CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0CVE-2012-0950
https://notcve.org/view.php?id=CVE-2012-0950
The Apport hook (DistUpgradeApport.py) in Update Manager, as used by Ubuntu 12.04 LTS, 11.10, and 11.04, uploads the /var/log/dist-upgrade directory when reporting bugs to Launchpad, which allows remote attackers to read repository credentials by viewing a public bug report. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0949. El gancho Apport (DistUpgradeApport.py) en Update Manager, como el usado por Ubuntu v12.04 LTS, v11.10, y v11.04, carga el directorio /var/log/dist-upgrade al informar de los fallos a Launchpad, lo que permite a atacantes remotos leer las credenciales del repositorio mediante la visualización de un informe de error público. NOTA: esta vulnerabilidad existe debido a una solución incompleta para CVE-2012-0949. • http://www.ubuntu.com/usn/USN-1443-2 https://bugs.launchpad.net/ubuntu/%2Bsource/update-manager/%2Bbug/1004503 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0CVE-2012-0949
https://notcve.org/view.php?id=CVE-2012-0949
The Apport hook in Update Manager as used by Ubuntu 12.04 LTS, 11.10, and 11.04 uploads certain system state archive files when reporting bugs to Launchpad, which allows remote attackers to read repository credentials by viewing a public bug report. El gancho Apport en el administrador de actualizaciones utilizado por Ubuntu v12.04 LTS, v11.10 y v11.04 sube algunos ficheros de archivo del estado del sistema cuando se reportan fallos(bugs) a Launchpad, lo que permite la lectura de las credenciales del repositorio a atacantes remotos al ver un informe de error público. • http://osvdb.org/82020 http://secunia.com/advisories/49230 http://www.securityfocus.com/bid/53605 http://www.ubuntu.com/usn/USN-1443-1 https://exchange.xforce.ibmcloud.com/vulnerabilities/75728 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 2.1EPSS: 0%CPEs: 6EXPL: 0CVE-2012-0948
https://notcve.org/view.php?id=CVE-2012-0948
DistUpgrade/DistUpgradeMain.py in Update Manager, as used by Ubuntu 12.04 LTS, 11.10, and 11.04, uses weak permissions for (1) apt-clone_system_state.tar.gz and (2) system_state.tar.gz, which allows local users to obtain repository credentials. DistUpgrade/DistUpgradeMain.py en el Administrador de actualización de Ubuntu v12.04 LTS, v11.10 y v11.04, utiliza permisos débiles para (1) system_state.tar.gz y (2) apt-clone_system_state.tar.gz, lo que permite a usuarios locales obtener las credenciales del repositorio. • http://launchpadlibrarian.net/105380733/update-manager_1%3A0.156.14.3_1%3A0.156.14.4.diff.gz http://osvdb.org/82019 http://secunia.com/advisories/49230 http://www.securityfocus.com/bid/53604 http://www.ubuntu.com/usn/USN-1443-1 https://exchange.xforce.ibmcloud.com/vulnerabilities/75727 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.8EPSS: 2%CPEs: 8EXPL: 0CVE-2012-1185
https://notcve.org/view.php?id=CVE-2012-1185
Multiple integer overflows in (1) magick/profile.c or (2) magick/property.c in ImageMagick 6.7.5 and earlier allow remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted offset value in the ResolutionUnit tag in the EXIF IFD0 of an image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0247. Múltiples desbordamientos de enteros en (1) Magick/profile.c o (2) magick/property.c de ImageMagick v6.7.5 y anteriores permite a atacantes remotos causar una denegación de servicio (por corrupción de memoria) y posiblemente ejecutar código de su elección a través de un valor de desplazamiento modificado en la etiqueta ResolutionUnit en EXIF IFD0 de una imagen. NOTA: esta vulnerabilidad existe debido a una solución incompleta para CVE-2012-0247. • http://lists.opensuse.org/opensuse-updates/2012-06/msg00001.html http://secunia.com/advisories/47926 http://secunia.com/advisories/48974 http://secunia.com/advisories/49043 http://secunia.com/advisories/49317 http://trac.imagemagick.org/changeset/6998/ImageMagick/branches/ImageMagick-6.7.5/magick/profile.c http://trac.imagemagick.org/changeset/6998/ImageMagick/branches/ImageMagick-6.7.5/magick/property.c http://ubuntu.com/usn/usn-1435-1 http://www.debian.org/security/2012/dsa-246 • CWE-190: Integer Overflow or Wraparound •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2012-1186
https://notcve.org/view.php?id=CVE-2012-1186
Integer overflow in the SyncImageProfiles function in profile.c in ImageMagick 6.7.5-8 and earlier allows remote attackers to cause a denial of service (infinite loop) via crafted IOP tag offsets in the IFD in an image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0248. Un desbordamiento de entero en la función SyncImageProfiles en profile.c en ImageMagick v6.7.5-8 y anteriores permite a atacantes remotos causar una denegación de servicio (por un bucle infinito) a través de las desplazamientos (offsets) de etiquetas IOP modificadas en el IFD en una imagen. NOTA: esta vulnerabilidad existe debido a una solución incompleta al CVE-2012-0248. • http://lists.opensuse.org/opensuse-updates/2012-06/msg00001.html http://secunia.com/advisories/47926 http://secunia.com/advisories/48974 http://secunia.com/advisories/49043 http://secunia.com/advisories/49317 http://trac.imagemagick.org/changeset/6998/ImageMagick/branches/ImageMagick-6.7.5/magick/profile.c http://ubuntu.com/usn/usn-1435-1 http://www.debian.org/security/2012/dsa-2462 http://www.openwall.com/lists/oss-security/2012/03/19/5 http://www.osvdb.org/80555&# • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •