Search criteria
18 vulnerabilities found for lunascape by lunascape
VAR-201003-1082
Vulnerability from variot - Updated: 2024-07-23 21:04The png_decompress_chunk function in pngrutil.c in libpng 1.0.x before 1.0.53, 1.2.x before 1.2.43, and 1.4.x before 1.4.1 does not properly handle compressed ancillary-chunk data that has a disproportionately large uncompressed representation, which allows remote attackers to cause a denial of service (memory and CPU consumption, and application hang) via a crafted PNG file, as demonstrated by use of the deflate compression method on data composed of many occurrences of the same character, related to a "decompression bomb" attack. libpng Has a specific PNG ( Portable Network Graphics ) There is a problem with the file processing. libpng Contains crafted auxiliary chunks PNG When processing files, a huge amount of memory CPU May use resources. For more information, PNG Development Group Security advisories and Defending Libpng Applications Against Decompression Bombs Please confirm.Disturbance of service operation by a remote third party (DoS) An attack may be carried out. The 'libpng' library is prone to a remote denial-of-service vulnerability. Successful exploits will allow an attacker to consume an excessive amount of CPU memory, denying service to legitimate users. Successful exploits will allow an attacker to obtain potentially sensitive information. Versions prior to libpng 1.4.1, 1.2.43, and 1.0.53 are vulnerable. This resource consumption may cause applications using the libpng library to hang. The PNG format uses efficient compression to store graphic data and some related data in an auxiliary database. The PNG specification does not limit the number of chunks, limiting their size to 2.147G (2,147,483,647 bytes). Similarly, the specification limits the width and height of graphics to 2.147 billion rows and 2.147 billion columns. Since the deflate compression method can very efficiently compress data streams consisting of repeated single bytes, small PNG files may occupy a large amount of memory when decompressed, forming a \"decompression bomb that exhausts all available memory. For example, for a zTXt block containing 50,000 lines each containing 100 letters Z, the compressed size is about 17k bytes, but the decompressed size is 5M, and the compression ratio is about 300:1. Libpng library uses inefficient memory acquisition method when expanding compressed zTXt, iTXt and iCCP auxiliary data blocks. About 50k malformed iCCP blocks contained in graphic files can be decompressed to 60M, which will hang the browser for about 20 Minutes, a well-crafted malicious block can also hang the browser for even longer, using up all available memory. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201010-01
http://security.gentoo.org/
Severity: Normal Title: Libpng: Multiple vulnerabilities Date: October 05, 2010 Bugs: #307637, #324153, #335887 ID: 201010-01
Synopsis
Multiple vulnerabilities in libpng might lead to privilege escalation or a Denial of Service. It is used by several programs, including web browsers and potentially server processes.
Affected packages
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 media-libs/libpng < 1.4.3 >= 1.4.3
Description
Multiple vulnerabilities were found in libpng:
-
The png_decompress_chunk() function in pngrutil.c does not properly handle certain type of compressed data (CVE-2010-0205)
-
A buffer overflow in pngread.c when using progressive applications (CVE-2010-1205)
-
A memory leak in pngrutil.c when dealing with a certain type of chunks (CVE-2010-2249)
Impact
An attacker could exploit these vulnerabilities to cause programs linked against the library to crash or execute arbitrary code with the permissions of the user running the vulnerable program, which could be the root user.
Workaround
There is no known workaround at this time.
Resolution
All libpng users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/libpng-1.4.3"
References
[ 1 ] CVE-2010-0205 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0205 [ 2 ] CVE-2010-1205 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1205 [ 3 ] CVE-2010-2249 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2249
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201010-01.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2010 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
VMware Security Advisory
Advisory ID: VMSA-2010-0014 Synopsis: VMware Workstation, Player, and ACE address several security issues. Issue date: 2010-09-23 Updated on: 2010-09-23 (initial release of advisory) CVE numbers: CVE-2010-3277 CVE-2010-1205 CVE-2010-0205 CVE-2010-2249 CVE-2010-0434 CVE-2010-0425
- Summary
VMware Workstation and Player address a potential installer security issue and security issues in libpng. VMware ACE Management Server (AMS) for Windows updates Apache httpd.
- Relevant releases
VMware Workstation 7.1.1 and earlier, VMware Player 3.1.1 and earlier, VMware ACE Management Server 2.7.1 and earlier,
Note: VMware Server was declared End Of Availability on January 2010, support will be limited to Technical Guidance for the duration of the support term.
- Problem Description
a. VMware Workstation and Player installer security issue
The Workstation 7.x and Player 3.x installers will load an index.htm
file located in the current working directory on which Workstation
7.x or Player 3.x is being installed. This may allow an attacker to
display a malicious file if they manage to get their file onto the
system prior to installation.
The issue can only be exploited at the time that Workstation 7.x or
Player 3.x is being installed. Installed versions of Workstation and
Player are not affected. The security issue is no longer present in
the installer of the new versions of Workstation 7.x and Player 3.x
(see table below for the version numbers).
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-3277 to this issue.
VMware would like to thank Alexander Trofimov and Marc Esher for
independently reporting this issue to VMware.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
Workstation 7.x any 7.1.2 build 301548 or later *
Workstation 6.5.x any not affected
Player 3.x any 3.1.2 build 301548 or later *
Player 2.5.x any not affected
AMS any any not affected
Server any any not affected
Fusion any Mac OS/X not affected
ESXi any ESXi not affected
ESX any ESX not affected
- Note: This only affects the installer, if you have a version of Workstation or Player installed you are not vulnerable.
b. Third party libpng updated to version 1.2.44
A buffer overflow condition in libpng is addressed that could
potentially lead to code execution with the privileges of the
application using libpng. Two potential denial of service issues
are also addressed in the update.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the names CVE-2010-1205, CVE-2010-0205, CVE-2010-2249
to these issues.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
Workstation 7.1.x any 7.1.2 build 301548 or later
Workstation 6.5.x any affected, patch pending
Player 3.1.x any 3.1.2 build 301548 or later
Player 2.5.x any affected, patch pending
AMS any any not affected
Server any any affected, no patch planned
Fusion any Mac OS/X not affected
ESXi any ESXi not affected
ESX any ESX not affected
c. VMware ACE Management Server (AMS) for Windows updates Apache httpd version 2.2.15.
A function in Apache HTTP Server when multithreaded MPM is used
does not properly handle headers in subrequests in certain
circumstances which may allow remote attackers to obtain sensitive
information via a crafted request that triggers access to memory
locations associated with an earlier request.
The Apache mod_isapi module can be forced to unload a specific
library before the processing of a request is complete, resulting
in memory corruption. This vulnerability may allow a remote
attacker to execute arbitrary code.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the names CVE-2010-0434 and CVE-2010-0425 to the
issues addressed in this update.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
Workstation any any not affected
Player any any not affected
AMS any Windows 2.7.2 build 301548 or later
AMS any Linux affected, patch pending *
Server any any not affected
Fusion any Mac OS/X not affected
ESXi any ESXi not affected
ESX any ESX not affected
-
Note CVE-2010-0425 is not applicable to AMS running on Linux
-
Solution Please review the patch/release notes for your product and version and verify the md5sum and/or the sha1sum of your downloaded file.
VMware Workstation 7.1.2
http://www.vmware.com/download/ws/ Release notes: http://downloads.vmware.com/support/ws71/doc/releasenotes_ws712.html
Workstation for Windows 32-bit and 64-bit with VMware Tools
md5sum: 2e9715ec297dc3ca904ad2707d3e2614
sha1sum: 55b2b99f67c3dacd402fb9880999086efd264e7a
Workstation for Windows 32-bit and 64-bit without VMware Tools
md5sum: 066929f59aef46f11f4d9fd6c6b36e4d
sha1sum: def776a28ee1a21b1ad26e836ae868551fff6fc3
VMware Player 3.1.2
http://www.vmware.com/download/player/ Release notes:
http://downloads.vmware.com/support/player31/doc/releasenotes_player312.html
VMware Player for Windows 32-bit and 64-bit
md5sum: 3f289cb33af5e425c92d8512fb22a7ba
sha1sum: bf67240c1f410ebeb8dcb4f6d7371334bf9a6b70
VMware Player for Linux 32-bit
md5sum: 11e3e3e8753e1d9abbbb92c4e3c1dfe8
sha1sum: dd1dbcdb1f4654eefc11472b68934dcb69842749
VMware Player for Linux 64-bit
md5sum: 2ab08e0d4050719845a64d334ca15bb1
sha1sum: f024ad84ec831fce8667dfa9601851da5d9fa59c
VMware ACE Management Server 2.7.2
http://downloads.vmware.com/d/info/desktop_downloads/vmware_ace/2_7 Release notes: http://downloads.vmware.com/support/ace27/doc/releasenotes_ace272.html
ACE Management Server for Windows
md5sum: 02f0072b8e48a98ed914b633f070d550
sha1sum: 94a68eac4a328d21a741879b9d063227c0dc1ce4
- References
CVE numbers http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3277 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1205 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0205 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2249 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0434 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0425
- Change log
2010-09-23 VMSA-2010-0014 Initial security advisory after release of Workstation 7.1.2, Player 3.1.2 and ACE Management Server 2.7.2 on 2010-09-23
- Contact
E-mail list for product security notifications and announcements: http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
- security-announce at lists.vmware.com
- bugtraq at securityfocus.com
- full-disclosure at lists.grok.org.uk
E-mail: security at vmware.com PGP key at: http://kb.vmware.com/kb/1055
VMware Security Center http://www.vmware.com/security
VMware Security Advisories http://www.vmware.com/security/advisoiries
VMware security response policy http://www.vmware.com/support/policies/security_response.html
General support life cycle policy http://www.vmware.com/support/policies/eos.html
VMware Infrastructure support life cycle policy http://www.vmware.com/support/policies/eos_vi.html
Copyright 2010 VMware Inc. All rights reserved.
