 + USN-2102-2 + USN-2102-1 + http://www.mozilla.org/security/announce/2014/mfsa2014-09.html + DSA-2858 + 56706 + RHSA-2014:0133 + RHSA-2014:0132 + openSUSE-SU-2014:0419 + SUSE-SU-2014:0248 + openSUSE-SU-2014:0213 + openSUSE-SU-2014:0212 + FEDORA-2014-2083 + FEDORA-2014-2041 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The Web workers implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allows remote attackers to execute arbitrary code via vectors involving termination of a worker process that has performed a cross-thread object-passing operation in conjunction with use of asm.js. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=950604 + https://8pecxstudios.com/?page_id=44080 + USN-2102-2 + USN-2102-1 + http://www.mozilla.org/security/announce/2014/mfsa2014-11.html + 56706 + openSUSE-SU-2014:0419 + SUSE-SU-2014:0248 + openSUSE-SU-2014:0212 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Mozilla Firefox before 27.0 does not properly restrict access to about:home buttons by script on other pages, which allows user-assisted remote attackers to cause a denial of service (session restore) via a crafted web site. + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=959531 + USN-2102-2 + USN-2102-1 + http://www.mozilla.org/security/announce/2014/mfsa2014-10.html + SUSE-SU-2014:0248 + openSUSE-SU-2014:0212 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors involving a resumption handshake that triggers incorrect replacement of a session ticket. + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=930874 + https://bugzilla.mozilla.org/show_bug.cgi?id=930857 + https://8pecxstudios.com/?page_id=44080 + USN-2119-1 + USN-2102-2 + USN-2102-1 + http://www.mozilla.org/security/announce/2014/mfsa2014-12.html + DSA-2858 + 56706 + openSUSE-SU-2014:0419 + SUSE-SU-2014:0248 + openSUSE-SU-2014:0213 + openSUSE-SU-2014:0212 + FEDORA-2014-2083 + FEDORA-2014-2041 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, does not properly restrict public values in Diffie-Hellman key exchanges, which makes it easier for remote attackers to bypass cryptographic protection mechanisms in ticket handling by leveraging use of a certain value. + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=934545 + USN-2119-1 + USN-2102-2 + USN-2102-1 + http://www.mozilla.org/security/announce/2014/mfsa2014-12.html + DSA-2858 + openSUSE-SU-2014:0419 + SUSE-SU-2014:0248 + openSUSE-SU-2014:0213 + openSUSE-SU-2014:0212 + FEDORA-2014-2083 + FEDORA-2014-2041 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate. + + + + + + + + + https://hg.mozilla.org/projects/nss/rev/709d4e597979 + https://developer.mozilla.org/en-US/docs/NSS/NSS_3.16_release_notes + https://bugzilla.redhat.com/show_bug.cgi?id=1079851 + https://bugzilla.mozilla.org/show_bug.cgi?id=903885 + USN-2159-1 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=977538 + https://bugzilla.mozilla.org/show_bug.cgi?id=967341 + https://bugzilla.mozilla.org/show_bug.cgi?id=965982 + https://bugzilla.mozilla.org/show_bug.cgi?id=963974 + https://bugzilla.mozilla.org/show_bug.cgi?id=960145 + https://bugzilla.mozilla.org/show_bug.cgi?id=958867 + https://bugzilla.mozilla.org/show_bug.cgi?id=896268 + USN-2151-1 + http://www.mozilla.org/security/announce/2014/mfsa2014-15.html + DSA-2881 + RHSA-2014:0316 + RHSA-2014:0310 + openSUSE-SU-2014:0448 + openSUSE-SU-2014:0419 + SUSE-SU-2014:0418 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. + + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=964462 + https://bugzilla.mozilla.org/show_bug.cgi?id=949843 + https://bugzilla.mozilla.org/show_bug.cgi?id=938626 + https://bugzilla.mozilla.org/show_bug.cgi?id=938615 + https://bugzilla.mozilla.org/show_bug.cgi?id=933219 + https://bugzilla.mozilla.org/show_bug.cgi?id=932496 + https://bugzilla.mozilla.org/show_bug.cgi?id=927579 + https://bugzilla.mozilla.org/show_bug.cgi?id=909586 + https://bugzilla.mozilla.org/show_bug.cgi?id=627295 + http://www.mozilla.org/security/announce/2014/mfsa2014-15.html + openSUSE-SU-2014:0448 + openSUSE-SU-2014:0419 + SUSE-SU-2014:0418 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 might allow local users to gain privileges by modifying the extracted Mar contents during an update. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=925747 + http://www.mozilla.org/security/announce/2014/mfsa2014-16.html + SUSE-SU-2014:0418 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The mozilla::WaveReader::DecodeAudioData function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information from process heap memory, cause a denial of service (out-of-bounds read and application crash), or possibly have unspecified other impact via a crafted WAV file. + + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=966311 + USN-2151-1 + http://www.mozilla.org/security/announce/2014/mfsa2014-17.html + DSA-2881 + RHSA-2014:0316 + RHSA-2014:0310 + openSUSE-SU-2014:0448 + openSUSE-SU-2014:0419 + SUSE-SU-2014:0418 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The crypto.generateCRMFRequest method in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does not properly validate a certain key type, which allows remote attackers to cause a denial of service (application crash) via vectors that trigger generation of a key that supports the Elliptic Curve ec-dual-use algorithm. + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=935618 + http://www.mozilla.org/security/announce/2014/mfsa2014-18.html + openSUSE-SU-2014:0448 + openSUSE-SU-2014:0419 + SUSE-SU-2014:0418 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to spoof the domain name in the WebRTC (1) camera or (2) microphone permission prompt by triggering navigation at a certain time during generation of this prompt. + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=961512 + http://www.mozilla.org/security/announce/2014/mfsa2014-19.html + openSUSE-SU-2014:0448 + openSUSE-SU-2014:0419 + SUSE-SU-2014:0418 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to cause a denial of service (resource consumption and application hang) via onbeforeunload events that trigger background JavaScript execution. + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=956524 + http://www.mozilla.org/security/announce/2014/mfsa2014-20.html + openSUSE-SU-2014:0448 + openSUSE-SU-2014:0419 + SUSE-SU-2014:0418 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Mozilla Firefox before 28.0 on Android allows remote attackers to bypass the Same Origin Policy and access arbitrary file: URLs via vectors involving the "Open Link in New Tab" menu selection. + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=960135 + http://www.mozilla.org/security/announce/2014/mfsa2014-21.html + SUSE-SU-2014:0418 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The (1) WebGL.compressedTexImage2D and (2) WebGL.compressedTexSubImage2D functions in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to bypass the Same Origin Policy and render content in a different domain via unspecified vectors. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=972622 + http://www.mozilla.org/security/announce/2014/mfsa2014-22.html + openSUSE-SU-2014:0448 + openSUSE-SU-2014:0419 + SUSE-SU-2014:0418 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The session-restore feature in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does not consider the Content Security Policy of a data: URL, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted document that is accessed after a browser restart. + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=911547 + http://www.mozilla.org/security/announce/2014/mfsa2014-23.html + openSUSE-SU-2014:0448 + openSUSE-SU-2014:0419 + SUSE-SU-2014:0418 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The SVG filter implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive displacement-correlation information, and possibly bypass the Same Origin Policy and read text from a different domain, via a timing attack involving feDisplacementMap elements, a related issue to CVE-2013-1693. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=941887 + USN-2151-1 + http://www.mozilla.org/security/announce/2014/mfsa2014-28.html + DSA-2881 + RHSA-2014:0316 + RHSA-2014:0310 + openSUSE-SU-2014:0448 + openSUSE-SU-2014:0419 + SUSE-SU-2014:0418 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Directory traversal vulnerability in Android Crash Reporter in Mozilla Firefox before 28.0 on Android allows attackers to trigger the transmission of local files to arbitrary servers, or cause a denial of service (application crash), via a crafted application that specifies Android Crash Reporter arguments. + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=944374 + http://www.mozilla.org/security/announce/2014/mfsa2014-24.html + 20140326 Firefox for Android Profile Directory Derandomization and Data Exfiltration (CVE-2014-1484, CVE-2014-1506, CVE-2014-1515, CVE-2014-1516) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Directory traversal vulnerability in the DeviceStorage API in Mozilla FirefoxOS before 1.2.2 allows attackers to bypass the media sandbox protection mechanism, and read or modify arbitrary files, via a crafted application that uses a relative pathname for a DeviceStorageFile object. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=940684 + http://www.mozilla.org/security/announce/2014/mfsa2014-25.html + + + + + + + + + + The libxul.so!gfxContext::Polygon function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information from process memory, cause a denial of service (out-of-bounds read and application crash), or possibly bypass the Same Origin Policy via vectors involving MathML polygon rendering. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=963198 + USN-2151-1 + http://www.mozilla.org/security/announce/2014/mfsa2014-26.html + DSA-2881 + RHSA-2014:0316 + RHSA-2014:0310 + openSUSE-SU-2014:0448 + openSUSE-SU-2014:0419 + SUSE-SU-2014:0418 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Buffer overflow in the _cairo_truetype_index_to_ucs4 function in cairo, as used in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25, allows remote attackers to execute arbitrary code via a crafted extension that renders fonts in a PDF document. + + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=966021 + USN-2151-1 + http://www.mozilla.org/security/announce/2014/mfsa2014-27.html + RHSA-2014:0316 + RHSA-2014:0310 + openSUSE-SU-2014:0448 + openSUSE-SU-2014:0419 + SUSE-SU-2014:0418 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary JavaScript code with chrome privileges by using an IDL fragment to trigger a window.open call. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=982906 + USN-2151-1 + http://www.mozilla.org/security/announce/2014/mfsa2014-29.html + DSA-2881 + RHSA-2014:0316 + RHSA-2014:0310 + openSUSE-SU-2014:0448 + openSUSE-SU-2014:0419 + SUSE-SU-2014:0418 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to bypass the popup blocker via unspecified vectors. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=982909 + USN-2151-1 + http://www.mozilla.org/security/announce/2014/mfsa2014-29.html + DSA-2881 + RHSA-2014:0316 + RHSA-2014:0310 + openSUSE-SU-2014:0448 + openSUSE-SU-2014:0419 + SUSE-SU-2014:0418 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Use-after-free vulnerability in the TypeObject class in the JavaScript engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary code by triggering extensive memory consumption while garbage collection is occurring, as demonstrated by improper handling of BumpChunk objects. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=982957 + USN-2151-1 + http://www.mozilla.org/security/announce/2014/mfsa2014-30.html + DSA-2881 + RHSA-2014:0316 + RHSA-2014:0310 + openSUSE-SU-2014:0448 + openSUSE-SU-2014:0419 + SUSE-SU-2014:0418 + 20140326 VUPEN Security Research - Mozilla Firefox "BumpChunk" Object Processing Use-after-free (Pwn2Own) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + TypedArrayObject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not prevent a zero-length transition during use of an ArrayBuffer object, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based out-of-bounds write or read) via a crafted web site. + + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=982974 + USN-2151-1 + http://www.mozilla.org/security/announce/2014/mfsa2014-31.html + DSA-2881 + RHSA-2014:0316 + RHSA-2014:0310 + openSUSE-SU-2014:0448 + openSUSE-SU-2014:0419 + SUSE-SU-2014:0418 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + vmtypedarrayobject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not validate the length of the destination array before a copy operation, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) by triggering incorrect use of the TypedArrayObject class. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=983344 + USN-2151-1 + http://www.mozilla.org/security/announce/2014/mfsa2014-32.html + DSA-2881 + RHSA-2014:0316 + RHSA-2014:0310 + openSUSE-SU-2014:0448 + openSUSE-SU-2014:0419 + SUSE-SU-2014:0418 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Mozilla Firefox before 28.0.1 on Android processes a file: URL by copying a local file onto the SD card, which allows attackers to obtain sensitive information from the Firefox profile directory via a crafted application. + + + + + + + + + https://www.mozilla.org/security/announce/2014/mfsa2014-33.html + https://bugzilla.mozilla.org/show_bug.cgi?id=945429 + 20140326 Firefox for Android Profile Directory Derandomization and Data Exfiltration (CVE-2014-1484, CVE-2014-1506, CVE-2014-1515, CVE-2014-1516) + + + + + + + + + + The saltProfileName function in base/GeckoProfileDirectories.java in Mozilla Firefox through 28.0.1 on Android relies on Android's weak approach to seeding the Math.random function, which makes it easier for attackers to bypass a profile-randomization protection mechanism via a crafted application. + + + + + + + + + http://www.slideshare.net/ibmsecurity/overtaking-firefox-profiles-vulnerabilities-in-firefox-for-android + http://securityintelligence.com/vulnerabilities-firefox-android-overtaking-firefox-profiles/ + 20140326 Firefox for Android Profile Directory Derandomization and Data Exfiltration (CVE-2014-1484, CVE-2014-1506, CVE-2014-1515, CVE-2014-1516) + + + + + + + + + + The login form in Bugzilla 2.x, 3.x, 4.x before 4.4.3, and 4.5.x before 4.5.3 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account and then submit a vulnerability report, related to a "login CSRF" issue. + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=713926 + http://git.mozilla.org/?p=bugzilla/bugzilla.git;a=commit;h=0e390970ba51b14a5dc780be7c6f0d6d7baa67e3 + http://www.bugzilla.org/security/4.0.11/ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=993546 + https://bugzilla.mozilla.org/show_bug.cgi?id=992968 + https://bugzilla.mozilla.org/show_bug.cgi?id=991471 + https://bugzilla.mozilla.org/show_bug.cgi?id=986843 + https://bugzilla.mozilla.org/show_bug.cgi?id=986678 + https://bugzilla.mozilla.org/show_bug.cgi?id=980537 + https://bugzilla.mozilla.org/show_bug.cgi?id=966630 + https://bugzilla.mozilla.org/show_bug.cgi?id=952022 + https://bugzilla.mozilla.org/show_bug.cgi?id=944353 + http://www.mozilla.org/security/announce/2014/mfsa2014-34.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=996883 + https://bugzilla.mozilla.org/show_bug.cgi?id=995607 + https://bugzilla.mozilla.org/show_bug.cgi?id=990794 + https://bugzilla.mozilla.org/show_bug.cgi?id=986864 + https://bugzilla.mozilla.org/show_bug.cgi?id=977955 + https://bugzilla.mozilla.org/show_bug.cgi?id=953104 + https://bugzilla.mozilla.org/show_bug.cgi?id=946658 + https://bugzilla.mozilla.org/show_bug.cgi?id=919592 + http://www.mozilla.org/security/announce/2014/mfsa2014-34.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + maintenservice_installer.exe in the Maintenance Service Installer in Mozilla Firefox before 29.0 and Firefox ESR 24.x before 24.5 on Windows allows local users to gain privileges by placing a Trojan horse DLL file into a temporary directory at an unspecified point in the update process. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=961676 + http://www.mozilla.org/security/announce/2014/mfsa2014-35.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The mozilla::dom::OscillatorNodeEngine::ComputeCustom function in the Web Audio subsystem in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read, memory corruption, and application crash) via crafted content. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=995289 + http://www.mozilla.org/security/announce/2014/mfsa2014-36.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Heap-based buffer overflow in the read_u32 function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG image. + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=969226 + http://www.mozilla.org/security/announce/2014/mfsa2014-37.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The nsXBLProtoImpl::InstallImplementation function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 does not properly check whether objects are XBL objects, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted JavaScript code that accesses a non-XBL object as if it were an XBL object. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=989183 + http://www.mozilla.org/security/announce/2014/mfsa2014-38.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The mozilla::dom::TextTrack::AddCue function in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 does not properly perform garbage collection for Text Track Manager variables, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and heap memory corruption) via a crafted VIDEO element in an HTML document. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=989210 + http://www.mozilla.org/security/announce/2014/mfsa2014-39.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The XrayWrapper implementation in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allows user-assisted remote attackers to bypass intended access restrictions via a crafted web site that is visited in the debugger, leading to unwrapping operations and calls to DOM methods on the unwrapped objects. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=988106 + http://www.mozilla.org/security/announce/2014/mfsa2014-47.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Mozilla Firefox before 29.0 on Android allows remote attackers to spoof the address bar via crafted JavaScript code that uses DOM events to prevent the reemergence of the actual address bar after scrolling has taken it off of the screen. + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=960146 + http://www.mozilla.org/security/announce/2014/mfsa2014-40.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The sse2_composite_src_x888_8888 function in Pixman, as used in Cairo in Mozilla Firefox 28.0 and SeaMonkey 2.25 on Windows, allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) by painting on a CANVAS element. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=963962 + http://www.mozilla.org/security/announce/2014/mfsa2014-41.html + + + + + + + + + + + + + The Web Notification API in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to bypass intended source-component restrictions and execute arbitrary JavaScript code in a privileged context via a crafted web page for which Notification.permission is granted. + + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=987003 + http://www.mozilla.org/security/announce/2014/mfsa2014-42.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The docshell implementation in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to trigger the loading of a URL with a spoofed baseURI property, and conduct cross-site scripting (XSS) attacks, via a crafted web site that performs history navigation. + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=895557 + http://www.mozilla.org/security/announce/2014/mfsa2014-43.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Use-after-free vulnerability in the nsGenericHTMLElement::GetWidthHeightForImage function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving an imgLoader object that is not properly handled during an image-resize operation. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=987140 + http://www.mozilla.org/security/announce/2014/mfsa2014-44.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Use-after-free vulnerability in the nsHostResolver::ConditionallyRefreshRecord function in libxul.so in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors related to host resolution. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=966006 + http://www.mozilla.org/security/announce/2014/mfsa2014-46.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + SQL injection vulnerability in the CMDB web application in synetics i-doit pro before 1.2.5 and i-doit open allows remote attackers to execute arbitrary SQL commands via the objID parameter to the default URI. + + + + + + + + + + + idoit-cve20141597-sql-injection(91269) + 65557 + http://www.i-doit.com/en/company/news/single-news/?tx_ttnews%5Btt_news%5D=141 + http://www.csnc.ch/misc/files/advisories/CVE-2014-1597_i-doit_SQL_Injection.txt + 56931 + 20140217 SQL Injection i-doit Pro (CVE-2014-1597) + + + + + + + + + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in the SFR Box router with firmware NB6-MAIN-R3.3.4 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) dns, (2) dhcp, (3) nat, (4) route, or (5) lan in network/; or (6) wifi/config. + + + + + + + + + + 20140305 CVE-2014-1599 - 39 Type-1 XSS in SFR DSL/Fiber Box + + + + + + + + + + + + + The parser cache functionality in parsergenerator.py in RPLY (aka python-rply) before 0.7.1 allows local users to spoof cache data by pre-creating a temporary rply-*.json file with a predictable name. + + + + + + + + + https://github.com/alex/rply/commit/fc9bbcd25b0b4f09bbd6339f710ad24c129d5d7c + rply-cve20141604-insecure-permissions(90593) + 102202 + [oss-security] 20140117 Re: Fwd: [Python-modules-team] Bug#735263: python-rply: insecure use of /tmp + [oss-security] 20140114 Fwd: [Python-modules-team] Bug#735263: python-rply: insecure use of /tmp + 56429 + http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=735263 + + + + + + + + + + ** DISPUTED ** Cross-site scripting (XSS) vulnerability in the EventCalendar module for Drupal 7.14 allows remote attackers to inject arbitrary web script or HTML via the year parameter to eventcalander/. NOTE: this issue has been disputed by the Drupal Security Team; it may be site-specific. If so, then this CVE will be REJECTed in the future. + + + + + + + + + + https://groups.drupal.org/node/402023 + 20140123 [CVE-2014-1607.] Cross Site Scripting(XSS) in Drupal Event calendar module + + + + + + + + + + SQL injection vulnerability in the mci_file_get function in api/soap/mc_file_api.php in MantisBT before 1.2.16 allows remote attackers to execute arbitrary SQL commands via a crafted envelope tag in a mc_issue_attachment_get SOAP request. + + + + + + + + + + + http://www.ocert.org/advisories/ocert-2014-001.html + https://github.com/mantisbt/mantisbt/commit/00b4c17088fa56594d85fe46b6c6057bb3421102 + https://bugzilla.redhat.com/show_bug.cgi?id=1063111 + 65445 + http://www.mantisbt.org/bugs/view.php?id=16879 + + + + + + + + + + + + + + + + + + + + + + + + + + + + Multiple SQL injection vulnerabilities in MantisBT before 1.2.16 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to the (1) mc_project_get_attachments function in api/soap/mc_project_api.php; the (2) news_get_limited_rows function in core/news_api.php; the (3) summary_print_by_enum, (4) summary_print_by_age, (5) summary_print_by_developer, (6) summary_print_by_reporter, or (7) summary_print_by_category function in core/summary_api.php; the (8) create_bug_enum_summary or (9) enum_bug_group function in plugins/MantisGraph/core/graph_api.php; (10) bug_graph_bycategory.php or (11) bug_graph_bystatus.php in plugins/MantisGraph/pages/; or (12) proj_doc_page.php, related to use of the db_query function, a different vulnerability than CVE-2014-1608. + + + + + + + + + + + http://www.ocert.org/advisories/ocert-2014-001.html + https://github.com/mantisbt/mantisbt/commit/7efe0175f0853e18ebfacedfd2374c4179028b3f + https://bugzilla.redhat.com/show_bug.cgi?id=1063111 + 65461 + http://www.mantisbt.org/bugs/view.php?id=16880 + + + + + + + + + + + + + + + + + + + + + + + + + + + + MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5 and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php. + + + + + + + + + + + https://gerrit.wikimedia.org/r/#/c/110215/ + https://gerrit.wikimedia.org/r/#/c/110069/2/includes/media/Bitmap.php + https://gerrit.wikimedia.org/r/#/c/110069/ + https://bugzilla.wikimedia.org/show_bug.cgi?id=60339 + https://bugzilla.wikimedia.org/attachment.cgi?id=14384&action=diff + https://bugzilla.wikimedia.org/attachment.cgi?id=14361&action=diff + 1029707 + 65223 + 102631 + 31329 + DSA-2891 + http://www.checkpoint.com/threatcloud-central/articles/2014-01-28-tc-researchers-discover.html + http://www.checkpoint.com/defense/advisories/public/2014/cpai-26-jan.html + 57472 + 56695 + 102630 + [MediaWiki-announce] 20140128 MediaWiki Security Releases: 1.22.2, 1.21.5 and 1.19.11 + FEDORA-2014-1745 + FEDORA-2014-1802 + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the Anonymous Posting module 7.x-1.2 and 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via the contact name field. + + + + + + + + + + https://drupal.org/node/2173437 + https://drupal.org/node/2173321 + anonymousposting-contactname-xss(90526) + 56476 + 20140115 [Security-news] SA-CONTRIB-2014-002 - Anonymous Posting - Cross Site Scripting (XSS) + http://packetstormsecurity.com/files/124803/Drupal-Anonymous-Posting-7.x-Cross-Site-Scripting.html + 102126 + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in login.esp in the Web Management Interface in Media5 Mediatrix 4402 VoIP Gateway with firmware Dgw 1.1.13.186 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter. + + + + + + + + + + VU#252294 + mediatrixwebmanagement-cve20141612-xss(90656) + 20140123 Reflected cross-site scripting (XSS) vulnerability in Mediatrix Web Management Interface login page + 56638 + http://packetstormsecurity.com/files/124931/Mediatrix-4402-Cross-Site-Scripting.html + 102415 + + + + + + + + + + + + + Multiple cross-site request forgery (CSRF) vulnerabilities in Carbon Black before 4.1.0 allow remote attackers to hijack the authentication of administrators for requests that add new administrative users and have other unspecified action, as demonstrated by a request to api/user. + + + + + + + + + + + + http://www.secureworks.com/advisories/SWRX-2014-007/SWRX-2014-007.pdf + 57645 + + + + + + + + + + + + Multiple SQL injection vulnerabilities in UAEPD Shopping Cart Script allow remote attackers to execute arbitrary SQL commands via the (1) cat_id or (2) p_id parameter to products.php or id parameter to (3) page.php or (4) news.php. + + + + + + + + + + + uaepd-multiple-sql-injection(90214) + 64734 + http://www.iphobos.com/blog/2014/01/04/uaepd-script-multiple-sql-injection-vulnerabilty + 56351 + http://packetstormsecurity.com/files/124723/uaepdshopping-sql.txt + 101900 + 101899 + 101859 + + + + + + + + + + Multiple SQL injection vulnerabilities in Cubic CMS 5.1.1, 5.1.2, and 5.2 allow remote attackers to execute arbitrary SQL commands via the (1) resource_id or (2) version_id parameter to recursos/agent.php or (3) login or (4) pass parameter to login.usuario. + + + + + + + + + + + cubiccms-agent-login-sql-injection(90153) + http://www.cubicfactory.com/es/cubic-cms/changelog/id/260 + http://packetstormsecurity.com/files/124652 + 101721 + 101719 + + + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in add.php in HIOX Guest Book (HGB) 5.0 allow remote attackers to inject arbitrary web script or HTML via the (1) name1, (2) email, or (3) cmt parameter. + + + + + + + + + + hiox-guestbook-add-xss(90156) + http://packetstormsecurity.com/files/124681/Hiox-Guest-Book-5.0-Cross-Site-Scripting.html + 101844 + + + + + + + + + + Race condition in the xdg.BaseDirectory.get_runtime_dir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to an attacker-controlled location once the get_runtime_dir function is called. + + + + + + + + + + pythonxdg-cve20141624-symlink(90618) + 65042 + [oss-security] 20140121 Re: Fwd: [Python-modules-team] Bug#736247: python-xdg: get_runtime_dir(strict=False): insecure use of /tmp + [oss-security] 20140121 Fwd: [Python-modules-team] Bug#736247: python-xdg: get_runtime_dir(strict=False): insecure use of /tmp + http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736247 + + + + + + + + + + XML External Entity (XXE) vulnerability in MARC::File::XML module before 1.0.2 for Perl, as used in Evergreen, Koha, perl4lib, and possibly other products, allows context-dependent attackers to read arbitrary files via a crafted XML file. + + + + + + + + + https://metacpan.org/source/GMCHARLT/MARC-XML-1.0.2/Changes + marcfile-xml-info-disc(90620) + 65057 + http://www.nntp.perl.org/group/perl.perl4lib/2014/01/msg3073.html + 55404 + 102367 + [Koha] 20140122 SECURITY release: MARC::File::XML 1.0.2 + [OPEN-ILS-GENERAL] 20140121 SECURITY release: MARC::File::XML 1.0.2 + + + + + + + + + + + Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to (1) admin_school_names.php, (2) admin_subjects.php, (3) admin_grades.php, (4) admin_terms.php, (5) admin_school_years.php, (6) admin_sgrades.php, (7) admin_media_codes_1.php, (8) admin_infraction_codes.php, (9) admin_generations.php, (10) admin_relations.php, (11) admin_titles.php, or (12) health_allergies.php in sw/. + + + + + + + + + + + commandschool-id-sql-injection(90175) + 64707 + http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html + 101885 + 101884 + 101883 + 101882 + 101881 + 101880 + 101879 + 101878 + 101877 + 101876 + 101875 + 101874 + + + + + + + + + + Command School Student Management System 1.06.01 does not properly restrict access to sw/backup/backup_ray2.php, which allows remote attackers to download a database backup via a direct request. + + + + + + + + + 64707 + http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html + 101888 + + + + + + + + + + (1) debian/postrm and (2) debian/localepurge.config in localepurge before 0.7.3.2 use tempfile to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename. + + + + + + + + + + localepurge-cve20141638-symlink(90669) + 65098 + 102381 + 102379 + [oss-security] 20140122 Re: Getting tempfile/mktemp wrong + [oss-security] 20140122 Getting tempfile/mktemp wrong + http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736359 + + + + + + + + + + syncevo/installcheck-local.sh in syncevolution before 1.3.99.7 uses mktemp to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename. + + + + + + + + + + syncevolution-cve20141639-symlink(90662) + 65098 + 102380 + [oss-security] 20140122 Re: Getting tempfile/mktemp wrong + [oss-security] 20140122 Getting tempfile/mktemp wrong + http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736357 + + + + + + + + + + axiom-test.sh in axiom 20100701-1.1 uses tempfile to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename. + + + + + + + + + + axiom-cve20141640-symlink(90663) + 102383 + [oss-security] 20140122 Re: Getting tempfile/mktemp wrong + [oss-security] 20140122 Getting tempfile/mktemp wrong + http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736358 + + + + + + + + + + The IRQ setup in Xen 4.2.x and 4.3.x, when using device passthrough and configured to support a large number of CPUs, frees certain memory that may still be intended for use, which allows local guest administrators to cause a denial of service (memory corruption and hypervisor crash) and possibly execute arbitrary code via vectors related to an out-of-memory error that triggers a (1) use-after-free or (2) double free. + + + + + + + + + + + xen-irq-cve20141642-code-exec(90649) + http://xenbits.xen.org/xsa/advisory-83.html + 1029679 + 65097 + [oss-security] 20140123 Xen Security Advisory 83 (CVE-2014-1642) - Out-of-memory condition yielding memory corruption during IRQ setup + 56557 + 102406 + SUSE-SU-2014:0373 + FEDORA-2014-1552 + + + + + + + + + + + + + + + The Web Email Protection component in Symantec Encryption Management Server (aka PGP Universal Server) before 3.3.2 allows remote authenticated users to read the stored outbound e-mail messages of arbitrary users via a modified URL. + + + + + + + + + http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140205_00 + 65300 + + + + + + + + + + + + The forgotten-password feature in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator (LUA) 2.x before 2.3.2.110 allows remote attackers to reset arbitrary passwords by providing the e-mail address associated with a user account. + + + + + + + + + + + http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140327_00 + https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140328-0_Symantec_LiveUpdate_Administrator_Multiple_vulnerabilities_wo_poc_v10.txt + 66399 + 20140328 SEC Consult SA-20140328-0 :: Multiple vulnerabilities in Symantec LiveUpdate Administrator + + + + + + + + + + + + + + + + + + SQL injection vulnerability in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator (LUA) 2.x before 2.3.2.110 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. + + + + + + + + + + + http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140327_00 + https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140328-0_Symantec_LiveUpdate_Administrator_Multiple_vulnerabilities_wo_poc_v10.txt + 66400 + 20140328 SEC Consult SA-20140328-0 :: Multiple vulnerabilities in Symantec LiveUpdate Administrator + + + + + + + + + + + + + + + + + + Symantec PGP Desktop 10.0.x through 10.2.x and Encryption Desktop Professional 10.3.x before 10.3.2 MP1 do not properly perform memory copies, which allows remote