CVSS: 9.3EPSS: 1%CPEs: 5EXPL: 0CVE-2011-3439 – freetype: Multiple security flaws when loading CID-keyed Type 1 fonts
https://notcve.org/view.php?id=CVE-2011-3439
FreeType in CoreGraphics in Apple iOS before 5.0.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font in a document. FreeType en CoreGraphics en Apple iOS anterior a v5.0.1 permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria) a través de una fuente manipulada en un documento. • http://lists.apple.com/archives/Security-announce/2011/Nov/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00008.html http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00012.html http://secunia.com/advisories/46921 http://secunia.com/advisories/48951 http://support.apple.com/kb/HT5052 https://access.redhat.com/security/cve/CVE-2011-3439 https://bugzilla.redhat.com/show_ • CWE-787: Out-of-bounds Write •
CVSS: 3.6EPSS: 0%CPEs: 87EXPL: 0CVE-2011-3171
https://notcve.org/view.php?id=CVE-2011-3171
Directory traversal vulnerability in pure-FTPd 1.0.22 and possibly other versions, when running on SUSE Linux Enterprise Server and possibly other operating systems, when the Netware OES remote server feature is enabled, allows local users to overwrite arbitrary files via unknown vectors. Una vulnerabilidad de salto de directorio en Pure-ftpd v1.0.22 y posiblemente en otras versiones, cuando se ejecutan en SUSE Linux Enterprise Server y posiblemente otros sistemas operativos y cuando la función de servidor remoto Netware OES está activada, permite a usuarios locales sobreescribir ficheros arbitrarios a través de vectores desconocidos. • http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00015.html http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00016.html http://www.securityfocus.com/bid/49541 https://exchange.xforce.ibmcloud.com/vulnerabilities/69686 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 0CVE-2011-2660
https://notcve.org/view.php?id=CVE-2011-2660
The modify_resolvconf_suse script in the vpnc package before 0.5.1-55.10.1 in SUSE Linux Enterprise Desktop 11 SP1 might allow remote attackers to execute arbitrary commands via a crafted DNS domain name. El script modify_resolvconf_suse del paquete vpnc antes su versión v0.5.1-55.10.1 en SUSE Linux Enterprise Desktop v11 SP1 podría permitir a atacantes remotos ejecutar código arbitrario a través de un nombre de dominio DNS puesto a mano. • http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00028.html http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00029.html http://www.securityfocus.com/bid/49391 https://bugzilla.novell.com/651577 https://bugzilla.novell.com/708656 https://exchange.xforce.ibmcloud.com/vulnerabilities/69514 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 16EXPL: 0CVE-2011-1526 – krb5-appl: ftpd incorrect group privilege dropping (MITKRB5-SA-2011-005)
https://notcve.org/view.php?id=CVE-2011-1526
ftpd.c in the GSS-API FTP daemon in MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.1 and earlier does not check the krb5_setegid return value, which allows remote authenticated users to bypass intended group access restrictions, and create, overwrite, delete, or read files, via standard FTP commands, related to missing autoconf tests in a configure script. ftpd.c en el demonio GSS-API FTP en MIT Kerberos Version 5 Applications (también conocido como krb5-appl) v1.0.1 y anteriores no comprueban el valor de retorno krb5_setegid, lo que permite que usuarios autenticados de forma remota evitar las restricciones de acceso de grupo, y crear, sobreescribir, borrar, o leer ficheros, a través de comandos FTP estándar, relacionado con test autoconfigurados olvidados en un script configurado. It was found that ftpd, a Kerberos-aware FTP server, did not properly drop privileges. On Red Hat Enterprise Linux 5, the ftpd daemon did not check for the potential failure of the krb5_setegid() function call. On systems where the set real, set effective, or set saved group ID system calls might fail, a remote FTP user could use this flaw to gain unauthorized read or write access to files that were owned by the root group. • http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062681.html http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062699.html http://lists.opensuse.org/opensuse-security-announce/2011-10/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00005.html http://lists.opensuse.org/opensuse-security-announce/201 • CWE-269: Improper Privilege Management •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2011-1477
https://notcve.org/view.php?id=CVE-2011-1477
Multiple array index errors in sound/oss/opl3.c in the Linux kernel before 2.6.39 allow local users to cause a denial of service (heap memory corruption) or possibly gain privileges by leveraging write access to /dev/sequencer. Múltiples errores de índice de matriz en sound/oss/opl3.c en versiones del kernel de Linux anteriores a v2.6.39 permiten a usuarios locales provocar una denegación de servicio (corrupción de memoria dinámica) o posiblemente obtener privilegios mediante el aprovechamiento del acceso de escritura a /dev/sequencer. • http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=4d00135a680727f6c3be78f8befaac009030e4df http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html http://www.openwall.com/lists/oss-security/2011/03/25/1 https://github.com/torvalds/linux/commit/4d00135a680727f6c3be78f8befaac009030e4df • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-264: Permissions, Privileges, and Access Controls •