CVSS: 6.5EPSS: 0%CPEs: 162EXPL: 0CVE-2013-0311 – kernel: vhost: fix length for cross region descriptor
https://notcve.org/view.php?id=CVE-2013-0311
The translate_desc function in drivers/vhost/vhost.c in the Linux kernel before 3.7 does not properly handle cross-region descriptors, which allows guest OS users to obtain host OS privileges by leveraging KVM guest OS privileges. La función translate_desc en el kernel de Linux anterior a v3.7 no maneja correctamente descriptores cross-region, lo que permite a usuarios invitados del SO obtener privilegios del SO mediante el aprovechamiento de los privilegios KVM de invitado del SO. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=bd97120fc3d1a11f3124c7c9ba1d91f51829eb85 http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html http://rhn.redhat.com/errata/RHSA-2013-0496.html http://rhn.redhat.com/errata/RHSA-2013-0579.html http://rhn.redhat.com/errata/RHSA-2013-0882.html http://rhn.redhat.com/errata/RHSA-2013-0928.html http://www.kernel.org/pub/linux/kernel/v3.x/patch-3.7.bz2 http://www.mandriva.com&# •
CVSS: 7.1EPSS: 1%CPEs: 2EXPL: 0CVE-2012-3552 – kernel: net: slab corruption due to improper synchronization around inet->opt
https://notcve.org/view.php?id=CVE-2012-3552
Race condition in the IP implementation in the Linux kernel before 3.0 might allow remote attackers to cause a denial of service (slab corruption and system crash) by sending packets to an application that sets socket options during the handling of network traffic. La aplicación IP en el kernel de Linux antes de v3.0 podría permitir a atacantes remotos provocar una denegación de servicio mediante el envío de paquetes a una aplicación que configura las opciones de socket durante el manejo de tráfico de red. • http://ftp.osuosl.org/pub/linux/kernel/v3.0/ChangeLog-3.0 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f6d8bd051c391c1c0458a30b2a7abcd939329259 http://rhn.redhat.com/errata/RHSA-2012-1540.html http://www.openwall.com/lists/oss-security/2012/08/31/11 https://bugzilla.redhat.com/show_bug.cgi?id=853465 https://github.com/torvalds/linux/commit/f6d8bd051c391c1c0458a30b2a7abcd939329259 https://access.redhat.com/security/cve/CVE-2012-3552 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 9.3EPSS: 0%CPEs: 25EXPL: 1CVE-2012-3967 – Mozilla: WebGL use-after-free and memory corruption (MFSA 2012-62)
https://notcve.org/view.php?id=CVE-2012-3967
The WebGL implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 on Linux, when a large number of sampler uniforms are used, does not properly interact with Mesa drivers, which allows remote attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via a crafted web site. La implementación WebGL en Mozilla Firefox anterior a v15.0, Firefox ESR v10.x anterior a v10.0.7, Thunderbird anterior a v15.0, Thunderbird ESR v10.x anterior a v10.0.7, y SeaMonkey anterior a v2.12 en Linux, cuando un gran número de muestreos uniformes se utilizan, interactuando de forma no adecuada con los (drivers) Mesa, lo que permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de pila de memoria) a través de un sitio web manipulado. • http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html http://rhn.redhat.com/errata/RHSA-2012-1210.html http://rhn.redhat.com/errata/RHSA-2012-1211.html http://www.mozilla.org/security/announce/2012/mfsa2012-62.html http://www.securityfocus.com/bid/55277 http://www.ubuntu.com/usn/USN-1548-1 http://www.ubuntu&# • CWE-416: Use After Free CWE-787: Out-of-bounds Write •
CVSS: 2.1EPSS: 0%CPEs: 174EXPL: 0CVE-2012-1717 – OpenJDK: insecure temporary file permissions (JRE, 7143606)
https://notcve.org/view.php?id=CVE-2012-1717
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows local users to affect confidentiality via unknown vectors related to printing on Solaris or Linux. Vulnerabilidad no especificada en el Java Runtime Environment (JRE), componente de Oracle Java SE 7 Update 4 y anteriores, 6 Update 32 y anteriores, 5 actualización 35 y anteriores, y v1.4.2_37 y anteriores permite a usuarios locales afectar la confidencialidad a través de vectores desconocidos relacionados con el la impresión en Solaris o Linux. • http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00020.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00028.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00032.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00035.html http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2012-June/019076.html http://rhn.redhat.com/errata/RHSA-2012-0734.html http://rhn.redhat.com/errata/RHSA-2012-1243.html http://rhn.redhat& • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 1.2EPSS: 0%CPEs: 22EXPL: 1CVE-2012-2313 – kernel: unfiltered netdev rio_ioctl access by users
https://notcve.org/view.php?id=CVE-2012-2313
The rio_ioctl function in drivers/net/ethernet/dlink/dl2k.c in the Linux kernel before 3.3.7 does not restrict access to the SIOCSMIIREG command, which allows local users to write data to an Ethernet adapter via an ioctl call. La función rio_ioctl de drivers/net/ethernet/dlink/dl2k.c del kernel de Linux en versiones anteriores a la 3.3.7 no restringe el acceso al comando SIOCSMIIREG, lo que permite a usuarios locales escribir datos a un adaptador Ethernet a través de una llamada ioctl. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1bb57e940e1958e40d51f2078f50c3a96a9b2d75 http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html http://marc.info/?l=bugtraq&m=139447903326211&w=2 http://rhn.redhat.com/errata/RHSA-2012-1174.html http://rhn.redhat.com/errata/RHSA-2012-1481.html http://rhn.redhat.com/errata/RHSA-2012-1541.html http://rhn.redhat.com/errata/RHSA-2012-1589.html http://www.kernel.org/pub/linux/ke • CWE-264: Permissions, Privileges, and Access Controls •