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (MingW32)
iEYEARECAAYFAkycSrQACgkQS2KysvBH1xmT9wCfbBUS4GYrJohz+QMLYcoiFmSh eTgAoIAmx+ilbe2myj02daLjFrVQfQII =5jlh -----END PGP SIGNATURE----- .
Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers.
The updated packages have been patched to correct these issues.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2042 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0205
Updated Packages:
Mandriva Linux 2008.0: a490385a7af091254460923d5b370281 2008.0/i586/libpng3-1.2.22-0.4mdv2008.0.i586.rpm 0a24bbf70a2d0acfe67872e0c9d8f709 2008.0/i586/libpng-devel-1.2.22-0.4mdv2008.0.i586.rpm 4606a9e929c6051e122b70ebe2e7bad4 2008.0/i586/libpng-source-1.2.22-0.4mdv2008.0.i586.rpm 694d03d2e8d3bcd07fc0684fd8a6b0c9 2008.0/i586/libpng-static-devel-1.2.22-0.4mdv2008.0.i586.rpm da310f9645a322af4d2a97b9cf4592eb 2008.0/SRPMS/libpng-1.2.22-0.4mdv2008.0.src.rpm
Mandriva Linux 2008.0/X86_64: 4502fd5d882a47d409bfd0e0bc154c88 2008.0/x86_64/lib64png3-1.2.22-0.4mdv2008.0.x86_64.rpm 91b539a7a3a87d57c1ee1e33921aa787 2008.0/x86_64/lib64png-devel-1.2.22-0.4mdv2008.0.x86_64.rpm f0e202692b44e5ebd09168e307a1ad7b 2008.0/x86_64/lib64png-static-devel-1.2.22-0.4mdv2008.0.x86_64.rpm a5c685aa7aac15155af58211a576e08c 2008.0/x86_64/libpng-source-1.2.22-0.4mdv2008.0.x86_64.rpm da310f9645a322af4d2a97b9cf4592eb 2008.0/SRPMS/libpng-1.2.22-0.4mdv2008.0.src.rpm
Corporate 4.0: e224d113e77e285d85ff11c55dae9e50 corporate/4.0/i586/libpng3-1.2.8-1.7.20060mlcs4.i586.rpm c0d62f11277442b0d7a909d0c1c53249 corporate/4.0/i586/libpng3-devel-1.2.8-1.7.20060mlcs4.i586.rpm 8ea7ca8ab7bbed8f2683698a3f493d56 corporate/4.0/i586/libpng3-static-devel-1.2.8-1.7.20060mlcs4.i586.rpm 76f958bdba2876ea2a36f42407aaa9dc corporate/4.0/SRPMS/libpng-1.2.8-1.7.20060mlcs4.src.rpm
Corporate 4.0/X86_64: a19c0839e78e5d16cc159621ff8e3786 corporate/4.0/x86_64/lib64png3-1.2.8-1.7.20060mlcs4.x86_64.rpm 68d1b5c5174f6de15eb1d68735e45e0f corporate/4.0/x86_64/lib64png3-devel-1.2.8-1.7.20060mlcs4.x86_64.rpm d477b9271f6beba77435121f09dff09d corporate/4.0/x86_64/lib64png3-static-devel-1.2.8-1.7.20060mlcs4.x86_64.rpm 76f958bdba2876ea2a36f42407aaa9dc corporate/4.0/SRPMS/libpng-1.2.8-1.7.20060mlcs4.src.rpm
Multi Network Firewall 2.0: 5fe2f05d45ebaac79c58e47429dedceb mnf/2.0/i586/libpng3-1.2.5-10.12.M20mdk.i586.rpm 0ebace3f9758ea06e6471317f95b253f mnf/2.0/i586/libpng3-devel-1.2.5-10.12.M20mdk.i586.rpm 3aa8ba999455eb190979ec7f6f22421a mnf/2.0/i586/libpng3-static-devel-1.2.5-10.12.M20mdk.i586.rpm 1ceca3083b90247ac1d1b68b4bf08f33 mnf/2.0/SRPMS/libpng-1.2.5-10.12.M20mdk.src.rpm
To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFLp88BmqjQ0CJFipgRAl2vAKCNCYs8gf3lw0tqgRMM6WC87P6roQCfZMU2 M2vZq2Q3ZYYDuZssm6LfxaI= =dFcH -----END PGP SIGNATURE----- . =========================================================== Ubuntu Security Notice USN-913-1 March 16, 2010 libpng vulnerabilities CVE-2009-2042, CVE-2010-0205 ===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 6.06 LTS Ubuntu 8.04 LTS Ubuntu 8.10 Ubuntu 9.04 Ubuntu 9.10
This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the following package versions:
Ubuntu 6.06 LTS: libpng12-0 1.2.8rel-5ubuntu0.5
Ubuntu 8.04 LTS: libpng12-0 1.2.15~beta5-3ubuntu0.2
Ubuntu 8.10: libpng12-0 1.2.27-1ubuntu0.2
Ubuntu 9.04: libpng12-0 1.2.27-2ubuntu2.1
Ubuntu 9.10: libpng12-0 1.2.37-1ubuntu0.1
After a standard system upgrade you need to reboot your computer to effect the necessary changes.
Details follow:
It was discovered that libpng did not properly initialize memory when decoding certain 1-bit interlaced images. If a user or automated system were tricked into processing crafted PNG images, an attacker could possibly use this flaw to read sensitive information stored in memory. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 8.10 and 9.04. (CVE-2009-2042)
It was discovered that libpng did not properly handle certain excessively compressed PNG images. If a user or automated system were tricked into processing a crafted PNG image, an attacker could possibly use this flaw to consume all available resources, resulting in a denial of service. (CVE-2010-0205)
Updated packages for Ubuntu 6.06 LTS:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.8rel-5ubuntu0.5.diff.gz
Size/MD5: 22337 fa254fcc4cb513e59eb9467abad87cca
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.8rel-5ubuntu0.5.dsc
Size/MD5: 661 17f3956e31ccadfed0a3bfdc8f5f065a
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.8rel.orig.tar.gz
Size/MD5: 510681 cac1512878fb98f2456df6dc50bc9bc7
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng3_1.2.8rel-5ubuntu0.5_all.deb
Size/MD5: 842 a5ab55fb1b372c9ac93493fd699b276f
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.8rel-5ubuntu0.5_amd64.deb
Size/MD5: 114374 1315864425b2dfaea123fe05118de0b0
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.8rel-5ubuntu0.5_amd64.deb
Size/MD5: 247552 4acf10d5d173d06843cb1dc9b1b894fe
http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng12-0-udeb_1.2.8rel-5ubuntu0.5_amd64.udeb
Size/MD5: 69464 1761fb1c524387b8aabd7bd3dccb2eda
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.8rel-5ubuntu0.5_i386.deb
Size/MD5: 111916 0043501424d2cee81d5f6229a2b3d166
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.8rel-5ubuntu0.5_i386.deb
Size/MD5: 239610 8422b7b137f09b49d27541a87251cce4
http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng12-0-udeb_1.2.8rel-5ubuntu0.5_i386.udeb
Size/MD5: 66948 a8e6db358ed472eb9f18d3b51aed1347
powerpc architecture (Apple Macintosh G3/G4/G5):
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.8rel-5ubuntu0.5_powerpc.deb
Size/MD5: 111422 a0ea39141ce6319b057db22e9fcaf8d6
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.8rel-5ubuntu0.5_powerpc.deb
Size/MD5: 245142 d2d7ed0b8fa777fd58fe78345625a1e7
http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng12-0-udeb_1.2.8rel-5ubuntu0.5_powerpc.udeb
Size/MD5: 66386 f65de398bac540da7a25370999eb9643
sparc architecture (Sun SPARC/UltraSPARC):
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.8rel-5ubuntu0.5_sparc.deb
Size/MD5: 108988 5bad496a668c87614866fe1f04c8c17e
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.8rel-5ubuntu0.5_sparc.deb
Size/MD5: 239972 b3cf4fc712ab063ababdefc5030ad07a
http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng12-0-udeb_1.2.8rel-5ubuntu0.5_sparc.udeb
Size/MD5: 63832 148d28886ec7fdb3334196a762daad1c
Updated packages for Ubuntu 8.04 LTS:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.15~beta5-3ubuntu0.2.diff.gz
Size/MD5: 21048 9f9e2ce175afd0a41bfa613c8672a164
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.15~beta5-3ubuntu0.2.dsc
Size/MD5: 832 59b9f6994e1bef9b8f83561b70afda00
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.15~beta5.orig.tar.gz
Size/MD5: 829038 77ca14fcee1f1f4daaaa28123bd0b22d
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng3_1.2.15~beta5-3ubuntu0.2_all.deb
Size/MD5: 940 e6cfd9d151530dac9ef81148e1690e61
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.15~beta5-3ubuntu0.2_amd64.deb
Size/MD5: 190022 6a7c0dfd7c8501f8628178b5b0eee0cd
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.15~beta5-3ubuntu0.2_amd64.deb
Size/MD5: 179662 bc60e9256f650d385f0c1d175c14fe80
http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng12-0-udeb_1.2.15~beta5-3ubuntu0.2_amd64.udeb
Size/MD5: 70430 a6782df5314e3c49137b1d3253c2c6b4
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.15~beta5-3ubuntu0.2_i386.deb
Size/MD5: 188650 0d4b87ea55d252a24bc74ebc4d748645
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.15~beta5-3ubuntu0.2_i386.deb
Size/MD5: 171178 9608ecb2bd7697bbf4510822a6c61e32
http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng12-0-udeb_1.2.15~beta5-3ubuntu0.2_i386.udeb
Size/MD5: 69094 f39b5e822f4da67599876c68904ecad1
lpia architecture (Low Power Intel Architecture):
http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.15~beta5-3ubuntu0.2_lpia.deb
Size/MD5: 189520 36f70d5b5d6cc10e89323efd72b3e061
http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.15~beta5-3ubuntu0.2_lpia.deb
Size/MD5: 172882 1b5a5a4d6198c0eb6b14dc89c5a9da19
http://ports.ubuntu.com/pool/universe/libp/libpng/libpng12-0-udeb_1.2.15~beta5-3ubuntu0.2_lpia.udeb
Size/MD5: 69994 a3e824e57de27f7b7ed1b93ddd6f6917
powerpc architecture (Apple Macintosh G3/G4/G5):
http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.15~beta5-3ubuntu0.2_powerpc.deb
Size/MD5: 190076 8ec2399126dc45cb9069588dec4f23ef
http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.15~beta5-3ubuntu0.2_powerpc.deb
Size/MD5: 179070 3a16935d6ed3029b636f5a2277470659
http://ports.ubuntu.com/pool/universe/libp/libpng/libpng12-0-udeb_1.2.15~beta5-3ubuntu0.2_powerpc.udeb
Size/MD5: 70556 a2f68773735f91ca14c95fe374a56d7b
sparc architecture (Sun SPARC/UltraSPARC):
http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.15~beta5-3ubuntu0.2_sparc.deb
Size/MD5: 185426 8755e9f8c1be78dbe2de213d9666fd7f
http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.15~beta5-3ubuntu0.2_sparc.deb
Size/MD5: 173332 f94ff6354e27bda2f21a8a542e77f274
http://ports.ubuntu.com/pool/universe/libp/libpng/libpng12-0-udeb_1.2.15~beta5-3ubuntu0.2_sparc.udeb
Size/MD5: 65854 2631780a00ee2727264e6d0f477daa83
Updated packages for Ubuntu 8.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.27-1ubuntu0.2.diff.gz
Size/MD5: 19116 22de419d4a9203e183ccc14813b0d5e2
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.27-1ubuntu0.2.dsc
Size/MD5: 1293 bd0ff3a04141fae88c8136f6f9ee63d4
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.27.orig.tar.gz
Size/MD5: 783204 13a0de401db1972a8e68f47d5bdadd13
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng3_1.2.27-1ubuntu0.2_all.deb
Size/MD5: 934 cdd02e7c09b4bb61bd14670f155f81f4
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.27-1ubuntu0.2_amd64.deb
Size/MD5: 168308 37a5c4970ffd3dc878026e66310bfecc
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.27-1ubuntu0.2_amd64.deb
Size/MD5: 255526 df3e911f99e2d64d3246710e0dea9d49
http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng12-0-udeb_1.2.27-1ubuntu0.2_amd64.udeb
Size/MD5: 72758 6a64efb6a07e32ddfe80bed566e110c8
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.27-1ubuntu0.2_i386.deb
Size/MD5: 166630 08a7389cb42e41ebba773ecdb9e347fe
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.27-1ubuntu0.2_i386.deb
Size/MD5: 247664 e39fbb64952529e977b335e308662782
http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng12-0-udeb_1.2.27-1ubuntu0.2_i386.udeb
Size/MD5: 71014 9e5c717ed5d4e17d86caabb80221030d
lpia architecture (Low Power Intel Architecture):
http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.27-1ubuntu0.2_lpia.deb
Size/MD5: 167096 ed195852cc2b60cb0ddc9cccf87ed280
http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.27-1ubuntu0.2_lpia.deb
Size/MD5: 248616 dc85b020b9a129916f24618d3e27e684
http://ports.ubuntu.com/pool/universe/libp/libpng/libpng12-0-udeb_1.2.27-1ubuntu0.2_lpia.udeb
Size/MD5: 71418 e60289ac791f78aae8eb5598a3eacb5a
powerpc architecture (Apple Macintosh G3/G4/G5):
http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.27-1ubuntu0.2_powerpc.deb
Size/MD5: 167230 5f8b71b3a98b1645727f1f4ae534f960
http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.27-1ubuntu0.2_powerpc.deb
Size/MD5: 254380 76ea57650fd01eb86a315ca0b73dcdca
http://ports.ubuntu.com/pool/universe/libp/libpng/libpng12-0-udeb_1.2.27-1ubuntu0.2_powerpc.udeb
Size/MD5: 71582 f9b8803343f2f61bf5f07b1fb4a25918
sparc architecture (Sun SPARC/UltraSPARC):
http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.27-1ubuntu0.2_sparc.deb
Size/MD5: 162222 445a3d3abb843e73fbf89fe0520ab664
http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.27-1ubuntu0.2_sparc.deb
Size/MD5: 248216 768f20b123d1b0c1c448b3b240245d5c
http://ports.ubuntu.com/pool/universe/libp/libpng/libpng12-0-udeb_1.2.27-1ubuntu0.2_sparc.udeb
Size/MD5: 66728 cf376eab6461fdee69f0bbde6d58dc53
Updated packages for Ubuntu 9.04:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.27-2ubuntu2.1.diff.gz
Size/MD5: 174503 ffa63cd1b57dc442faff9a65d2f25ee7
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.27-2ubuntu2.1.dsc
Size/MD5: 1296 890ff19ff7b12aa90d0d38c0b1550055
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.27.orig.tar.gz
Size/MD5: 783204 13a0de401db1972a8e68f47d5bdadd13
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng3_1.2.27-2ubuntu2.1_all.deb
Size/MD5: 936 3dee09961304f1caf76db0995a027b95
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0-udeb_1.2.27-2ubuntu2.1_amd64.udeb
Size/MD5: 72778 30622682dc700cba1101384ab84fe7ca
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.27-2ubuntu2.1_amd64.deb
Size/MD5: 168382 4be6ce864bf04169baf7d4b656ea8e02
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.27-2ubuntu2.1_amd64.deb
Size/MD5: 255620 730ed6a69006fa14753ef99f89664d31
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0-udeb_1.2.27-2ubuntu2.1_i386.udeb
Size/MD5: 71084 5a3cc8f7589fae49e91689d85476b193
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.27-2ubuntu2.1_i386.deb
Size/MD5: 166732 d674a5262197c091d9ca5b2370cff187
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.27-2ubuntu2.1_i386.deb
Size/MD5: 247744 644a3757529a46d3389e2db18a566f3d
lpia architecture (Low Power Intel Architecture):
http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0-udeb_1.2.27-2ubuntu2.1_lpia.udeb
Size/MD5: 71472 662aba7284b732240c2d7bff864eed12
http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.27-2ubuntu2.1_lpia.deb
Size/MD5: 167200 47dc03f91b37b73626e026cb7da28b15
http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.27-2ubuntu2.1_lpia.deb
Size/MD5: 248706 a01e8fe54d38f4101c6ad0f78eec4a7e
powerpc architecture (Apple Macintosh G3/G4/G5):
http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0-udeb_1.2.27-2ubuntu2.1_powerpc.udeb
Size/MD5: 71564 96e3fb7342ab462db7a27fbd39a46649
http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.27-2ubuntu2.1_powerpc.deb
Size/MD5: 167254 90e1cb3da8cc85953442611cf0faaed8
http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.27-2ubuntu2.1_powerpc.deb
Size/MD5: 254444 4b89c89e031c0d4265b1eb3da45f06e9
sparc architecture (Sun SPARC/UltraSPARC):
http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0-udeb_1.2.27-2ubuntu2.1_sparc.udeb
Size/MD5: 66646 ac9aa1a738ef8ed71bd8b876f1920098
http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.27-2ubuntu2.1_sparc.deb
Size/MD5: 162176 06a1b4ab47a39790da4e9b1e0967c1d2
http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.27-2ubuntu2.1_sparc.deb
Size/MD5: 248222 91cca4c40c4ce6ac41df52ea62e5008a
Updated packages for Ubuntu 9.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.37-1ubuntu0.1.diff.gz
Size/MD5: 18107 a9bf93cac21b17a3589193ae511b75d2
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.37-1ubuntu0.1.dsc
Size/MD5: 1293 dc9a20f9a129ad150f61ec9bb745b039
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.37.orig.tar.gz
Size/MD5: 805380 7480dbbf9f6c3297faf6fe52ec9b91ab
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng3_1.2.37-1ubuntu0.1_all.deb
Size/MD5: 934 3d21bd9bf41fe210303474389cfeb0a8
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0-udeb_1.2.37-1ubuntu0.1_amd64.udeb
Size/MD5: 73848 d436fc20150573d565017d9e29141484
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.37-1ubuntu0.1_amd64.deb
Size/MD5: 174886 34607a76ee1ebdd82b5c71068e6e32b2
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.37-1ubuntu0.1_amd64.deb
Size/MD5: 265214 f600588bdf4f00731d94ccd8bbc68455
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0-udeb_1.2.37-1ubuntu0.1_i386.udeb
Size/MD5: 70382 7d93414ce0e28351b972605abae92cd1
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.37-1ubuntu0.1_i386.deb
Size/MD5: 171402 2b8f6f1c8e8300c3149c59d1fc107659
http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.37-1ubuntu0.1_i386.deb
Size/MD5: 255250 a033009f8d9a990655437c3d129668bf
lpia architecture (Low Power Intel Architecture):
http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0-udeb_1.2.37-1ubuntu0.1_lpia.udeb
Size/MD5: 71012 d3df3a73bf61acb9f1d489a32b3b8a60
http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.37-1ubuntu0.1_lpia.deb
Size/MD5: 172126 1b94fcc470ba8878eace85240fae74cf
http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.37-1ubuntu0.1_lpia.deb
Size/MD5: 257172 3c3280435a2b7d1817b49cd4a3a14bef
powerpc architecture (Apple Macintosh G3/G4/G5):
http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0-udeb_1.2.37-1ubuntu0.1_powerpc.udeb
Size/MD5: 72402 e0b80daed7db7e00d2a921ed5708ffe8
http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.37-1ubuntu0.1_powerpc.deb
Size/MD5: 173494 31c424c02fe594bb6cf9acd1bef1763f
http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.37-1ubuntu0.1_powerpc.deb
Size/MD5: 264450 b0546250e1804b0d385bb8eb714cd2da
sparc architecture (Sun SPARC/UltraSPARC):
http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0-udeb_1.2.37-1ubuntu0.1_sparc.udeb
Size/MD5: 67312 0df0d665eeb40343b9d5485910101786
http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.37-1ubuntu0.1_sparc.deb
Size/MD5: 168372 2a079837d6b9f47c41a02340c5d9e27c
http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.37-1ubuntu0.1_sparc.deb
Size/MD5: 257434 05811c8ff658321e91078f280dacfbe7
. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Debian Security Advisory DSA-2032-1 security@debian.org http://www.debian.org/security/ Giuseppe Iuculano April 11, 2010 http://www.debian.org/security/faq
Package : libpng Vulnerability : several Problem type : local (remote) Debian-specific: no CVE Id(s) : CVE-2009-2042 CVE-2010-0205 Debian Bugs : 533676 572308
Several vulnerabilities have been discovered in libpng, a library for reading and writing PNG files. The Common Vulnerabilities and Exposures project identifies the following problems:
CVE-2009-2042
libpng does not properly parse 1-bit interlaced images with width values that are not divisible by 8, which causes libpng to include uninitialized bits in certain rows of a PNG file and might allow remote attackers to read portions of sensitive memory via "out-of-bounds pixels" in the file.
For the testing (squeeze) and unstable (sid) distribution, these problems have been fixed in version 1.2.43-1
We recommend that you upgrade your libpng package.
Upgrade instructions
wget url will fetch the file for you dpkg -i file.deb will install the referenced file.
If you are using the apt-get package manager, use the line for sources.list as given below:
apt-get update will update the internal database apt-get upgrade will install corrected packages
You may use an automated update by adding the resources from the footer to the proper configuration.
Debian GNU/Linux 5.0 alias lenny
Debian (stable)
Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.
Source archives:
http://security.debian.org/pool/updates/main/libp/libpng/libpng_1.2.27-2+lenny3.dsc Size/MD5 checksum: 1201 abe81b0d3c4aa7a1fa418e29f2c5b297 http://security.debian.org/pool/updates/main/libp/libpng/libpng_1.2.27.orig.tar.gz Size/MD5 checksum: 783204 13a0de401db1972a8e68f47d5bdadd13 http://security.debian.org/pool/updates/main/libp/libpng/libpng_1.2.27-2+lenny3.diff.gz Size/MD5 checksum: 19687 60ede1843ceb8a1f127c54b847a74dfa
