CVSS: 10.0EPSS: 0%CPEs: 26EXPL: 0CVE-2013-3334 – flash-plugin: multiple code execution flaws (APSB13-14)
https://notcve.org/view.php?id=CVE-2013-3334
Adobe Flash Player before 10.3.183.86 and 11.x before 11.7.700.202 on Windows and Mac OS X, before 10.3.183.86 and 11.x before 11.2.202.285 on Linux, before 11.1.111.54 on Android 2.x and 3.x, and before 11.1.115.58 on Android 4.x; Adobe AIR before 3.7.0.1860; and Adobe AIR SDK & Compiler before 3.7.0.1860 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-2728, CVE-2013-3324, CVE-2013-3325, CVE-2013-3326, CVE-2013-3327, CVE-2013-3328, CVE-2013-3329, CVE-2013-3330, CVE-2013-3331, CVE-2013-3332, CVE-2013-3333, and CVE-2013-3335. Adobe Flash Player antes de v10.3.183.86 y v11.x antes de v11.7.700.202 para Windows y Mac OS X, antes de v10.3.183.86 y v11.x antes de v11.2.202.285 para Linux, antes de v11.1.111.54 para Android v2.x y v3.x, y antes de v11.1.115.58 para Android v4.x; Adobe AIR before v3.7.0.1860; y Adobe AIR SDK & Compiler antes de v3.7.0.1860 permite a atacantes ejecutar código arbitrario o causar una denegación de servicios (consumo de memoria) a través de vectores sin especificar, una vulnerabilidad diferente a CVE-2013-2728, CVE-2013-3324, CVE-2013-3325, CVE-2013-3326, CVE-2013-3327, CVE-2013-3328, CVE-2013-3329, CVE-2013-3330, CVE-2013-3331, CVE-2013-3332, CVE-2013-3333, y CVE-2013-3335. • http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00010.html http://rhn.redhat.com/errata/RHSA-2013-0825.html http://secunia.com/advisories/53442 http://www.adobe.com/support/security/bulletins/apsb13-14.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16407 https://access.redhat.com/security&# • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 0%CPEs: 26EXPL: 0CVE-2013-3332 – flash-plugin: multiple code execution flaws (APSB13-14)
https://notcve.org/view.php?id=CVE-2013-3332
Adobe Flash Player before 10.3.183.86 and 11.x before 11.7.700.202 on Windows and Mac OS X, before 10.3.183.86 and 11.x before 11.2.202.285 on Linux, before 11.1.111.54 on Android 2.x and 3.x, and before 11.1.115.58 on Android 4.x; Adobe AIR before 3.7.0.1860; and Adobe AIR SDK & Compiler before 3.7.0.1860 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-2728, CVE-2013-3324, CVE-2013-3325, CVE-2013-3326, CVE-2013-3327, CVE-2013-3328, CVE-2013-3329, CVE-2013-3330, CVE-2013-3331, CVE-2013-3333, CVE-2013-3334, and CVE-2013-3335. Adobe Flash Player antes de v10.3.183.86 y v11.x antes de v11.7.700.202 para Windows y Mac OS X, antes de v10.3.183.86 y v11.x antes de v11.2.202.285 para Linux, antes de v11.1.111.54 para Android v2.x y v3.x, y antes de v11.1.115.58 para Android v4.x; Adobe AIR before v3.7.0.1860; y Adobe AIR SDK & Compiler antes de v3.7.0.1860 permite a atacantes ejecutar código arbitrario o causar una denegación de servicios (consumo de memoria) a través de vectores sin especificar, una vulnerabilidad diferente a CVE-2013-2728, CVE-2013-3324, CVE-2013-3325, CVE-2013-3326, CVE-2013-3327, CVE-2013-3328, CVE-2013-3329, CVE-2013-3330, CVE-2013-3331, CVE-2013-3333, CVE-2013-3334, y CVE-2013-3335 • http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00010.html http://rhn.redhat.com/errata/RHSA-2013-0825.html http://secunia.com/advisories/53442 http://www.adobe.com/support/security/bulletins/apsb13-14.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17141 https://access.redhat.com/security&# • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.1EPSS: 20%CPEs: 27EXPL: 0CVE-2013-1862 – httpd: mod_rewrite allows terminal escape sequences to be written to the log file