attackers to cause a denial of service (read access violation and application crash) via a malformed certificate. + + + + + + + + + + http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140423_00 + 67016 + + + + + + + + + + + + + + + + + + + + + + + + Symantec PGP Desktop 10.0.x through 10.2.x and Encryption Desktop Professional 10.3.x before 10.3.2 MP1 do not properly perform block-data moves, which allows remote attackers to cause a denial of service (read access violation and application crash) via a malformed certificate. + + + + + + + + + + http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140423_00 + 67020 + + + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in brightmail/setting/compliance/DlpConnectFlow$view.flo in the management console in Symantec Messaging Gateway 10.x before 10.5.2 allows remote attackers to inject arbitrary web script or HTML via the displayTab parameter. + + + + + + + + + + http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140422_00 + 66966 + 20140422 (CVE-2014-1648) Symantec Messaging Gateway Management Console Cross Site Scripting Vulnerability + + + + + + + + + + + + + + + Unspecified vulnerability in Citrix XenMobile Device Manager server (formerly Zenprise Device Manager server) 8.5, 8.6, and MDM 8.0.1 allows remote attackers to obtain sensitive information via unknown vectors. + + + + + + + + + 65348 + http://support.citrix.com/article/CTX140044 + 56438 + + + + + + + + + + + + + + The Citrix GoToMeeting application 5.0.799.1238 for Android logs HTTP requests containing sensitive information, which allows attackers to obtain user IDs, meeting details, and authentication tokens via an application that reads the system log file. + + + + + + + + + gotomeeting-cve20141664-info-disc(90695) + 65123 + 20140124 [CVE-2014-1664] GoToMeeting Information Disclosure via Logging Output (Android) + 102559 + + + + + + + + + + The do_physdev_op function in Xen 4.1.5, 4.1.6.1, 4.2.2 through 4.2.3, and 4.3.x does not properly restrict access to the (1) PHYSDEVOP_prepare_msix and (2) PHYSDEVOP_release_msix operations, which allows local PV guests to cause a denial of service (host or guest malfunction) or possibly gain privileges via unspecified vectors. + + + + + + + + + + + http://xenbits.xen.org/xsa/xsa87-unstable-4.3.patch + xen-cve20141666-priv-esc(90675) + http://xenbits.xen.org/xsa/advisory-87.html + 1029684 + 65125 + [oss-security] 20140123 Xen Security Advisory 87 (CVE-2014-1666) - PHYSDEVOP_{prepare,release}_msix exposed to unprivileged guests + 56650 + 102536 + SUSE-SU-2014:0373 + SUSE-SU-2014:0372 + FEDORA-2014-1552 + + + + + + + + + + + + + + + The Microsoft Bing application before 4.2.1 for Android allows remote attackers to install arbitrary APK files via vectors involving a crafted DNS response. + + + + + + + + + + + + https://play.google.com/store/apps/details?id=com.microsoft.bing + http://www.youtube.com/watch?v=_j1RKtTxZ3k + 65128 + 102575 + http://blog.trustlook.com/2014/01/23/trustlook-reported-microsofts-first-ever-android-vulnerability/ + + + + + + + + + + Multiple SQL injection vulnerabilities in Dell KACE K1000 5.4.76847 and possibly earlier allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the macAddress element in a (1) getUploadPath or (2) getKBot SOAP request to service/kbot_service.php; the ID parameter to (3) userui/advisory_detail.php or (4) userui/ticket.php; and the (5) ORDER[] parameter to userui/ticket_list.php. + + + + + + + + + + + kace-multiple-sql-injection(90592) + 65029 + http://www.baesystemsdetica.com.au/Research/Advisories/Dell-KACE-K1000-SQL-Injection-(DS-2014-001) + 56396 + + + + + + + + + + + + + + + + + + + + + + Check Point R75.47 Security Gateway and Management Server does not properly enforce Anti-Spoofing when the routing table is modified and the "Get - Interfaces with Topology" action is performed, which allows attackers to bypass intended access restrictions. + + + Per: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk98087 + +"This issue affects only R75.47 Security Gateway and R75.47 Management Server." + + + + + + + + + + https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk98087 + + + + + + + + + + + + + Check Point Session Authentication Agent allows remote attackers to obtain sensitive information (user credentials) via unspecified vectors. + + + + + + + + + https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk98263 + check-point-cve20141673-unauth-access(90746) + 20140127 [CVE-2014-1673] Check Point Session Authentication Agent vulnerability + http://packetstormsecurity.com/files/124967 + 102418 + + + + + + + + + + Untrusted search path vulnerability in Bandisoft Bandizip before 3.10 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory. + Per: http://cwe.mitre.org/data/definitions/426.html + +"CWE-426: Untrusted Search Path" + + + + + + + + + + + bandzip-dll-cve20141680-code-exec(90966) + http://www.bandisoft.com/bandizip/history + http://packetstormsecurity.com/files/125059 + 102979 + + + + + + + + + + + + + + + + + + + Multiple unspecified vulnerabilities in Google Chrome before 32.0.1700.102 have unknown impact and attack vectors, related to 12 "security fixes [that were not] either contributed by external researchers or particularly interesting." + + + + + + + + + + + 102633 + http://googlechromereleases.blogspot.com/2014/01/stable-channel-update_27.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248-04, when the pid parameter is 4, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) name, (2) email, (3) subject, or (4) message parameter to index.php, when the pid parameter is 4. + + + + + + + + + + + skybluecanvas-index-command-exec(90670) + 65129 + 31432 + 31183 + 56646 + 20140123 Remote Command Injection Vulnerability in SkyBlueCanvas CMS + http://packetstormsecurity.com/files/124948/SkyBlueCanvas-CMS-1.1-r248-03-Command-Injection.html + + + + + + + + + + The ASF_ReadObject_file_properties function in modules/demux/asf/libasf.c in the ASF Demuxer in VideoLAN VLC Media Player before 2.1.3 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a zero minimum and maximum data packet size in an ASF file. + + + + + + + + + http://git.videolan.org/gitweb.cgi/vlc.git/?p=vlc.git;a=commitdiff;h=98787d0843612271e99d62bee0dfd8197f0cf404 + https://trac.videolan.org/vlc/ticket/10482 + http://www.elsherei.com/?p=269 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The help function in net/netfilter/nf_nat_irc.c in the Linux kernel before 3.12.8 allows remote attackers to obtain sensitive information from kernel memory by establishing an IRC DCC session in which incorrect packet data is transmitted during use of the NAT mangle feature. + + + + + + + + + https://github.com/torvalds/linux/commit/2690d97ade05c5325cbf7c72b94b90d265659886 + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2690d97ade05c5325cbf7c72b94b90d265659886 + https://bugzilla.redhat.com/show_bug.cgi?id=1058748 + USN-2158-1 + USN-2140-1 + USN-2137-1 + [oss-security] 20140128 Re: CVE request Linux kernel: netfilter: nf_nat: leakage of uninitialized buffer in IRC NAT helper + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.8 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted serialized object in the _formvars form. + + + + + + + + + + + https://github.com/horde/horde/commit/da6afc7e9f4e290f782eca9dbca794f772caccb3 + [oss-security] 20140128 Re: Remote code execution in horde < 5.1.1 + [oss-security] 20140128 Remote code execution in horde < 5.1.1 + https://github.com/horde/horde/blob/82c400788537cfc0106b68447789ff53793ac086/bundles/groupware/docs/CHANGES#L215 + DSA-2853 + [oss-security] 20140129 Re: Remote code execution in horde < 5.1.1 + + + + + + + + + + + + + + + The hash_buffer function in schnorr.c in OpenSSH through 6.4, when Makefile.inc is modified to enable the J-PAKE protocol, does not initialize certain data structures, which might allow remote attackers to cause a denial of service (memory corruption) or have unspecified other impact via vectors that trigger an error condition. + + + + + + + + + + + openssh-cve20141692-code-exec(90819) + 65230 + http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/schnorr.c#rev1.10 + http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/Attic/schnorr.c.diff?r1=1.9;r2=1.10;f=h + 102611 + [oss-security] 20140128 OpenSSH J-PAKE vulnerability (no cause for panic! remain calm!) + [oss-security] 20140129 Re: OpenSSH J-PAKE vulnerability (no cause for panic! remain calm!) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences.pm, (2) CustomerTicketMessage.pm, (3) CustomerTicketProcess.pm, and (4) CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow remote attackers to hijack the authentication of arbitrary users for requests that (5) create tickets or (6) send follow-ups to existing tickets. + + + + + + + + + + + + https://www.otrs.com/security-advisory-2014-01-csrf-issue-customer-web-interface + https://github.com/OTRS/otrs/commit/ca2c3390fd60d9a3f810ed2c22cbc2c193457b77 + https://github.com/OTRS/otrs/commit/92f417277f43832f1a0462f2485fe1fd3fd52312 + https://github.com/OTRS/otrs/commit/6f324aaf8647729d509eebf063a0181f9f9196f7 + https://www.otrs.com/release-notes-otrs-help-desk-3-3-4 + [oss-security] 20140129 CVE Request: otrs: CSRF issue in customer web interface + [oss-security] 20140129 Re: CVE Request: otrs: CSRF issue in customer web interface + DSA-2867 + 56655 + 56644 + 102632 + http://bugs.otrs.org/show_bug.cgi?id=10099 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.20, 3.2.x before 3.2.15, and 3.3.x before 3.3.5 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML email. + + + + + + + + + + https://www.otrs.com/security-advisory-2014-03-xss-issue + 65844 + 57018 + openSUSE-SU-2014:0360 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Siemens SIMATIC WinCC OA before 3.12 P002 January uses a weak hash algorithm for passwords, which makes it easier for remote attackers to obtain access via a brute-force attack. + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-035-01 + simatic-wincc-cve20141696-priv-esc(90934) + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-342587.pdf + 102809 + + + + + + + + + + The integrated web server in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to execute arbitrary code via crafted packets to TCP port 4999. + + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-035-01 + simatic-wincc-cve20141697-code-exec(90933) + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-342587.pdf + 65351 + 56651 + 102810 + + + + + + + + + + Directory traversal vulnerability in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to read arbitrary files via crafted packets to TCP port 4999. + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-035-01 + simatic-wincc-cve20141698-dir-trav(90935) + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-342587.pdf + 65349 + 56651 + 102811 + + + + + + + + + + Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to cause a denial of service (monitoring-service outage) via malformed HTTP requests to port 4999. + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-035-01 + simatic-wincc-cve20141699-dos(90936) + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-342587.pdf + 65347 + 56651 + 102812 + + + + + + + + + + Use-after-free vulnerability in modules/speech/SpeechSynthesis.cpp in Blink, as used in Google Chrome before 33.0.1750.149, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of a certain utterance data structure. + + + + + + + + + + + https://src.chromium.org/viewvc/blink?revision=168171&view=revision + https://code.google.com/p/chromium/issues/detail?id=344881 + DSA-2883 + http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The GenerateFunction function in bindings/scripts/code_generator_v8.pm in Blink, as used in Google Chrome before 33.0.1750.149, does not implement a certain cross-origin restriction for the EventTarget::dispatchEvent function, which allows remote attackers to conduct Universal XSS (UXSS) attacks via vectors involving events. + + + + + + + + + https://src.chromium.org/viewvc/blink?revision=166999&view=revision + https://code.google.com/p/chromium/issues/detail?id=342618 + DSA-2883 + http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Use-after-free vulnerability in the DatabaseThread::cleanupDatabaseThread function in modules/webdatabase/DatabaseThread.cpp in the web database implementation in Blink, as used in Google Chrome before 33.0.1750.149, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of scheduled tasks during shutdown of a thread. + + + + + + + + + + + https://src.chromium.org/viewvc/blink?revision=168059&view=revision + https://code.google.com/p/chromium/issues/detail?id=333058 + DSA-2883 + http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Use-after-free vulnerability in the WebSocketDispatcherHost::SendOrDrop function in content/browser/renderer_host/websocket_dispatcher_host.cc in the Web Sockets implementation in Google Chrome before 33.0.1750.149 might allow remote attackers to bypass the sandbox protection mechanism by leveraging an incorrect deletion in a certain failure case. + + + + + + + + + + + https://src.chromium.org/viewvc/chrome?revision=247627&view=revision + https://code.google.com/p/chromium/issues/detail?id=338354 + DSA-2883 + http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Multiple unspecified vulnerabilities in Google V8 before 3.23.17.18, as used in Google Chrome before 33.0.1750.149, allow attackers to cause a denial of service or possibly have other impact via unknown vectors. + + + + + + + + + + + https://code.google.com/p/v8/source/detail?r=19668 + https://code.google.com/p/v8/source/detail?r=19614 + https://code.google.com/p/v8/source/detail?r=18564 + https://code.google.com/p/chromium/issues/detail?id=349079 + https://code.google.com/p/chromium/issues/detail?id=345715 + https://code.google.com/p/chromium/issues/detail?id=328202 + DSA-2883 + http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Google V8, as used in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors. + + + + + + + + + + + https://code.google.com/p/chromium/issues/detail?id=351787 + DSA-2883 + http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_14.html + http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + crosh in Google Chrome OS before 33.0.1750.152 allows attackers to inject commands via unspecified vectors. + + + + + + + + + + + https://code.google.com/p/chromium/issues/detail?id=351796 + http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html + + + + + + + + + + + + + + + + + + + + Directory traversal vulnerability in CrosDisks in Google Chrome OS before 33.0.1750.152 has unspecified impact and attack vectors. + + + + + + + + + + + https://code.google.com/p/chromium/issues/detail?id=351811 + http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html + + + + + + + + + + + + + + + + + + + + The boot implementation in Google Chrome OS before 33.0.1750.152 does not properly consider file persistence, which allows remote attackers to execute arbitrary code via unspecified vectors. + + + + + + + + + + + https://code.google.com/p/chromium/issues/detail?id=344051 + http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html + + + + + + + + + + + + + + + + + + + + The AsyncPixelTransfersCompletedQuery::End function in gpu/command_buffer/service/query_manager.cc in Google Chrome, as used in Google Chrome OS before 33.0.1750.152, does not check whether a certain position is within the bounds of a shared-memory segment, which allows remote attackers to cause a denial of service (GPU command-buffer memory corruption) or possibly have unspecified other impact via unknown vectors. + + + + + + + + + + + https://src.chromium.org/viewvc/chrome?revision=256918&view=revision + https://src.chromium.org/viewvc/chrome?revision=256723&view=revision + https://code.google.com/p/chromium/issues/detail?id=351852 + http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html + + + + + + + + + + + + + + + + + + + + The GPU driver in the kernel in Google Chrome OS before 33.0.1750.152 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via unknown vectors. + + + + + + + + + + + https://code.google.com/p/chromium/issues/detail?id=351855 + http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html + + + + + + + + + + + + + + + + + + + + Use-after-free vulnerability in the AttributeSetter function in bindings/templates/attributes.cpp in the bindings in Blink, as used in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving the document.location value. + + + + + + + + + + + https://src.chromium.org/viewvc/blink?revision=169176&view=revision + https://code.google.com/p/chromium/issues/detail?id=352374 + DSA-2883 + http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_14.html + http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html + APPLE-SA-2014-04-22-2 + APPLE-SA-2014-04-22-3 + APPLE-SA-2014-04-01-1 + 20140326 VUPEN Security Research - Google Chrome Blink "locationAttributeSetter" Use-after-free (Pwn2Own) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The ScopedClipboardWriter::WritePickledData function in ui/base/clipboard/scoped_clipboard_writer.cc in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows does not verify a certain format value, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the clipboard. + + + + + + + + + + + https://src.chromium.org/viewvc/chrome?revision=256974&view=revision + https://code.google.com/p/chromium/issues/detail?id=352395 + http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_14.html + 20140326 VUPEN Security Research - Google Chrome "Clipboard::WriteData()" Function Sandbox Escape (Pwn2Own) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Directory traversal vulnerability in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows has unspecified impact and attack vectors. + + + + + + + + + + + https://code.google.com/p/chromium/issues/detail?id=352429 + DSA-2883 + http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_14.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the Runtime_SetPrototype function in runtime.cc in Google V8, as used in Google Chrome before 34.0.1847.116, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)." + + + + + + + + + + + https://code.google.com/p/v8/source/detail?r=20138 + https://code.google.com/p/chromium/issues/detail?id=354123 + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html + + + + + + + + + + Google V8, as used in Google Chrome before 34.0.1847.116, does not properly use numeric casts during handling of typed arrays, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JavaScript code. + + + + + + + + + + + https://code.google.com/p/v8/source/detail?r=20020 + https://code.google.com/p/chromium/issues/detail?id=353004 + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html + + + + + + + + + + Integer overflow in the SoftwareFrameManager::SwapToNewFrame function in content/browser/renderer_host/software_frame_manager.cc in the software compositor in Google Chrome before 34.0.1847.116 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted mapping of a large amount of renderer memory. + + + + + + + + + + + https://src.chromium.org/viewvc/chrome?revision=261817&view=revision + https://src.chromium.org/viewvc/chrome?revision=260969&view=revision + https://src.chromium.org/viewvc/chrome?revision=258418&view=revision + https://src.chromium.org/viewvc/chrome?revision=257417&view=revision + https://code.google.com/p/chromium/issues/detail?id=348332 + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html + + + + + + + + + + Use-after-free vulnerability in the WebSharedWorkerStub::OnTerminateWorkerContext function in content/worker/websharedworker_stub.cc in the Web Workers implementation in Google Chrome before 34.0.1847.116 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via vectors that trigger a SharedWorker termination during script loading. + + + + + + + + + + + https://src.chromium.org/viewvc/chrome?revision=252010&view=revision + https://code.google.com/p/chromium/issues/detail?id=343661 + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html + + + + + + + + + + Use-after-free vulnerability in the HTMLBodyElement::insertedInto function in core/html/HTMLBodyElement.cpp in Blink, as used in Google Chrome before 34.0.1847.116, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving attributes. + + + + + + + + + + + https://src.chromium.org/viewvc/blink?revision=170216&view=revision + https://code.google.com/p/chromium/issues/detail?id=356095 + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html + + + + + + + + + + Google V8, as used in Google Chrome before 34.0.1847.116, does not properly implement lazy deoptimization, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted JavaScript code, as demonstrated by improper handling of a heap allocation of a number outside the Small Integer (aka smi) range. + + + + + + + + + + + https://code.google.com/p/v8/source/detail?r=19834 + https://code.google.com/p/chromium/issues/detail?id=350434 + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html + + + + + + + + + + Use-after-free vulnerability in the RenderBlock::addChildIgnoringAnonymousColumnBlocks function in core/rendering/RenderBlock.cpp in Blink, as used in Google Chrome before 34.0.1847.116, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving addition of a child node. + + + + + + + + + + + https://src.chromium.org/viewvc/blink?revision=164405&view=revision + https://code.google.com/p/chromium/issues/detail?id=330626 + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html + + + + + + + + + + The UnescapeURLWithOffsetsImpl function in net/base/escape.cc in Google Chrome before 34.0.1847.116 does not properly handle bidirectional Internationalized Resource Identifiers (IRIs), which makes it easier for remote attackers to spoof URLs via crafted use of right-to-left (RTL) Unicode text. + + + + + + + + + + + https://src.chromium.org/viewvc/chrome?revision=254091&view=revision + https://code.google.com/p/chromium/issues/detail?id=337746 + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html + + + + + + + + + + Use-after-free vulnerability in Free(b)soft Laboratory Speech Dispatcher 0.7.1, as used in Google Chrome before 34.0.1847.116, allows remote attackers to cause a denial of service (application hang) or possibly have unspecified other impact via a text-to-speech request. + + + + + + + + + + + https://src.chromium.org/viewvc/chrome?revision=259109&view=revision + https://code.google.com/p/chromium/issues/detail?id=327295 + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html + + + + + + + + + + The base64DecodeInternal function in wtf/text/Base64.cpp in Blink, as used in Google Chrome before 34.0.1847.116, does not properly handle string data composed exclusively of whitespace characters, which allows remote attackers to cause a denial of service (out-of-bounds read) via a window.atob method call. + + + + + + + + + https://src.chromium.org/viewvc/blink?revision=170264&view=revision + https://code.google.com/p/chromium/issues/detail?id=357332 + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html + + + + + + + + + + The drag implementation in Google Chrome before 34.0.1847.116 allows user-assisted remote attackers to bypass the Same Origin Policy and forge local pathnames by leveraging renderer access. + + + + + + + + + + https://src.chromium.org/viewvc/chrome?revision=259353&view=revision + https://code.google.com/p/chromium/issues/detail?id=346135 + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html + + + + + + + + + + Use-after-free vulnerability in content/renderer/renderer_webcolorchooser_impl.h in Google Chrome before 34.0.1847.116 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to forms. + + + + + + + + + + + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html + https://src.chromium.org/viewvc/chrome?revision=255276&view=revision + https://code.google.com/p/chromium/issues/detail?id=342735 + + + + + + + + + + Multiple unspecified vulnerabilities in Google Chrome before 34.0.1847.116 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. + + + + + + + + + + + https://code.google.com/p/chromium/issues/detail?id=360298 + https://code.google.com/p/chromium/issues/detail?id=358059 + https://code.google.com/p/chromium/issues/detail?id=356517 + https://code.google.com/p/chromium/issues/detail?id=356235 + https://code.google.com/p/chromium/issues/detail?id=355586 + https://code.google.com/p/chromium/issues/detail?id=354297 + https://code.google.com/p/chromium/issues/detail?id=353013 + https://code.google.com/p/chromium/issues/detail?id=352982 + https://code.google.com/p/chromium/issues/detail?id=351815 + https://code.google.com/p/chromium/issues/detail?id=350863 + https://code.google.com/p/chromium/issues/detail?id=350537 + https://code.google.com/p/chromium/issues/detail?id=350533 + https://code.google.com/p/chromium/issues/detail?id=348319 + https://code.google.com/p/chromium/issues/detail?id=347262 + https://code.google.com/p/chromium/issues/detail?id=345820 + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html + + + + + + + + + + Multiple unspecified vulnerabilities in Google V8 before 3.24.35.22, as used in Google Chrome before 34.0.1847.116, allow attackers to cause a denial of service or possibly have other impact via unknown vectors. + + + + + + + + + + + https://code.google.com/p/v8/source/detail?r=20409 + https://code.google.com/p/v8/source/detail?r=20345 + https://code.google.com/p/v8/source/detail?r=20033 + https://code.google.com/p/v8/source/detail?r=19923 + https://code.google.com/p/v8/source/detail?r=19584 + https://code.google.com/p/v8/source/detail?r=19572 + https://code.google.com/p/chromium/issues/detail?id=358059 + https://code.google.com/p/chromium/issues/detail?id=355586 + https://code.google.com/p/chromium/issues/detail?id=352982 + https://code.google.com/p/chromium/issues/detail?id=350863 + https://code.google.com/p/chromium/issues/detail?id=348319 + https://code.google.com/p/chromium/issues/detail?id=347262 + https://code.google.com/p/chromium/issues/detail?id=345820 + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html + + + + + + + + + + Google V8, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly store internationalization metadata, which allows remote attackers to bypass intended access restrictions by leveraging "type confusion" and reading property values, related to i18n.js and runtime.cc. + + + + + + + + + https://code.google.com/p/v8/source/detail?r=20595 + https://code.google.com/p/v8/source/detail?r=20593 + https://code.google.com/p/v8/source/detail?r=20388 + https://code.google.com/p/v8/source/detail?r=20377 + https://code.google.com/p/v8/source/detail?r=20375 + https://code.google.com/p/chromium/issues/detail?id=354967 + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html + + + + + + + + + + + core/html/HTMLSelectElement.cpp in the DOM implementation in Blink, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly check renderer state upon a focus event, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion" for SELECT elements. + + + + + + + + + + + https://src.chromium.org/viewvc/blink?revision=171216&view=revision + https://code.google.com/p/chromium/issues/detail?id=349903 + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html + + + + + + + + + + + Use-after-free vulnerability in browser/ui/views/speech_recognition_bubble_views.cc in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact via an INPUT element that triggers the presence of a Speech Recognition Bubble window for an incorrect duration. + + + + + + + + + + + https://src.chromium.org/viewvc/chrome?revision=261737&view=revision + https://code.google.com/p/chromium/issues/detail?id=352851 + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html + + + + + + + + + + + The PointerCompare function in codegen.cc in Seccomp-BPF, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly merge blocks, which might allow remote attackers to bypass intended sandbox restrictions by leveraging renderer access. + + + + + + + + + + + https://src.chromium.org/viewvc/chrome?revision=260157&view=revision + https://code.google.com/p/chromium/issues/detail?id=351103 + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html + + + + + + + + + + + Multiple unspecified vulnerabilities in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux allow attackers to cause a denial of service or possibly have other impact via unknown vectors. + + + + + + + + + + + https://code.google.com/p/chromium/issues/detail?id=367314 + https://code.google.com/p/chromium/issues/detail?id=357382 + https://code.google.com/p/chromium/issues/detail?id=356181 + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html + + + + + + + + + + + Multiple unspecified vulnerabilities in Google V8 before 3.24.35.33, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, allow attackers to cause a denial of service or possibly have other impact via unknown vectors. + + + + + + + + + + + https://src.chromium.org/viewvc/blink?revision=171127&view=revision + https://src.chromium.org/viewvc/blink?revision=171077&view=revision + https://code.google.com/p/v8/source/detail?r=20624 + https://code.google.com/p/v8/source/detail?r=20622 + https://code.google.com/p/v8/source/detail?r=20501 + https://code.google.com/p/chromium/issues/detail?id=360429 + https://code.google.com/p/chromium/issues/detail?id=359525 + https://code.google.com/p/chromium/issues/detail?id=359130 + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html + + + + + + + + + + + Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0235 and CVE-2014-1755. + + + + + + + + + + + + MS14-018 + + + + + + + + + + Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." + + + + + + + + + + + + MS14-018 + + + + + + + + + + + Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." + + + + + + + + + + + + MS14-018 + + + + + + + + + + + + + Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0235 and CVE-2014-1751. + + + + + + + + + + + + MS14-018 + + + + + + + + + + Microsoft Word 2007 SP3 and 2010 SP1 and SP2, and Office Compatibility Pack SP3, allocates memory incorrectly for file conversions from a binary (aka .doc) format to a newer format, which allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office File Format Converter Vulnerability." + + + + + + + + + + + + MS14-017 + + + + + + + + + + + + + + + Stack-based buffer overflow in Microsoft Word 2003 SP3 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Word Stack Overflow Vulnerability." + + + + + + + + + + + + MS14-017 + + + + + + + + + + pubconv.dll in Microsoft Publisher 2003 SP3 and 2007 SP3 allows remote attackers to execute arbitrary code or cause a denial of service (incorrect pointer dereference and application crash) via a crafted .pub file, aka "Arbitrary Pointer Dereference Vulnerability." + + + + + + + + + + + + MS14-020 + + + + + + + + + + + Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." + + + + + + + + + + + + MS14-018 + + + + + + + + + + Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Word Automation Services on SharePoint Server 2010 SP1 and SP2 and 2013; Office Web Apps 2010 SP1 and SP2; and Office Web Apps Server 2013 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, as exploited in the wild in March 2014. + + + + + + + + + + + + MS14-017 + http://technet.microsoft.com/security/advisory/2953095 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code with medium-integrity privileges and bypass a sandbox protection mechanism via unknown vectors, as demonstrated by ZDI during a Pwn4Fun competition at CanSecWest 2014. + + + + + + + + + + + http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/ + http://twitter.com/thezdi/statuses/443810610958958592 + + + + + + + + + + Use-after-free vulnerability in Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014. + + + + + + + + + + + http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/ + http://twitter.com/thezdi/statuses/443855973673754624 + + + + + + + + + + Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism by leveraging "object confusion" in a broker process, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014. + + + + + + + + + + + http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/ + http://twitter.com/thezdi/statuses/443855973673754624 + + + + + + + + + + Multiple use-after-free vulnerabilities in Microsoft Internet Explorer 11 allow remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by Sebastian Apelt and Andreas Schmidt during a Pwn2Own competition at CanSecWest 2014. + + + + + + + + + + + http://www.pwn2own.com/2014/03/pwn2own-results-thursday-day-two/ + http://twitter.com/thezdi/statuses/444216845734666240 + + + + + + + + + + Unspecified vulnerability in the kernel in Microsoft Windows 8.1 allows local users to gain privileges via unknown vectors, as demonstrated by Sebastian Apelt and Andreas Schmidt during a Pwn2Own competition at CanSecWest 2014. + + + + + + + + + + + http://www.pwn2own.com/2014/03/pwn2own-results-thursday-day-two/ + http://twitter.com/thezdi/statuses/444216845734666240 + + + + + + + + + + Use-after-free vulnerability in VGX.DLL in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as exploited in the wild in April 2014. + + + + + + + + + + + https://technet.microsoft.com/library/security/2963983 + http://www.fireeye.com/blog/uncategorized/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the iThoughtsHD app 4.19 for iOS on iPad devices, when the WiFi Transfer feature is used, allows remote attackers to inject arbitrary web script or HTML via a crafted map name. + + + + + + + + + + http://www.madirish.net/559 + + + + + + + + + + The iThoughtsHD app 4.19 for iOS on iPad devices, when the WiFi Transfer feature is used, allows remote attackers to upload arbitrary files by placing a %00 sequence after a dangerous extension, as demonstrated by a .html%00.txt file. + + + + + + + + + + http://www.madirish.net/559 + + + + + + + + + + The iThoughts web server in the iThoughtsHD app 4.19 for iOS on iPad devices allows remote attackers to cause a denial of service (disk consumption) by uploading a large file. + + + + + + + + + + http://www.madirish.net/559 + + + + + + + + + + Directory traversal vulnerability in uupdate in devscripts 2.14.1 allows remote attackers to modify arbitrary files via a crafted .orig.tar file, related to a symlink. + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1059947 + 65260 + [oss-security] 20140131 CVE request: uupdate (devscripts) directory traversal + [oss-security] 20140131 Re: CVE request: uupdate (devscripts) directory traversal + 102748 + http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737160 + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the StackIdeas Komento (com_komento) component before 1.7.4 for Joomla! allows remote attackers to inject arbitrary web script or HTML via vectors related to "checking new comments." + + + + + + + + + + komento-joomla-cve20141837-xss(90974) + 65173 + http://stackideas.com/downloads/changelog/komento + 56577 + 102563 + + + + + + + + + + + + + The (1) extract_keys_from_pdf and (2) fill_pdf functions in pdf_ext.py in logilab-commons before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf. + + + + + + + + + + + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737051 + http://www.logilab.org/ticket/207561 + 57209 + openSUSE-SU-2014:0306 + [oss-security] 20140131 CVE request: temp file issues in python's logilab-common module + + + + + + + + + + + + + + The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file. + + + + + + + + + + + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737051 + http://www.logilab.org/ticket/207562 + 57209 + openSUSE-SU-2014:0306 + [oss-security] 20140131 CVE request: temp file issues in python's logilab-common module + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in Upload/search.php in MyBB 1.6.12 and earlier allows remote attackers to inject arbitrary web script or HTML via the keywords parameter in a do_search action, which is not properly handled in a forced SQL error message. + + + + + + + + + + http://packetstormsecurity.com/files/125038/MyBB-1.6.12-POST-Cross-Site-Scripting.html + http://osandamalith.wordpress.com/2014/02/02/mybb-1-6-12-post-xss-0day/ + + + + + + + + + + + + + + + + + + + + + + Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to copy an arbitrary user's home folder via a Move action with a .. (dot dot) in the src parameter. + + + + + + + + + 20140210 Titan FTP Server Directory Traversal Vulnerabilities - [CVE-2014-1841 / CVE-2014-1842 / CVE-2014-1843] + + + + + + + + + + + + + Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to list all usernames via a Go action with a .. (dot dot) in the search-bar value. + + + + + + + + + 20140210 Titan FTP Server Directory Traversal Vulnerabilities - [CVE-2014-1841 / CVE-2014-1842 / CVE-2014-1843] + + + + + + + + + + + + + Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to obtain the property information of an arbitrary home folder via a Properties action with a .. (dot dot) in the src parameter. + + + + + + + + + 20140210 Titan FTP Server Directory Traversal Vulnerabilities - [CVE-2014-1841 / CVE-2014-1842 / CVE-2014-1843] + + + + + + + + + + + + + SQL injection vulnerability in library/clicktracker.php in the AdRotate Pro plugin 3.9 through 3.9.5 and AdRotate Free plugin 3.9 through 3.9.