Architecture independent packages:
http://security.debian.org/pool/updates/main/libp/libpng/libpng3_1.2.27-2+lenny3_all.deb Size/MD5 checksum: 880 028b00e28aad8282714776c5dcca64a8
alpha architecture (DEC Alpha)
http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0-udeb_1.2.27-2+lenny3_alpha.udeb Size/MD5 checksum: 86562 d9c50af59951e972557d393409b75bf2 http://security.debian.org/pool/updates/main/libp/libpng/libpng12-dev_1.2.27-2+lenny3_alpha.deb Size/MD5 checksum: 287752 1d7d84aee223c0933d1a616722607096 http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0_1.2.27-2+lenny3_alpha.deb Size/MD5 checksum: 182436 001ecbf421f70ca521a3968f1d14c874
amd64 architecture (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0-udeb_1.2.27-2+lenny3_amd64.udeb Size/MD5 checksum: 71912 78fbe1a6568671e4c557ec12e29481b0 http://security.debian.org/pool/updates/main/libp/libpng/libpng12-dev_1.2.27-2+lenny3_amd64.deb Size/MD5 checksum: 254500 481312a64867f31c363b7fbba9cfe171 http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0_1.2.27-2+lenny3_amd64.deb Size/MD5 checksum: 167864 3d285c20d2f080313f82eb09dcb7261b
arm architecture (ARM)
http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0-udeb_1.2.27-2+lenny3_arm.udeb Size/MD5 checksum: 64566 a4a9742190557d14beae40133fb46cf1 http://security.debian.org/pool/updates/main/libp/libpng/libpng12-dev_1.2.27-2+lenny3_arm.deb Size/MD5 checksum: 245438 a16f62e771622e05812172f7c7066504 http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0_1.2.27-2+lenny3_arm.deb Size/MD5 checksum: 159612 81facf06de458dd6b1e84a78bb1acfc8
armel architecture (ARM EABI)
http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0-udeb_1.2.27-2+lenny3_armel.udeb Size/MD5 checksum: 67028 56fc4199656d239231c7b8d8e035fead http://security.debian.org/pool/updates/main/libp/libpng/libpng12-dev_1.2.27-2+lenny3_armel.deb Size/MD5 checksum: 245930 9f64181bc16af0ad0de4ba2e86b25706 http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0_1.2.27-2+lenny3_armel.deb Size/MD5 checksum: 162504 3129e1c2360fcba0309257e2b1dff8ca
hppa architecture (HP PA RISC)
http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0-udeb_1.2.27-2+lenny3_hppa.udeb Size/MD5 checksum: 73858 9d5a53e3258b5149bee68a4d20067bf9 http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0_1.2.27-2+lenny3_hppa.deb Size/MD5 checksum: 169602 12ddce05c84ef675c348a1e64f1a277c http://security.debian.org/pool/updates/main/libp/libpng/libpng12-dev_1.2.27-2+lenny3_hppa.deb Size/MD5 checksum: 261788 9297cb916e57e2f912de3f16bcbae475
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/libp/libpng/libpng12-dev_1.2.27-2+lenny3_i386.deb Size/MD5 checksum: 246968 083d472fd65f884c91dff5926e538342 http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0_1.2.27-2+lenny3_i386.deb Size/MD5 checksum: 165560 233945ee4b1e442357276431ce495a4c http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0-udeb_1.2.27-2+lenny3_i386.udeb Size/MD5 checksum: 70094 769336f4574678e56931e1a1eaf6be6a
ia64 architecture (Intel ia64)
http://security.debian.org/pool/updates/main/libp/libpng/libpng12-dev_1.2.27-2+lenny3_ia64.deb Size/MD5 checksum: 305324 42d7265034b84662467bb75456653787 http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0-udeb_1.2.27-2+lenny3_ia64.udeb Size/MD5 checksum: 111776 ad716022a6a22371bb83f3966ebe17d4 http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0_1.2.27-2+lenny3_ia64.deb Size/MD5 checksum: 206866 572b9d18c5adba74a4e5b99714968a60
mipsel architecture (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/libp/libpng/libpng12-dev_1.2.27-2+lenny3_mipsel.deb Size/MD5 checksum: 262242 e905771ac3fa905cc03a3ddc8f9872dd http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0-udeb_1.2.27-2+lenny3_mipsel.udeb Size/MD5 checksum: 68370 4d44877866357a0fd8474fd8fe183616 http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0_1.2.27-2+lenny3_mipsel.deb Size/MD5 checksum: 164154 93c02dbae7dfe59b77ce4b683b82eaef
powerpc architecture (PowerPC)
http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0_1.2.27-2+lenny3_powerpc.deb Size/MD5 checksum: 166402 1d470464fe2b493aef8d95dde5fd95d8 http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0-udeb_1.2.27-2+lenny3_powerpc.udeb Size/MD5 checksum: 70682 1dd9713672dbac4a7434f1f96a1184b5 http://security.debian.org/pool/updates/main/libp/libpng/libpng12-dev_1.2.27-2+lenny3_powerpc.deb Size/MD5 checksum: 253478 7a87577e07ed0bb9e759b973b2d7cf18
s390 architecture (IBM S/390)
http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0-udeb_1.2.27-2+lenny3_s390.udeb Size/MD5 checksum: 73470 52b1a911a81f133a83a387663aa3ffb2 http://security.debian.org/pool/updates/main/libp/libpng/libpng12-dev_1.2.27-2+lenny3_s390.deb Size/MD5 checksum: 252988 18b4c8b17b3e30ab6cce89c21c99fbfc http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0_1.2.27-2+lenny3_s390.deb Size/MD5 checksum: 169264 601982b9a97707ab05e1f4469cd8e20e
sparc architecture (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0_1.2.27-2+lenny3_sparc.deb Size/MD5 checksum: 161562 facd643206903acfa3a503c1d69e9248 http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0-udeb_1.2.27-2+lenny3_sparc.udeb Size/MD5 checksum: 66032 cbbe521a9a5629987603a57b8c9f35be http://security.debian.org/pool/updates/main/libp/libpng/libpng12-dev_1.2.27-2+lenny3_sparc.deb Size/MD5 checksum: 247212 76b8fe782fd0e5f7546bd535f8d442bc
These files will probably be moved into the stable distribution on its next update. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201003-1082",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "linux",
"scope": "eq",
"trust": 1.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "linux enterprise server",
"scope": "eq",
"trust": 1.3,
"vendor": "suse",
"version": "9"
},
{
"model": "libpng",
"scope": "lt",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.43"
},
{
"model": "linux enterprise server",
"scope": "eq",
"trust": 1.0,
"vendor": "suse",
"version": "10"
},
{
"model": "ubuntu linux",
"scope": "eq",
"trust": 1.0,
"vendor": "canonical",
"version": "9.04"
},
{
"model": "fedora",
"scope": "eq",
"trust": 1.0,
"vendor": "fedoraproject",
"version": "13"
},
{
"model": "mac os x",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "10.6.5"
},
{
"model": "opensuse",
"scope": "eq",
"trust": 1.0,
"vendor": "opensuse",
"version": "11.1"
},
{
"model": "libpng",
"scope": "gte",
"trust": 1.0,
"vendor": "libpng",
"version": "1.0.0"
},
{
"model": "libpng",
"scope": "lt",
"trust": 1.0,
"vendor": "libpng",
"version": "1.4.1"
},
{
"model": "ubuntu linux",
"scope": "eq",
"trust": 1.0,
"vendor": "canonical",
"version": "8.04"
},
{
"model": "libpng",
"scope": "gte",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.0"
},
{
"model": "linux enterprise server",
"scope": "eq",
"trust": 1.0,
"vendor": "suse",
"version": "11"
},
{
"model": "ubuntu linux",
"scope": "eq",
"trust": 1.0,
"vendor": "canonical",
"version": "8.10"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "6.0"
},
{
"model": "ubuntu linux",
"scope": "eq",
"trust": 1.0,
"vendor": "canonical",
"version": "9.10"
},
{
"model": "fedora",
"scope": "eq",
"trust": 1.0,
"vendor": "fedoraproject",
"version": "12"
},
{
"model": "libpng",
"scope": "gte",
"trust": 1.0,
"vendor": "libpng",
"version": "1.4.0"
},
{
"model": "ubuntu linux",
"scope": "eq",
"trust": 1.0,
"vendor": "canonical",
"version": "6.06"
},
{
"model": "fedora",
"scope": "eq",
"trust": 1.0,
"vendor": "fedoraproject",
"version": "11"
},
{
"model": "opensuse",
"scope": "eq",
"trust": 1.0,
"vendor": "opensuse",
"version": "11.0"
},
{
"model": "libpng",
"scope": "lt",
"trust": 1.0,
"vendor": "libpng",
"version": "1.0.53"
},
{
"model": "opensuse",
"scope": "eq",
"trust": 1.0,
"vendor": "opensuse",
"version": "11.2"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.9,
"vendor": "libpng",
"version": "1.0.52"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.9,
"vendor": "libpng",
"version": "1.2.13"
},
{
"model": "lunascape",
"scope": "eq",
"trust": 0.8,
"vendor": "lunascape",
"version": "6"
},
{
"model": "libpng",
"scope": "lte",
"trust": 0.8,
"vendor": "png group",
"version": "1.4.0"
},
{
"model": "player",
"scope": "eq",
"trust": 0.8,
"vendor": "vmware",
"version": "2.5.x"
},
{
"model": "player",
"scope": "eq",
"trust": 0.8,
"vendor": "vmware",
"version": "3.1.x"
},
{
"model": "server",
"scope": null,
"trust": 0.8,
"vendor": "vmware",
"version": null
},
{
"model": "workstation",
"scope": "eq",
"trust": 0.8,
"vendor": "vmware",
"version": "6.5.x"
},
{
"model": "workstation",
"scope": "eq",
"trust": 0.8,
"vendor": "vmware",
"version": "7.1.x"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.5.8"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.6 to v10.6.4"
},
{
"model": "mac os x server",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.5.8"
},
{
"model": "mac os x server",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.6 to v10.6.4"
},
{
"model": "solaris",
"scope": "eq",
"trust": 0.8,
"vendor": "oracle",
"version": "10"
},
{
"model": "solaris",
"scope": "eq",
"trust": 0.8,
"vendor": "oracle",
"version": "11 express"
},
{
"model": "solaris",
"scope": "eq",
"trust": 0.8,
"vendor": "oracle",
"version": "8"
},
{
"model": "solaris",
"scope": "eq",
"trust": 0.8,
"vendor": "oracle",
"version": "9"
},
{
"model": "asianux server",