https://notcve.org/view.php?id=CVE-2013-1862
mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator. mod_rewrite.c en el modulo mod_rewrite en Apache HTTP Server v2.2.x anterior a v2.2.25 escribe datos en un archivo de log sin eliminar caracteres no imprimibles, lo que podría permitir a un atacante remotos ejecutar comandos arbitrarios a través de una petición HTTP que contiene una secuencia de escape para un emulador de terminal. • http://lists.opensuse.org/opensuse-updates/2013-08/msg00026.html http://lists.opensuse.org/opensuse-updates/2013-08/msg00029.html http://lists.opensuse.org/opensuse-updates/2013-08/msg00030.html http://people.apache.org/~jorton/mod_rewrite-CVE-2013-1862.patch http://rhn.redhat.com/errata/RHSA-2013-0815.html http://rhn.redhat.com/errata/RHSA-2013-1207.html http://rhn.redhat.com/errata/RHSA-2013-1208.html http://rhn.redhat.com/errata/RHSA-2013-1209.html http://secunia. •
CVSS: 4.3EPSS: 97%CPEs: 15EXPL: 2CVE-2013-2423 – Oracle JRE Unspecified Vulnerability
https://notcve.org/view.php?id=CVE-2013-2423
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from the original researcher that this vulnerability allows remote attackers to bypass permission checks by the MethodHandles method and modify arbitrary public final fields using reflection and type confusion, as demonstrated using integer and double fields to disable the security manager. Una vulnerabilidad no especificada en el componente Java Runtime Environment (JRE) en Java SE versión 7 Update 17 y anteriores, y OpenJDK versión 7 de Oracle, permite a los atacantes remotos afectar la integridad por medio de vectores desconocidos relacionados a HotSpot. NOTA: la información anterior es de la CPU de abril de 2013. • https://www.exploit-db.com/exploits/24976 http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released http://blog.spiderlabs.com/2013/04/java-is-so-confusing.html http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/b453d9be6b3f http://lists.opensuse.org/opensuse-updates/2013-06/msg00099.html http://rhn.redhat.com/errata/RHSA-2013-0752.html http://rhn.redhat.com/errata/RHSA-2013-0757.html http://security.gentoo.org/glsa/glsa-201406-32 •
CVSS: 4.0EPSS: 95%CPEs: 12EXPL: 0CVE-2013-1416 – krb5: NULL pointer dereference (DoS, KDC crash) by processing certain TGS requests
https://notcve.org/view.php?id=CVE-2013-1416
The prep_reprocess_req function in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.5 does not properly perform service-principal realm referral, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted TGS-REQ request. La función prep_reprocess_req en do_tgs_req.c en el Key Distribution Center (KDC) en MIT Kerberos 5 (aka krb5) antes de v1.10.5 no realiza correctamente el servicio ámbito de referencia principal, lo que permite a usuarios remotos autenticados causar una denegación de servicio (desreferencia a un puntero nulo y la caída del demonio) a través de una solicitud TGS-REQ modificada. • http://krbdev.mit.edu/rt/Ticket/Display.html?id=7600 http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102058.html http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102074.html http://lists.opensuse.org/opensuse-updates/2013-05/msg00011.html http://lists.opensuse.org/opensuse-updates/2013-06/msg00041.html http://lists.opensuse.org/opensuse-updates/2013-06/msg00102.html http://rhn.redhat.com/errata/RHSA-2013-0748.html http://www.mandriva.com/security/ • CWE-476: NULL Pointer Dereference •