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the track parameter. + + + + + + + + + + + https://www.htbridge.com/advisory/HTB23201 + adrotate-track-sql-injection(91253) + 65709 + 20140220 SQL Injection in AdRotate + 31834 + http://www.adrotateplugin.com/2014/01/adrotate-pro-3-9-6-and-adrotate-free-3-9-5 + 57079 + + + + + + + + + + + + + + + + + + + + The client in Jetro COCKPIT Secure Browsing (JCSB) 4.3.1 and 4.3.3 does not validate the FileName element in an RDP_FILE_TRANSFER document, which allows remote JCSB servers to execute arbitrary programs by providing a .EXE extension. + + + + + + + + + + + + http://blog.quaji.com/2014/02/remote-code-execution-on-all-enterprise.html + 20140217 Jetro Cockpit Secure Browsing vulnerability - Client missing input validation allowing RCE + + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in ZeroClipboard.swf in ZeroClipboard before 1.3.2, as maintained by Jon Rohan and James M. Greene, allow remote attackers to inject arbitrary web script or HTML via vectors related to certain SWF query parameters (aka loaderInfo.parameters). + + + + + + + + + + https://github.com/zeroclipboard/zeroclipboard/releases/tag/v1.3.2 + https://github.com/zeroclipboard/zeroclipboard/pull/335 + https://github.com/zeroclipboard/zeroclipboard/commit/2f9eb9750a433965572d047e24b0fc78fd1415ca + zeroclipboard-cve20141869-xss(91085) + 65484 + 56821 + + + + + + + + + + + + + + + + + + + + + + + + + + Opera before 19 on Mac OS X allows user-assisted remote attackers to spoof the address bar via vectors involving a drag-and-drop operation. + + + + + + + + + + http://blogs.opera.com/security/2014/01/security-changes-features-opera-19/ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The security_context_to_sid_core function in security/selinux/ss/services.c in the Linux kernel before 3.13.4 allows local users to cause a denial of service (system crash) by leveraging the CAP_MAC_ADMIN capability to set a zero-length security context. + + + + + + + + + https://github.com/torvalds/linux/commit/2172fa709ab32ca60e86179dc67d0857be8e2c98 + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2172fa709ab32ca60e86179dc67d0857be8e2c98 + https://bugzilla.redhat.com/show_bug.cgi?id=1062356 + USN-2141-1 + USN-2140-1 + USN-2139-1 + USN-2138-1 + USN-2137-1 + USN-2136-1 + USN-2135-1 + USN-2134-1 + USN-2133-1 + USN-2129-1 + USN-2128-1 + [oss-security] 20140206 Re: CVE Request: Linux kernel: SELinux local DoS + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.4 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The unpacker::redirect_stdio function in unpack.cpp in unpack200 in OpenJDK 6, 7, and 8; Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 does not securely create temporary files when a log file cannot be opened, which allows local users to overwrite arbitrary files via a symlink attack on /tmp/unpack.log. + + + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1060907 + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + [oss-security] 20140207 Re: CVE request and heads-up on insecure temp file handling in unpack200 (OpenJDK, Oracle Java) + [oss-security] 20140203 CVE request and heads-up on insecure temp file handling in unpack200 (OpenJDK, Oracle Java) + 102808 + http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737562 + + + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 2.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Phone, (2) Street, (3) Address line, (4) Zip code, or (5) City field to main/auth/profile.php; (6) Subject field to main/social/groups.php; or (7) Message body field to main/messages/view_message.php. + + + + + + + + + + dokeos-cve20141877-xss(91295) + http://www.xchg.info/?p=381 + [oss-security] 20140207 Re: Dokeos 2.1.1 Multiple Stored XSS Vulnerabilities + [oss-security] 20140206 Dokeos 2.1.1 Multiple Stored XSS Vulnerabilities + + + + + + + + + + Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a denial of service (segmentation fault) via a long message to cmd.cgi. + + + + + + + + + https://dev.icinga.org/issues/5434 + https://www.icinga.org/2014/02/11/bugfix-releases-1-10-3-1-9-5-1-8-6 + https://bugzilla.redhat.com/show_bug.cgi?id=1066578 + 65605 + 57024 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in import.php in phpMyAdmin before 4.1.7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename in an import action. + + + + + + + + + + https://github.com/phpmyadmin/phpmyadmin/commit/968d5d5f486820bfa30af046f063b9f23304e14a + http://www.phpmyadmin.net/home_page/security/PMASA-2014-1.php + openSUSE-SU-2014:0344 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted library clone that leverages IFRAME script execution and waits a certain amount of time for an OnJsPrompt handler return value as an alternative to correct synchronization. + + + + + + + + + + + 20140124 Security Vulnerabilities in Apache Cordova / PhoneGap + http://www.internetsociety.org/ndss2014/programme#session3 + http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf + http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt + [oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap + + + + + + + + + + + + + + + + + + + + + + + + + + + + Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted library clone that leverages IFRAME script execution and directly accesses bridge JavaScript objects, as demonstrated by certain cordova.require calls. + + + + + + + + + + + http://www.internetsociety.org/ndss2014/programme#session3 + http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf + 20140124 Security Vulnerabilities in Apache Cordova / PhoneGap + http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt + [oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap + + + + + + + + + + + + + + + + + + + + + + + + + + + + Adobe PhoneGap before 2.6.0 on Android uses the shouldOverrideUrlLoading callback instead of the proper shouldInterceptRequest callback, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application. + + + + + + + + + + + 20140124 Security Vulnerabilities in Apache Cordova / PhoneGap + https://github.com/phonegap/phonegap/blob/2.6.0/changelog + http://www.internetsociety.org/ndss2014/programme#session3 + http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf + http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt + [oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap + + + + + + + + + + + + + + + + + Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7 and 8 do not properly restrict navigation events, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application. + + + + + + + + + + + http://www.internetsociety.org/ndss2014/programme#session3 + http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf + 20140124 Security Vulnerabilities in Apache Cordova / PhoneGap + http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt + [oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap + + + + + + + + + + + + + + + + + + + + + + + + + + + + The ForzeArmate application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently obtain write access to external-storage resources, by leveraging control over any Google syndication advertising domain. + + + + + + + + + + http://www.internetsociety.org/ndss2014/programme#session3 + http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf + [oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap + + + + + + + + + + The Edinburgh by Bus application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently access external-storage resources, by leveraging control over one of a number of "obscure Eastern European dating sites." + + + + + + + + + + + + http://www.internetsociety.org/ndss2014/programme#session3 + http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf + [oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap + + + + + + + + + + The DrinkedIn BarFinder application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently obtain sensitive fine-geolocation information, by leveraging control over one of a number of adult sites, as demonstrated by (1) freelifetimecheating.com and (2) www.babesroulette.com. + + + + + + + + + + http://www.internetsociety.org/ndss2014/programme#session3 + http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf + [oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the name field to groups/create/step/group-details. NOTE: this can be exploited without authentication by leveraging CVE-2014-1889. + + + + + + + + + + buddypress-cve20141888-xss(91175) + 65555 + 20140213 Wordpress plugin Buddypress <= 1.9.1 stored xss vulnerability + 56950 + http://packetstormsecurity.com/files/125212/WordPress-Buddypress-1.9.1-Cross-Site-Scripting.html + 103307 + http://buddypress.org/2014/02/buddypress-1-9-2 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Multiple integer overflows in the (1) FLASK_GETBOOL, (2) FLASK_SETBOOL, (3) FLASK_USER, and (4) FLASK_CONTEXT_TO_SID suboperations in the flask hypercall in Xen 4.3.x, 4.2.x, 4.1.x, 3.2.x, and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1892, CVE-2014-1893, and CVE-2014-1894. + + + + + + + + + http://xenbits.xen.org/xsa/advisory-84.html + [oss-security] 20140210 Xen Security Advisory 84 (CVE-2014-1891,CVE-2014-1892,CVE-2014-1893,CVE-2014-1894) - integer overflow in several XSM/Flask hypercalls + [oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls + [oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls + SUSE-SU-2014:0446 + SUSE-SU-2014:0373 + SUSE-SU-2014:0372 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Xen 3.3 through 4.1, when XSM is enabled, allows local users to cause a denial of service via vectors related to a "large memory allocation," a different vulnerability than CVE-2014-1891, CVE-2014-1893, and CVE-2014-1894. + + + + + + + + + http://xenbits.xen.org/xsa/advisory-84.html + [oss-security] 20140210 Xen Security Advisory 84 (CVE-2014-1891,CVE-2014-1892,CVE-2014-1893,CVE-2014-1894) - integer overflow in several XSM/Flask hypercalls + [oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls + [oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls + SUSE-SU-2014:0446 + SUSE-SU-2014:0373 + SUSE-SU-2014:0372 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Multiple integer overflows in the (1) FLASK_GETBOOL and (2) FLASK_SETBOOL suboperations in the flask hypercall in Xen 4.1.x, 3.3.x, 3.2.x, and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1891, CVE-2014-1892, and CVE-2014-1894. + + + + + + + + + http://xenbits.xen.org/xsa/advisory-84.html + [oss-security] 20140210 Xen Security Advisory 84 (CVE-2014-1891,CVE-2014-1892,CVE-2014-1893,CVE-2014-1894) - integer overflow in several XSM/Flask hypercalls + [oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls + [oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls + SUSE-SU-2014:0446 + SUSE-SU-2014:0373 + SUSE-SU-2014:0372 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Multiple integer overflows in unspecified suboperations in the flask hypercall in Xen 3.2.x and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1891, CVE-2014-1892, and CVE-2014-1893. + + + + + + + + + http://xenbits.xen.org/xsa/advisory-84.html + [oss-security] 20140210 Xen Security Advisory 84 (CVE-2014-1891,CVE-2014-1892,CVE-2014-1893,CVE-2014-1894) - integer overflow in several XSM/Flask hypercalls + [oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls + [oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls + SUSE-SU-2014:0446 + SUSE-SU-2014:0373 + SUSE-SU-2014:0372 + + + + + + + + + + + + + + + + + + Off-by-one error in the flask_security_avc_cachestats function in xsm/flask/flask_op.c in Xen 4.2.x and 4.3.x, when the maximum number of physical CPUs are in use, allows local users to cause a denial of service (host crash) or obtain sensitive information from hypervisor memory by leveraging a FLASK_AVC_CACHESTAT hypercall, which triggers a buffer over-read. + + + + + + + + + + http://xenbits.xen.org/xsa/advisory-85.html + [oss-security] 20140210 Xen Security Advisory 85 (CVE-2014-1895) - Off-by-one error in FLASK_AVC_CACHESTAT hypercall + [oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls + SUSE-SU-2014:0373 + + + + + + + + + + + + + + + The (1) do_send and (2) do_recv functions in io.c in libvchan in Xen 4.2.x, 4.3.x, and 4.4-RC series allows local guests to cause a denial of service or possibly gain privileges via crafted xenstore ring indexes, which triggers a "read or write past the end of the ring." + + + + + + + + + + + http://xenbits.xen.org/xsa/xsa86.patch + http://xenbits.xen.org/xsa/advisory-86.html + [oss-security] 20140210 Xen Security Advisory 86 (CVE-2014-1896) - libvchan failure handling malicious ring indexes + [oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls + SUSE-SU-2014:0373 + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in Citrix NetScaler Gateway (formerly Citrix Access Gateway Enterprise Edition) 9.x before 9.3.66.5 and 10.x before 10.1.123.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + https://support.citrix.com/article/CTX140291 + + + + + admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not restrict the set of functions accessible to the API handler, which allows remote attackers to execute arbitrary PHP code via the function and args parameters to admin/config.php. + + + + + + + + + + + 20140211 [CVE-2014-1903] FreePBX 2.9 through 12 RCE + http://www.freepbx.org/news/2014-02-06/security-vulnerability-notice + http://packetstormsecurity.com/files/125215/FreePBX-2.9-Remote-Code-Execution.html + http://packetstormsecurity.com/files/125166/FreePBX-2.x-Code-Execution.html + 103240 + http://issues.freepbx.org/browse/FREEPBX-7123 + http://issues.freepbx.org/browse/FREEPBX-7117 + http://code.freepbx.org/changelog/FreePBX_SVN?cs=16429 + http://code.freepbx.org/changelog/FreePBX_Framework?cs=a29382efeb293ef4f42aa9b841dfc8eabb2d1e03 + 20140211 Re: Freepbx , php code execution exploit + 20140211 Freepbx , php code execution exploit + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action. + + + + + + + + + + https://jira.springsource.org/browse/SPR-11426 + https://github.com/spring-projects/spring-framework/commit/741b4b229ae032bd17175b46f98673ce0bd2d485 + 20140311 CVE-2014-1904 XSS when using Spring MVC + http://www.gopivotal.com/security/cve-2014-1904 + 57915 + RHSA-2014:0400 + http://docs.spring.io/spring/docs/3.2.8.RELEASE/changelog.txt + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) m parameter to lb_status.php; (2) msg parameter to vc_chatlog.php; n parameter to (3) channel.php, (4) htmlchat.php, (5) video.php, or (6) videotext.php; (7) message parameter to lb_logout.php; or ct parameter to (8) lb_status.php or (9) v_status.php in ls/. + + + + + + + + + + https://www.htbridge.com/advisory/HTB23199 + videowhisper-cve20141906-xss(91477) + http://packetstormsecurity.com/files/125454 + + + + + + + + + + + + + + + + + + + + Multiple directory traversal vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_login.php or (2) delete arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_logout.php. + + + + + + + + + + https://www.htbridge.com/advisory/HTB23199 + videowhisper-cve20141907-dir-trav(91478) + http://packetstormsecurity.com/files/125454 + + + + + + + + + + + + + + + + + + + + Citrix ShareFile Mobile and ShareFile Mobile for Tablets before 2.4.4 for Android do not verify X.509 certificates from SSL servers, which allow man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. + + + + + + + + + + http://support.citrix.com/article/CTX140303 + 1029791 + 57020 + + + + + + + + + + + + + The Foscam FI8910W camera with firmware before 11.37.2.55 allows remote attackers to obtain sensitive video and image data via a blank username and password. + + + + + + + + + VU#525132 + http://foscam.us/forum/mjpeg-54-firmware-bug-user-logon-bypass-t8442.html + + + + + + + + + + + + + Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3.3.4, and 3.4.x before 3.4rc1 allows remote attackers to execute arbitrary code via a crafted string. + + + + + + + + + + + http://bugs.python.org/issue20246 + https://www.trustedsec.com/february-2014/python-remote-code-execution-socket-recvfrom_into/ + USN-2125-1 + 1029831 + [oss-security] 20140212 Re: CVE request? buffer overflow in socket.recvfrom_into + 31875 + DSA-2880 + http://pastebin.com/raw.php?i=GHXSmNEg + http://hg.python.org/cpython/rev/87673659d8f7 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to inject arbitrary web script or HTML via the (1) topic parameter to sw/add_topic.php or (2) nick parameter to sw/chat/message.php. + + + + + + + + + + commandschool-message-xss(90179) + commandschool-addtopic-xss(90178) + 64707 + http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html + 101892 + 101891 + + + + + + + + + + Multiple cross-site request forgery (CSRF) vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to hijack the authentication of (1) administrators for requests that change the administrator password via an update action to sw/admin_change_password.php or (2) unspecified victims for requests that add a topic or blog entry to sw/add_topic.php. NOTE: vector 2 can be leveraged to bypass the authentication requirements for exploiting vector 1 in CVE-2014-1914. + + + + + + + + + + + + 64707 + http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html + 101890 + 101889 + + + + + + + + + + The (1) opus_packet_get_nb_frames and (2) opus_packet_get_samples_per_frame functions in the client in MumbleKit before commit fd190328a9b24d37382b269a5674b0c0c7a7e36d and Mumble for iOS 1.1 through 1.2.2 do not properly check the return value of the copyDataBlock method, which allow remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted length prefix value in an Opus voice packet. + + + + + + + + + 102957 + http://mumble.info/security/Mumble-SA-2014-003.txt + + + + + + + + + + + + + + + + + + parcimonie before 0.8.1, when using a large keyring, sleeps for the same amount of time between fetches, which allows attackers to correlate key fetches via unspecified vectors. + + + + + + + + + + + https://gaffer.ptitcanardnoir.org/intrigeri/files/parcimonie/App-Parcimonie-0.8.1.tar.gz + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=738134 + parcimonie-cve20141921-info-disc(91118) + 65505 + DSA-2860 + [oss-security] 20140210 Re: CVE request: parcimonie (0.6 to 0.8, included) possible correlation between key fetches + [oss-security] 20140210 CVE request: parcimonie (0.6 to 0.8, included) possible correlation between key fetches + + + + + + + + + + + + + Visibility Software Cyber Recruiter before 8.1.00 does not use the appropriate combination of HTTPS transport and response headers to prevent access to (1) AppSelfService.aspx and (2) AgencyPortal.aspx in the browser history, which allows remote attackers to obtain sensitive information by leveraging an unattended workstation. + + + + + + + + + VU#566894 + http://www.vspublic.com/help/Cyber%20Recruiter/default.aspx?pageid=release_details + 65305 + 102815 + 102814 + http://jvn.jp/vu/JVNVU97441356/index.html + + + + + + + + + + + + + + + + The user login page in Visibility Software Cyber Recruiter before 8.1.00 generates different responses for invalid password-retrieval attempts depending on which data elements are incorrect, which might allow remote attackers to obtain account-related information via a series of requests. + + + + + + + + + http://www.vspublic.com/help/Cyber%20Recruiter/default.aspx?pageid=release_details + 65564 + + + + + + + + + + + + + + + + The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file. + + + + + + + + + + + https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7 + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059 + USN-2168-1 + [oss-security] 20140210 Re: CVE requests: Pacemaker, Python Imaging Library, eyeD3, 9base, rc, Gamera, RPLY - insecure use of /tmp + + + + + + + + + + + + + The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes. + + + + + + + + + https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7 + USN-2168-1 + [oss-security] 20140210 Re: CVE requests: Pacemaker, Python Imaging Library, eyeD3, 9base, rc, Gamera, RPLY - insecure use of /tmp + [oss-security] 20140210 CVE requests: Pacemaker, Python Imaging Library, eyeD3, 9base, rc, Gamera, RPLY - insecure use of /tmp + + + + + + + + + + + + + java/android/webkit/BrowserFrame.java in Android before 4.4 uses the addJavascriptInterface API in conjunction with creating an object of the SearchBoxImpl class, which allows attackers to execute arbitrary Java code by leveraging access to the searchBoxJavaBridge_ interface at certain Android API levels. + + + + + + + + + + + [oss-security] 20140210 CVE-2014-1939 searchBoxJavaBridge_ in Android Jelly Bean + http://blog.chromium.org/2013/11/introducing-chromium-powered-android.html + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in aal/loginverification.aspx in Pearson eSIS Enterprise Student Information System allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + VU#163188 + + + + + + + + + + Fine Free file before 5.17 allows context-dependent attackers to cause a denial of service (infinite recursion, CPU consumption, and crash) via a crafted indirect offset value in the magic of a file. + + + + + + + + + https://github.com/glensc/file/blob/FILE5_17/ChangeLog + USN-2126-1 + USN-2123-1 + http://www.php.net/ChangeLog-5.php + DSA-2868 + DSA-2861 + [file] 20140213 segfault in magic_buffer + [file] 20140211 segfault in magic_buffer + [file] 20140211 segfault in magic_buffer + [file] 20142010 segfault in magic_buffer + openSUSE-SU-2014:0367 + openSUSE-SU-2014:0364 + + + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in Ilch CMS 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the text parameter to index.php/guestbook/index/newentry. + + + + + + + + + + https://github.com/IlchCMS/Ilch-2.0/commit/381e15f39d07d3cdf6aaaa25c0f2321f817935f7 + https://www.htbridge.com/advisory/HTB23203 + ilchcms-cve20141944-xss(91538) + 20140305 Cross-Site Scripting (XSS) in Ilch CMS + 32076 + + + + + + + + + + SQL injection vulnerability in ajax_udf.php in OpenDocMan before 1.2.7.2 allows remote attackers to execute arbitrary SQL commands via the add_value parameter. + + + + + + + + + + + http://www.opendocman.com/opendocman-v1-2-7-2-released + http://www.opendocman.com/opendocman-v1-2-7-1-release + https://www.htbridge.com/advisory/HTB23202 + 65775 + 56189 + + + + + + + + + + + + + + + + + + + + + OpenStack Image Registry and Delivery Service (Glance) 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the Swift store backend password when authentication fails and WARNING level logging is enabled, which allows local users to obtain sensitive information by reading the log. + + + + + + + + + + https://bugs.launchpad.net/glance/+bug/1275062 + 65507 + [oss-security] 20140212 [OSSA 2014-004] Glance Swift store backend password leak (CVE-2014-1948) + 56419 + RHSA-2014:0229 + + + + + + + + + + + Use-after-free vulnerability in the xc_cpupool_getinfo function in Xen 4.1.x through 4.3.x, when using a multithreaded toolstack, does not properly handle a failure by the xc_cpumap_alloc function, which allows local users with access to management functions to cause a denial of service (heap corruption) and possibly gain privileges via unspecified vectors. + + + + + + + + + + + http://xenbits.xen.org/xsa/advisory-88.html + [oss-security] 20140212 Xen Security Advisory 88 (CVE-2014-1950) - use-after-free in xc_cpupool_getinfo() under memory pressure + SUSE-SU-2014:0373 + SUSE-SU-2014:0372 + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + http://www.fortiguard.com/advisory/FG-IR-13-009/ + + + + + + + + + + CRLF injection vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors. + CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') "http://cwe.mitre.org/data/definitions/113.html" + + + + + + + + + + + http://www.fortiguard.com/advisory/FG-IR-13-009/ + + + + + + + + + + FortiGuard FortiWeb before 5.0.3 allows remote authenticated users to gain privileges via unspecified vectors. + + + + + + + + + + + + http://www.fortiguard.com/advisory/FG-IR-13-009/ + + + + + + + + + + lib/x509/verify.c in GnuTLS before 3.1.21 and 3.2.x before 3.2.11 treats version 1 X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates. + + + + + + + + + + https://www.gitorious.org/gnutls/gnutls/commit/b1abfe3d182d68539900092eb42fc62cf1bb7e7c + USN-2121-1 + http://www.gnutls.org/security.html + DSA-2866 + [oss-security] 20140213 Re: CVE Request - GnuTLS corrects flaw in certificate verification (3.1.x/3.2.x) + [oss-security] 20140213 CVE Request - GnuTLS corrects flaw in certificate verification (3.1.x/3.2.x) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The Solution Manager in SAP NetWeaver does not properly restrict access, which allows remote attackers to obtain sensitive information via unspecified vectors. + + + + + + + + + https://service.sap.com/sap/support/notes/1828885 + netweaver-solution-info-disc(91093) + 56942 + http://scn.sap.com/docs/DOC-8218 + http://erpscan.com/advisories/erpscan-14-004-sap-netweaver-solution-manager-missing-authorization-check-information-disclosure/ + + + + + + + + + + + + + + Unspecified vulnerability in the Portal WebDynPro in SAP NetWeaver allows remote attackers to obtain sensitive path information via unknown attack vectors. + + + + + + + + + https://service.sap.com/sap/support/notes/1852146 + netweaver-webdyn-path-disclosure(91096) + 56947 + http://scn.sap.com/docs/DOC-8218 + http://erpscan.com/advisories/erpscan-14-002-sap-portal-webdynpro-path-disclosure/ + + + + + + + + + + Gwsync in SAP CRM 7.02 EHP 2 allows remote attackers to obtain sensitive information via unspecified vectors, related to an XML External Entity (XXE) issue. + + + + + + + + + https://service.sap.com/sap/support/notes/1917054 + sap-crm-info-disc(91098) + 56944 + http://scn.sap.com/docs/DOC-8218 + http://erpscan.com/advisories/erpscan-14-003-sap-crm-gwsync-xxe/ + + + + + + + + + + Unspecified vulnerability in Message Server in SAP NetWeaver 7.20 allows remote attackers to cause a denial of service via unknown attack vectors. + + + + + + + + + https://service.sap.com/sap/support/notes/1773912 + netweaver-message-server-dos(91097) + 56947 + http://scn.sap.com/docs/DOC-8218 + http://erpscan.com/advisories/erpscan-14-001-sap-netweaver-message-server-dos/ + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the Integration Repository in the SAP Exchange Infrastructure (BC-XI) component in SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via vectors related to the ESR application and a DIR error. + + + + + + + + + + https://service.sap.com/sap/support/notes/1788080 + netweaver-dir-xss(91095) + 56947 + http://scn.sap.com/docs/DOC-8218 + http://erpscan.com/advisories/erpscan-14-005-sap-netweaver-dir-error-xss/ + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in ISpeakAdapter in the Integration Repository in the SAP Exchange Infrastructure (BC-XI) component 3.0, 7.00 through 7.02, and 7.10 through 7.11 for SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via vectors related to PIP. + + + + + + + + + + https://service.sap.com/sap/support/notes/1442517 + netweaver-ispeakadapter-xss(91094) + http://www.stechno.net/sap-notes.html?view=sapnote&id=1442517 + 56947 + http://erpscan.com/advisories/erpscan-14-006-sap-netweaver-pip-xss/ + + + + + + + + + + + + + + + The SNMP implementation in Siemens RuggedCom ROS before 3.11, ROS 3.11 for RS950G, ROS 3.12 before 3.12.4, and ROS 4.0 for RSG2488 allows remote attackers to cause a denial of service (device outage) via crafted packets. + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-051-03 + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-892342.pdf + + + + + + + + + + + + + + + + + + + + The Denny's application before 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. + + + + + + + + + + https://play.google.com/store/apps/details?id=jp.denimoba + JVNDB-2014-000022 + JVN#48810179 + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the XooNIps module 3.47 and earlier for XOOPS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + http://xoonips.sourceforge.jp + JVNDB-2014-000025 + JVN#87797318 + + + + + + + + + + + + + + + + + Directory traversal vulnerability in the apps4u@android SD Card Manager application before 20140224 for Android allows attackers to overwrite or create arbitrary files via a crafted filename. + + + + + + + + + + JVNDB-2014-000035 + JVN#47386847 + + + + + + + + + + Directory traversal vulnerability in the ES File Explorer File Manager application before 3.0.4 for Android allows remote attackers to overwrite or create arbitrary files via unspecified vectors. + + + + + + + + + + JVNDB-2014-000033 + JVN#70029459 + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in Silex before 2.0.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + https://github.com/silexlabs/Silex/blob/master/docs/change-log.md + JVNDB-2014-000032 + JVN#14282890 + + + + + + + + + + Directory traversal vulnerability in the LYSESOFT AndExplorer application before 20140403 and AndExplorerPro application before 20140405 for Android allows attackers to overwrite or create arbitrary files via unspecified vectors. + + + + + + + + + + https://play.google.com/store/apps/details?id=lysesoft.andexplorerpro + https://play.google.com/store/apps/details?id=lysesoft.andexplorer + JVNDB-2014-000037 + JVN#22670349 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Directory traversal vulnerability in the R-Company Unzipper application 1.0.1 and earlier for Android allows remote attackers to overwrite or create arbitrary files via a crafted filename. + + + + + + + + + + + https://play.google.com/store/apps/details?id=org.rhorita777.unzipper + JVNDB-2014-000031 + JVN#38227002 + http://jvn.jp/en/jp/JVN38227002/995495/index.html + + + + + + + + + + + The Demaecan application 2.1.0 and earlier for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. + + + + + + + + + + https://play.google.com/store/apps/details?id=com.demaecan.androidapp + JVNDB-2014-000030 + JVN#16263849 + + + + + + + + + + + The NTT DOCOMO sp mode mail application 6300 and earlier for Android 4.0.x and 6700 and earlier for Android 4.1 through 4.4 uses weak permissions for attachments during processing of incoming e-mail messages, which allows attackers to obtain sensitive information via a crafted application. + + + + + + + + + JVNDB-2014-000027 + JVN#81739241 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The application link interface in the NTT DOCOMO sp mode mail application 6100 through 6300 for Android 4.0.x and 6130 through 6700 for Android 4.1 through 4.4 writes message content to the SD card during e-mail composition, which allows attackers to obtain sensitive information via a crafted application. + + + + + + + + + JVNDB-2014-000028 + JVN#05951929 + + + + + + + + + + + + + The NTT DOCOMO sp mode mail application 5900 through 6300 for Android 4.0.x and 6000 through 6620 for Android 4.1 through 4.4 allows remote attackers to execute arbitrary Java methods via Deco-mail emoticon POP data in an e-mail message. + + + + + + + + + + + + JVNDB-2014-000029 + JVN#89260331 + + + + + + + + + + + + + + The administrative interface in Allied Telesis AT-RG634A ADSL Broadband router 3.3+, iMG624A firmware 3.5, iMG616LH firmware 2.4, and iMG646BD firmware 3.5 allows remote attackers to gain privileges and execute arbitrary commands via a direct request to cli.html. + + + + + + + + + + + 32545 + 20140326 [GTA-2014-01] - Allied Telesis AT-RG634A ADSL Broadband router hidden administrative unauthenticated webshell. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in Cybozu Remote Service Manager through 2.3.0 and 3.x before 3.1.1 allows remote attackers to cause a denial of service (CPU consumption) via unknown vectors. + + + + + + + + + http://cs.cybozu.co.jp/information/20130317notice01.php + JVNDB-2014-000039 + JVN#10319260 + + + + + + + + + + + Session fixation vulnerability in the management screen in Cybozu Remote Service Manager through 2.3.0 and 3.x before 3.1.1 allows remote attackers to hijack web sessions via unspecified vectors. + + + + + + + + + + + http://cs.cybozu.co.jp/information/20130317notice02.php + JVNDB-2014-000040 + JVN#00058727 + + + + + + + + + + + Open redirect vulnerability in the redirect_back_or_default function in app/controllers/application_controller.rb in Redmine before 2.4.5 and 2.5.x before 2.5.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the back url (back_url parameter). + + + + + + + + + + + http://www.redmine.org/projects/redmine/wiki/Security_Advisories + https://github.com/redmine/redmine/commit/7567c3d8b21fe67e5f04e6839c1fce061600f2f3 + http://www.redmine.org/projects/redmine/wiki/Changelog_2_4 + http://www.redmine.org/projects/redmine/wiki/Changelog + 57524 + [oss-security] 20140410 Re: CVE request: redmine open redirector + + + + + + + + + + + + + + + The Content Provider in the KOKUYO CamiApp application 1.21.1 and earlier for Android allows attackers to bypass intended access restrictions and read database information via a crafted application. + + + + + + + + + + https://play.google.com/store/apps/details?id=jp.co.kokuyost.CamiApp + JVNDB-2014-000036 + JVN#55438786 + + + + + + + + + + The Phone Messages feature in Cybozu Garoon 2.0.0 through 3.7 SP2 allows remote authenticated users to cause a denial of service (resource consumption) via unspecified vectors. + + + + + + + + + https://support.cybozu.com/ja-jp/article/8105 + JVNDB-2014-000042 + JVN#90519014 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cybozu Garoon 3.0 through 3.7 SP3 allows remote authenticated users to bypass intended access restrictions and delete schedule information via unspecified API calls. + + + + + + + + + + + https://support.cybozu.com/ja/article/5264 + JVNDB-2014-000043 + JVN#31230946 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site request forgery (CSRF) vulnerability in TopAccess (aka the web-based management utility) on TOSHIBA TEC e-Studio 232, 233, 282, and 283 devices allows remote attackers to hijack the authentication of administrators for requests that change passwords. + + + + + + + + + + + + http://www.toshibatec.co.jp/page.jsp?id=4224 + JVNDB-2014-000038 + JVN#13313061 + + + + + + + + + + + + + + + + + + + Stack-based buffer overflow in the xps_parse_color function in xps/xps-common.c in MuPDF 1.3 and earlier allows remote attackers to execute arbitrary code via a large number of entries in the ContextColor value of the Fill attribute in a Path element. + + + + + + + + + + + http://www.hdwsec.fr/blog/mupdf.html + [oss-security] 20140218 Re: CVE request: MuPDF Stack-based Buffer Overflow in xps_parse_color() + 20140120 0day - MuPDF Stack-based Buffer Overflow in xps_parse_color() + openSUSE-SU-2014:0309 + http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=60dabde18d7fe12b19da8b509bdfee9cc886aafc + http://bugs.ghostscript.com/show_bug.cgi?id=694957 + + + + + + + + + + + + + imapsync before 1.584, when running with the --tls option, attempts a cleartext login when a certificate verification failure occurs, which allows remote attackers to obtain credentials by sniffing the network. + + + + + + + + + [oss-security] 20140218 Re: CVE request: "imapsync ignores the --tls switch and sends my authentication plaintext." + FEDORA-2014-2505 + https://github.com/imapsync/imapsync/issues/15 + https://bugs.mageia.org/show_bug.cgi?id=12770 + MDVSA-2014:060 + [imapsync_list] 20140122 Re: [imapsync] Upon certificate issues STARTTLS is ignored and the password sent in plaintext (#15) + [imapsync_list] 20140120 Re: [imapsync] STARTTLS support (#15) + [oss-security] 20140217 CVE request: "imapsync ignores the --tls switch and sends my authentication plaintext." + + + + + + + + + + + + + + + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in OXID eShop Professional and Community Edition 4.6.8 and earlier, 4.7.x before 4.7.11, and 4.8.x before 4.8.4, and Enterprise Edition 4.6.8 and earlier, 5.0.x before 5.0.11 and 5.1.x before 5.1.4 allow remote attackers to inject arbitrary web script or HTML via the searchtag parameter to the getTag function in (1) application/controllers/details.php or (2) application/controllers/tag.php. + + + + + + + + + + http://wiki.oxidforge.org/Security_bulletins/2014-001 + 57438 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8, Thunderbird ESR 17.x through 17.0.10, and SeaMonkey before 2.20 allows user-assisted remote attackers to inject arbitrary web script or HTML via an e-mail message containing a data: URL in a (1) OBJECT or (2) EMBED element, a related issue to CVE-2013-6674. + + + + + + + + + + VU#863369 + https://bugzilla.mozilla.org/show_bug.cgi?id=875818 + http://www.vulnerability-lab.com/get_content.php?id=953 + http://www.mozilla.org/security/announce/2014/mfsa2014-14.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The iCloud subsystem in Apple iOS before 7.1 allows physically proximate attackers to bypass an intended password requirement, and turn off the Find My iPhone service or complete a Delete Account action and then associate this service with a different Apple ID account, by entering an arbitrary iCloud Account Password value and a blank iCloud Account Description value. + + + + + + + + + http://www.youtube.com/watch?v=QnPk4RRWjic + http://support.apple.com/kb/HT6162 + http://news.softpedia.com/news/Major-iOS-7-Security-Flaw-Discovered-Video-425011.shtml + + + + + + + + + + + + + + ext/gd/gd.c in PHP 5.5.x before 5.5.9 does not check data types, which might allow remote attackers to obtain sensitive information by using a (1) string or (2) array data type in place of a numeric data type, as demonstrated by an imagecrop function call with a string for the x dimension value, a different vulnerability than CVE-2013-7226. + + + + + + + + + https://github.com/php/php-src/commit/2938329ce19cb8c4197dec146c3ec887c6f61d01 + https://bugs.php.net/bug.php?id=66356 + USN-2126-1 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in classes/controller/error.php in Open Classifieds 2 before 2.1.3 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to shared-apartments-rooms/. + + + + + + + + + + https://github.com/open-classifieds/openclassifieds2/commit/45ee8fb601a91b8a4238229580a32a4fd8d96ef9 + https://www.htbridge.com/advisory/HTB23204 + https://github.com/open-classifieds/openclassifieds2/issues/556 + 20140312 Cross-Site Scripting (XSS) in Open Classifieds + + + + + + + + + + + + + + + + + + + + + The caching feature in SGOS in Blue Coat ProxySG 5.5 through 5.5.11.3, 6.1 through 6.1.6.3, 6.2 through 6.2.15.3, 6.4 through 6.4.6.1, and 6.3 and 6.5 before 6.5.4 allows remote authenticated users to bypass intended access restrictions during a time window after account deletion or modification by leveraging knowledge of previously valid credentials. + + + + + + + + + + + VU#221620 + https://kb.bluecoat.com/index?page=content&id=SA77 + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in Sonatype Nexus OSS and Pro 2.4.0 through 2.7.1 allows attackers to create arbitrary user accounts via unknown vectors related to "an unauthenticated execution path." + + + + + + + + + + + https://support.sonatype.com/entries/42374566-CVE-2014-2034-Nexus-Security-Advisory-REST-API + http://www.sonatype.org/advisories/archive/2014-03-03-Nexus + 65956 + 104049 + 57142 + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in xhr.php in InterWorx Web Control Panel (aka InterWorx Hosting Control Panel and InterWorx-CP) before 5.0.13 build 574 allows remote attackers to inject arbitrary web script or HTML via the i parameter. + + + + + + + + + + 20140220 [CVE-2014-2035] XSS in InterWorx Web Control Panel <= 5.0.12 + http://www.interworx.com/developers/changelog/version-5-0-13-build-574-2014-02-19 + + + + + + + + + + + + + + The nfs_can_extend_write function in fs/nfs/write.c in the Linux kernel before 3.13.3 relies on a write delegation to extend a write operation without a certain up-to-date verification, which allows local users to obtain sensitive information from kernel memory in opportunistic circumstances by writing to a file in an NFS filesystem and then reading the same file. + + + + + + + + + + + https://github.com/torvalds/linux/commit/263b4509ec4d47e0da3e753f85a39ea12d1eff24 + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=263b4509ec4d47e0da3e753f85a39ea12d1eff24 + https://bugzilla.redhat.com/show_bug.cgi?id=1066939 + USN-2140-1 + USN-2137-1 + [oss-security] 20140221 Re: Re: CVE request: Linux kernel: nfs: information leakage + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.3 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + arch/s390/kernel/head64.S in the Linux kernel before 3.13.5 on the s390 platform does not properly handle attempted use of the linkage stack, which allows local users to cause a denial of service (system crash) by executing a crafted instruction. + + + + + + + + + https://github.com/torvalds/linux/commit/8d7f6690cedb83456edd41c9bd583783f0703bf0 + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8d7f6690cedb83456edd41c9bd583783f0703bf0 + https://bugzilla.redhat.com/show_bug.cgi?id=1067558 + [oss-security] 20140220 Re: CVE Request: Linux kernel: s390: crash due to linkage stack instruction + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.5 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in the (1) callback_multicheck, (2) callback_radio, and (3) callback_wysiwygin functions in mfrh_class.settings-api.php in the Media File Renamer plugin 1.7.0 for WordPress allow remote authenticated users with permissions to add media or edit media to inject arbitrary web script or HTML via unspecified parameters, as demonstrated by the title of an uploaded file. + + + + + + + + + + http://www.vapid.dhs.org/advisories/wordpress/plugins/MediaFileRenamer-1.7.0/index.html + 65715 + 20140226 Persistent XSS in Media File Renamer V1.7.0 wordpress plugin + + + + + + + + + + Unrestricted file upload vulnerability in the Manage Project functionality in Livetecs Timelive before 6.5.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in a predictable directory in Uploads/. + Per: http://cwe.mitre.org/data/definitions/434.html + +"CWE-434: Unrestricted Upload of File with Dangerous Type" + + + + + + + + + + + 20140423 CVE-2014-2042 - Unrestricted file upload in Livetecs Timelive + 20140423 CVE-2014-2042 - Unrestricted file upload in Livetecs Timelive + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + SQL injection vulnerability in Resources/System/Templates/Data.aspx in Procentia IntelliPen before 1.1.18.1658 allows remote authenticated users to execute arbitrary SQL commands via the value parameter. + + + + + + + + + + + https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2043 + 20140312 CVE-2014-2043 - SQL Injection in Procentia IntelliPen + 32212 + + + + + + + + + + Session fixation vulnerability in ownCloud before 6.0.2, when PHP is configured to accept session parameters through a GET request, allows remote attackers to hijack web sessions via unspecified vectors. + + + + + + + + + + + http://owncloud.org/about/security/advisories/oC-SA-2014-001/ + + + + + + + + + + + The default Flash Cross Domain policies in ownCloud before 5.0.15 and 6.x before 6.0.2 allows remote attackers to access user files via unspecified vectors. + + + + + + + + + http://owncloud.org/about/security/advisories/oC-SA-2014-003/ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 6.0.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + http://owncloud.org/about/security/advisories/oC-SA-2014-007/ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Directory traversal vulnerability in the CLI job creation (hudson/cli/CreateJobCommand.java) in CloudBees Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to overwrite arbitrary files via the job name. + + + + + + + + + + + https://github.com/jenkinsci/jenkins/commit/ad38d8480f20ce3cbf8fec3e2003bc83efda4f7d + https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14 + jenkins-cve20142059-dir-trav(91346) + [oss-security] 20140220 Re: Possible CVE Requests: several issues fixed in Jenkins (Advisory 2014-02-14) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in java/hudson/model/Cause.java in CloudBees Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to inject arbitrary web script or HTML via a "remote cause note." + + + + + + + + + https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14 + https://github.com/jenkinsci/jenkins/commit/5d57c855f3147bfc5e7fda9252317b428a700014 + jenkins-cve20142067-xss(91354) + [oss-security] 20140220 Re: Possible CVE Requests: several issues fixed in Jenkins (Advisory 2014-02-14) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + TIBCO Enterprise Administrator 1.0.0 and Enterprise Administrator SDK 1.0.0 do not properly enforce administrative authentication requirements, which allows remote attackers to execute arbitrary commands via unspecified vectors. + + + + + + + + + + + http://www.tibco.com/multimedia/enterprise_administator_advisory_20140226_tcm8-20533.txt + http://www.tibco.com/mk/advisory.jsp + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite 7.4.1 before 7.4.1-rev10 and 7.4.2 before 7.4.2-rev8 allows remote attackers to inject arbitrary web script or HTML via the subject of an email, involving 'the aria "tags" for screenreaders at the top bar'. + + + + + + + + + + 57290 + 20140317 Open-Xchange Security Advisory 2014-03-17 + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in ModX Evolution before 2.2.11 allows remote attackers to inject arbitrary web script or HTML via the "a" parameter. + + + + + + + + + + https://github.com/modxcms/revolution/commit/77463eb6a8090f474b04fdc1b72225cb93c558ea + http://modx.com/blog/2014/01/21/revolution-2.2.11%E2%80%94security-fixes-and-prevent-change-loss + 57038 + [oss-security] 20140224 Re: CVE request: XSS in MODX Revolution before 2.2.11 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Stack-based buffer overflow in the CDownloads_Deleted::UpdateDownload function in Downloads_Deleted.cpp in Free Download Manager 3.9.3 build 1360, 3.8 build 1173, 3.0 build 852, and earlier allows user-assisted remote attackers to execute arbitrary code via a long file name, which is then deleted from the download queue by the user. + + + + + + + + + + + + https://www.rcesecurity.com/2014/03/cve-2014-2087-free-download-manager-cdownloads_deleted-updatedownload-remote-code-execution + 66211 + + + + + + + + + + + Unrestricted file upload vulnerability in ilias.php in ILIAS 4.4.1 allows remote authenticated users to execute arbitrary PHP code by using a .php filename in an upload_files action to the uploadFiles command, and then accessing the .php file via a direct request to a certain client_id pathname. + Per: http://cwe.mitre.org/data/definitions/434.html + +"CWE-434: Unrestricted Upload of File with Dangerous Type" + + + + + + + + + + + http://packetstormsecurity.com/files/125350/ILIAS-4.4.1-Cross-Site-Scripting-Shell-Upload.html + + + + + + + + + + ILIAS 4.4.1 allows remote attackers to execute arbitrary PHP code via an e-mail attachment that leads to creation of a .php file with a certain client_id pathname. + + + + + + + + + + + + http://packetstormsecurity.com/files/125350/ILIAS-4.4.1-Cross-Site-Scripting-Shell-Upload.html + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in ilias.php in ILIAS 4.4.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) tar, (2) tar_val, or (3) title parameter. + + + + + + + + + + http://packetstormsecurity.com/files/125350/ILIAS-4.4.1-Cross-Site-Scripting-Shell-Upload.html + + + + + + + + + + Cross-site scripting (XSS) vulnerability in mods/_standard/forums/admin/forum_add.php in ATutor 2.1.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the title parameter in an add_forum action. NOTE: the original disclosure also reported issues that may not cross privilege boundaries. + + + + + + + + + + http://packetstormsecurity.com/files/125348/ATutor-2.1.1-Cross-Site-Scripting.html + + + + + + + + + + Cross-site scripting (XSS) vulnerability in lib/filemanager/ImageManager/editorFrame.php in CMS Made Simple 1.11.10 allows remote attackers to inject arbitrary web script or HTML via the action parameter, a different issue than CVE-2014-0334. NOTE: the original disclosure also reported issues that may not cross privilege boundaries. + + + + + + + + + + http://packetstormsecurity.com/files/125353/CMSMadeSimple-1.11.10-Cross-Site-Scripting.html + + + + + + + + + + Untrusted search path vulnerability in Catfish through 0.4.0.3 allows local users to gain privileges via a Trojan horse catfish.py in the current working directory. + Per: http://cwe.mitre.org/data/definitions/426.html + +"CWE-426: Untrusted Search Path" + + + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1069396 + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739958 + [oss-security] 20140225 Re: CVE request for catfish program + [oss-security] 20140225 Re: CVE request for catfish program + + + + + + + + + + + + + Untrusted search path vulnerability in Catfish through 0.4.0.3, when a Fedora package such as 0.4.0.2-2 is not used, allows local users to gain privileges via a Trojan horse catfish.pyc in the current working directory. + + + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1069396 + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739958 + [oss-security] 20140225 Re: CVE request for catfish program + [oss-security] 20140225 Re: CVE request for catfish program + + + + + + + + + + + + + Untrusted search path vulnerability in Catfish 0.6.0 through 1.0.0, when a Fedora package such as 0.8.2-1 is not used, allows local users to gain privileges via a Trojan horse bin/catfish.pyc under the current working directory. + Per: http://cwe.mitre.org/data/definitions/426.html + +"CWE-426: Untrusted Search Path" + + + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1069396 + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739958 + [oss-security] 20140225 Re: CVE request for catfish program + [oss-security] 20140225 Re: CVE request for catfish program + + + + + + + + + + + + + + + + + + Untrusted search path vulnerability in Catfish 0.6.0 through 1.0.0 allows local users to gain privileges via a Trojan horse bin/catfish.py under the current working directory. + Per: http://cwe.mitre.org/data/definitions/426.html + +"CWE-426: Untrusted Search Path" + + + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1069396 + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739958 + [oss-security] 20140225 Re: CVE request for catfish program + [oss-security] 20140225 Re: CVE request for catfish program + + + + + + + + + + + + + + + + + + The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before 2.1.4 does not properly validate a certain bits-per-sample value, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted TAK (aka Tom's lossless Audio Kompressor) data. + + + + + + + + + + + + http://git.videolan.org/?p=ffmpeg.git;a=commit;h=f58eab151214d2d35ff0973f2b3e51c5eb372da4 + + + + + + + + + + + + + + + + + libavcodec/wmalosslessdec.c in FFmpeg before 2.1.4 uses an incorrect data-structure size for certain coefficients, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted WMA data. + + + + + + + + + + + + http://git.videolan.org/?p=ffmpeg.git;a=commit;h=ec9578d54d09b64bf112c2bf7a34b1ef3b93dbd3 + + + + + + + + + + + + + + + + + The msrle_decode_frame function in libavcodec/msrle.c in FFmpeg before 2.1.4 does not properly calculate line sizes, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Microsoft RLE video data. + + + + + + + + + + + + http://git.videolan.org/?p=ffmpeg.git;a=commit;h=c919e1ca2ecfc47d796382973ba0e48b8f6f92a2 + + + + + + + + + + + + + + + + + Cisco Unified Contact Center Express (Unified CCX) does not properly restrict the content of the CCMConfig page, which allows remote authenticated users to obtain sensitive information by examining this content, aka Bug ID CSCum95575. + + + + + + + + + 20140225 Cisco Unified Contact Center Express CCMConfig Sensitive Information Disclosure Vulnerability + + + + + + + + + + Cisco Intrusion Prevention System (IPS) Software allows remote attackers to cause a denial of service (MainApp process outage) via malformed SNMP packets, aka Bug IDs CSCum52355 and CSCul49309. + + + + + + + + + 20140227 Cisco IPS MainApp SNMP Denial of Service Vulnerability + + + + + + + + + + + + + + + + + + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in the Business Voice Services Manager (BVSM) page in Cisco Unified Communications Domain Manager 9.0(.1) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCum78536, CSCum78526, CSCum69809, and CSCum63113. + + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=33111 + 20140227 Cisco Unified Communications Domain Manager Cross-Site Scripting Vulnerability + + + + + + + + + + Cisco IOS 15.3M before 15.3(3)M2 and IOS XE 3.10.xS before 3.10.2S allow remote attackers to cause a denial of service (device reload) via crafted SIP messages, aka Bug ID CSCug45898. + + + Per: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-sip + +"The following Cisco IOS Software and Cisco IOS XE Software releases are affected by this vulnerability: + + Cisco IOS Software release 15.3(3)M and 15.3(3)M1 + Cisco IOS XE Software release 3.10.0S and 3.10.1S1" + + + + + + + + + 20140326 Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability + + + + + + + + + + + + + + + Cisco IOS 12.2 and 15.0 through 15.3, when used with the Kailash FPGA before 2.6 on RSP720-3C-10GE and RSP720-3CXL-10GE devices, allows remote attackers to cause a denial of service (route switch processor outage) via crafted IP packets, aka Bug ID CSCug84789. + + + + + + + + + 20140326 Cisco 7600 Series Route Switch Processor 720 with 10 Gigabit Ethernet Uplinks Denial of Service Vulnerability + + + + + + + + + + + + + + + Cisco IOS 12.2 and 15.0 through 15.3 and IOS XE 3.2 through 3.7 before 3.7.5S and 3.8 through 3.10 before 3.10.1S allow remote attackers to cause a denial of service (device reload) via a malformed IKEv2 packet, aka Bug ID CSCui88426. + + + + + + + + + 20140326 Cisco IOS Software Internet Key Exchange Version 2 Denial of Service Vulnerability + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The TCP Input module in Cisco IOS 12.2 through 12.4 and 15.0 through 15.4, when NAT is used, allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted TCP packets, aka Bug IDs CSCuh33843 and CSCuj41494. + + + + + + + + + 20140326 Cisco IOS Software Network Address Translation Vulnerabilities + + + + + + + + + + + + + + + + + The Application Layer Gateway (ALG) module in Cisco IOS 12.2 through 12.4 and 15.0 through 15.4, when NAT is used, allows remote attackers to cause a denial of service (device reload) via crafted DNS packets, aka Bug ID CSCue00996. + + + + + + + + + 20140326 Cisco IOS Software Network Address Translation Vulnerabilities + + + + + + + + + + + + + + + + + The SSL VPN (aka WebVPN) feature in Cisco IOS 15.1 through 15.4 allows remote attackers to cause a denial of service (memory consumption) via crafted HTTP requests, aka Bug ID CSCuf51357. + + + + + + + + + 20140326 Cisco IOS Software SSL VPN Denial of Service Vulnerability + + + + + + + + + + + + + Cisco IOS 15.1 through 15.3 and IOS XE 3.3 and 3.5 before 3.5.2E; 3.7 before 3.7.5S; and 3.8, 3.9, and 3.10 before 3.10.2S allow remote attackers to cause a denial of service (I/O memory consumption and device reload) via a malformed IPv6 packet, aka Bug ID CSCui59540. + + + + + + + + + 20140326 Cisco IOS Software Crafted IPv6 Packet Denial of Service Vulnerability + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in UserServlet in Cisco Emergency Responder (ER) 8.6 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun24384. + + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=33644 + 20140403 Cisco Emergency Responder Cross-Site Scripting Vulnerability + + + + + + + + + + Multiple cross-site request forgery (CSRF) vulnerabilities in CERUserServlet pages in Cisco Emergency Responder (ER) 8.6 and earlier allow remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCun24250. + + + + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=33643 + 20140403 Cisco Emergency Responder Cross-Site Request Forgery Vulnerability + + + + + + + + + + Cisco Emergency Responder (ER) 8.6 and earlier allows remote attackers to inject web pages and modify dynamic content via unspecified parameters, aka Bug ID CSCun37882. + + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=33641 + 20140403 Cisco Emergency Responder Dynamic Content Modification Vulnerability + + + + + + + + + + Multiple open redirect vulnerabilities in Cisco Emergency Responder (ER) 8.6 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified parameters, aka Bug ID CSCun37909. + + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=33642 + 20140403 Cisco Emergency Responder Open Redirect Vulnerability + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in dashboard-related HTML documents in Cisco Prime Security Manager (aka PRSM) 9.2(.1-2) and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCun50687. + + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=33542 + 20140327 Cisco Prime Security Manager Cross-Site Scripting Vulnerability + + + + + + + + + + + + + + + + + + + The End User Safelist/Blocklist (aka SLBL) service in Cisco AsyncOS Software for Email Security Appliance (ESA) before 7.6.3-023 and 8.x before 8.0.1-023 and Cisco Content Security Management Appliance (SMA) before 7.9.1-110 and 8.x before 8.1.1-013 allows remote authenticated users to execute arbitrary code with root privileges via an FTP session that uploads a modified SLBL database file, aka Bug IDs CSCug79377 and CSCug80118. + + + + + + + + + + + 20140319 Cisco AsyncOS Software Code Execution Vulnerability + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun19025. + + + + + + + + + + 20140318 Cisco Adaptive Security Appliance WebVPN Login Page Cross-Site Scripting Vulnerability + + + + + + + + + + The Java-based software in Cisco Hosted Collaboration Solution (HCS) allows remote attackers to cause a denial of service (closing of TCP ports) via unspecified vectors, aka Bug IDs CSCug77633, CSCug77667, CSCug78266, CSCug82795, and CSCuh58643. + + + + + + + + + 1029933 + 66283 + 20140318 Cisco Hosted Collaboration Solution Denial of Service Vulnerability + + + + + + + + + + Memory leak in the GUI in the Impact server in Cisco Hosted Collaboration Solution (HCS) allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, aka Bug ID CSCub58999. + + + + + + + + + cisco-hosted-cve20142122-dos(91907) + 1029936 + 66293 + 20140318 Cisco Hosted Collaboration Solution Memory Leak Vulnerability + + + + + + + + + + Cisco IOS 15.1(2)SY3 and earlier, when used with Supervisor Engine 2T (aka Sup2T) on Catalyst 6500 devices, allows remote attackers to cause a denial of service (device crash) via crafted multicast packets, aka Bug ID CSCuf60783. + + + + + + + + + ciscoios-cve20142124-dos(91904) + 1029942 + 66301 + http://tools.cisco.com/security/center/viewAlert.x?alertId=33413 + 20140319 Cisco IOS Software Sup2T Denial of Service Vulnerability + 57515 + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the Web Inbox in Cisco Unity Connection 8.6(2a)SU3 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCui33028. + + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=33603 + 20140401 Cisco Unity Connection Cross-Site Scripting Vulnerability + + + + + + + + + + + + + + + + Cisco Adaptive Security Appliance (ASA) Software 8.2 before 8.2(5.47), 8.4 before 8.4(7.5), 8.7 before 8.7(1.11), 9.0 before 9.0(3.10), and 9.1 before 9.1(3.4) allows remote authenticated users to gain privileges by leveraging level-0 ASDM access, aka Bug ID CSCuj33496. + + + + + + + + + + + 20140409 Multiple Vulnerabilities in Cisco ASA Software + + + + + + + + + + + + + + Cisco Adaptive Security Appliance (ASA) Software 8.x before 8.2(5.48), 8.3 before 8.3(2.40), 8.4 before 8.4(7.9), 8.6 before 8.6(1.13), 9.0 before 9.0(4.1), and 9.1 before 9.1(4.3) does not properly process management-session information during privilege validation for SSL VPN portal connections, which allows remote authenticated users to gain privileges by establishing a Clientless SSL VPN session and entering crafted URLs, aka Bug ID CSCul70099. + + + + + + + + + + + 20140409 Multiple Vulnerabilities in Cisco ASA Software + + + + + + + + + + + + + + + + + The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 8.2 before 8.2(5.47, 8.3 before 8.3(2.40), 8.4 before 8.4(7.3), 8.6 before 8.6(1.13), 9.0 before 9.0(3.8), and 9.1 before 9.1(3.2) allows remote attackers to bypass authentication via (1) a crafted cookie value within modified HTTP POST data or (2) a crafted URL, aka Bug ID CSCua85555. + + + + + + + + + 20140409 Multiple Vulnerabilities in Cisco ASA Software + + + + + + + + + + + + + + + The SIP inspection engine in Cisco Adaptive Security Appliance (ASA) Software 8.2 before 8.2(5.48), 8.4 before 8.4(6.5), 9.0 before 9.0(3.1), and 9.1 before 9.1(2.5) allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted SIP packets, aka Bug ID CSCuh44052. + + + + + + + + + 20140409 Multiple Vulnerabilities in Cisco ASA Software + + + + + + + + + + + + + The packet driver in Cisco IOS allows remote attackers to cause a denial of service (device reload) via a series of (1) Virtual Switching Systems (VSS) or (2) Bidirectional Forwarding Detection (BFD) packets, aka Bug IDs CSCug41049 and CSCue61890. + + + + + + + + + 20140328 Cisco IOS Software High Priority Queue Denial of Service Vulnerability + + + + + + + + + + CRLF injection vulnerability in the web framework in Cisco Web Security Appliance (WSA) 7.7 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct redirection attacks via a crafted URL, aka Bug ID CSCuj61002. + + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=33608 + 20140401 Cisco WSA HTTP Header Injection Vulnerability + + + + + + + + + + + + + + + + + + + + CRLF injection vulnerability in the web framework in Cisco Security Manager 4.2 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct redirection attacks via a crafted URL, aka Bug ID CSCun82349. + + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=33607 + 20140401 Cisco Security Manager HTTP Header Redirection Vulnerability + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cisco ONS 15454 controller cards with software 9.6 and earlier allow remote attackers to cause a denial of service (flash write outage) via a TCP FIN attack that triggers file-descriptor exhaustion, aka Bug ID CSCug97315. + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=33681 + 20140407 Cisco ONS 15454 Controller Card Denial of Service Vulnerability + + + + + + + + + + + + + + + + + + + + Cisco ONS 15454 controller cards with software 9.6 and earlier allow remote attackers to cause a denial of service (card reset) via a TCP FIN attack that triggers file-descriptor exhaustion and a failure to open a CAL pipe, aka Bug ID CSCug97348. + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=33680 + 20140407 Cisco ONS 15454 Controller Card Denial of Service Vulnerability + + + + + + + + + + + + + + + + + + + + The session-termination functionality on Cisco ONS 15454 controller cards with software 9.6 and earlier does not initialize an unspecified pointer, which allows remote authenticated users to cause a denial of service (card reset) via crafted session-close actions, aka Bug ID CSCug97416. + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=33682 + 20140407 Cisco ONS 15454 Controller Card Denial of Service Vulnerability + + + + + + + + + + + + + + + + + + + + Cisco ONS 15454 controller cards with software 10.0 and earlier allow remote attackers to cause a denial of service (card reload) via a crafted HTTP URI, aka Bug ID CSCun06870. + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=33679 + 20140407 Cisco ONS 15454 Controller Card Denial of Service Vulnerability + + + + + + + + + + + + + + + + + + + + + + + + The IKE implementation in Cisco IOS 15.4(1)T and earlier and IOS XE allows remote attackers to cause a denial of service (security-association drop) via crafted Main Mode packets, aka Bug ID CSCun31021. + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=33639 + 20140403 Cisco IOS Software IKE Main Mode Vulnerability + + + + + + + + + + + + + + + + + + + + + + + + + Cisco