CVSS: 4.9EPSS: 0%CPEs: 14EXPL: 0CVE-2010-0623
https://notcve.org/view.php?id=CVE-2010-0623
The futex_lock_pi function in kernel/futex.c in the Linux kernel before 2.6.33-rc7 does not properly manage a certain reference count, which allows local users to cause a denial of service (OOPS) via vectors involving an unmount of an ext3 filesystem. La función futex_lock_pi en kernel/futex.c en el kernel de Linux anterior a 2.6.33-rc7 no maneja adecuadamente determinadas cuentas de referencia, lo que permite a usuarios locales provocar una denegación de servicio (OOPS) a través de vectores que involucran el desmontado del sistema de ficheros ext3. • http://bugzilla.kernel.org/show_bug.cgi?id=14256 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=5ecb01cfdf96c5f465192bdb2a4fd4a61a24c6cc http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00006.html http://secunia.com/advisories/38922 http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.33-rc7 http://www.mandriva.com/security/advisories?name=MDVSA-2010:088 http://www.openwall.com/lists/oss-security/2010/02/11/2 http:/ •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2010-0230
https://notcve.org/view.php?id=CVE-2010-0230
SUSE Linux Enterprise 10 SP3 (SLE10-SP3) and openSUSE 11.2 configures postfix to listen on all network interfaces, which might allow remote attackers to bypass intended access restrictions. SUSE Linux Enterprise versión 10 SP3 (SLE10-SP3) y openSUSE versión 11.2 configura Postfix para escuchar en todas las interfaces de la red, lo que podría permitir a los atacantes remotos omitir las restricciones de acceso previstas. • http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00004.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 96%CPEs: 10EXPL: 1CVE-2009-3953 – Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2009-3953
The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994. La implementación U3D en Adobe Reader y Acrobat v9.x anterior a v9.3, y v8.x anterior a v8.2 sobre Windows y Mac OS X, podría permitir a atacantes ejecutar código de su elección a través de vectores no especificados, relacionados con una "cuestión de limitación en el array". Adobe Acrobat and Reader contains an array boundary issue in Universal 3D (U3D) support that could lead to remote code execution. • https://www.exploit-db.com/exploits/16622 http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html http://osvdb.org/61690 http://secunia.com/advisories/38138 http://secunia.com/advisories/38215 http://www.adobe.com/support/security/bulletins/apsb10-02.html http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl http://www.redhat.com/support/errata/RHSA-2010-0060.html http://www.securityfocus.com/bid/37758 http://www.securitytracker.com/i • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 7%CPEs: 10EXPL: 1CVE-2010-0013 – Pidgin MSN 2.6.4 - File Download
https://notcve.org/view.php?id=CVE-2010-0013
Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/x-msnmsgrp2p MSN emoticon (aka custom smiley) request, a related issue to CVE-2004-0122. NOTE: it could be argued that this is resultant from a vulnerability in which an emoticon download request is processed even without a preceding text/x-mms-emoticon message that announced availability of the emoticon. Vulnerabilidad de salto de directorio en slp.c en el complemento del protocolo MSN en libpurple en Pidgin v2.6.4 y Adium v1.3.8 permite a atacantes remotos leer ficheros de su elección a través de un .. (punto punto) en una petición emoticono MSN application/x-msnmsgrp2p (también conocido como emoticono personalizado), un caso relaciona con CVE-2004-0122. • https://www.exploit-db.com/exploits/11203 http://d.pidgin.im/viewmtn/revision/info/3d02401cf232459fc80c0837d31e05fae7ae5467 http://d.pidgin.im/viewmtn/revision/info/4be2df4f72bd8a55cdae7f2554b73342a497c92f http://d.pidgin.im/viewmtn/revision/info/c64a1adc8bda2b4aeaae1f273541afbc4f71b810 http://developer.pidgin.im/viewmtn/revision/diff/3d02401cf232459fc80c0837d31e05fae7ae5467/with/c64a1adc8bda2b4aeaae1f273541afbc4f71b810/libpurple/protocols/msn/slp.c http://events.ccc.de/congress/2009/Fahrplan/events/3596.en.html http://lists.fedoraproject.org/piperma • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.8EPSS: 0%CPEs: 8EXPL: 0CVE-2010-0012
https://notcve.org/view.php?id=CVE-2010-0012
Directory traversal vulnerability in libtransmission/metainfo.c in Transmission 1.22, 1.34, 1.75, and 1.76 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a pathname within a .torrent file. Vulnerabilidad de salto de directorio en libtransmission/metainfo.c en Transmission v1.22, v1.34, v1.75, y v1.76 permite a atacantes remotos sobreescribir ficheros de su elección a través de .. (punto punto) en un nombre de ruta con un fichero .torrent • http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html http://secunia.com/advisories/37993 http://secunia.com/advisories/38005 http://security.debian.org/pool/updates/main/t/transmission/transmission_1.22-1+lenny2.diff.gz http://trac.transmissionbt.com/changeset/9829 http://trac.transmissionbt.com/wiki/Changes#version-1.77 http://www.debian.org/security/2010/dsa-1967 http://www.mail-archive.com/debian-devel-changes%40lists.debian.org/msg264483.html http://www.open • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •