CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2014-2463
https://notcve.org/view.php?id=CVE-2014-2463
Unspecified vulnerability in the Oracle Secure Global Desktop (SGD) component in Oracle Virtualization 4.63, 4.71, 5.0, and 5.1 allows remote attackers to affect integrity via unknown vectors related to Workspace Web Application, a different vulnerability than CVE-2014-4232. Vulnerabilidad no especificada en el componente Oracle Secure Global Desktop (SGD) en Oracle Virtualization 4.63, 4.71, 5.0 y 5.1 permite a atacantes remotos afectar la integridad a través de vectores desconocidos relacionados con Workspace Web Application, una vulnerabilidad diferente a CVE-2014-4232. • http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html •
CVSS: 6.1EPSS: 8%CPEs: 4EXPL: 1CVE-2013-4282 – spice: stack buffer overflow in reds_handle_ticket() function
https://notcve.org/view.php?id=CVE-2013-4282
Stack-based buffer overflow in the reds_handle_ticket function in server/reds.c in SPICE 0.12.0 allows remote attackers to cause a denial of service (crash) via a long password in a SPICE ticket. Desbordamiento de búfer de pila en la función reds_handle_ticket en server/reds.c en SPICE 0.12.0 que permite a atacantes remotos provocar una denegación de servicio (caída) a través de una contraseña larga en un ticket de SPICE. • http://cgit.freedesktop.org/spice/spice/commit/?id=8af619009660b24e0b41ad26b30289eea288fcc2 http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00008.html http://rhn.redhat.com/errata/RHSA-2013-1460.html http://rhn.redhat.com/errata/RHSA-2013-1473.html http://rhn.redhat.com/errata/RHSA-2013-1474.html http://www.debian.org/security/2014/dsa-2839 http://www.securityfocus.com/bid/63408 http://www.ubuntu.com/usn/USN-2027-1 https://access.redhat.com/security/cve/CVE-2 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-121: Stack-based Buffer Overflow •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2013-3834
https://notcve.org/view.php?id=CVE-2013-3834
Unspecified vulnerability in the Oracle Secure Global Desktop component in Oracle Virtualization 5 allows remote attackers to affect availability via unknown vectors related to ttaauxserv. Vulnerabilidad no especificada en el componente Oracle Secure Global Desktop en Oracle Virtualization 5 permite a atacantes remotos afectar la disponibilidad a través de vectores desconocidos relacionados con ttaauxserv. • http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html •
CVSS: 7.4EPSS: 0%CPEs: 33EXPL: 0CVE-2012-3515 – qemu: VT100 emulation vulnerability
https://notcve.org/view.php?id=CVE-2012-3515
Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulating certain devices with a virtual console backend, allows local OS guest users to gain privileges via a crafted escape VT100 sequence that triggers the overwrite of a "device model's address space." Qemu, tal como se utiliza en Xen v4.0, v4.1 y posiblemente otros productos, al emular ciertos dispositivos con una consola virtual, permite a los usuarios locales del SO invitado obtener privilegios a través de una secuencia VT100 de escape manipulada que desencadena la sobrescritura del espacio de direcciones de un "device model's address space." • http://git.qemu.org/?p=qemu-stable-0.15.git%3Ba=log http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00012.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00016.ht • CWE-20: Improper Input Validation CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.8EPSS: 0%CPEs: 10EXPL: 0CVE-2012-3406 – glibc: printf() unbound alloca() usage in case of positional parameters + many format specs
https://notcve.org/view.php?id=CVE-2012-3406
The vfprintf function in stdio-common/vfprintf.c in GNU C Library (aka glibc) 2.5, 2.12, and probably other versions does not "properly restrict the use of" the alloca function when allocating the SPECS array, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (crash) or possibly execute arbitrary code via a crafted format string using positional parameters and a large number of format specifiers, a different vulnerability than CVE-2012-3404 and CVE-2012-3405. La función vfprintf en stdio-common/vfprintf.c en GNU C Library (también conocido como glibc) 2.5, 2.12 y probablemente otras versiones no "restringe debidamente el uso de" la función alloca cuando asigna el array SPECS, lo que permite a atacantes dependientes de contexto evadir el mecanismo de protección de cadenas de formato FORTIFY_SOURCE y causar una denegación de servicio (caída) o posiblemente ejecutar código arbitrario a través de una cadena de formato manipulada mediante el uso de parámetros posicionales y un gran número de especificadores de formato, una vulnerabilidad diferente a CVE-2012-3404 y CVE-2012-3405. • http://rhn.redhat.com/errata/RHSA-2012-1097.html http://rhn.redhat.com/errata/RHSA-2012-1098.html http://rhn.redhat.com/errata/RHSA-2012-1185.html http://rhn.redhat.com/errata/RHSA-2012-1200.html http://www.openwall.com/lists/oss-security/2012/07/11/17 http://www.ubuntu.com/usn/USN-1589-1 https://bugzilla.redhat.com/attachment.cgi?id=594722 https://bugzilla.redhat.com/show_bug.cgi?id=826943 https://security.gentoo.org/glsa/201503-04 https://access.redh • CWE-264: Permissions, Privileges, and Access Controls •