IOS XR does not properly throttle ICMPv6 redirect packets, which allows remote attackers to cause a denial of service (IPv4 and IPv6 transit outage) via crafted redirect messages, aka Bug ID CSCum14266. + + + + + + + + + 20140404 Cisco IOS XR Software ICMPv6 Redirect Vulnerability + + + + + + + + + + Directory traversal vulnerability in the messaging API in Cisco Unity Connection allows remote authenticated users to read arbitrary files via vectors related to unenforced access constraints for .wav files and the audio/x-wav MIME type, aka Bug ID CSCun91071. + + + + + + + + + 20140404 Cisco Unity Connection Directory Traversal Vulnerability + + + + + + + + + + Memory leak in the SIP inspection engine in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to cause a denial of service (memory consumption and instability) via crafted SIP packets, aka Bug ID CSCuf67469. + + + + + + + + + 20140422 Cisco ASA SIP Inspection Memory Leak Vulnerability + + + + + + + + + + The DHCPv6 server module in Cisco CNS Network Registrar 7.1 allows remote attackers to cause a denial of service (daemon reload) via a malformed DHCPv6 packet, aka Bug ID CSCuo07437. + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=33850 + 20140417 Cisco Network Registrar DHCPv6 Denial of Service Vulnerability + + + + + + + + + + Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCty45739. + + + Per: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-mxp + +" Vulnerable Products +The following products running a version of Cisco TelePresence System MXP Series Software prior to F9.3.1 are affected by the vulnerabilities described in this advisory: + + Cisco TelePresence System 1700 MXP + Cisco TelePresence System 1000 MXP + Cisco TelePresence System Edge 75 MXP + Cisco TelePresence System Edge 85 MXP + Cisco TelePresence System Edge 95 MXP + Cisco TelePresence System Codec 3000 MXP + Cisco TelePresence System Codec 6000 MXP + Tandberg 550 MXP + Tandberg 770 MXP + Tandberg 880 MXP + Tandberg 990 MXP + Tandberg 2000 MXP" + + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCty45733. + + + Per: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-mxp + +" Vulnerable Products +The following products running a version of Cisco TelePresence System MXP Series Software prior to F9.3.1 are affected by the vulnerabilities described in this advisory: + + Cisco TelePresence System 1700 MXP + Cisco TelePresence System 1000 MXP + Cisco TelePresence System Edge 75 MXP + Cisco TelePresence System Edge 85 MXP + Cisco TelePresence System Edge 95 MXP + Cisco TelePresence System Codec 3000 MXP + Cisco TelePresence System Codec 6000 MXP + Tandberg 550 MXP + Tandberg 770 MXP + Tandberg 880 MXP + Tandberg 990 MXP + Tandberg 2000 MXP" + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCty45720. + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted packets, aka Bug ID CSCtq78722. + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted packets, aka Bug ID CSCty45745. + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted packets, aka Bug ID CSCty45731. + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCud29566. + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCua64961. + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCuj94651. + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCtq72699. + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The SIP implementation in Cisco TelePresence TC Software 4.x and TE Software 4.x allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCto70562. + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + + + + + + + + + + + + + + + + + + + + + + + + The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCua86589. + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Buffer overflow in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to execute arbitrary code via crafted DNS response packets, aka Bug ID CSCty44804. + + + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cisco TelePresence TC Software 4.x through 6.x before 6.2.0 and TE Software 4.x and 6.0 allow remote authenticated users to execute arbitrary commands by using the commands as arguments to internal system scripts, aka Bug ID CSCue60211. + + + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cisco TelePresence TC Software 4.x and 5.x before 5.1.7 and 6.x before 6.0.1 and TE Software 4.x and 6.0 allow remote authenticated users to execute arbitrary commands by using the commands as arguments to tshell (aka tcsh) scripts, aka Bug ID CSCue60202. + + + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Heap-based buffer overflow in Cisco TelePresence TC Software 4.x through 6.x before 6.0.1 and TE Software 4.x and 6.0.x before 6.0.2 allows remote attackers to execute arbitrary code via crafted SIP packets, aka Bug ID CSCud81796. + + + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Buffer overflow in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows local users to gain privileges by leveraging improper handling of the u-boot compiler flag for internal executable files, aka Bug ID CSCub67693. + + + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 do not properly restrict access to the serial port, which allows local users to gain privileges via unspecified commands, aka Bug ID CSCub67692. + + + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allow remote attackers to cause a denial of service (memory consumption) via crafted H.225 packets, aka Bug ID CSCtq78849. + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The Document Management component in Cisco Unified Contact Center Express does not properly validate a parameter, which allows remote authenticated users to upload files to arbitrary pathnames via a crafted HTTP request, aka Bug ID CSCun74133. + + + + + + + + + 20140428 Cisco Unified Contact Center Express Arbitrary File Upload Vulnerability + + + + + + + + + + + + + Cisco Adaptive Security Appliance (ASA) Software, when DHCPv6 replay is configured, allows remote attackers to cause a denial of service (device reload) via a crafted DHCPv6 packet, aka Bug ID CSCun45520. + + + + + + + + + 20140428 Cisco ASA DHCPv6 Denial of Service Vulnerability + + + + + + + + + + The L2TP module in Cisco IOS XE 3.10S(.2) and earlier on ASR 1000 routers allows remote authenticated users to cause a denial of service (ESP card reload) via a malformed L2TP packet, aka Bug ID CSCun09973. + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=33971 + 20140428 Cisco IOS XE Software Malformed L2TP Packet Vulnerability + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The IP Manager Assistant (IPMA) component in Cisco Unified Communications Manager (Unified CM) allows remote attackers to obtain sensitive information via a crafted URL, aka Bug ID CSCun74352. + + + + + + + + + 20140428 Cisco Unified Communications Manager Sensitive Information Disclosure Vulnerability + + + + + + + + + + The Call Detail Records (CDR) Management component in Cisco Unified Communications Manager (Unified CM) allows remote authenticated users to obtain sensitive information by reading extraneous fields in an HTML document, aka Bug ID CSCun74374. + + + + + + + + + 20140428 Cisco Unified Communications Manager CDR Management Vulnerability + + + + + + + + + + Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco WebEx Meetings Server allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj81777. + + + + + + + + + + + + 20140429 Cisco WebEx Meetings Server Cross-Site Request Forgery Vulnerability + + + + + + + + + + The Import and Export Framework in McAfee ePolicy Orchestrator (ePO) before 4.6.7 Hotfix 940148 allows remote authenticated users with permissions to add dashboards to read arbitrary files by importing a crafted XML file, related to an XML External Entity (XXE) issue. + + + + + + + + + https://www.redteam-pentesting.de/advisories/rt-sa-2014-001.txt + https://kc.mcafee.com/corporate/index?page=content&id=SB10065 + 65771 + 20140225 [RT-SA-2014-001] McAfee ePolicy Orchestrator: XML External Entity Expansion in Dashboard + 57114 + + + + + + + + + + + + + + + + + Stack-based buffer overflow in GetGo Download Manager 4.9.0.1982, 4.8.2.1346, 4.4.5.502, and earlier allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a long HTTP Response Header. + + + + + + + + + + + 65913 + 20140302 [CVE-2014-2206] GetGo Download Manager HTTP Response Header Buffer Overflow Remote Code Execution + http://www.rcesecurity.com/2014/03/cve-2014-2206-getgo-download-manager-http-response-header-buffer-overflow-remote-code-execution + + + + + + + + + + + + Multiple directory traversal vulnerabilities in CA ERwin Web Portal 9.5 allow remote attackers to obtain sensitive information, bypass intended access restrictions, cause a denial of service, or possibly execute arbitrary code via unspecified vectors. + + + + + + + + + + + https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7B7F968A14-7407-4BCF-9EB1-EFE9F0E6D663%7D + + + + + + + + + + SQL injection vulnerability in portal/addtoapplication.php in POSH (aka Posh portal or Portaneo) 3.0 before 3.3.0 allows remote attackers to execute arbitrary SQL commands via the rssurl parameter. + + + + + + + + + + + http://www.sysdream.com/CVE-2014-2211_2214 + http://www.sysdream.com/system/files/POSH-3.2.1-advisory_0.pdf + 65817 + http://sourceforge.net/p/posh/svn/3540/ + [oss-security] 20140227 [CVE assignment notification] Multiple vulnerabilities in POSH + + + + + + + + + + + + + + + + + + The remember me feature in portal/scr_authentif.php in POSH (aka Posh portal or Portaneo) 3.0, 3.2.1, 3.3.0, and earlier stores the username and MD5 digest of the password in cleartext in a cookie, which allows attackers to obtain sensitive information by reading this cookie. + + + + + + + + + http://www.sysdream.com/system/files/POSH-3.2.1-advisory_0.pdf + http://www.sysdream.com/CVE-2014-2211_2214 + [oss-security] 20140227 [CVE assignment notification] Multiple vulnerabilities in POSH + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in whizzywig/wb.php in CMSimple Classic 3.54 and earlier, possibly as downloaded before February 26, 2014, allows remote attackers to inject arbitrary web script or HTML via the d parameter. + + + + + + + + + + https://www.htbridge.com/advisory/HTB23205 + 20140319 Cross-Site Scripting (XSS) in CMSimple + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the API in synetics i-doit pro before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via a property title. + + + + + + + + + + http://www.i-doit.com/en/company/news/single-news/?tx_ttnews%5Btt_news%5D=141 + 56931 + + + + + + + + + + + + + + + + + A certain Apple patch for OpenSSL in Apple OS X 10.9.2 and earlier uses a Trust Evaluation Agent (TEA) feature without terminating certain TLS/SSL handshakes as specified in the SSL_CTX_set_verify callback function's documentation, which allows remote attackers to bypass extra verification within a custom application via a crafted certificate chain that is acceptable to TEA but not acceptable to that application. + + + + + + + + + + https://hynek.me/articles/apple-openssl-verification-surprises/ + + + + + + + + + + Cross-site scripting (XSS) vulnerability in Askbot before 0.7.49 allows remote attackers to inject arbitrary web script or HTML via vectors related to the question search form. + + + + + + + + + + https://github.com/ASKBOT/askbot-devel/commit/876e3662ff6b78cc6241338c15e3a0cb49edf4e2 + https://bugzilla.redhat.com/show_bug.cgi?id=1070852 + [oss-security] 20140228 Re: CVE request: askbot xss + 57163 + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in Askbot before 0.7.49 allow remote attackers to inject arbitrary web script or HTML via vectors related to the (1) tag or (2) user search forms. + + + + + + + + + + https://github.com/ASKBOT/askbot-devel/commit/a676a86b6b7a5737d4da4f59f71e037406f88d29 + https://github.com/ASKBOT/askbot-devel/commit/876e3662ff6b78cc6241338c15e3a0cb49edf4e2#diff-b693b4c02739be4b3231bece15b0eb87 + https://bugzilla.redhat.com/show_bug.cgi?id=1070852 + [oss-security] 20140228 Re: CVE request: askbot xss + 57163 + + + + + + + + + + + + + + + + + + The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-3, when issuing a trust token with impersonation enabled, does not include this token in the trustee's token-index-list, which prevents the token from being invalidated by bulk token revocation and allows the trustee to bypass intended access restrictions. + + + + + + + + + https://bugs.launchpad.net/keystone/+bug/1260080 + [oss-security] 20140304 [OSSA 2014-006] Trustee token revocation does not work with memcache backend (CVE-2014-2237) + + + + + + + + + + + + + + + SQL injection vulnerability in the manage configuration page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.16 allows remote authenticated administrators to execute arbitrary SQL commands via the filter_config_id parameter. + + + + + + + + + + + [oss-security] 20140304 Re: CVE request: MantisBT 1.2.13 SQL injection vulnerability + 65903 + http://www.mantisbt.org/blog/?p=288 + [oss-security] 20140228 CVE request: MantisBT 1.2.13 SQL injection vulnerability + http://mantisbt.domainunion.de/bugs/view.php?id=17055 + + + + + + + + + + + + + Stack-based buffer overflow in the cf2_hintmap_build function in cff/cf2hints.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of stem hints in a font file. + + + + + + + + + + + http://www.freetype.org/index.html + USN-2148-1 + 1029895 + 66074 + http://sourceforge.net/projects/freetype/files/freetype2/2.5.3 + 57447 + 57291 + http://savannah.nongnu.org/bugs/?41697 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The (1) cf2_initLocalRegionBuffer and (2) cf2_initGlobalRegionBuffer functions in cff/cf2ft.c in FreeType before 2.5.3 do not properly check if a subroutine exists, which allows remote attackers to cause a denial of service (assertion failure), as demonstrated by a crafted ttf file. + + + + + + + + + + + + http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=135c3faebb96f8f550bd4f318716f2e1e095a969 + USN-2148-1 + [oss-security] 20140312 Re: Two stack-based issues in freetype [NOT a request] + 57447 + http://savannah.nongnu.org/bugs/?41697 + + + + + + + + + + + + + + + includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload, as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element. + + + + + + + + + + [mediawiki-announce] 20140228 MediaWiki Security and Maintenance Releases: 1.22.3, 1.21.6 and 1.19.12 + https://gerrit.wikimedia.org/r/#/q/7d923a6b53f7fbcb0cbc3a19797d741bf6f440eb,n,z + https://bugzilla.wikimedia.org/show_bug.cgi?id=60771 + https://bugzilla.redhat.com/show_bug.cgi?id=1071135 + [oss-security] 20140301 Re: CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release + [oss-security] 20140228 CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote attackers to obtain access via a brute-force attack that relies on timing differences in responses to incorrect token guesses. + + + + + + + + + + [mediawiki-announce] 20140228 MediaWiki Security and Maintenance Releases: 1.22.3, 1.21.6 and 1.19.12 + https://gerrit.wikimedia.org/r/#/q/I2a9e89120f7092015495e638c6fa9f67adc9b84f,n,z + https://bugzilla.wikimedia.org/show_bug.cgi?id=61346 + https://bugzilla.redhat.com/show_bug.cgi?id=1071136 + [oss-security] 20140301 Re: CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release + [oss-security] 20140228 CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the formatHTML function in includes/api/ApiFormatBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 allows remote attackers to inject arbitrary web script or HTML via a crafted string located after http:// in the text parameter to api.php. + + + + + + + + + + [mediawiki-announce] 20140228 MediaWiki Security and Maintenance Releases: 1.22.3, 1.21.6 and 1.19.12 + https://gerrit.wikimedia.org/r/#/q/Idf985e4e69c2f11778a8a90503914678441cb3fb,n,z + https://bugzilla.wikimedia.org/show_bug.cgi?id=61362 + https://bugzilla.redhat.com/show_bug.cgi?id=1071139 + [oss-security] 20140301 Re: CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release + [oss-security] 20140228 CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + SQL injection vulnerability in the News module in CMS Made Simple (CMSMS) before 1.11.10 allows remote authenticated users with the "Modify News" permission to execute arbitrary SQL commands via the sortby parameter to admin/moduleinterface.php. NOTE: some of these details are obtained from third party information. + + + + + + + + + + + 65953 + 56996 + [oss-security] 20140301 Re: CVE request: CMS Made Simple SQL injection fixed in 1.11.10 + http://dev.cmsmadesimple.org/project/changelog/4602 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01 + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf + + + + + + + + + + + + + The integrated web server on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allows remote attackers to inject headers via unspecified vectors. + CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) + + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01 + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf + + + + + + + + + + + + + Open redirect vulnerability in the integrated web server on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. + CWE-601: URL Redirection to Untrusted Site (ā€œOpen Redirectā€) + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01 + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf + + + + + + + + + + + + + Cross-site request forgery (CSRF) vulnerability on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 and SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. + + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02 + http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01 + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf + + + + + + + + + + + + + The random-number generator on Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors, a different vulnerability than CVE-2014-2251. + + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02 + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf + + + + + + + + + + + + + + + + + + + + + + + + + + The random-number generator on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors. + CWE-331: Insufficient Entropy + + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01 + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf + + + + + + + + + + + + + Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted PROFINET packets, a different vulnerability than CVE-2014-2253. + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02 + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf + + + + + + + + + + + + + + + + + + + + + + + + + + Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted Profinet packets. + CWE-404: Improper Resource Shutdown or Release + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01 + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf + + + + + + + + + + + + + Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted HTTP packets, a different vulnerability than CVE-2014-2255. + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02 + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf + + + + + + + + + + + + + + + + + + + + + + + + + + Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted HTTP packets. + CWE-404: Improper Resource Shutdown or Release + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01 + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf + + + + + + + + + + + + + Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted ISO-TSAP packets, a different vulnerability than CVE-2014-2257. + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02 + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf + + + + + + + + + + + + + + + + + + + + + + + + + + Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted ISO-TSAP packets. + CWE-404: Improper Resource Shutdown or Release + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01 + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf + + + + + + + + + + + + + Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted HTTPS packets, a different vulnerability than CVE-2014-2259. + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02 + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf + + + + + + + + + + + + + + + + + + + + + + + + + + Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted HTTPS packets. + CWE-404: Improper Resource Shutdown or Release + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01 + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in plugins/main/content/js/ajenti.coffee in Eugene Pankov Ajenti 1.2.13 allows remote authenticated users to inject arbitrary web script or HTML via the command field in the Cron functionality. + + + + + + + + + + https://github.com/Eugeny/ajenti/commit/3270fd1d78391bb847b4c9ce37cf921f485b1310 + https://github.com/Eugeny/ajenti/issues/233 + 64982 + 102174 + http://packetstormsecurity.com/files/124804/Ajenti-1.2.13-Cross-Site-Scripting.html + + + + + + + + + + Buffer overflow in the client application in Base SAS 9.2 TS2M3, SAS 9.3 TS1M1 and TS1M2, and SAS 9.4 TS1M0 allows user-assisted remote attackers to execute arbitrary code via a crafted SAS program. + + + + + + + + + + + + https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140227-0_SAS_Buffer_overflow_v10.txt + 65853 + 20140227 SEC Consult SA-20140227-0 :: Local Buffer Overflow vulnerability in SAS for Windows (Statistical Analysis System) + http://support.sas.com/kb/51/701.html + 57029 + + + + + + + + + + + + + The mpegts_write_pmt function in the MPEG2 transport stream (aka DVB) muxer (libavformat/mpegtsenc.c) in FFmpeg, possibly 2.1 and earlier, allows remote attackers to have unspecified impact and vectors, which trigger an out-of-bounds write. + + + + + + + + + + + + http://git.videolan.org/?p=ffmpeg.git;a=commit;h=842b6c14bc + ffmpeg-mpegtswritepmt-bo(91174) + 65560 + 56971 + + + + + + + + + + + + + + The OpenVPN module in Synology DiskStation Manager (DSM) 4.3-3810 update 1 has a hardcoded root password of synopass, which makes it easier for remote attackers to obtain access via a VPN session. + + + + + + + + + VU#534284 + http://forum.synology.com/enu/viewtopic.php?f=173&t=77644 + + + + + + + + + + Rock Lobster Contact Form 7 before 3.7.2 allows remote attackers to bypass the CAPTCHA protection mechanism and submit arbitrary form data by omitting the _wpcf7_captcha_challenge_captcha-719 parameter. + + + + + + + + + http://contactform7.com/2014/02/26/contact-form-7-372/ + http://www.hedgehogsecurity.co.uk/2014/02/26/contactform7-vulnerability/ + http://wordpress.org/plugins/contact-form-7/changelog + + + + + + + + + + + + modules/Users/ForgotPassword.php in vTiger 6.0 before Security Patch 2 allows remote attackers to reset the password for arbitrary users via a request containing the username, password, and confirmPassword parameters. + + + + + + + + + + [Vtigercrm-developers] 20140316 IMP: forgot password and re-installation security fix + 66758 + + + + + + + + + + softmagic.c in file before 5.17 and libmagic allows context-dependent attackers to cause a denial of service (out-of-bounds memory access and crash) via crafted offsets in the softmagic of a PE executable. + + + + + + + + + https://github.com/file/file/commit/447558595a3650db2886cd2f416ad0beba965801 + http://bugs.gw.com/view.php?id=313 + USN-2163-1 + USN-2162-1 + http://www.php.net/ChangeLog-5.php + DSA-2873 + [oss-security] 20140305 Re: CVE Request: file: crashes when checking softmagic for some corrupt PE executables + [oss-security] 20140305 Re: CVE Request: file: crashes when checking softmagic for some corrupt PE executables + [oss-security] 20140303 CVE Request: file: crashes when checking softmagic for some corrupt PE executables + openSUSE-SU-2014:0435 + openSUSE-SU-2014:0367 + openSUSE-SU-2014:0364 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The FileUploadController servlet in EMC Connectrix Manager Converged Network Edition (CMCNE) before 12.1.5 does not properly restrict additions to the Connectrix Manager repository, which allows remote attackers to obtain sensitive information by importing a crafted firmware file. + + + + + + + + + connectrix-cve20142276-info-disc(91987) + 1029939 + 66308 + 57513 + 20140318 ESA-2014-018: EMC Connectrix Manager Converged Network Edition Information Disclosure Vulnerability + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the search feature in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allows remote attackers to inject arbitrary web script or HTML via the query parameter. + + + + + + + + + + seeddms-cve20142280-xss(91830) + http://sourceforge.net/p/seeddms/code/ci/master/tree/CHANGELOG + 57475 + http://packetstormsecurity.com/files/125726 + 20140314 Multiple Vulnerabilities in SeedDMS < = 4.3.3 + + + + + + + + + + + + The nfs_name_snoop_add_name function in epan/dissectors/packet-nfs.c in the NFS dissector in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 does not validate a certain length value, which allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted NFS packet. + + + + + + + + + + https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9672 + http://anonsvn.wireshark.org/viewvc?view=revision&revision=54875 + http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-nfs.c?r1=54875&r2=54874&pathrev=54875 + http://www.wireshark.org/security/wnpa-sec-2014-01.html + DSA-2871 + 57489 + 57480 + RHSA-2014:0342 + RHSA-2014:0341 + openSUSE-SU-2014:0383 + openSUSE-SU-2014:0382 + + + + + + + + + + + + + + + + + + + + + + + + + + + + The dissect_protocol_data_parameter function in epan/dissectors/packet-m3ua.c in the M3UA dissector in Wireshark 1.10.x before 1.10.6 does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) via a crafted SS7 MTP3 packet. + + + + + + + + + + http://anonsvn.wireshark.org/viewvc?view=revision&revision=51608 + http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-m3ua.c?r1=51608&r2=51607&pathrev=51608 + https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9699 + http://www.wireshark.org/security/wnpa-sec-2014-02.html + 57480 + openSUSE-SU-2014:0382 + + + + + + + + + + + + + + + epan/dissectors/packet-rlc in the RLC dissector in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 uses inconsistent memory-management approaches, which allows remote attackers to cause a denial of service (use-after-free error and application crash) via a crafted UMTS Radio Link Control packet. + + + + + + + + + + https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=217293ba4a0353bf5d657e74fe8623dd3c86fe08 + https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9802 + https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9730 + http://www.wireshark.org/security/wnpa-sec-2014-03.html + DSA-2871 + 57489 + 57480 + RHSA-2014:0342 + openSUSE-SU-2014:0383 + openSUSE-SU-2014:0382 + + + + + + + + + + + + + + + + + + + + + + + + + + + + The Linux implementation of the ICMP-MIB in Net-SNMP 5.5 before 5.5.2.1, 5.6.x before 5.6.2.1, and 5.7.x before 5.7.2.1 does not properly validate input, which allows remote attackers to cause a denial of service via unspecified vectors. + + + + + + + + + USN-2166-1 + [net-snmp-announce] 20140225 Multiple Security-fix Net-SNMP Releases: 5.5.2.1, 5.6.2.1, and 5.7.2.1 + 57870 + 57583 + 57526 + RHSA-2014:0321 + openSUSE-SU-2014:0399 + openSUSE-SU-2014:0398 + [oss-security] 20140305 CVE request for two net-snmp remote DoS flaws + + + + + + + + + + + + + + + + + + + + + The perl_trapd_handler function in perl/TrapReceiver/TrapReceiver.xs in Net-SNMP 5.7.3.pre3 and earlier, when using certain Perl versions, allows remote attackers to cause a denial of service (snmptrapd crash) via an empty community string in an SNMP trap, which triggers a NULL pointer dereference within the newSVpv function in Perl. + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1072778 + https://bugzilla.redhat.com/show_bug.cgi?id=1072044 + http://www.nntp.perl.org/group/perl.perl5.porters/2006/09/msg116250.html + http://sourceforge.net/p/net-snmp/patches/1275/ + openSUSE-SU-2014:0399 + openSUSE-SU-2014:0398 + [oss-security] 20140305 CVE request for two net-snmp remote DoS flaws + + + + + + + + + + main/http.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.x before 1.8.15-cert5 and 11.6 before 11.6-cert2, allows remote attackers to cause a denial of service (stack consumption) and possibly execute arbitrary code via an HTTP request with a large number of Cookie headers. + + + + + + + + + + + http://downloads.asterisk.org/pub/security/AST-2014-001.html + http://downloads.asterisk.org/pub/security/AST-2014-001-1.8.diff + https://issues.asterisk.org/jira/browse/ASTERISK-23340 + 66093 + MDVSA-2014:078 + FEDORA-2014-3762 + FEDORA-2014-3779 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + channels/chan_sip.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.15 before 1.8.15-cert5 and 11.6 before 11.6-cert2, when chan_sip has a certain configuration, allows remote authenticated users to cause a denial of service (channel and file descriptor consumption) via an INVITE request with a (1) Session-Expires or (2) Min-SE header with a malformed or invalid value. + + + + + + + + + http://downloads.asterisk.org/pub/security/AST-2014-002.html + http://downloads.asterisk.org/pub/security/AST-2014-002-1.8.diff + https://issues.asterisk.org/jira/browse/ASTERISK-23373 + 66094 + MDVSA-2014:078 + FEDORA-2014-3762 + FEDORA-2014-3779 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The PJSIP channel driver in Asterisk Open Source 12.x before 12.1.1, when qualify_frequency "is enabled on an AOR and the remote SIP server challenges for authentication of the resulting OPTIONS request," allows remote attackers to cause a denial of service (crash) via a PJSIP endpoint that does not have an associated outgoing request. + + + + + + + + + http://downloads.asterisk.org/pub/security/AST-2014-003-12.diff + https://issues.asterisk.org/jira/browse/ASTERISK-23210 + FEDORA-2014-3762 + FEDORA-2014-3779 + http://downloads.asterisk.org/pub/security/AST-2014-003.html + + + + + + + + + + + + + + res/res_pjsip_exten_state.c in the PJSIP channel driver in Asterisk Open Source 12.x before 12.1.0 allows remote authenticated users to cause a denial of service (crash) via a SUBSCRIBE request without any Accept headers, which triggers an invalid pointer dereference. + + + + + + + + + http://downloads.asterisk.org/pub/security/AST-2014-004.html + http://downloads.asterisk.org/pub/security/AST-2014-004-12.diff + https://issues.asterisk.org/jira/browse/ASTERISK-23139 + FEDORA-2014-3762 + FEDORA-2014-3779 + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the Pulse Collaboration (Secure Meeting) user pages in Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS before 7.1r18, 7.3 before 7.3r10, 7.4 before 7.4r8, and 8.0 before 8.0r1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10617 + juniper-junos-cve20142291-xss(91770) + 57375 + + + + + + + + + + + + + Unspecified vulnerability in the Linux Network Connect client in Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS before 7.1r18, 7.3 before 7.3r10, 7.4 before 7.4r8, and 8.0 before 8.0r1 allows local users to gain privileges via unspecified vectors. + + + + + + + + + + + https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10616 + + + + + + + + + + + + + Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a large record in MPEG data. + + + + + + + + + + + + https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=f567435ac7140c96a5de56dbce3d5e7659af4d09 + https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9843 + http://www.wireshark.org/security/wnpa-sec-2014-04.html + DSA-2871 + 57489 + 57480 + RHSA-2014:0342 + RHSA-2014:0341 + openSUSE-SU-2014:0383 + openSUSE-SU-2014:0382 + + + + + + + + + + + + + + + + + + + + + + + + + + + + The ip6_route_add function in net/ipv6/route.c in the Linux kernel through 3.13.6 does not properly count the addition of routes, which allows remote attackers to cause a denial of service (memory consumption) via a flood of ICMPv6 Router Advertisement packets. + + + + + + + + + http://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=c88507fbad8055297c1d1e21e599f46960cbee39 + 1029894 + [oss-security] 20140307 Re: CVE Request: Linux kernel: IPv6: crash due to router advertisement flooding + 57250 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The AgentX subagent in Net-SNMP before 5.4.4 allows remote attackers to cause a denial of service (hang) by sending a multi-object request with an Object ID (OID) containing more subids than previous requests, a different vulnerability than CVE-2012-6151. + + + + + + + + + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=684388 + USN-2166-1 + http://sourceforge.net/p/net-snmp/patches/1113/ + http://sourceforge.net/p/net-snmp/code/ci/eb816330a1887798d844d2fd5dc6482002123cbd/ + 57870 + [oss-security] 20140307 Re: CVE request: net-snmp agentx incorrect handling of multi-object requests DoS + [oss-security] 20140306 CVE request: net-snmp agentx incorrect handling of multi-object requests DoS + + + + + + + + + + SQL injection vulnerability in modx.class.php in MODX Revolution 2.0.0 before 2.2.13 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. + + + + + + + + + + + [oss-security] 20140308 Re: CVE request: SQL injection in MODX Revolution before 2.2.13 + http://modx.com/blog/2014/03/07/revolution-2.2.13/ + http://forums.modx.com/thread/89486/modx-revolution-2-x-sql-injection + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Directory traversal vulnerability in the Importers plugin in Atlassian JIRA before 6.0.5 allows remote attackers to create arbitrary files via unspecified vectors. + + + Per: https://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2014-02-26 + +"Issue 2: Path traversal in JIRA Importers plugin (Windows only)" + + + + + + + + + https://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2014-02-26 + + + + + + + + + + + + + + Directory traversal vulnerability in the Issue Collector plugin in Atlassian JIRA before 6.0.4 allows remote attackers to create arbitrary files via unspecified vectors. + + + Per: https://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2014-02-26 + +"Issue 1: Path traversal in JIRA Issue Collector plugin (Windows only)" + + + + + + + + + https://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2014-02-26 + + + + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in the Thank You Counter Button plugin 1.8.