"scope": "eq",
"trust": 0.8,
"vendor": "cybertrust",
"version": "3 (x86)"
},
{
"model": "asianux server",
"scope": "eq",
"trust": 0.8,
"vendor": "cybertrust",
"version": "3 (x86-64)"
},
{
"model": "asianux server",
"scope": "eq",
"trust": 0.8,
"vendor": "cybertrust",
"version": "3.0"
},
{
"model": "asianux server",
"scope": "eq",
"trust": 0.8,
"vendor": "cybertrust",
"version": "3.0 (x86-64)"
},
{
"model": "asianux server",
"scope": "eq",
"trust": 0.8,
"vendor": "cybertrust",
"version": "4.0"
},
{
"model": "asianux server",
"scope": "eq",
"trust": 0.8,
"vendor": "cybertrust",
"version": "4.0 (x86-64)"
},
{
"model": "pictbear",
"scope": "lt",
"trust": 0.8,
"vendor": "fenrir",
"version": "2.01"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "3 (as)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "3 (es)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "3 (ws)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (as)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (es)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (ws)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.8 (as)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.8 (es)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "5 (server)"
},
{
"model": "enterprise linux desktop",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "3.0"
},
{
"model": "enterprise linux desktop",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.0"
},
{
"model": "enterprise linux desktop",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "5.0 (client)"
},
{
"model": "rhel desktop workstation",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "5 (client)"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.6,
"vendor": "libpng",
"version": "1.0.46"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.6,
"vendor": "libpng",
"version": "1.0.47"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.6,
"vendor": "libpng",
"version": "1.2.11"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.6,
"vendor": "libpng",
"version": "1.0.48"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.6,
"vendor": "libpng",
"version": "1.2.23"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.6,
"vendor": "libpng",
"version": "1.0.51"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.6,
"vendor": "libpng",
"version": "1.0.50"
},
{
"model": "proactive contact",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "4.1.2"
},
{
"model": "server build",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "1.0.8126538"
},
{
"model": "linux armel",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "linux i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.10"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.0.24"
},
{
"model": "linux hppa",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "multi network firewall",
"scope": "eq",
"trust": 0.3,
"vendor": "mandrakesoft",
"version": "2.0"
},
{
"model": "player build",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "2.5.4246459"
},
{
"model": "linux enterprise sp3",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "10"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.0.25"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.2.42"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.6"
},
{
"model": "workstation",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "6.5.1"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.0.17"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.3"
},
{
"model": "voice portal sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0"
},
{
"model": "voice portal",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.1"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.0.43"
},
{
"model": "server",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "1.0.7"
},
{
"model": "intuity audix",
"scope": null,
"trust": 0.3,
"vendor": "avaya",
"version": null
},
{
"model": "corporate server x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "mandrakesoft",
"version": "4.0"
},
{
"model": "aura sip enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.1"
},
{
"model": "proactive contact",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "4.1.1"
},
{
"model": "intuity audix lx r1.1",
"scope": null,
"trust": 0.3,
"vendor": "avaya",
"version": null
},
{
"model": "aura system manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "1.0"
},
{
"model": "linux lts powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "6.06"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5"
},
{
"model": "enterprise server",
"scope": "eq",
"trust": 0.3,
"vendor": "mandrakesoft",
"version": "5"
},
{
"model": "voice portal sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.2.16"
},
{
"model": "proactive contact",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "3.0.2"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.0.18"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.2.8"
},
{
"model": "workstation",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "6.5.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.7"
},
{
"model": "server build",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "1.0.580187"
},
{
"model": "proactive contact",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "4.1"
},
{
"model": "messaging storage server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "3.1"
},
{
"model": "voice portal sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "4.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.4"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.2"
},
{
"model": "messaging storage server sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "3.1"
},
{
"model": "server build",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "2.0.2203138"
},
{
"model": "intuity audix lx sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "2.0"
},
{
"model": "beta01",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.2.27"
},
{
"model": "messaging storage server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0"
},
{
"model": "linux lts amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"model": "server",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "2.0.2"
},
{
"model": "opensuse",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "11.1"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.0.7"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.1"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.4"
},
{
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.10"
},
{
"model": "server",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "1.0.3"
},
{
"model": "player",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "2.5.1"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.0.13"
},
{
"model": "intuity audix lx",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "1.0"
},
{
"model": "linux lts powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"model": "voice portal sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "4.1"
},
{
"model": "libpng",
"scope": "ne",
"trust": 0.3,
"vendor": "libpng",
"version": "1.4.1"
},
{
"model": "proactive contact",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "3.0"
},
{
"model": "hat enterprise linux desktop client",
"scope": "eq",
"trust": 0.3,
"vendor": "red",
"version": "5"
},
{
"model": "workstation build",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "6.5.4246459"
},
{
"model": "player",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "3.1"
},
{
"model": "workstation build",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "6.5118166"
},
{
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.10"
},
{
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "intuity audix lx sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "2.0"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6"
},
{
"model": "linux lts i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "6.06"
},
{
"model": "aura session manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "1.1"
},
{
"model": "aura sip enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"model": "enterprise linux ws",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux ws",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "3"
},
{
"model": "messaging storage server",
"scope": null,
"trust": 0.3,
"vendor": "avaya",
"version": null
},
{
"model": "player build",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "2.5118166"
},
{
"model": "linux mandrake",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2008.0"
},
{
"model": "messaging storage server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "2.0"
},
{
"model": "server",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "2.0.1"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.0.33"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.1"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.2.21"
},
{
"model": "enterprise linux es",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "linux enterprise sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "10"
},
{
"model": "solaris express",
"scope": "eq",
"trust": 0.3,
"vendor": "sun",
"version": "11"
},
{
"model": "enterprise linux es",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "3"
},
{
"model": "linux mandrake",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2010.0"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.4"
},
{
"model": "proactive contact",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "0"
},
{
"model": "linux lts sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.8"
},
{
"model": "libpng",
"scope": "ne",
"trust": 0.3,
"vendor": "libpng",
"version": "1.2.43"
},
{
"model": "server",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "1.0.6"
},
{
"model": "linux lts amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "6.06"
},
{
"model": "aura system platform",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "player",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "2.5.2"
},
{
"model": "linux lts i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.5"
},
{
"model": "linux mandrake",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2009.0"
},
{
"model": "server",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "1.0.8"
},
{
"model": "player",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "2.5.3"
},
{
"model": "messaging storage server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.1"
},
{
"model": "voice portal",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "4.0"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.2.20"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.2.36"
},
{
"model": "server",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "1.0.9"
},
{
"model": "server",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "2.0"
},
{
"model": "aura sip enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "4.0"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.0.14"
},
{
"model": "server build",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "1.0.691891"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.2"
},
{
"model": "hat enterprise linux server",
"scope": "eq",
"trust": 0.3,
"vendor": "red",
"version": "5"
},
{
"model": "server build",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "1.0.10203137"
},
{
"model": "server",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "1.0.4"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.0.6"
},
{
"model": "linux lpia",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "9.10"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.3"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.0.12"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.0.32"
},
{
"model": "aura session manager sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"model": "linux mandrake x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2009.1"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.0.8"
},
{
"model": "message networking",
"scope": null,
"trust": 0.3,
"vendor": "avaya",
"version": null
},
{
"model": "opensuse",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "11.0"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.2.27"
},
{
"model": "linux lts sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "6.06"
},
{
"model": "corporate server",
"scope": "eq",
"trust": 0.3,
"vendor": "mandrakesoft",
"version": "4.0"
},
{
"model": "linux enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "10"
},
{
"model": "linux enterprise sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.0.9"
},
{
"model": "libpng",
"scope": "ne",
"trust": 0.3,
"vendor": "libpng",
"version": "1.0.53"
},
{
"model": "enterprise linux desktop version",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.6"
},
{
"model": "linux enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.3"
},
{
"model": "player build",
"scope": "ne",
"trust": 0.3,
"vendor": "vmware",
"version": "3.1.2301548"
},
{
"model": "solaris 10 sparc",
"scope": null,
"trust": 0.3,
"vendor": "sun",
"version": null
},
{
"model": "mac os server",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.5"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.0.11"
},
{
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "9.10"
},
{
"model": "message networking",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "3.1"
},
{
"model": "linux",
"scope": null,
"trust": 0.3,
"vendor": "gentoo",
"version": null
},
{
"model": "desktop",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "3.0"
},
{
"model": "rc1",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.2.22"
},
{
"model": "aura sip enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "3.1.1"
},
{
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "9.10"
},
{
"model": "aura system platform",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "1.1"
},
{
"model": "enterprise linux desktop workstation client",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "5"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5"
},
{
"model": "player build",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "2.5.3185404"
},
{
"model": "voice portal",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0"
},
{
"model": "aura sip enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "3.1"
},
{
"model": "aura session manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"model": "workstation build",
"scope": "ne",
"trust": 0.3,
"vendor": "vmware",
"version": "7.1.2301548"
},
{
"model": "linux alpha",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "server build",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "1.0.9156507"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.4"
},
{
"model": "aura sip enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0"
},
{
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "9.10"
},
{
"model": "server build",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "1.0.7108231"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.2"
},
{
"model": "linux lts lpia",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"model": "server",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "1.0.5"
},
{
"model": "workstation build",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "6.5.3185404"
},
{
"model": "linux i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "9.10"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.2.34"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.2.18"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.7"
},
{
"model": "server build",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "2.0.1156745"
},
{
"model": "linux i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "9.04"
},
{
"model": "voice portal",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "4.1"
},
{
"model": "aura session manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "1.0"
},
{
"model": "messaging storage server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "4.0"
},
{
"model": "message networking mn",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "3.1"
},
{
"model": "server",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "1.0.10"
},
{
"model": "aura sip enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2.1"
},
{
"model": "server",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "1.0.2"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.0.42"
},
{
"model": "linux s/390",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "workstation",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "7.1"
},
{
"model": "message networking",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.4"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.0.16"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.0.5"
},
{
"model": "linux lpia",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "9.04"
},
{
"model": "beta01",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.4"
},
{
"model": "aura system manager sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "player",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "2.5.4"
},
{
"model": "voice portal",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "3.0"
},
{
"model": "aura system manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.2.17"
},
{
"model": "aura session manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.1"
},
{
"model": "aura sip enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "3.0"
},
{
"model": "beta19",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.4"
},
{
"model": "proactive contact",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "3.0.3"
},
{
"model": "solaris 10 x86",
"scope": null,
"trust": 0.3,
"vendor": "sun",
"version": null
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.0.10"
},
{
"model": "linux lpia",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.10"
},
{
"model": "workstation build",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "6.5.2156735"
},
{
"model": "messaging storage server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.0.15"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.5"
},
{
"model": "proactive contact",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "4.0"
},
{
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "9.04"
},
{
"model": "linux mandrake x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2008.0"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.2.35"
},
{
"model": "intuity audix lx",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "2.0"
},
{
"model": "workstation",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "6.5.3"
},
{
"model": "solaris 9 x86",
"scope": null,
"trust": 0.3,
"vendor": "sun",
"version": null
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.2.37"
},
{
"model": "aura conferencing standard",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "opensuse",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "11.2"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.8"
},
{
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "9.04"
},
{
"model": "solaris 9 sparc",
"scope": null,
"trust": 0.3,
"vendor": "sun",
"version": null
},
{
"model": "aura system platform sp1.1",
"scope": null,
"trust": 0.3,
"vendor": "avaya",
"version": null
},
{
"model": "linux ia-32",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "linux mandrake x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2010.0"
},
{
"model": "linux mipsel",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "linux mips",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "enterprise server x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "mandrakesoft",
"version": "5"
},
{
"model": "player build",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "2.5.2156735"
},
{
"model": "messaging storage server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "1.0"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.2"
},
{
"model": "linux mandrake",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2009.1"
},
{
"model": "aura session manager sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.10"
},
{
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "9.04"
},
{
"model": "linux mandrake x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2009.0"
},
{
"model": "hat enterprise linux as",
"scope": "eq",
"trust": 0.3,
"vendor": "red",
"version": "4"
},
{
"model": "hat enterprise linux as",
"scope": "eq",
"trust": 0.3,
"vendor": "red",
"version": "3"
},
{
"model": "linux m68k",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.2.26"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.3,
"vendor": "libpng",
"version": "1.2.19"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.3"
},
{
"model": "linux ia-64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
}
],
"sources": [
{
"db": "BID",
"id": "38478"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001158"
},
{
"db": "CNNVD",
"id": "CNNVD-201003-024"
},
{
"db": "NVD",
"id": "CVE-2010-0205"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "1.0.53",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "1.2.43",
"versionStartIncluding": "1.2.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "1.4.1",
"versionStartIncluding": "1.4.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "10.6.5",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:13:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:opensuse:opensuse:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:suse:linux_enterprise_server:9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:suse:linux_enterprise_server:10:sp3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:suse:linux_enterprise_server:11:-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2010-0205"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Glenn Randers-Pehrson",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201003-024"
}
],
"trust": 0.6
},
"cve": "CVE-2010-0205",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 7.8,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2010-0205",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-42810",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULMON",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "CVE-2010-0205",
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "MEDIUM",
"trust": 0.1,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2010-0205",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#576029",
"trust": 0.8,
"value": "0.85"
},
{
"author": "NVD",
"id": "CVE-2010-0205",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201003-024",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-42810",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2010-0205",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#576029"
},
{
"db": "VULHUB",
"id": "VHN-42810"
},
{
"db": "VULMON",
"id": "CVE-2010-0205"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001158"
},
{
"db": "CNNVD",
"id": "CNNVD-201003-024"
},
{
"db": "NVD",
"id": "CVE-2010-0205"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The png_decompress_chunk function in pngrutil.c in libpng 1.0.x before 1.0.53, 1.2.x before 1.2.43, and 1.4.x before 1.4.1 does not properly handle compressed ancillary-chunk data that has a disproportionately large uncompressed representation, which allows remote attackers to cause a denial of service (memory and CPU consumption, and application hang) via a crafted PNG file, as demonstrated by use of the deflate compression method on data composed of many occurrences of the same character, related to a \"decompression bomb\" attack. libpng Has a specific PNG ( Portable Network Graphics ) There is a problem with the file processing. libpng Contains crafted auxiliary chunks PNG When processing files, a huge amount of memory CPU May use resources. For more information, PNG Development Group Security advisories and Defending Libpng Applications Against Decompression Bombs Please confirm.Disturbance of service operation by a remote third party (DoS) An attack may be carried out. The \u0027libpng\u0027 library is prone to a remote denial-of-service vulnerability. \nSuccessful exploits will allow an attacker to consume an excessive amount of CPU memory, denying service to legitimate users. \nSuccessful exploits will allow an attacker to obtain potentially sensitive information. \nVersions prior to libpng 1.4.1, 1.2.43, and 1.0.53 are vulnerable. This resource consumption may cause applications using the libpng library to hang. The PNG format uses efficient compression to store graphic data and some related data in an auxiliary database. The PNG specification does not limit the number of chunks, limiting their size to 2.147G (2,147,483,647 bytes). Similarly, the specification limits the width and height of graphics to 2.147 billion rows and 2.147 billion columns. Since the deflate compression method can very efficiently compress data streams consisting of repeated single bytes, small PNG files may occupy a large amount of memory when decompressed, forming a \\\"decompression bomb that exhausts all available memory. For example, for a zTXt block containing 50,000 lines each containing 100 letters Z, the compressed size is about 17k bytes, but the decompressed size is 5M, and the compression ratio is about 300:1. Libpng library uses inefficient memory acquisition method when expanding compressed zTXt, iTXt and iCCP auxiliary data blocks. About 50k malformed iCCP blocks contained in graphic files can be decompressed to 60M, which will hang the browser for about 20 Minutes, a well-crafted malicious block can also hang the browser for even longer, using up all available memory. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory GLSA 201010-01\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n http://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: Normal\n Title: Libpng: Multiple vulnerabilities\n Date: October 05, 2010\n Bugs: #307637, #324153, #335887\n ID: 201010-01\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities in libpng might lead to privilege escalation\nor a Denial of Service. It is used by several programs, including web\nbrowsers and potentially server processes. \n\nAffected packages\n=================\n\n -------------------------------------------------------------------\n Package / Vulnerable / Unaffected\n -------------------------------------------------------------------\n 1 media-libs/libpng \u003c 1.4.3 \u003e= 1.4.3\n\nDescription\n===========\n\nMultiple vulnerabilities were found in libpng:\n\n* The png_decompress_chunk() function in pngrutil.c does not properly\n handle certain type of compressed data (CVE-2010-0205)\n\n* A buffer overflow in pngread.c when using progressive applications\n (CVE-2010-1205)\n\n* A memory leak in pngrutil.c when dealing with a certain type of\n chunks (CVE-2010-2249)\n\nImpact\n======\n\nAn attacker could exploit these vulnerabilities to cause programs\nlinked against the library to crash or execute arbitrary code with the\npermissions of the user running the vulnerable program, which could be\nthe root user. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll libpng users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose \"\u003e=media-libs/libpng-1.4.3\"\n\nReferences\n==========\n\n [ 1 ] CVE-2010-0205\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0205\n [ 2 ] CVE-2010-1205\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1205\n [ 3 ] CVE-2010-2249\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2249\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n http://security.gentoo.org/glsa/glsa-201010-01.xml\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2010 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttp://creativecommons.org/licenses/by-sa/2.5\n\n\n\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n- ------------------------------------------------------------------------\n VMware Security Advisory\n\nAdvisory ID: VMSA-2010-0014\nSynopsis: VMware Workstation, Player, and ACE address several\n security issues. \nIssue date: 2010-09-23\nUpdated on: 2010-09-23 (initial release of advisory)\nCVE numbers: CVE-2010-3277 CVE-2010-1205 CVE-2010-0205\n CVE-2010-2249 CVE-2010-0434 CVE-2010-0425\n- ------------------------------------------------------------------------\n\n1. Summary\n\n VMware Workstation and Player address a potential installer security\n issue and security issues in libpng. VMware ACE Management Server\n (AMS) for Windows updates Apache httpd. \n\n2. Relevant releases\n\n VMware Workstation 7.1.1 and earlier,\n VMware Player 3.1.1 and earlier,\n VMware ACE Management Server 