CVSS: 6.8EPSS: 1%CPEs: 16EXPL: 0CVE-2013-1872 – Mesa: Memory corruption (OOB read/write) on intel drivers
https://notcve.org/view.php?id=CVE-2013-1872
The Intel drivers in Mesa 8.0.x and 9.0.x allow context-dependent attackers to cause a denial of service (reachable assertion and crash) and possibly execute arbitrary code via vectors involving 3d graphics that trigger an out-of-bounds array access, related to the fs_visitor::remove_dead_constants function. NOTE: this issue might be related to CVE-2013-0796. Los controladores Intel en Mesa 8.0.x y 9.0.x, permiten a atacantes dependientes del contexto provocar una denegación de servicio (caída y afirmación accesible) y posiblemente la ejecución de código arbitrario a través de vectores que involucran a los gráficos 3D que provocar un acceso a una matriz fuera de rango, relacionado con la función fs_visitor::remove_dead_constants. NOTA: esta vulnerabilidad podría estar relacionada con el CVE-2013-0796. • http://advisories.mageia.org/MGASA-2013-0190.html http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00014.html http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00019.html http://rhn.redhat.com/errata/RHSA-2013-0897.html http://www.debian.org/security/2013/dsa-2704 http://www.securityfocus.com/bid/60285 http://www.ubuntu.com/usn/USN-1888-1 https://bugs.freedesktop.org/show_bug.cgi?id=59429 https://bugzilla.redhat.com/show_bug.cgi?id=923584 http • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 2%CPEs: 5EXPL: 2CVE-2013-2765 – ModSecurity - Remote Null Pointer Dereference
https://notcve.org/view.php?id=CVE-2013-2765
The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereference, process crash, and disk consumption) via a POST request with a large body and a crafted Content-Type header. El módulo ModSecurity anterior a 2.7.4 para Apache HTTP Server, permite a atacantes remotos provocar una denegación de servicio (deferencia a puntero NULO, caída de proceso y consumo de disco) a través de una petición POST con un cuerpo (body) de gran tamaño y una cabecera Content-Type manipulada. • https://www.exploit-db.com/exploits/25852 http://archives.neohapsis.com/archives/bugtraq/2013-05/0125.html http://lists.opensuse.org/opensuse-updates/2013-08/msg00020.html http://lists.opensuse.org/opensuse-updates/2013-08/msg00025.html http://lists.opensuse.org/opensuse-updates/2013-08/msg00031.html http://sourceforge.net/mailarchive/message.php?msg_id=30900019 http://www.modsecurity.org http://www.shookalabs.com https://bugzilla.redhat.com/show_bug.cgi?id=967615 https://github • CWE-476: NULL Pointer Dereference •
CVSS: 7.8EPSS: 0%CPEs: 11EXPL: 0CVE-2013-3561 – wireshark: Multiple Denial of Service flaws
https://notcve.org/view.php?id=CVE-2013-3561
Multiple integer overflows in Wireshark 1.8.x before 1.8.7 allow remote attackers to cause a denial of service (loop or application crash) via a malformed packet, related to a crash of the Websocket dissector, an infinite loop in the MySQL dissector, and a large loop in the ETCH dissector. Múltiples desbordamientos de enteros en Wireshark v1.8.x antes de v1.8.7 permite a atacantes remotos provocar una denegación de servicio (bucle o caída de aplicación) a través de un paquete mal formado, en relación con una caída del disector Websocket, un bucle infinito en el disector de MySQL, y un gran bucle en el disector ETCH. • http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-etch.c?r1=48919&r2=48918&pathrev=48919 http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-mysql.c?r1=48894&r2=48893&pathrev=48894 http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-websocket.c?r1=48336&r2=48335&pathrev=48336 http://anonsvn.wireshark.org/viewvc?view=revision&revision=48336 http://anonsvn.wireshark.org/viewvc? • CWE-189: Numeric Errors •
CVSS: 5.0EPSS: 0%CPEs: 26EXPL: 1CVE-2013-3557 – wireshark: DoS (crash) in the ASN.1 BER dissector (wnpa-sec-2013-25, upstream #8599)
https://notcve.org/view.php?id=CVE-2013-3557
The dissect_ber_choice function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 1.6.x before 1.6.15 and 1.8.x before 1.8.7 does not properly initialize a certain variable, which allows remote attackers to cause a denial of service (application crash) via a malformed packet. La función dissect_ber_choice en epan/dissectors/packet-ber.c en el disector ASN.1 BER en Wireshark v1.6.x antes de v1.6.15 y v1.8.x antes de v1.8.7 no inicializa correctamente una determinada variable, lo que permite a atacantes remotos provocar una denegación de servicio (caída de aplicación) a través de un paquete mal formado. • http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-ber.c?r1=48944&r2=48943&pathrev=48944 http://anonsvn.wireshark.org/viewvc?view=revision&revision=48944 http://lists.opensuse.org/opensuse-updates/2013-06/msg00048.html http://lists.opensuse.org/opensuse-updates/2013-06/msg00083.html http://lists.opensuse.org/opensuse-updates/2013-06/msg00194.html http://lists.opensuse.org/opensuse-updates/2013-06/msg00196.html http://rhn.redhat.com/errata/RHSA-2014-0341.html http://secunia. • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.8EPSS: 1%CPEs: 11EXPL: 1CVE-2013-3559 – wireshark: DoS (crash) in the DCP ETSI dissector (wnpa-sec-2013-27, upstream #8231, #8540, #8541)
https://notcve.org/view.php?id=CVE-2013-3559
epan/dissectors/packet-dcp-etsi.c in the DCP ETSI dissector in Wireshark 1.8.x before 1.8.7 uses incorrect integer data types, which allows remote attackers to cause a denial of service (integer overflow, and heap memory corruption or NULL pointer dereference, and application crash) via a malformed packet. epan/dissectors/packet-dcp-etsi.c en el disector DCP ETSI en Wireshar v1.8.x antes de v1.8.7 utiliza tipos de datos enteros incorrectos, lo que permite a atacantes remotos provocar una denegación de servicio (desbordamiento de enteros y corrupción de memoria dinámica o referencia a un puntero NULL y caída de aplicación) a través de un paquete mal formado. • http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-dcp-etsi.c?r1=48644&r2=48643&pathrev=48644 http://anonsvn.wireshark.org/viewvc?view=revision&revision=48644 http://lists.opensuse.org/opensuse-updates/2013-06/msg00048.html http://lists.opensuse.org/opensuse-updates/2013-06/msg00083.html http://lists.opensuse.org/opensuse-updates/2013-06/msg00194.html http://lists.opensuse.org/opensuse-updates/2013-06/msg00196.html http://rhn.redhat.com/errata/RHSA-2014-0341.html http://sec • CWE-189: Numeric Errors •