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) thanks_caption, (2) thanks_caption_style, or (3) thanks_style parameter to wp-admin/options.php. + + + + + + + + + + thanks-you-wordpress-xss(91474) + http://packetstormsecurity.com/files/125397 + + + + + + + + + + SQL injection vulnerability in se_search_default in the Search Everything plugin before 7.0.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the s parameter to index.php. NOTE: some of these details are obtained from third party information. + + + + + + + + + + + http://wordpress.org/plugins/search-everything/changelog/ + 56820 + + + + + + + + + + SQL injection vulnerability in ajax_udf.php in OpenDocMan before 1.2.7.2 allows remote attackers to execute arbitrary SQL commands via the table parameter. NOTE: some of these details are obtained from third party information. + + + + + + + + + + + http://www.opendocman.com/opendocman-v1-2-7-2-released + 65775 + 56189 + + + + + + + + + + + + + + + + + + + + + SQL injection vulnerability in ATCOM Netvolution 3 allows remote attackers to execute arbitrary SQL commands via the m parameter. + + + + + + + + + + + netvolution-m-sql-injection(91543) + 65942 + http://packetstormsecurity.com/files/125507 + + + + + + + + + + The Encrypt Files feature in ConeXware PowerArchiver before 14.02.05 uses legacy ZIP encryption even if the AES 256-bit selection is chosen, which makes it easier for context-dependent attackers to obtain sensitive information via a known-plaintext attack. + + + + + + + + + http://www.powerarchiver.com/2014/03/12/powerarchiver-2013-14-02-05-released/ + http://int21.de/cve/CVE-2014-2319-powerarchiver.html + + + + + + + + + + + + + web_shell_cmd.gch on ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests, as demonstrated by using "set TelnetCfg" commands to enable a TELNET service with specified credentials. + + + Per: http://www.kb.cert.org/vuls/id/600724 + +" It has been reported that the web_shell_cmd.gch script is sometimes accessible from the WAN interface making exploitation of this backdoor from the Internet possible in certain cases. " + + + + + + + + + + + VU#600724 + https://community.rapid7.com/community/infosec/blog/2014/03/03/disclosure-r7-2013-18-zte-f460-and-zte-f660-webshellcmdgch-backdoor + http://www.myxzy.com/post-411.html + + + + + + + + + + + + + lib/string_utf_support.rb in the Arabic Prawn 0.0.1 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) downloaded_file or (2) url variable. + + + http://www.vapid.dhs.org/advisories/arabic-ruby-gem.html + [oss-security] 20140312 Re: Remote Command Injection in Arabic Prawn 0.0.1 Ruby Gem + [oss-security] 20140310 Remote Command Injection in Arabic Prawn 0.0.1 Ruby Gem + + + + + SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname. + + + + + + + + + + + http://www.lighttpd.net/2014/3/12/1.4.35/ + DSA-2877 + 57514 + 57404 + [oss-security] 20140312 Re: lighttpd 1.4.34 SQL injection and path traversal CVE request + [oss-security] 20140312 lighttpd 1.4.34 SQL injection and path traversal CVE request + openSUSE-SU-2014:0496 + SUSE-SU-2014:0474 + openSUSE-SU-2014:0449 + http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2014_01.txt + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname. + + + + + + + + + http://www.lighttpd.net/2014/3/12/1.4.35/ + DSA-2877 + 57514 + 57404 + [oss-security] 20140312 Re: lighttpd 1.4.34 SQL injection and path traversal CVE request + [oss-security] 20140312 lighttpd 1.4.34 SQL injection and path traversal CVE request + openSUSE-SU-2014:0496 + SUSE-SU-2014:0474 + openSUSE-SU-2014:0449 + http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2014_01.txt + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in Proxmox Mail Gateway before 3.1-5829 allow remote attackers to inject arbitrary web script or HTML via the (1) state parameter to objects/who/index.htm or (2) User email address to quarantine/spam/manage.htm. + + + + + + + + + + http://proxmox.com/news/archive/view/listid-1-proxmox-newsletter/mailid-48-proxmox-newsletter-march-2014-proxmox-ve-3-2-released/tmpl-component + 66169 + 20140312 Multiplus XSS in Proxmox Mail Gateway 3.1 (CVE-2014-2325) + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in Cacti 0.8.7g allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + 66390 + http://packetstormsecurity.com/files/125849/Deutsche-Telekom-CERT-Advisory-DTC-A-20140324-001.html + + + + + + + + + + Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users. + + + + + + + + + + + + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768 + 66392 + 20140324 Deutsche Telekom CERT Advisory [DTC-A-20140324-001] vulnerabilities in cacti + + + + + + + + + + + + + + + + + + + + lib/graph_export.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in unspecified vectors. + Per: https://cwe.mitre.org/data/definitions/77.html + +"CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')" + + + + + + + + + + + http://svn.cacti.net/viewvc?view=rev&revision=7442 + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768 + 66387 + 20140324 Deutsche Telekom CERT Advisory [DTC-A-20140324-001] vulnerabilities in cacti + FEDORA-2014-4892 + FEDORA-2014-4928 + http://bugs.cacti.net/view.php?id=2433 + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the Lazyest Gallery plugin before 1.1.21 for WordPress allows remote attackers to inject arbitrary web script or HTML via an EXIF tag. NOTE: some of these details are obtained from third party information. + + + + + + + + + + 66756 + http://wordpress.org/plugins/lazyest-gallery/changelog + 57746 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + IKEv2 in strongSwan 4.0.7 before 5.1.3 allows remote attackers to bypass authentication by rekeying an IKE_SA during (1) initiation or (2) re-authentication, which triggers the IKE_SA state to be set to established. + + + + + + + + + + http://www.strongswan.org/blog/2014/04/14/strongswan-authentication-bypass-vulnerability-%28cve-2014-2338%29.html + DSA-2903 + 57823 + SUSE-SU-2014:0529 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Multiple SQL injection vulnerabilities in bbs/ajax.autosave.php in GNUboard 5.x and possibly earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) subject or (2) content parameter. + + + + + + + + + + + gnuboard-cve20142339-sql-injection(91814) + 66228 + 20140317 [CVE-2014-2339] GNUboard SQL Injection Vulnerability + + + + + + + + + + + + + + + Cross-site request forgery (CSRF) vulnerability in the XCloner plugin before 3.1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that create website backups via a request to wp-admin/plugins.php. + + + + + + + + + + + + https://www.htbridge.com/advisory/HTB23206 + 66280 + 20140402 &ETH;&iexcl;ross-Site Request Forgery (CSRF) in XCloner Wordpress Plugin + 32701 + http://wordpress.org/plugins/xcloner-backup-and-restore/changelog/ + 57362 + + + + + + + + + + + + + + + + + + + + + + Session fixation vulnerability in CubeCart before 5.2.9 allows remote attackers to hijack web sessions via the PHPSESSID parameter. + + + + + + + + + + + cubecart-cve20142341-session-hijacking(92526) + 1030086 + 66805 + 105784 + 32830 + 57856 + http://forums.cubecart.com/topic/48427-cubecart-529-relased/ + + + + + + + + + + + + + + + + + + dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter. + + + + + + + + + https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2383/ + https://github.com/dompdf/dompdf/commit/23a693993299e669306929e3d49a4a1f7b3fb028 + 20140423 CVE-2014-2383 - Arbitrary file read in dompdf + 20140423 CVE-2014-2383 - Arbitrary file read in dompdf + + + + + + + + + + vmx86.sys in VMware Workstation 10.0.1 build 1379776 and VMware Player 6.0.1 build 1379776 on Windows might allow local users to cause a denial of service (read access violation and system crash) via a crafted buffer in an IOCTL call. NOTE: the researcher reports "Vendor rated issue as non-exploitable." + + + + + + + + + https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2384/ + 20140411 CVE-2014-2384 - Invalid Pointer Dereference in VMware Workstation and Player + + + + + + + + + + + + + Multiple off-by-one errors in Icinga, possibly 1.10.2 and earlier, allow remote attackers to cause a denial of service (crash) via unspecified vectors to the (1) display_nav_table, (2) print_export_link, (3) page_num_selector, or (4) page_limit_selector function in cgi/cgiutils.c or (5) status_page_num_selector function in cgi/status.c, which triggers a stack-based buffer overflow. + + + + + + + + + https://git.icinga.org/?p=icinga-core.git;a=commitdiff;h=73285093b71a5551abdaab0a042d3d6bae093b0d + https://dev.icinga.org/issues/5663 + openSUSE-SU-2014:0420 + [oss-security] 20140313 CVE request for icinga 1 byte \0 overflows + + + + + + + + + + + + + + + + Stack-based buffer overflow in a certain decryption function in qconnDoor on Blackberry Z10 devices with software 10.1.0.2312, when developer-mode has been previously enabled, allows remote attackers to execute arbitrary code via a crafted packet in a TCP session on a wireless network. + + + + + + + + + + + 20140408 BlackBerry Z 10 - Buffer Overflow in qconnDoor [MZ-13-05] + + + + + + + + + + + + + The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potentially useful password-pattern information by reading (1) a web-server access log, (2) a web-server Referer log, or (3) browser history that contains this string because of its presence in a GET request. + + + + + + + + + 20140408 Open-Xchange Security Advisory 2014-04-08 + + + + + + + + + + + + + + The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 places a password in a GET request, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history. + + + + + + + + + 20140408 Open-Xchange Security Advisory 2014-04-08 + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in Open-Xchange AppSuite 7.4.1 before 7.4.1-rev11 and 7.4.2 before 7.4.2-rev13 allows remote attackers to inject arbitrary web script or HTML via a Drive filename that is not properly handled during use of the composer to add an e-mail attachment. + + + + + + + + + + 20140408 Open-Xchange Security Advisory 2014-04-08 + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. + + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JavaFX 2.2.51; and JRockit R27.8.1 and R28.3.1 allows remote authenticated users to affect integrity via unknown vectors related to Javadoc. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 2.2.2 allows remote attackers to affect integrity via unknown vectors related to Oracle Endeca Information Discovery (Formerly Latitude), a different vulnerability than CVE-2014-2400. + Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + +"Please refer to My Oracle Support Note 1629648.1 for instructions on how to address this issue." + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 2.2.2 allows remote attackers to affect integrity via unknown vectors related to Oracle Endeca Information Discovery (Formerly Latitude), a different vulnerability than CVE-2014-2399. + Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + +"Please refer to My Oracle Support Note 1629648.1 for instructions on how to address this issue." + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JavaFX 2.2.51; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality via unknown vectors related to 2D. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-0432 and CVE-2014-0455. + per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + +Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets + + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality via vectors related to JAXP. + per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + +Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 10.1.4.3, 11.1.1.3.0, 11.1.1.5.0, 11.1.1.7.0, 11.1.2.0.0, 11.1.2.1.0, and 11.1.2.2.0 allows remote authenticated users to affect confidentiality via unknown vectors related to WebGate. + Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + +"Please refer to My Oracle Support Note 1643382.1 for instructions on how to address this issue." + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, and 12.1.0.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to "Advisor" and "Select Any Dictionary" privileges. + Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + +"The CVSS Base Score is 8.5 only for Windows. For Linux, Unix and other platforms, the CVSS Base Score is 6.0, and the impacts for Confidentiality, Integrity and Availability are Partial+." + + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect availability via unknown vectors related to Data Quality, a different vulnerability than CVE-2014-2415, CVE-2014-2416, CVE-2014-2417, and CVE-2014-2418. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, and 12.1.0.1 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to the "Grant Any Object Privilege." + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Deployment. + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 8 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX. + per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + +Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. + + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + Unspecified vulnerability in the Oracle Identity Analytics component in Oracle Fusion Middleware Oracle Identity Analytics 11.1.1.5 and Sun Role Manager 5.0 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Security. + + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, SE 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT, a different vulnerability than CVE-2014-0451. + + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect integrity via unknown vectors related to Libraries. + per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + +Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAXB. + + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect availability via unknown vectors related to Data Quality, a different vulnerability than CVE-2014-2407, CVE-2014-2416, CVE-2014-2417, and CVE-2014-2418. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect availability via unknown vectors related to Data Quality, a different vulnerability than CVE-2014-2407, CVE-2014-2415, CVE-2014-2417, and CVE-2014-2418. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect availability via unknown vectors related to Data Quality, a different vulnerability than CVE-2014-2407, CVE-2014-2415, CVE-2014-2416, and CVE-2014-2418. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect availability via unknown vectors related to Data Quality, a different vulnerability than CVE-2014-2407, CVE-2014-2415, CVE-2014-2416, and CVE-2014-2417. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + Unspecified vulnerability in Oracle MySQL Server 5.5.35 and earlier and 5.6.15 and earlier allows remote authenticated users to affect availability via unknown vectors related to Partition. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect integrity via unknown vectors related to Deployment. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JavaFX 2.2.51; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. + + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 7u51 and 8, and JavaFX 2.2.51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. + per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + +Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets + + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0452 and CVE-2014-0458. + + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + Unspecified vulnerability in the Oracle Event Processing component in Oracle Fusion Middleware 11.1.1.7.0 allows remote authenticated users to affect integrity via vectors related to CEP system. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + Unspecified vulnerability in the Oracle OpenSSO component in Oracle Fusion Middleware 8.0 Update 2 Patch 5 allows remote authenticated users to affect confidentiality via unknown vectors. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + Unspecified vulnerability in the Oracle OpenSSO component in Oracle Fusion Middleware 8.0 Update 2 Patch 5 allows remote authenticated users to affect integrity and availability via unknown vectors related to Admin Console. + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Sound. + per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + +Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. + + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. + + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + Unspecified vulnerability in the PeopleSoft Enterprise CS Campus Self Service component in Oracle PeopleSoft Products 9.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Campus Mobile. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + Unspecified vulnerability in Oracle MySQL Server 5.5.36 and earlier and 5.6.16 and earlier allows remote authenticated users to affect availability via unknown vectors related to Performance Schema. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle MySQL Server 5.5.36 and earlier and 5.6.16 and earlier allows remote attackers to affect availability via unknown vectors related to Options. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability Oracle the MySQL Server component 5.5.35 and earlier and 5.6.15 and earlier allows remote authenticated users to affect availability via unknown vectors related to Federated. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in the PeopleSoft Enterprise PT PeopleTools component in Oracle PeopleSoft Products 8.53 allows remote attackers to affect availability via unknown vectors related to Integration Broker. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + Unspecified vulnerability in Oracle MySQL Server 5.6.15 and earlier allows remote authenticated users to affect availability via vectors related to DML. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle MySQL Server 5.6.16 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle MySQL Server 5.5.36 and earlier and 5.6.16 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to RBR. + + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in the PeopleSoft Enterprise PT PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Integration Broker, a different vulnerability than CVE-2014-2447. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + Unspecified vulnerability in Oracle MySQL Server 5.5.35 and earlier and 5.6.15 and earlier allows remote authenticated users to affect availability via unknown vectors related to Replication. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in the Oracle Secure Global Desktop (SGD) component in Oracle Virtualization 5.0 and 5.1 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Workspace Web Application. + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + Unspecified vulnerability in the MySQL Client component in Oracle MySQL 5.5.36 and earlier and 5.6.16 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. + + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.1.32, 4.2.24, and 4.3.10 allows local users to affect confidentiality, integrity, and availability via vectors related to Graphics driver (WDDM) for Windows guests. + + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle MySQL Server 5.6.15 and earlier allows remote authenticated users to affect availability via vectors related to MyISAM. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in the PeopleSoft Enterprise PT PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect integrity via vectors related to PIA Core Technology. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + Unspecified vulnerability in Oracle MySQL Server 5.6.15 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to InnoDB. + + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.3 allows remote authenticated users to affect integrity via unknown vectors related to Security, a different vulnerability than CVE-2014-2467. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + Unspecified vulnerability in the PeopleSoft Enterprise PT PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote authenticated users to affect confidentiality via vectors related to QAS. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + Unspecified vulnerability in the PeopleSoft Enterprise PT PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Integration Broker, a different vulnerability than CVE-2014-2437. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + Unspecified vulnerability in the PeopleSoft Enterprise PT PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Install and Packaging. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + Unspecified vulnerability in the PeopleSoft Enterprise HRMS Talent Acquisition Manager component in Oracle PeopleSoft Products 9.0, 9.1, and 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Security. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + Unspecified vulnerability in Oracle MySQL Server 5.6.15 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in Oracle MySQL Server 5.6.15 and earlier allows remote authenticated users to affect availability via unknown vectors related to Privileges. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.1.5 allows remote authenticated users to affect availability via unknown vectors related to Webserver Plugin. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + Unspecified vulnerability in the Hyperion Common Admin component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows remote attackers to affect integrity via unknown vectors related to User Interface. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + Unspecified vulnerability in the Hyperion Common Admin component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows remote attackers to affect confidentiality via unknown vectors related to User Interface. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + Unspecified vulnerability in the Hyperion Common Admin component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to User Interface. + + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + Unspecified vulnerability in the Oracle Agile Product Lifecycle component in Oracle Supply Chain Products Suite 6.0 and 6.1.0 allows remote attackers to affect integrity via unknown vectors related to Install. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + Unspecified vulnerability in the Oracle Agile Product Lifecycle component in Oracle Supply Chain Products Suite 6.1.0.3 and 6.1.1.3 allows remote attackers to affect integrity via unknown vectors related to Install. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.3.2 and 6.3.3 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Security. + + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 5.5.06, 6.0, 6.1, 6.2, 6.3, 6.3.1, 6.3.2, and 6.3.3 allows remote authenticated users to affect confidentiality via vectors related to CSV Management. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 5.5.06, 6.0, 6.1, 6.2, 6.3, 6.3.1, 6.3.2, and 6.3.3 allows remote attackers to affect confidentiality via unknown vectors related to Security. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + + + + + Unspecified vulnerability in the Oracle Secure Global Desktop (SGD) component in Oracle Virtualization 4.63, 4.71, 5.0, and 5.1 allows remote attackers to affect integrity via unknown vectors related to Workspace Web Application. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.3.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Security. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.3 allows remote attackers to affect integrity via unknown vectors related to Security. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.3 allows remote authenticated users to affect confidentiality via unknown vectors related to Security. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.3 allows remote authenticated users to affect integrity via unknown vectors related to Security, a different vulnerability than CVE-2014-2445. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via vectors related to Open_UI. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + Unspecified vulnerability in Lighthttpd in Oracle Solaris 11.1 allows attackers to cause a denial of service via unknown vectors. + + + + + + + + + https://blogs.oracle.com/sunsecurity/entry/cve_2014_2469_denial_of + 66599 + 105298 + 1029999 + + + + + + + + + + Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0, 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Security. + + + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + + + Unspecified vulnerability in the Oracle iLearning component in Oracle iLearning 6.0 and 6.1 allows remote attackers to affect integrity via unknown vectors related to Learner Pages. + + + + + + + + + http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html + + + + + + + + + + + The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file. + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1076676 + https://bugs.php.net/bug.php?id=66901 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + curl and libcurl 7.27.0 through 7.35.0, when runnning on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate. + + + + + + + + + + http://curl.haxx.se/docs/adv_20140326D.html + 66296 + http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/ + http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/ + http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/ + 57968 + 57966 + 57836 + [oss-security] 20140317 Re: CVE request: flaw in curl's Windows SSL backend + [oss-security] 20140317 CVE request: flaw in curl's Windows SSL backend + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + net/netfilter/nf_conntrack_proto_dccp.c in the Linux kernel through 3.13.6 uses a DCCP header pointer incorrectly, which allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a DCCP packet that triggers a call to the (1) dccp_new, (2) dccp_packet, or (3) dccp_error function. + + + + + + + + + + + https://github.com/torvalds/linux/commit/b22f5126a24b3b2f15448c3f2a254fc10cbc2b92 + https://bugzilla.redhat.com/show_bug.cgi?id=1077343 + linux-kernel-cve20142523-code-exec(91910) + 1029945 + 66279 + [oss-security] 20140317 Re: CVE Request: netfilter: remote memory corruption in nf_conntrack_proto_dccp.c + http://twitter.com/grsecurity/statuses/445496197399461888 + 57446 + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b22f5126a24b3b2f15448c3f2a254fc10cbc2b92 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Heap-based buffer overflow in the yaml_parser_scan_uri_escapes function in LibYAML before 0.1.6 allows context-dependent attackers to execute arbitrary code via a long sequence of percent-encoded characters in a URI in a YAML file. + + + + + + + + + + + http://www.ocert.org/advisories/ocert-2014-003.html + https://bitbucket.org/xi/libyaml/commits/bce8b60f0b9af69fa9fab3093d0a41ba243de048 + USN-2160-1 + http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/ + http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/ + http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/ + DSA-2885 + DSA-2884 + 57968 + 57966 + 57836 + RHSA-2014:0355 + RHSA-2014:0354 + RHSA-2014:0353 + openSUSE-SU-2014:0500 + + + + + + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in BarracudaDrive before 6.7 allow remote attackers to inject arbitrary web script or HTML via the (1) sForumName or (2) sDescription parameter to Forum/manage/ForumManager.lsp; (3) sHint, (4) sWord, or (5) nId parameter to Forum/manage/hangman.lsp; (6) user parameter to rtl/protected/admin/wizard/setuser.lsp; (7) name or (8) email parameter to feedback.lsp; (9) lname or (10) url parameter to private/manage/PageManager.lsp; (11) cmd parameter to fs; (12) newname, (13) description, (14) firstname, (15) lastname, or (16) id parameter to rtl/protected/mail/manage/list.lsp; or (17) PATH_INFO to fs/. + + + + + + + + + + barracudadrive-multiple-scripts-xss(91920) + 57451 + http://secpod.org/blog/?p=2158 + http://secpod.org/advisories/SecPod_BarracudaDrive_Mult_XSS_Vuln.txt + http://packetstormsecurity.com/files/125766 + http://barracudadrive.com/readme.txt + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config, which allows remote attackers to bypass intended environment restrictions by using a substring located before a wildcard character. + + + + + + + + + + openssh-cve20142532-sec-bypass(91986) + USN-2155-1 + 1029925 + 66355 + DSA-2894 + 57574 + 57488 + [security-announce] 20140315 Announce: OpenSSH 6.6 released + + + + + + + + + + + + + + + /sbin/ifwatchd in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to gain privileges by providing an arbitrary program name as a command-line argument. + + + + + + + + + + + 32153 + 20140312 Medium severity flaw in BlackBerry QNX Neutrino RTOS + 20140313 Re: Medium severity flaw in BlackBerry QNX Neutrino RTOS + 20140313 Re: Medium severity flaw in BlackBerry QNX Neutrino RTOS + 20140311 Medium severity flaw in BlackBerry QNX Neutrino RTOS + + + + + + + + + + + /sbin/pppoectl in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to obtain sensitive information by reading "bad parameter" lines in error messages, as demonstrated by reading the root password hash in /etc/shadow. + + + + + + + + + 32156 + 20140312 Medium severity flaw in BlackBerry QNX Neutrino RTOS + 20140313 Re: Medium severity flaw in BlackBerry QNX Neutrino RTOS + 20140313 Re: Medium severity flaw in BlackBerry QNX Neutrino RTOS + 20140311 Medium severity flaw in BlackBerry QNX Neutrino RTOS + + + + + + + + + + + Directory traversal vulnerability in McAfee Web Gateway (MWG) 7.4.x before 7.4.1, 7.3.x before 7.3.2.6, and 7.2.0.9 and earlier allows remote authenticated users to read arbitrary files via a crafted request to the web filtering port. + + + Per: https://kc.mcafee.com/corporate/index?page=content&id=SB10063 + +"Affected versions + + MWG 7.4.0 (and earlier) + MWG 7.3.2.4 (and earlier) + MWG 7.2.0.9 (and earlier)" + + + + + + + + + + https://kc.mcafee.com/corporate/index?page=content&id=SB10063 + mcafee-gateway-filtering-dir-traversal(91772) + 66193 + 56958 + + + + + + + + + + + + Directory traversal vulnerability in McAfee Cloud Identity Manager 3.0, 3.1, and 3.5.1, McAfee Cloud Single Sign On (MCSSO) before 4.0.1, and Intel Expressway Cloud Access 360-SSO 2.1 and 2.5 allows remote authenticated users to read an unspecified file containing a hash of the administrator password via unknown vectors. + + + Per: https://kc.mcafee.com/corporate/index?page=content&id=SB10066 + +"Affected Versions: + + Intel Expressway Cloud Access 360-SSO 2.1, 2.5 + McAfee Cloud Identity Manager 3.0, 3.1, 3.5.1 + McAfee Cloud Single Sign On 4.0.0" + + + + + + + + + https://kc.mcafee.com/corporate/index?page=content&id=SB10066 + 66181 + 57381 + 57368 + + + + + + + + + + + + + + + + + + + Memory leak in the TCP stack in the kernel in Sophos UTM before 9.109 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors. + + + + + + + + + http://blogs.sophos.com/2014/02/20/utm-up2date-9-109/ + 1029920 + 66231 + 57344 + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in lib/rack/ssl.rb in the rack-ssl gem before 1.4.0 for Ruby allows remote attackers to inject arbitrary web script or HTML via a URI, which might not be properly handled by third-party adapters such as JRuby-Rack. + + + + + + + + + + https://github.com/josh/rack-ssl/commit/9d7d7300b907e496db68d89d07fbc2e0df0b487b + [oss-security] 20140319 Re: CVE Request: rack-ssl rubygem: XSS in error page + 57466 + openSUSE-SU-2014:0515 + + + + + + + + + + + + + + + + + SQL injection vulnerability in OrbitScripts Orbit Open Ad Server before 1.1.1 allows remote attackers to execute arbitrary SQL commands via the site_directory_sort_field parameter to guest/site_directory. + + + + + + + + + + + https://www.htbridge.com/advisory/HTB23208 + 66667 + 20140409 SQL Injection in Orbit Open Ad Server + 32792 + + + + + + + + + + The Rendezvous Daemon (rvd), Rendezvous Routing Daemon (rvrd), Rendezvous Secure Daemon (rvsd), and Rendezvous Secure Routing Daemon (rvsrd) in TIBCO Rendezvous before 8.4.2, Messaging Appliance before 8.7.1, and Substation ES before 2.8.1 do not properly implement access control, which allows remote attackers to obtain sensitive information or modify transmitted information via unspecified vectors. + + + + + + + + + http://www.tibco.com/multimedia/rendezvous_advisory_20140408_tcm8-20763.txt + http://www.tibco.com/mk/advisory.jsp + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the Rendezvous Daemon (rvd), Rendezvous Routing Daemon (rvrd), Rendezvous Secure Daemon (rvsd), and Rendezvous Secure Routing Daemon (rvsrd) in TIBCO Rendezvous before 8.4.2, Messaging Appliance before 8.7.1, and Substation ES before 2.8.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + http://www.tibco.com/multimedia/rendezvous_advisory_20140408_tcm8-20763.txt + http://www.tibco.com/mk/advisory.jsp + + + + + + + + + + + + + + + + + + + + + + + + + Buffer overflow in the Rendezvous Daemon (rvd), Rendezvous Routing Daemon (rvrd), Rendezvous Secure Daemon (rvsd), and Rendezvous Secure Routing Daemon (rvsrd) in TIBCO Rendezvous before 8.4.2, Messaging Appliance before 8.7.1, and Substation ES before 2.8.1 allows remote attackers to execute arbitrary code by leveraging access to a directly connected client and transmitting crafted data. + + + + + + + + + + + http://www.tibco.com/multimedia/rendezvous_advisory_20140408_tcm8-20763.txt + http://www.tibco.com/mk/advisory.jsp + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in Spotfire Web Player Engine, Spotfire Desktop, and Spotfire Server Authentication Module in TIBCO Spotfire Server 3.3.x before 3.3.4, 4.5.x before 4.5.1, 5.0.x before 5.0.2, 5.5.x before 5.5.1, and 6.x before 6.0.2; Spotfire Professional 4.0.x before 4.0.4, 4.5.x before 4.5.2, 5.0.x before 5.0.2, 5.5.x before 5.5.1, and 6.x before 6.0.1; Spotfire Web Player 4.0.x before 4.0.4, 4.5.x before 4.5.2, 5.0.x before 5.0.2, 5.5.x before 5.5.1, and 6.x before 6.0.1; Spotfire Automation Services 4.0.x before 4.0.4, 4.5.x before 4.5.2, 5.0.x before 5.0.2, 5.5.x before 5.5.1, and 6.x before 6.0.1; Spotfire Deployment Kit 4.0.x before 4.0.4, 4.5.x before 4.5.2, 5.0.x before 5.0.2, 5.5.x before 5.5.1, and 6.x before 6.0.1; Spotfire Desktop 6.x before 6.0.1; and Spotfire Analyst 6.x before 6.0.1 allows remote attackers to execute arbitrary code via unknown vectors. + + + + + + + + + + + http://www.tibco.com/multimedia/spotfire_advisory_20140409_tcm8-20764.txt + http://www.tibco.com/mk/advisory.jsp + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + TIBCO Managed File Transfer Internet Server before 7.2.2, Managed File Transfer Command Center before 7.2.2, Slingshot before 1.9.1, and Vault before 1.0.1 allow remote attackers to obtain sensitive information via a crafted HTTP request. + + + + + + + + + http://www.tibco.com/multimedia/mft_advisory_20140429_tcm8-21013.txt + http://www.tibco.com/mk/advisory.jsp + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to dynamic fields. + + + + + + + + + + https://www.otrs.com/security-advisory-2014-04-xss-issue + 57616 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + OTRS 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote attackers to conduct clickjacking attacks via an IFRAME element. + + + + + + + + + + http://www.otrs.com/security-advisory-2014-05-clickjacking-issue/ + openSUSE-SU-2014:0561 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The commandline interface in Blue Coat Content Analysis System (CAS) 1.1 before 1.1.4.2 allows remote administrators to execute arbitrary commands via unspecified vectors, related to "command injection." + + + + + + + + + + + https://kb.bluecoat.com/index?page=content&id=SA78&actp=LIST + + + + + + + + + + + + + + + The OpenConnectionTask::handleStateHelper function in Imap/Tasks/OpenConnectionTask.cpp in Trojita before 0.4.1 allows man-in-the-middle attackers to trigger use of cleartext for saving a message into a (1) sent or (2) draft folder via a PREAUTH response that prevents later use of the STARTTLS command. + + + + + + + + + + https://github.com/jktjkt/trojita/commit/25fffa3e25cbad85bbca804193ad336b090a9ce1 + http://jkt.flaska.net/blog/Trojita_0_4_1__a_security_update_for_CVE_2014_2567.html + + + + + + + + + + + + + + + + + + + + + + + Use-after-free vulnerability in the nfqnl_zcopy function in net/netfilter/nfnetlink_queue_core.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation. NOTE: the affected code was moved to the skb_zerocopy function in net/core/skbuff.c before the vulnerability was announced. + + + + + + + + + [oss-security] 20140320 Re: CVE request -- kernel: net: potential information leak when ubuf backed skbs are skb_zerocopy()ied + [linux-kernel] 20140320 [PATCH v3] core, nfqueue, openvswitch: Orphan frags in skb_zerocopy and handle errors + https://bugzilla.redhat.com/show_bug.cgi?id=1079012 + linux-kernel-cve20142568-info-disclosure(91922) + 66348 + [oss-sec] 20140320 CVE request -- kernel: net: potential information leak when ubuf backed skbs are skb_zerocopy()ied + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the quiz_question_tostring function in mod/quiz/editlib.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote authenticated users to inject arbitrary web script or HTML via a quiz question. + + + + + + + + + + https://moodle.org/mod/forum/discuss.php?d=256416 + [oss-security] 20140317 Moodle security notifications public + http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43690 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + mod/assign/externallib.php in Moodle 2.6.x before 2.6.2 does not properly handle assignment web-service parameters, which might allow remote authenticated users to modify grade metadata via unspecified vectors. + + + + + + + + + https://moodle.org/mod/forum/discuss.php?d=256425 + [oss-security] 20140317 Moodle security notifications public + http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43468 + + + + + + + + + + + The VMWare driver in OpenStack Compute (Nova) 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by requesting the VM be put into rescue and then deleting the image. + + + + + + + + + https://bugs.launchpad.net/nova/+bug/1269418 + [oss-security] 20140321 Re: CVE request for vulnerability in OpenStack Nova + [oss-security] 20140321 CVE request for vulnerability in OpenStack Nova + 57498 + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk before 5.0.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + splunk-cve20142578-xss(92126) + http://www.splunk.com/view/SP-CAAAKQX + 1029966 + 57554 + + + + + + + + + + + + + + + + + Multiple cross-site request forgery (CSRF) vulnerabilities in XCloner Standalone 3.5 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) change the administrator password via the config task to index2.php or (2) when the enable_db_backup and sql_mem options are enabled, access the database backup functionality via the dbbackup_comp parameter in the generate action to index2.php. NOTE: vector 2 might be a duplicate of CVE-2014-2340, which is for the XCloner Wordpress plugin. NOTE: remote attackers can leverage CVE-2014-2996 with vector 2 to execute arbitrary commands. + + + + + + + + + + + https://www.htbridge.com/advisory/HTB23207 + 20140409 &ETH;&iexcl;ross-Site Request Forgery (CSRF) in XCloner Standalone + 32790 + + + + + + + + + + The netback driver in Xen, when using certain Linux versions that do not allow sleeping in softirq context, allows local guest administrators to cause a denial of service ("scheduling while atomic" error and host crash) via a malformed packet, which causes a mutex to be taken when trying to disable the interface. + + + + + + + + + http://xenbits.xen.org/xsa/advisory-90.html + 1029949 + 66386 + [oss-security] 20140324 Re: Xen Security Advisory 90 - Linux netback crash trying to disable due to malformed packet + [oss-security] 20140324 Xen Security Advisory 90 - Linux netback crash trying to disable due to malformed packet + + + + + + + + + + Multiple directory traversal vulnerabilities in pam_timestamp.c in the pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to create aribitrary files or possibly bypass authentication via a .. (dot dot) in the (1) PAM_RUSER value to the get_ruser function or (2) PAM_TTY value to the check_tty funtion, which is used by the format_timestamp_name function. + + + + + + + + + + https://git.fedorahosted.org/cgit/linux-pam.git/commit/?id=Linux-PAM-1_1_8-32-g9dcead8 + 66493 + [oss-security] 20140331 Re: pam_timestamp internals + [oss-security] 20140326 Re: pam_timestamp internals + [oss-security] 20140324 pam_timestamp internals + 57317 + + + + + + + + + + ownCloud before 5.0.15 and 6.x before 6.0.2, when the file_external app is enabled, allows remote authenticated users to mount the local filesystem in the user's ownCloud via the mount configuration. + + + + + + + + + + http://owncloud.org/about/security/advisories/oC-SA-2014-008/ + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the login audit form in McAfee Cloud Single Sign On (SSO) allows remote attackers to inject arbitrary web script or HTML via a crafted password. + + + + + + + + + + https://twitter.com/BrandonPrry/status/445969380656943104 + 66302 + 32368 + 20140318 McAfee Cloud SSO and McAfee Asset Manager vulns + http://packetstormsecurity.com/files/125775/McAfee-Cloud-SSO-Asset-Manager-Issues.html + + + + + + + + + + SQL injection vulnerability in jsp/reports/ReportsAudit.jsp in McAfee Asset Manager 6.6 allows remote authenticated users to execute arbitrary SQL commands via the username of an audit report (aka user parameter). + + + + + + + + + + + mcafee-asset-reportsaudit-sql-injection(91929) + 1029927 + 66302 + 104634 + 32368 + 20140318 McAfee Cloud SSO and McAfee Asset Manager vulns + http://packetstormsecurity.com/files/125775/McAfee-Cloud-SSO-Asset-Manager-Issues.html + + + + + + + + + + Directory traversal vulnerability in servlet/downloadReport in McAfee Asset Manager 6.6 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the reportFileName parameter. + + + + + + + + + mcafee-asset-dir-traversal(91930) + 1029927 + 66302 + 104633 + 32368 + 20140318 McAfee Cloud SSO and McAfee Asset Manager vulns + http://packetstormsecurity.com/files/125775/McAfee-Cloud-SSO-Asset-Manager-Issues.html + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the Dashboard Backend service (stats/dashboard.jsp) in SonicWall Network Security Appliance (NSA) 2400 allows remote attackers to inject arbitrary web script or HTML via the sn parameter. + + + + + + + + + + sonicwall-nsa-dashboard-xss(91766) + http://www.vulnerability-lab.com/get_content.php?id=1100 + 1029884 + 66042 + 20140306 SonicWall Dashboard Backend Server - Client Side Cross Site Scripting Web Vulnerability + 104089 + 57275 + + + + + + + + + + The web management interface in Siemens RuggedCom ROS before 3.11, ROS 3.11 before 3.11.5 for RS950G, ROS 3.12, and ROS 4.0 for RSG2488 allows remote attackers to cause a denial of service (interface outage) via crafted HTTP packets. + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-087-01 + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-831997.pdf + + + + + + + + + + + + + + + + + + + + + PCNetSoftware RAC Server 4.0.4 and 4.0.5 allows local users to cause a denial of service (disabled keyboard or crash) via a large input buffer to unspecified IOCTL requests in RACDriver.sys, which triggers a buffer over-read. + + + + + + + + + https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2597/ + 58090 + 20140416 CVE-2014-2597 - Denial of Service in PCNetSoftware RAC Server + + + + + + + + + + + The HVMOP_set_mem_access HVM control operations in Xen 4.1.x for 32-bit and 4.1.x through 4.4.x for 64-bit allow local guest administrators to cause a denial of service (CPU consumption) by leveraging access to certain service domains for HVM guests and a large input. + + + + + + + + + http://xenbits.xen.org/xsa/advisory-89.html + 1029956 + 66407 + [oss-security] 20140325 Re: Xen Security Advisory 89 - HVMOP_set_mem_access is not preemptible + [oss-security] 20140325 Xen Security Advisory 89 - HVMOP_set_mem_access is not preemptible + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in HP IceWall Identity Manager 4.0 through SP1 and 5.0 and IceWall SSO 10.0 Password Reset Option, when Apache Commons FileUpload is used, allows remote authenticated users to cause a denial of service via unknown vectors. + + + + + + + + + SSRT101450 + HPSBGN02986 + + + + + + + + + + + + + + The server in HP Integrated Lights-Out 2 (aka iLO 2) 2.23 and earlier allows remote attackers to cause a denial of service via crafted HTTPS traffic, as demonstrated by traffic from a CVE-2014-0160 vulnerability-assessment tool. + + + + + + + + + SSRT101509 + HPSBHF03006 + + + + + + + + + + + + + + + + + + + + The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate. + + + + + + + + + + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742513 + USN-2164-1 + DSA-2894 + [oss-security] 20140326 CVE request: openssh client does not check SSHFP if server offers certificate + + + + + + + + + + + + + + + + Multiple SQL injection vulnerabilities in MobFox mAdserve 2.0 and earlier allow remote authenticated users to execute arbitrary SQL commands via the id parameter to (1) edit_ad_unit.php, (2) view_adunits.php, or (3) edit_campaign.php in www/cp/. + + + + + + + + + + + https://www.htbridge.com/advisory/HTB23209 + madserve-cve20142654-sql-injection(92545) + 66661 + 20140416 SQL Injection in mAdserve + 58003 + + + + + + + + + + SQL injection vulnerability in the gen_show_status function in functions.inc.php in Postfix Admin (aka postfixadmin) before 2.3.7 allows remote authenticated users to execute arbitrary SQL commands via a new alias. + + + + + + + + + + + http://sourceforge.net/p/postfixadmin/code/1650 + 66455 + [oss-security] 20140326 CVE request: postfixadmin SQL injection vulnerability + [oss-security] 20140326 Re: CVE request: postfixadmin SQL injection vulnerability + DSA-2889 + + + + + + + + + + + + + + + + + Unspecified vulnerability in the print release functionality in PaperCut MF 14.1 (Build 26983) has unknown impact and remote vectors, related to embedded MFPs. + + + + + + + + + + + papercut-cve20142657-unspec(92650) + http://www.papercut-mf.com/release-history/ + + + + + + + + + + Unspecified vulnerability in Papercut MF and NG before 14.1 (Build 26983) allows attacker to cause a denial of service via unknown vectors. + + + + + + + + + papercut-cve20142658-dos(92649) + http://www.papercut.com/release-history/ + http://www.papercut-mf.com/release-history/ + 58037 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site request forgery (CSRF) vulnerability in the admin UI in Papercut MF and NG before 14.1 (Build 26983) allows remote attackers to hijack the authentication of administrators via unspecified vectors. + + + + + + + + + + + + papercut-cve20142659-csrf(92648) + http://www.papercut.com/release-history/ + http://www.papercut-mf.com/release-history/ + 58037 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + includes/specials/SpecialChangePassword.php in MediaWiki before 1.19.14, 1.20.x and 1.21.x before 1.21.8, and 1.22.x before 1.22.5 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account, as demonstrated by tracking the victim's activity, related to a "login CSRF" issue. + + + + + + + + + https://gerrit.wikimedia.org/r/#/c/121517/1/includes/specials/SpecialChangePassword.php + [mediawiki-announce] 20140328 MediaWiki Security and Maintenance Releases: 1.22.5, 1.21.8 and 1.19.14 + https://bugzilla.wikimedia.org/show_bug.cgi?id=62497 + [oss-security] 20140401 Re: CVE request: MediaWiki 1.22.5 login csrf + [oss-security] 20140327 CVE request: MediaWiki 1.22.5 login csrf + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Apache CouchDB 1.5.0 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via the count parameter to /_uuids. + + + + + + + + + apache-couchdb-cve20142668-dos(92161) + 1029967 + 66474 + 32519 + 57572 + http://packetstormsecurity.com/files/125889 + + + + + + + + + + Multiple integer overflows in contrib/hstore/hstore_io.c in PostgreSQL 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact via vectors related to the (1) hstore_recv, (2) hstore_from_arrays, and (3) hstore_from_array functions in contrib/hstore/hstore_io.c; and the (4) hstoreArrayToPairs function in contrib/hstore/hstore_op.c, which triggers a buffer overflow. NOTE: this issue was SPLIT from CVE-2014-0064 because it has a different set of affected versions. + + + + + + + + + + + https://github.com/postgres/postgres/commit/31400a673325147e1205326008e32135a78b4d8a + http://www.postgresql.org/support/security/ + http://www.postgresql.org/about/news/1506/ + DSA-2865 + DSA-2864 + http://wiki.postgresql.org/wiki/20140220securityrelease + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in Properties.do in ZOHO ManageEngine OpStor before build 8500 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter, a different vulnerability than CVE-2014-0344. + + + + + + + + + + VU#140886 + + + + + + + + + + Microsoft Windows Media Player (WMP) 11.0.5721.5230 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted WAV file. + + + + + + + + + + + + ms-media-player-wav-code-exec(92080) + 66403 + 32477 + http://packetstormsecurity.com/files/125834 + + + + + + + + + + Race condition in the ath_tx_aggr_sleep function in drivers/net/wireless/ath/ath9k/xmit.c in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via a large amount of network traffic that triggers certain list deletions. + + + + + + + + + https://github.com/torvalds/linux/commit/21f8aaee0c62708654988ce092838aa7df4d25d8 + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=21f8aaee0c62708654988ce092838aa7df4d25d8 + https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.15 + https://bugzilla.kernel.org/show_bug.cgi?id=70551 + 66492 + [oss-security] 20140330 Re: CVE request: Linux Kernel, two security issues + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.7 + 57468 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The arch_dup_task_struct function in the Transactional Memory (TM) implementation in arch/powerpc/kernel/process.c in the Linux kernel before 3.13.7 on the powerpc platform does not properly interact with the clone and fork system calls, which allows local users to cause a denial of service (Program Check and system crash) via certain instructions that are executed with the processor in the Transactional state. + + + + + + + + + https://github.com/torvalds/linux/commit/621b5060e823301d0cba4cb52a7ee3491922d291 + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=621b5060e823301d0cba4cb52a7ee3491922d291 + https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.15 + linux-kernel-cve20142673-dos(92113) + 66477 + [oss-security] 20140330 Re: CVE request: Linux Kernel, two security issues + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.7 + 57436 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The rds_iw_laddr_check function in net/rds/iw.c in the Linux kernel through 3.14 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports. + + + + + + + + + [linux-kernel] 20140329 [PATCH v2] rds: prevent dereference of a NULL device in rds_iw_laddr_check + 66543 + [oss-security] 20140331 CVE-2013-7348 CVE-2014-2678 Linux kernel aio and rds issues + FEDORA-2014-4844 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Citrix VDI-in-a-Box 5.3.x before 5.3.6 and 5.4.x before 5.4.3 allows local users to obtain administrator credentials by reading the log. + + + + + + + + + 1030068 + http://support.citrix.com/article/CTX140106 + 57734 + + + + + + + + + + + + + + + + + + Race condition in the mac80211 subsystem in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via network traffic that improperly interacts with the WLAN_STA_PS_STA state (aka power-save mode), related to sta_info.c and tx.c. + + + + + + + + + https://github.com/torvalds/linux/commit/1d147bfa64293b2723c4fec50922168658e613ba + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1d147bfa64293b2723c4fec50922168658e613ba + https://bugzilla.redhat.com/show_bug.cgi?id=1083512 + https://bugzilla.kernel.org/show_bug.cgi?id=70551#c18 + [oss-security] 20140401 Re: CVE request: Linux Kernel, two security issues + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.7 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cups-browsed in cups-filters 1.0.41 before 1.0.51 in allows remote IPP printers to execute arbitrary commands via shell metacharacters in the (1) model or (2) PDL, related to "System V interface scripts generated for queues." + + + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1083326 + 57530 + [oss-security] 20140402 Re: cups-browsed remote exploit + FEDORA-2014-4708 + http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7188#NEWS + + + + + + + + + + + + + + + + + + + SQL injection vulnerability in graph_xport.php in Cacti 0.8.8b allows remote attackers to execute arbitrary SQL commands via unspecified vectors. + + + + + + + + + + + http://svn.cacti.net/viewvc?view=rev&revision=7439 + https://bugzilla.redhat.com/show_bug.cgi?id=1084258 + cacti-cve20142708-sql-injection(92278) + 66555 + [oss-security] 20140401 CVE request: cacti "bug#0002405: SQL injection in graph_xport.php" + [oss-security] 20140403 Re: CVE request: cacti "bug#0002405: SQL injection in graph_xport.php" + + + + + + + + + + lib/rrd.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified parameters. + Per: https://cwe.mitre.org/data/definitions/77.html + +"CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')" + + + + + + + + + + + http://svn.cacti.net/viewvc?view=rev&revision=7439 + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768 + 66630 + 57647 + [oss-security] 20140403 Re: CVE request: cacti "bug#0002405: SQL injection in graph_xport.php" + FEDORA-2014-4892 + FEDORA-2014-4928 + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in J-Web in Juniper Junos before 11.4R11, 11.4X27 before 11.4X27.62 (BBE), 12.1 before 12.1R9, 12.1X44 before 12.1X44-D35, 12.1X45 before 12.1X45-D25, 12.1X46 before 12.1X46-D20, 12.2 before 12.2R7, 12.3 before 12.3R6, 13.1 before 13.1R4, 13.2 before 13.2R3, and 13.3 before 13.3R1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10619 + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in J-Web in Juniper Junos before 10.0S25, 10.4 before 10.4R10, 11.4 before 11.4R11, 12.1 before 12.1R9, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, 12.1X46 before 12.1X46-D10, and 12.2 before 12.2R1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to index.php. + + + + + + + + + + http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10521 + + + + + + + + + + + + + + + + + Juniper Junos before 11.4R11, 12.1 before 12.1R9, 12.2 before 12.2R7, 12.3R4 before 12.3R4-S3, 13.1 before 13.1R4, 13.2 before 13.2R2, and 13.3 before 13.3R1, as used in MX Series and T4000 routers, allows remote attackers to cause a denial of service (PFE restart) via a crafted IP packet to certain (1) Trio or (2) Cassis-based Packet Forwarding Engine (PFE) modules. + + + + + + + + + http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10621 + + + + + + + + + + + + + + + + The Enhanced Web Filtering (EWF) in Juniper Junos before 10.4R15, 11.4 before 11.4R9, 12.1 before 12.1R7, 12.1X44 before 12.1X44-D20, 12.1X45 before 12.1X45-D10, and 12.1X46 before 12.1X46-D10, as used in the SRX Series services gateways, allows remote attackers to cause a denial of service (flow daemon crash and restart) via a crafted URL. + + + + + + + + + 66760 + 1030060 + 57835 + http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10622 + + + + + + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in vwrooms\templates\logout.tpl.php in the VideoWhisper Webcam plugins for Drupal 7.x allow remote attackers to inject arbitrary web script or HTML via the (1) module or (2) message parameter to index.php. + + + + + + + + + + 20140425 [CVE-2014-2715] Cross-site scripting (XSS) vulnerability in Videowhisper + + + + + + + + + + + + + Advanced_System_Content.asp in the ASUS RT series routers with firmware before 3.0.0.4.374.5517, when an administrator session is active, allows remote authenticated users to obtain the administrator user name and password by reading the source code. + + + + + + + + + http://support.asus.com/download.aspx?m=RT-N66U+%28VER.B1%29 + 20140416 ASUS RT-XXXX SOHO routers expose admin password, fixed in 3.0.0.4.374.5517 + http://dnlongen.blogspot.com/2014/04/CVE-2014-2719-Asus-RT-Password-Disclosure.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in content.aspx in Ektron CMS 8.7 before 8.7.0.055 allows remote authenticated users to inject arbitrary web script or HTML via the category0 parameter, which is not properly handled when displaying the Subjects tab in the View Properties menu option. + + + + + + + + + + 20140416 [SECURITY] Stored Cross Site Scripting in Ektron CMS 8.7 + 20140416 [Security Advisory] Stored Cross Site Scripting in Ektron CMS 8.7 + http://packetstormsecurity.com/files/126187/Ektron-CMS-8.7-Cross-Site-Scripting.html + + + + + + + + + + The XML parser in Microsoft Office 2007 SP3, 2010 SP1 and SP2, and 2013, and Office for Mac 2011, does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory consumption and persistent application hang) via a crafted XML document containing a large number of nested entity references, as demonstrated by a crafted text/plain e-mail message to Outlook, a similar issue to CVE-2003-1564. + + + + + + + + + 20140403 [softScheck] Denial of Service in Microsoft Office 2007-2013 + + + + + + + + + + + + + + + + + Multiple unspecified vulnerabilities in the integrated web server in Siemens SINEMA Server before 12 SP1 allow remote attackers to execute arbitrary code via HTTP traffic to port (1) 4999 or (2) 80. + + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-107-01 + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-364879.pdf + + + + + + + + + + Multiple directory traversal vulnerabilities in the integrated web server in Siemens SINEMA Server before 12 SP1 allow remote attackers to access arbitrary files via HTTP traffic to port (1) 4999 or (2) 80. + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-107-01 + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-364879.pdf + + + + + + + + + + Siemens SINEMA Server before 12 SP1 allows remote attackers to cause a denial of service (web-interface outage) via crafted HTTP requests to port (1) 4999 or (2) 80. + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-107-01 + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-364879.pdf + + + + + + + + + + The openssl extension in Ruby 2.x does not properly maintain the state of process memory after a file is reopened, which allows remote attackers to spoof signatures within the context of a Ruby script that attempts signature verification after performing a certain sequence of filesystem operations. + + + + + + + + + + https://gist.github.com/10446549 + 20140416 Ruby OpenSSL private key spoofing ~ CVE-2014-2734 with PoC + http://packetstormsecurity.com/files/126218/Ruby-OpenSSL-Private-Key-Spoofing.html + + + + + + + + + + + + + + + + + + + + WinSCP before 5.5.3, when FTP with TLS is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. + + + + + + + + + + 20140416 CVE-2014-2735 - WinSCP: missing X.509 validation + http://winscp.net/tracker/show_bug.cgi?id=1152 + http://winscp.net/eng/docs/history + + + + + + + + + + + + Multiple SQL injection vulnerabilities in MODX Revolution before 2.2.14 allow remote attackers to execute arbitrary SQL commands via the (1) session ID (PHPSESSID) to index.php or remote authenticated users to execute arbitrary SQL commands via the (2) user parameter to connectors/security/message.php or (3) id parameter to manager/index.php. + + + + + + + + + + + 66990 + 58036 + http://forums.modx.com/thread/90173/modx-revolution-2-2-13-and-prior-blind-sql-injection + 20140419 Multiple Vulnerabilities in MODX Revolution < = MODX 2.2.13-pl + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + SQL injection vulnerability in the get_active_session function in the KTAPI_UserSession class in webservice/clienttools/services/mdownload.php in KnowledgeTree 3.7.0.2 and earlier allows remote attackers to execute arbitrary SQL commands via the u parameter, related to the getFileName function. + + + + + + + + + + + 20140419 Blind SQL Injection Vulnerability in KnowledgeTree <= 3.7.0.2 + + + + + + + + + + + + The cma_req_handler function in drivers/infiniband/core/cma.c in the Linux kernel 3.14.x through 3.14.1 attempts to resolve an RDMA over Converged Ethernet (aka RoCE) address that is properly resolved within a different module, which allows remote attackers to cause a denial of service (incorrect pointer dereference and system crash) via crafted network traffic. + + + + + + + + + [oss-security] 20140410 Re: CVE request Linux kernel: IB/core: crash while resolving passive side RoCE L2 address in cma_req_handler + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b2853fd6c2d0f383dbdf7427e263eb576a633867 + https://github.com/torvalds/linux/commit/b2853fd6c2d0f383dbdf7427e263eb576a633867 + https://bugzilla.redhat.com/show_bug.cgi?id=1085415 + 66716 + + + + + + + + + + + + + + + + + + Ignite Realtime Openfire before 3.9.2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack. + + + + + + + + + http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/ + [oss-security] 20140408 Re: (Openfire M-Link Metronome Prosody Tigase) Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression + [oss-security] 20140407 Re: Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression + + + + + + + + + + Isode M-Link before 16.0v7 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack. + + + + + + + + + http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/ + [oss-security] 20140408 Re: (Openfire M-Link Metronome Prosody Tigase) Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression + [oss-security] 20140407 Re: Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression + + + + + + + + + + + + + + plugins/mod_compression.lua in Lightwitch Metronome through 3.4 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack. + + + + + + + + + http://code.lightwitch.org/metronome/rev/49f47277a411 + http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/ + [oss-security] 20140408 Re: (Openfire M-Link Metronome Prosody Tigase) Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression + [oss-security] 20140407 Re: Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression + + + + + + + + + + plugins/mod_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticated, which allows remote attackers to cause a denial of service (resource consumption) via compressed XML elements in an XMPP stream, aka an "xmppbomb" attack. + + + + + + + + + http://hg.prosody.im/0.9/rev/b3b1c9da38fb + http://code.lightwitch.org/metronome/rev/49f47277a411 + http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/ + DSA-2895 + 57710 + [oss-security] 20140408 Re: (Openfire M-Link Metronome Prosody Tigase) Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression + [oss-security] 20140407 Re: Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression + http://blog.prosody.im/prosody-0-9-4-released/ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Prosody before 0.9.4 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack, related to core/portmanager.lua and util/xmppstream.lua. + + + + + + + + + http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/ + DSA-2895 + 57710 + [oss-security] 20140408 Re: (Openfire M-Link Metronome Prosody Tigase) Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression + [oss-security] 20140407 Re: Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression + http://hg.prosody.im/0.9/rev/a97591d2e1ad + http://hg.prosody.im/0.9/rev/1107d66d2ab2 + http://blog.prosody.im/prosody-0-9-4-released/ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + net/IOService.java in Tigase before 5.2.1 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack. + + + + + + + + + https://projects.tigase.org/projects/tigase-server/repository/revisions/7f5af2f8c5b97bbf9def66fbb9dd47746a7ac292 + https://projects.tigase.org/issues/1780 + http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/ + http://www.tigase.org/content/uncontrolled-resource-consumption-highly-compressed-xmpp-messages + [oss-security] 20140408 Re: (Openfire M-Link Metronome Prosody Tigase) Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression + [oss-security] 20140407 Re: Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression + + + + + + + + + + The Security Audit Log facility in SAP Enhancement Package (EHP) 6 for SAP ERP 6.0 allows remote attackers to modify or delete arbitrary log classes via unspecified vectors. NOTE: some of these details are obtained from third party information. + + + + + + + + + + + https://service.sap.com/sap/support/notes/1926485 + sap-ehp-log-sec-bypass(92334) + http://www.onapsis.com/research-advisories.php + http://www.onapsis.com/get.php?resid=adv_onapsis-2014-002 + 57741 + + + + + + + + + + The HANA ICM process in SAP HANA allows remote attackers to obtain the platform version, host name, instance number, and possibly other sensitive information via a malformed HTTP GET request. + + + + + + + + + https://service.sap.com/sap/support/notes/1914778 + sap-hana-icm-info-disc(92325) + 66675 + http://www.onapsis.com/research-advisories.php + http://www.onapsis.com/get.php?resid=adv_onapsis-2014-001 + 57443 + + + + + + + + + + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-2744, CVE-2014-2745. Reason: This candidate is a duplicate of CVE-2014-2744 and/or CVE-2014-2745. Notes: All CVE users should reference CVE-2014-2744 and/or CVE-2014-2745 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. + + + + + + SAP Print and Output Management has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors. + + + + + + + + + + + http://www.onapsis.com/research-advisories.php + http://www.onapsis.com/get.php?resid=adv_onapsis-2014-004 + + + + + + + + + + SAP Business Object Processing Framework (BOPF) for ABAP has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors. + + + + + + + + + + + http://www.onapsis.com/research-advisories.php + http://www.onapsis.com/get.php?resid=adv_onapsis-2014-003 + + + + + + + + + + The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to cause a denial of service (CPU consumption) via a large number of the same authentication method in a request, aka "authentication chaining." + + + + + + + + + https://bugs.launchpad.net/keystone/+bug/1300274 + [oss-security] 20140410 [OSSA 2014-013] Keystone DoS through V3 API authentication chaining (CVE-2014-2828) + + + + + + + + + + + + + + + + + Erlang Solutions MongooseIM through 1.3.1 rev. 2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack. + + + + + + + + + https://github.com/esl/MongooseIM/commit/586d96cc12ef218243a3466354b4d208b5472a6c + http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/ + + + + + + + + + + + + + + Juniper ScreenOS 6.3 and earlier allows remote attackers to cause a denial of service (crash and restart or failover) via a malformed SSL/TLS packet. + + + + + + + + + https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10624 + 66802 + 57910 + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in F-Secure Messaging Secure Gateway 7.5.0 before Patch 1862 allows remote authenticated administrators to inject arbitrary web script or HTML via the new parameter in the SysUser module to admin. + + + + + + + + + + http://www.f-secure.com/en/web/labs_global/fsc-2014-2 + 58038 + 20140416 Reflected XSS Attacks vulnerabilities F-Secure Messaging Security Gateway V7.5.0.892 (CVE-2014-2844) + + + + + + + + + + Directory traversal vulnerability in opt/arkeia/wui/htdocs/index.php in the WD Arkeia virtual appliance (AVA) with firmware before 10.2.9 allows remote attackers to read arbitrary files and execute arbitrary PHP code via a ..././ (dot dot dot slash dot slash) in the lang Cookie parameter, as demonstrated by a request to login/doLogin. + + + + + + + + + + + 20140423 SEC Consult SA-20140423-0 :: Path Traversal/Remote Code Execution in WD Arkeia Network Backup Appliances + 20140423 SEC Consult SA-20140423-0 :: Path Traversal/Remote Code Execution in WD Arkeia Network Backup Appliances + + + + + + + + + + + + + SQL injection vulnerability in default.asp in CIS Manager CMS allows remote attackers to execute arbitrary SQL commands via the TroncoID parameter. + + + + + + + + + + + 66590 + 105364 + 32660 + + + + + + + + + + A race condition in the wmi_malware_scan.nbin plugin before 201402262215 for Nessus 5.2.1 allows local users to gain privileges by replacing the dissolvable agent executable in the Windows temp directory with a Trojan horse program. + + + + + + + + + + + https://www.nccgroup.com/en/learning-and-research-centre/technical-advisories/nessus-authenticated-scan-local-privilege-escalation/ + https://discussions.nessus.org/thread/7195 + 1029946 + 57403 + + + + + + + + + + + + + The Change Password dialog box (change_password) in Sophos Web Appliance before 3.8.2 allows remote authenticated users to change the admin user password via a crafted request. + + + + + + + + + + http://www.zerodayinitiative.com/advisories/ZDI-14-069/ + http://www.sophos.com/en-us/support/knowledgebase/120230.aspx + 66734 + 32789 + 57706 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The network interface configuration page (netinterface) in Sophos Web Appliance before 3.8.2 allows remote administrators to execute arbitrary commands via shell metacharacters in the address parameter. + + + + + + + + + + + http://www.zerodayinitiative.com/advisories/ZDI-14-069/ + http://www.sophos.com/en-us/support/knowledgebase/120230.aspx + 66734 + 32789 + 57706 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel through 3.14.1 allows local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that leverages an improperly managed reference counter. + + + + + + + + + + + https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=b04c46190219a4f845e46a459e3102137b7f6cac + [oss-security] 20140411 Re: CVE request -- Linux kernel: net: ping: refcount issue in ping_init_sock() function + [linux-kernel] 20140411 net: ipv4: current group_info should be put after using. + https://bugzilla.redhat.com/show_bug.cgi?id=1086730 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + OpenAFS before 1.6.7 delays the listen thread when an RXS_CheckResponse fails, which allows remote attackers to cause a denial of service (performance degradation) via an invalid packet. + + + + + + + + + http://www.openafs.org/frameset/dl/openafs/1.6.7/ChangeLog + DSA-2899 + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remote attackers to inject arbitrary web script or HTML via the sort key in an info action. + + + + + + + + + + https://www.mediawiki.org/wiki/Release_notes/1.22#Changes_since_1.22.5 + https://www.mediawiki.org/wiki/Release_notes/1.21#Changes_since_1.21.8 + https://github.com/wikimedia/mediawiki-core/commit/0b695ae09aada343ab59be4a3c9963995a1143b6 + https://bugzilla.wikimedia.org/show_bug.cgi?id=63251 + https://bugzilla.redhat.com/show_bug.cgi?id=1091967 + 67068 + 58262 + [MediaWiki-announce] 20140424 MediaWiki Security and Maintenance Releases: 1.22.6 and 1.21.9 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The check_secret function in authenticate.c in rsync 3.1.0 and earlier allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a user name which does not exist in the secrets file. + + + + + + + + + https://git.samba.org/?p=rsync.git;a=commit;h=0dedfbce2c1b851684ba658861fe9d620636c56a + https://bugzilla.samba.org/show_bug.cgi?id=10551 + https://bugs.launchpad.net/ubuntu/+source/rsync/+bug/1307230 + [oss-security] 20140415 Re: CVE Request: rsync denial of service + [oss-security] 20140414 CVE Request: rsync denial of service + 57948 + FEDORA-2014-5315 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in scheduler/client.c in Common Unix Printing System (CUPS) before 1.7.2 allows remote attackers to inject arbitrary web script or HTML via the URL path, related to the is_path_absolute function. + + + + + + + + + + [oss-security] 20140415 Re: CVE request: cross-site scripting issue fixed in CUPS 1.7.2 + [oss-security] 20140414 CVE request: cross-site scripting issue fixed in CUPS 1.7.2 + http://www.cups.org/str.php?L4356 + http://www.cups.org/documentation.php/relnotes.html + 57880 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 does not properly restrict access to files in the META-INF directory, which allows remote attackers to obtain sensitive information via a direct request. NOTE: this issue was SPLIT from CVE-2014-0053 due to different researchers per ADT5. + + + + + + + + + 20140227 Update: CVE-2014-0053 Information Disclosure when using Grails + http://www.gopivotal.com/security/cve-2014-0053 + 20140227 Update: CVE-2014-0053 Information Disclosure when using Grails + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Directory traversal vulnerability in the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 allows remote attackers to obtain sensitive information via unspecified vectors related to a "configured block." NOTE: this issue was SPLIT from CVE-2014-0053 per ADT2 due to different vulnerability types. + + + + + + + + + 20140227 Update: CVE-2014-0053 Information Disclosure when using Grails + http://www.gopivotal.com/security/cve-2014-0053 + 20140227 Update: CVE-2014-0053 Information Disclosure when using Grails + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to bypass intended access restrictions via a direct request. + + + + + + + + + + + VU#437385 + + + + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to inject arbitrary web script or HTML via a crafted HTTP request to a (1) ColdFusion or (2) JavaScript component. + + + + + + + + + + VU#437385 + + + + + + + + + + + + + Incomplete blacklist vulnerability in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted string, as demonstrated by bypassing a protection mechanism that removes only the "alert" string. + Per: https://cwe.mitre.org/data/definitions/184.html "CWE-184: Incomplete Blacklist" + + + + + + + + + + VU#437385 + + + + + + + + + + + + + PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 does not check authorization in unspecified situations, which allows remote authenticated users to perform actions via unknown vectors. + + + + + + + + + + + VU#437385 + + + + + + + + + + + + + Multiple absolute path traversal vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to have an unspecified impact via a full pathname in a parameter. + + + + + + + + + + + VU#437385 + + + + + + + + + + + + + Multiple directory traversal vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to have an unspecified impact via a filename parameter containing directory traversal sequences. + + + + + + + + + + + VU#437385 + + + + + + + + + + + + + PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to bypass intended access restrictions via a '\0' character, as demonstrated by using this character within a pathname on the drive containing the web root directory of a ColdFusion installation. + + + + + + + + + + + VU#437385 + + + + + + + + + + + + + PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 relies on client JavaScript code for access restrictions, which allows remote attackers to perform unspecified operations by modifying this code. + + + + + + + + + + + VU#437385 + + + + + + + + + + + + + Unrestricted file upload vulnerability in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to execute arbitrary code by uploading a ColdFusion page, and then accessing it via unspecified vectors. + Per: http://cwe.mitre.org/data/definitions/434.html "CWE-434: Unrestricted Upload of File with Dangerous Type" + + + + + + + + + + + VU#437385 + + + + + + + + + + + + + PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to modify the flow of execution of ColdFusion code by using an HTTP GET request to set a ColdFusion variable. + Per http://cwe.mitre.org/data/definitions/472.html "CWE-472: External Control of Assumed-Immutable Web Parameter" + + + + + + + + + + + VU#437385 + + + + + + + + + + + + + PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to obtain sensitive information via requests to unspecified URIs, as demonstrated by pathname, SQL server, e-mail address, and IP address information. + + + + + + + + + VU#437385 + + + + + + + + + + + + + The default configuration of PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 uses cleartext for storage of credentials in a database, which makes it easier for context-dependent attackers to obtain sensitive information via unspecified vectors. + + + + + + + + + VU#437385 + + + + + + + + + + + + + PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 relies on an HTTP session for entering credentials on login pages, which allows remote attackers to obtain sensitive information by sniffing the network. + + + + + + + + + VU#437385 + + + + + + + + + + + + + PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to obtain potentially sensitive information from a directory listing via unspecified vectors. + + + + + + + + + VU#437385 + + + + + + + + + + + + + PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 does not require authentication for access to log files, which allows remote attackers to obtain sensitive server information by using a predictable name in a request for a file. + + + + + + + + + VU#437385 + + + + + + + + + + + + + PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to execute arbitrary code via shell metacharacters in an unspecified context. + + + + + + + + + + + VU#437385 + + + + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in Dell SonicWALL Email Security 7.4.5 and earlier allow remote authenticated administrators to inject arbitrary web script or HTML via (1) the uploadPatch parameter to the System/Advanced page (settings_advanced.html) or (2) the uploadLicenses parameter in the License management (settings_upload_dlicense.html) page. + + + + + + + + + + http://www.vulnerability-lab.com/get_content.php?id=1191 + http://www.sonicwall.com/us/shared/download/Support-Bulletin_Email-Security_Scripting_Vulnerability__Resolved_in__ES746.pdf + 1029965 + 20140328 Dell SonicWall EMail Security 7.4.5 - Multiple Vulnerabilities (Bulletin) + + + + + + + + + + Open redirect vulnerability in Oracle Identity Manager 11g R2 SP1 (11.1.2.1.0) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the backUrl parameter in a changepwd action to identity/faces/firstlogin. + + + + + + + + + + + 66615 + 105384 + 32670 + http://packetstormsecurity.com/files/125992/Oracle-Identity-Manager-11g-R2-SP1-Unvalidated-Redirect.html + + + + + + + + + + Unspecified vulnerability in the Diffie-Hellman key agreement implementation in the management GUI Java applet in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 9.3-66.5 and 10.x before 10.1-122.17 has unknown impact and vectors. + + + + + + + + + + + 1030180 + http://support.citrix.com/article/CTX140651 + + + + + + + + + + + + + + + Unspecified vulnerability in the management GUI in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 9.3-66.5 and 10.x before 10.1-122.17 has unspecified impact and vectors, related to certificate validation. + + + + + + + + + + + 1030180 + http://support.citrix.com/article/CTX140651 + + + + + + + + + + + + + + + lib/sfpagent/bsig.rb in the sfpagent gem before 0.4.15 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the module name in a JSON request. + Per: https://cwe.mitre.org/data/definitions/77.html + +"CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')" + + + + + + + + + + + http://www.vapid.dhs.org/advisories/spfagent-remotecmd.html + [oss-security] 20140418 Re: Remote Command Injection in Ruby Gem sfpagent 0.4.14 + [oss-security] 20140415 Remote Command Injection in Ruby Gem sfpagent 0.4.14 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Off-by-one error in the bpf_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 3.1.8, when BPF JIT is enabled, allows local users to cause a denial of service (system crash) or possibly gain privileges via a long jump after a conditional jump. + + + + + + + + + + + https://github.com/torvalds/linux/commit/a03ffcf873fe0f2565386ca8ef832144c42e67fa + [oss-security] 20140418 Re: CVE request Linux kernel: arch: x86: net: bpf_jit: an off-by-one bug in x86_64 cond jump target + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.1.8 + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a03ffcf873fe0f2565386ca8ef832144c42e67fa + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the wrap_html function in MyID.php in phpMyID 0.9 allows remote attackers to inject arbitrary web script or HTML via the openid_error parameter to MyID.config.php when the openid.mode parameter is set to error, which is not properly handled in an error message. + + + + + + + + + + 66665 + [oss-security] 20140418 Re: CVE Request - XXS in phpMyID (openid_error) + [oss-security] 20140417 CVE Request - XXS in phpMyID (openid_error) + + + + + + + + + + Heap-based buffer overflow in the get_answer function in mmsh.c in libmms before 0.6.4 allows remote attackers to execute arbitrary code via a long line in an MMS over HTTP (MMSH) server response. + + + + + + + + + + + [oss-security] 20140418 Re: libmms heap-based buffer overflow fix + http://sourceforge.net/p/libmms/code/ci/03bcfccc22919c72742b7338d02859962861e0e8 + libmms-getanswer-bo(92640) + 66933 + http://sourceforge.net/p/libmms/code/ci/master/tree/ChangeLog + 57875 + + + + + + + + + + + + + The GetHTMLRunDir function in the scan-build utility in Clang 3.5 and earlier allows local users to obtain sensitive information or overwrite arbitrary files via a symlink attack on temporary directories with predictable names. + + + + + + + + + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=744817 + [oss-security] 20140420 Re: Bug#744817: CVE request: insecure temporary file handling in clang's scan-build utility + [oss-security] 20140416 CVE request: insecure temporary file handling in clang's scan-build utility + + + + + + + + + + Off-by-one error in the cmd_smart function in the smart self test in hw/ide/core.c in QEMU before 2.0 allows local users to have unspecified impact via a SMART EXECUTE OFFLINE command that triggers a buffer underflow and memory corruption. + + + + + + + + + + + [Qemu-devel] 20140414 Re: [PATCH for 2.0] ide: Correct improper smart self test c + [Qemu-devel] 20140414 Re: [PATCH for 2.0] ide: Correct improper smart self test c + [Qemu-devel] 20140412 [PATCH for 2.0] ide: Correct improper smart self test c + 66932 + [oss-security] 20140418 Re: CVE request Qemu: out of bounds buffer access, guest triggerable via IDE SMART + [oss-security] 20140415 CVE request Qemu: out of bounds buffer access, guest triggerable via IDE SMART + 57945 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + wolfSSL CyaSSL before 2.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via (1) a request for the peer certificate when a certificate parsing failure occurs or (2) a client_key_exchange message when the ephemeral key is not found. + + + + + + + + + http://www.wolfssl.com/yaSSL/Docs-cyassl-changelog.html + http://www.wolfssl.com/yaSSL/Blog/Entries/2014/4/11_wolfSSL_Security_Advisory__April_9%2C_2014.html + 57743 + [oss-security] 20140418 Re: CVE ids for CyaSSL 2.9.4? + [oss-security] 20140417 CVE ids for CyaSSL 2.9.4? + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + wolfSSL CyaSSL before 2.9.4 does not properly validate X.509 certificates with unknown critical extensions, which allows man-in-the-middle attackers to spoof servers via crafted X.509 certificate. + + + + + + + + + + http://www.wolfssl.com/yaSSL/Docs-cyassl-changelog.html + http://www.wolfssl.com/yaSSL/Blog/Entries/2014/4/11_wolfSSL_Security_Advisory__April_9%2C_2014.html + 57743 + [oss-security] 20140418 Re: CVE ids for CyaSSL 2.9.4? + [oss-security] 20140417 CVE ids for CyaSSL 2.9.4? + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly check the credentials, which allows local users to gain privileges via the universal variable socket, related to /tmp/fishd.socket.user permissions. + + + https://github.com/fish-shell/fish-shell/issues/1436 + [oss-security] 20140428 Upcoming security release of fish 2.1.1 + + + + + The srtp_add_address function in epan/dissectors/packet-rtp.c in the RTP dissector in Wireshark 1.10.x before 1.10.7 does not properly update SRTP conversation data, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. + + + + + + + + + + https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=30ba425e7e95f7b61b3a3e5ff0c46e4be9d3d8d7 + https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9885 + http://www.wireshark.org/security/wnpa-sec-2014-06.html + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-114-02 + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-892012.pdf + + + + + + + + + + + + + + + + + + + + + + + + + + + CRLF injection vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary HTTP headers via unspecified vectors. + + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-114-02 + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-892012.pdf + + + + + + + + + + + + + + + + + + + + + + + + + + + Xen 4.4.x, when running on ARM systems, does not properly restrict access to hardware features, which allows local guest users to cause a denial of service (host or guest crash) via unspecified vectors, related to (1) cache control, (2) coprocessors, (3) debug registers, and (4) other unspecified registers. + + + + + + + + + http://xenbits.xen.org/xsa/advisory-93.html + 1030135 + [oss-security] 20140423 Xen Security Advisory 93 (CVE-2014-2915) - Hardware features unintentionally exposed to guests on ARM + [oss-security] 20140422 Re: Xen Security Advisory 93 - Hardware features unintentionally exposed to guests on ARM + + + + + + + + + + + The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via vectors involving a Zend_Pdf_ElementFactory_Proxy object and a pathname with a trailing \0 character. + + + + + + + + + + + http://www.pimcore.org/en/resources/blog/pimcore+2.2+released_b442 + https://github.com/pedrib/PoC/blob/master/pimcore-2.1.0.txt + [oss-security] 20140421 Re: Remote code execution in Pimcore CMS + + + + + + + + + + + + + The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.1.0 does not properly handle an object obtained by unserializing a pathname, which allows remote attackers to conduct PHP object injection attacks and delete arbitrary files via vectors involving a Zend_Http_Response_Stream object. + + + + + + + + + + https://github.com/pedrib/PoC/blob/master/pimcore-2.1.0.txt + http://www.pimcore.org/en/resources/blog/pimcore+2.2+released_b442 + [oss-security] 20140421 Re: Remote code execution in Pimcore CMS + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in Advanced_Wireless_Content.asp in ASUS RT-AC68U and other RT series routers with firmware before 3.0.0.4.374.5047 allows remote attackers to inject arbitrary web script or HTML via the current_page parameter to apply.cgi. + + + + + + + + + + http://www.asus.com/Networking/RTAC68U/HelpDesk_Download/ + http://support.asus.com/download.aspx?m=RT-N66U+%28VER.B1%29 + 20140404 Reflected Cross-Site Scripting within the ASUS RT-AC68U Managing Web Interface + + + + + + + + + + + + + + + Directory traversal vulnerability in Sixnet SixView Manager 2.4.1 allows remote attackers to read arbitrary files via a .. (dot dot) in an HTTP GET request to TCP port 18081. + + + + + + + + + 32973 + + + + + + + + + + Tools/gdomap.c in gdomap in GNUstep Base 1.24.6 and earlier, when run in daemon mode, does not properly handle the file descriptor for the logger, which allows remote attackers to cause a denial of service (abort) via an invalid request. + + + + + + + + + http://svn.gna.org/viewcvs/gnustep/libs/base/trunk/Tools/gdomap.c?r1=37756&r2=37755&pathrev=37756 + https://savannah.gnu.org/bugs/?41751 + gnustep-cve20142980-dos(92688) + 66992 + http://svn.gna.org/viewcvs/gnustep/libs/base/trunk/ChangeLog?r1=37756&r2=37755&pathrev=37756 + 58104 + [oss-security] 20140421 Re: CVE request / advisory: gdomap (GNUstep core package <= 1.24.6) + [oss-security] 20140419 CVE request / advisory: gdomap (GNUstep core package <= 1.24.6) + + + + + + + + + + Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different anonymous users, which allows remote anonymous users to obtain sensitive interim form input information in opportunistic situations via unspecified vectors. + + + + + + + + + https://drupal.org/SA-CORE-2014-002 + [oss-security] 20140421 Re: CVE Request for Drupal Core + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-2650. Reason: This candidate is a reservation duplicate of CVE-2014-2650. Notes: All CVE users should reference CVE-2014-2650 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. + + + + + + The vgic_distr_mmio_write function in the virtual guest interrupt controller (GIC) distributor (arch/arm/vgic.c) in Xen 4.4.x, when running on an ARM system, allows local guest users to cause a denial of service (NULL pointer dereference and host crash) via unspecified vectors. + + + + + + + + + http://xenbits.xen.org/xsa/advisory-94.html + 1030146 + 67047 + [oss-security] 20140423 Xen Security Advisory 94 (CVE-2014-2986) - ARM hypervisor crash on guest interrupt controller access + [oss-security] 20140423 Re: Xen Security Advisory 94 - ARM hypervisor crash on guest interrupt controller access + [oss-security] 20140423 Xen Security Advisory 94 - ARM hypervisor crash on guest interrupt controller access + + + + + + + + + + + The Misli.com application for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. + + + + + + + + + + http://sceptive.com/p/mislicom-android-app-ssl-certificate-validation-weakness- + 20140424 Misli.com Android App SSL certificate validation weakness + + + + + + + + + + The Birebin.com application for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. + + + + + + + + + + http://sceptive.com/p/birebincom-android-app-ssl-certificate-validation-weakness- + 20140424 Birebin.com Android App SSL certificate validation weakness + + + + + + + + + + Stack-based buffer overflow in Acunetix Web Vulnerability Scanner (WVS) 8 build 20120704 allows remote attackers to execute arbitrary code via an HTML file containing an IMG element with a long URL (src attribute). + + + + + + + + + + + https://www.youtube.com/watch?v=RHaMx8K1GeM + 32997 + http://www.acunetix.com/blog/news/misleading-reports-0-day-acunetix-wvs/ + http://packetstormsecurity.com/files/126307/Acunetix-8-Scanner-Buffer-Overflow.html + http://packetstormsecurity.com/files/126306/Acunetix-8-Stack-Buffer-Overflow.html + http://osandamalith.wordpress.com/2014/04/24/pwning-script-kiddies-acunetix-buffer-overflow/ + http://an7isec.blogspot.co.il/2014/04/pown-noobs-acunetix-0day.html + + + + + + + + + + XCloner Standalone 3.5 and earlier, when enable_db_backup and sql_mem are enabled, allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the dbbackup_comp parameter in a generate action to index2.php. NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have the privileges to execute code. NOTE: this can be leveraged by remote attackers using CVE-2014-2579. + + + + + + + + + + + https://www.htbridge.com/advisory/HTB23207 + 20140409 &ETH;&iexcl;ross-Site Request Forgery (CSRF) in XCloner Standalone + 32790 + + + + + + + + + + The TCP reassembly function in the inet module in FreeBSD 8.3 before p16, 8.4 before p9, 9.1 before p12, 9.2 before p5, and 10.0 before p2 allows remote attackers to cause a denial of service (undefined memory access and system crash) or possibly read system memory via multiple crafted packets, related to moving a reassemble queue entry to the segment list when the queue is full. + + + 1030172 + 67153 + FreeBSD-SA-14:08 + 58293 + + + + + The device file system (aka devfs) in FreeBSD 10.0 before p2 does not load default rulesets when booting, which allows context-dependent attackers to bypass intended restrictions by leveraging a jailed device node process. + + + 1030171 + 67158 + FreeBSD-SA-14:07 + + + + + Sitepark Information Enterprise Server (IES) 2.9 before 2.9.6, when upgraded from an earlier version, does not properly restrict access, which allows remote attackers to change the manager account password and obtain sensitive information via a request to install/. + + + https://www.lsexperts.de/advisories/lse-2014-04-10.txt + 67165 + 20140430 LSE Leading Security Experts GmbH - LSE-2014-04-10 - Sitepark IES - Unauthenticated Access + 20140430 LSE Leading Security Experts GmbH - LSE-2014-04-10 - Sitepark IES - Unauthenticated Access + + + + + Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py. + + + + + + + + + + + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059 + http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-1932.html + + + + + + + + + + + + + Unitrends Enterprise Backup 7.3.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the comm parameter to recoveryconsole/bpl/snmpd.php. + + + + + + + + + + + https://gist.github.com/brandonprry/10745756 + unitrends-snmpod-command-exec(92642) + 66928 + 32885 + 58001 + 20140415 Unitrends enterprise backup remote unauthenticated root + + + + + + + + + + Xen 4.4.x, when running on an ARM system, does not properly context switch the CNTKCTL_EL1 register, which allows local guest users to modify the hardware timers and cause a denial of service (crash) via unspecified vectors. + + + http://xenbits.xen.org/xsa/advisory-91.html + 1030184 + 67157 + [oss-security] 20140430 Xen Security Advisory 91 - Hardware timer context is not properly context switched on ARM + [oss-security] 20140430 Re: Xen Security Advisory 91 - Hardware timer context is not properly context switched on ARM + 58347 + + + + + The Java Server Pages in the Software Lifecycle Manager (SLM) in SAP NetWeaver allows remote attackers to obtain sensitive information via a crafted request, related to SAP Solution Manager 7.1. + + + + + + + + + https://service.sap.com/sap/support/notes/1894049 + 1030157 + http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-005 + 20140428 [Onapsis Security Advisory 2014-005] Information disclosure in SAP Software Lifeclycle Manager + http://scn.sap.com/docs/DOC-8218 + + + + + + + + + + The ABAP Help documentation and translation tools (BC-DOC-HLP) in Basis in SAP Netweaver ABAP Application Server does not properly restrict access, which allows local users to gain privileges and execute ABAP instructions via crafted help messages. + + + + + + + + + + + + https://service.sap.com/sap/support/notes/1910914 + http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-009 + 20140428 [Onapsis Security Advisory 2014-009] SAP BASIS Missing Authorization Check + http://scn.sap.com/docs/DOC-8218 + + + + + + + + + + SAP Profile Maintenance does not properly restrict access, which allows remote authenticated users to obtain sensitive information via an unspecified RFC function, related to SAP Solution Manager 7.1. + + + + + + + + + https://service.sap.com/sap/support/notes/1917381 + http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-007 + 20140428 [Onapsis Security Advisory 2014-007] Missing authorization check in SAP Profile Maintenance + http://scn.sap.com/docs/DOC-8218 + + + + + + + + + + SAP Background Processing does not properly restrict access, which allows remote authenticated users to obtain sensitive information via an unspecified RFC function, related to SAP Solution Manager 7.1. + + + + + + + + + https://service.sap.com/sap/support/notes/1918333 + http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-006 + 20140428 [Onapsis Security Advisory 2014-006] Missing authorization check in SAP Background Processing RFC + http://scn.sap.com/docs/DOC-8218 + + + + + + + + + + SAP Netweaver Java Application Server does not properly restrict access, which allows remote attackers to obtain the list of SAP systems registered on an SLD via an unspecified webdynpro, related to SystemSelection. + + + + + + + + + https://service.sap.com/sap/support/notes/1922547 + http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-008 + 20140428 [Onapsis Security Advisory 2014-008] SAP NW Portal WD Information Disclosure + http://scn.sap.com/docs/DOC-8218 + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the InfoView application in SAP BusinessObjects allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + https://service.sap.com/sap/support/notes/1931399 + http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-010 + 20140428 [Onapsis Security Advisory 2014-010] SAP BusinessObjects InfoView Reflected Cross Site Scripting + http://scn.sap.com/docs/DOC-8218 + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 5.1.1 Alpha 9 allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to privatemessage/new/, (2) the folderid parameter to a private message in privatemessage/view, (3) a fragment indicator to /help, or (4) the view parameter to a topic, as demonstrated by a request to forum/anunturi-importante/rst-power/67030-rst-admin-restore. + + + + + + + + + + vbulletin-multiple-scripts-xss(92664) + 66972 + http://packetstormsecurity.com/files/126226/vBulletin-5.1-Cross-Site-Scripting.html + + + + + + + + + + SQL injection vulnerability in Xerox DocuShare before 6.53 Patch 6 Hotfix 2, 6.6.1 Update 1before Hotfix 24, and 6.6.1 Update 2 before Hotfix 3 allows remote authenticated users to execute arbitrary SQL commands via the PATH_INFO to /docushare/dsweb/ResultBackgroundJobMultiple/. NOTE: some of these details are obtained from third party information. + + + + + + + + + + + xerox-docushare-sql-injection(92548) + http://www.xerox.com/download/security/security-bulletin/a72cd-4f7a54ce14460/cert_XRX14-003_V1.0.pdf + 66922 + 105972 + 32886 + 57996 + 20140415 Xerox DocuShare authenticated SQL injection + http://packetstormsecurity.com/files/126171/Xerox-DocuShare-SQL-Injection.html + + + + + + + + + + + + + + recoveryconsole/bpl/snmpd.php in Unitrends Enterprise Backup 7.3.0 allows remote attackers to bypass authentication by setting the auth parameter to a certain string. + + + + + + + + + + + https://gist.github.com/brandonprry/10745756 + 32885 + 20140415 Unitrends enterprise backup remote unauthenticated root + + + + + + + + + + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-5795. Reason: This candidate is a duplicate of CVE-2013-5795. A typo caused the wrong ID to be used. Notes: All CVE users should reference CVE-2013-5795 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. + + + + + + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-5880. Reason: This candidate is a duplicate of CVE-2013-5880. A typo caused the wrong ID to be used. Notes: All CVE users should reference CVE-2013-5880 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. + + + + \ No newline at end of file diff --git a/dependency-check-core/src/test/resources/stagedhttp-modified.tar b/dependency-check-core/src/test/resources/stagedhttp-modified.tar new file mode 100644 index 000000000..bd9dd37dd Binary files /dev/null and b/dependency-check-core/src/test/resources/stagedhttp-modified.tar differ diff --git a/dependency-check-core/src/test/resources/uber-1.0-SNAPSHOT.jar b/dependency-check-core/src/test/resources/uber-1.0-SNAPSHOT.jar new file mode 100644 index 000000000..4d42dc33b Binary files /dev/null and b/dependency-check-core/src/test/resources/uber-1.0-SNAPSHOT.jar differ diff --git a/dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/Settings.java b/dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/Settings.java index 45271ef59..a204dd68e 100644 --- a/dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/Settings.java +++ b/dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/Settings.java @@ -197,6 +197,10 @@ public final class Settings { * The properties key for whether the Autoconf analyzer is enabled. */ public static final String ANALYZER_AUTOCONF_ENABLED = "analyzer.autoconf.enabled"; + /** + * The properties key for whether the CMake analyzer is enabled. + */ + public static final String ANALYZER_CMAKE_ENABLED = "analyzer.cmake.enabled"; /** * The properties key for whether the .NET Assembly analyzer is enabled. */ diff --git a/src/test/resources/axis-1.4.jar b/src/test/resources/axis-1.4.jar new file mode 100644 index 000000000..20b09a595 Binary files /dev/null and b/src/test/resources/axis-1.4.jar differ diff --git a/src/test/resources/data.zip b/src/test/resources/data.zip new file mode 100644 index 000000000..ae6196ee0 Binary files /dev/null and b/src/test/resources/data.zip differ diff --git a/src/test/resources/data.zip.REMOVED.git-id b/src/test/resources/data.zip.REMOVED.git-id deleted file mode 100644 index ab094e272..000000000 --- a/src/test/resources/data.zip.REMOVED.git-id +++ /dev/null @@ -1 +0,0 @@ -ae6196ee0e28a3fc1a015742b53da308ecbc1059 \ No newline at end of file diff --git a/src/test/resources/jaxb-xercesImpl-1.5.jar b/src/test/resources/jaxb-xercesImpl-1.5.jar new file mode 100644 index 000000000..a9f26d647 Binary files /dev/null and b/src/test/resources/jaxb-xercesImpl-1.5.jar differ