2.7.1 and earlier,\n\n Note: VMware Server was declared End Of Availability on January 2010,\n support will be limited to Technical Guidance for the duration\n of the support term. \n\n3. Problem Description\n\n a. VMware Workstation and Player installer security issue\n\n The Workstation 7.x and Player 3.x installers will load an index.htm\n file located in the current working directory on which Workstation\n 7.x or Player 3.x is being installed. This may allow an attacker to\n display a malicious file if they manage to get their file onto the\n system prior to installation. \n\n The issue can only be exploited at the time that Workstation 7.x or\n Player 3.x is being installed. Installed versions of Workstation and\n Player are not affected. The security issue is no longer present in\n the installer of the new versions of Workstation 7.x and Player 3.x\n (see table below for the version numbers). \n\n The Common Vulnerabilities and Exposures project (cve.mitre.org)\n has assigned the name CVE-2010-3277 to this issue. \n\n VMware would like to thank Alexander Trofimov and Marc Esher for\n independently reporting this issue to VMware. \n\n The following table lists what action remediates the vulnerability\n (column 4) if a solution is available. \n\n VMware Product Running Replace with/\n Product Version on Apply Patch\n ============= ======== ======= =================\n VirtualCenter any Windows not affected\n\n Workstation 7.x any 7.1.2 build 301548 or later *\n Workstation 6.5.x any not affected\n\n Player 3.x any 3.1.2 build 301548 or later *\n Player 2.5.x any not affected\n\n AMS any any not affected\n\n Server any any not affected\n\n Fusion any Mac OS/X not affected\n\n ESXi any ESXi not affected\n\n ESX any ESX not affected\n\n * Note: This only affects the installer, if you have a version of\n Workstation or Player installed you are not vulnerable. \n\n\n b. Third party libpng updated to version 1.2.44\n\n A buffer overflow condition in libpng is addressed that could\n potentially lead to code execution with the privileges of the\n application using libpng. Two potential denial of service issues\n are also addressed in the update. \n\n The Common Vulnerabilities and Exposures project (cve.mitre.org)\n has assigned the names CVE-2010-1205, CVE-2010-0205, CVE-2010-2249\n to these issues. \n\n The following table lists what action remediates the vulnerability\n (column 4) if a solution is available. \n\n\n VMware Product Running Replace with/\n Product Version on Apply Patch\n ============= ======== ======= =================\n VirtualCenter any Windows not affected\n\n Workstation 7.1.x any 7.1.2 build 301548 or later\n Workstation 6.5.x any affected, patch pending\n\n Player 3.1.x any 3.1.2 build 301548 or later\n Player 2.5.x any affected, patch pending\n\n AMS any any not affected\n\n Server any any affected, no patch planned\n\n Fusion any Mac OS/X not affected\n\n ESXi any ESXi not affected\n\n ESX any ESX not affected\n\n\n c. VMware ACE Management Server (AMS) for Windows updates Apache httpd\n version 2.2.15. \n\n A function in Apache HTTP Server when multithreaded MPM is used\n does not properly handle headers in subrequests in certain\n circumstances which may allow remote attackers to obtain sensitive\n information via a crafted request that triggers access to memory\n locations associated with an earlier request. \n\n The Apache mod_isapi module can be forced to unload a specific\n library before the processing of a request is complete, resulting\n in memory corruption. This vulnerability may allow a remote\n attacker to execute arbitrary code. \n\n The Common Vulnerabilities and Exposures project (cve.mitre.org)\n has assigned the names CVE-2010-0434 and CVE-2010-0425 to the\n issues addressed in this update. \n\n Column 4 of the following table lists the action required to\n remediate the vulnerability in each release, if a solution is\n available. \n\n VMware Product Running Replace with/\n Product Version on Apply Patch\n ============= ======== ======= =================\n VirtualCenter any Windows not affected\n\n Workstation any any not affected\n\n Player any any not affected\n\n AMS any Windows 2.7.2 build 301548 or later\n AMS any Linux affected, patch pending *\n\n Server any any not affected\n\n Fusion any Mac OS/X not affected\n\n ESXi any ESXi not affected\n\n ESX any ESX not affected\n\n * Note CVE-2010-0425 is not applicable to AMS running on Linux\n\n4. Solution\n Please review the patch/release notes for your product and version\n and verify the md5sum and/or the sha1sum of your downloaded file. \n\n VMware Workstation 7.1.2\n ------------------------\n http://www.vmware.com/download/ws/\n Release notes:\n http://downloads.vmware.com/support/ws71/doc/releasenotes_ws712.html\n\n Workstation for Windows 32-bit and 64-bit with VMware Tools\t\n md5sum: 2e9715ec297dc3ca904ad2707d3e2614\n sha1sum: 55b2b99f67c3dacd402fb9880999086efd264e7a\n\n Workstation for Windows 32-bit and 64-bit without VMware Tools\t\n md5sum: 066929f59aef46f11f4d9fd6c6b36e4d\n sha1sum: def776a28ee1a21b1ad26e836ae868551fff6fc3\n\n VMware Player 3.1.2\n -------------------\n http://www.vmware.com/download/player/\n Release notes:\n\nhttp://downloads.vmware.com/support/player31/doc/releasenotes_player312.html\n\n VMware Player for Windows 32-bit and 64-bit\t\n md5sum: 3f289cb33af5e425c92d8512fb22a7ba\n sha1sum: bf67240c1f410ebeb8dcb4f6d7371334bf9a6b70\n\n VMware Player for Linux 32-bit\t\n md5sum: 11e3e3e8753e1d9abbbb92c4e3c1dfe8\n sha1sum: dd1dbcdb1f4654eefc11472b68934dcb69842749\n\n VMware Player for Linux 64-bit\t\n md5sum: 2ab08e0d4050719845a64d334ca15bb1\n sha1sum: f024ad84ec831fce8667dfa9601851da5d9fa59c\n\n VMware ACE Management Server 2.7.2\n ----------------------------------\n http://downloads.vmware.com/d/info/desktop_downloads/vmware_ace/2_7\n Release notes:\n http://downloads.vmware.com/support/ace27/doc/releasenotes_ace272.html\n\n ACE Management Server for Windows\t\n md5sum: 02f0072b8e48a98ed914b633f070d550\n sha1sum: 94a68eac4a328d21a741879b9d063227c0dc1ce4\n\n5. References\n\n CVE numbers\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3277\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1205\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0205\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2249\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0434\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0425\n\n- ------------------------------------------------------------------------\n\n6. Change log\n\n2010-09-23 VMSA-2010-0014\nInitial security advisory after release of Workstation 7.1.2,\nPlayer 3.1.2 and ACE Management Server 2.7.2 on 2010-09-23\n\n- -----------------------------------------------------------------------\n7. Contact\n\nE-mail list for product security notifications and announcements:\nhttp://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce\n\nThis Security Advisory is posted to the following lists:\n\n * security-announce at lists.vmware.com\n * bugtraq at securityfocus.com\n * full-disclosure at lists.grok.org.uk\n\nE-mail: security at vmware.com\nPGP key at: http://kb.vmware.com/kb/1055\n\nVMware Security Center\nhttp://www.vmware.com/security\n\nVMware Security Advisories\nhttp://www.vmware.com/security/advisoiries\n\nVMware security response policy\nhttp://www.vmware.com/support/policies/security_response.html\n\nGeneral support life cycle policy\nhttp://www.vmware.com/support/policies/eos.html\n\nVMware Infrastructure support life cycle policy\nhttp://www.vmware.com/support/policies/eos_vi.html\n\nCopyright 2010 VMware Inc. All rights reserved. \n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.10 (MingW32)\n\niEYEARECAAYFAkycSrQACgkQS2KysvBH1xmT9wCfbBUS4GYrJohz+QMLYcoiFmSh\neTgAoIAmx+ilbe2myj02daLjFrVQfQII\n=5jlh\n-----END PGP SIGNATURE-----\n. \n \n Packages for 2008.0 are provided for Corporate Desktop 2008.0\n customers. \n \n The updated packages have been patched to correct these issues. \n _______________________________________________________________________\n\n References:\n\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2042\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0205\n _______________________________________________________________________\n\n Updated Packages:\n\n Mandriva Linux 2008.0:\n a490385a7af091254460923d5b370281 2008.0/i586/libpng3-1.2.22-0.4mdv2008.0.i586.rpm\n 0a24bbf70a2d0acfe67872e0c9d8f709 2008.0/i586/libpng-devel-1.2.22-0.4mdv2008.0.i586.rpm\n 4606a9e929c6051e122b70ebe2e7bad4 2008.0/i586/libpng-source-1.2.22-0.4mdv2008.0.i586.rpm\n 694d03d2e8d3bcd07fc0684fd8a6b0c9 2008.0/i586/libpng-static-devel-1.2.22-0.4mdv2008.0.i586.rpm \n da310f9645a322af4d2a97b9cf4592eb 2008.0/SRPMS/libpng-1.2.22-0.4mdv2008.0.src.rpm\n\n Mandriva Linux 2008.0/X86_64:\n 4502fd5d882a47d409bfd0e0bc154c88 2008.0/x86_64/lib64png3-1.2.22-0.4mdv2008.0.x86_64.rpm\n 91b539a7a3a87d57c1ee1e33921aa787 2008.0/x86_64/lib64png-devel-1.2.22-0.4mdv2008.0.x86_64.rpm\n f0e202692b44e5ebd09168e307a1ad7b 2008.0/x86_64/lib64png-static-devel-1.2.22-0.4mdv2008.0.x86_64.rpm\n a5c685aa7aac15155af58211a576e08c 2008.0/x86_64/libpng-source-1.2.22-0.4mdv2008.0.x86_64.rpm \n da310f9645a322af4d2a97b9cf4592eb 2008.0/SRPMS/libpng-1.2.22-0.4mdv2008.0.src.rpm\n\n Corporate 4.0:\n e224d113e77e285d85ff11c55dae9e50 corporate/4.0/i586/libpng3-1.2.8-1.7.20060mlcs4.i586.rpm\n c0d62f11277442b0d7a909d0c1c53249 corporate/4.0/i586/libpng3-devel-1.2.8-1.7.20060mlcs4.i586.rpm\n 8ea7ca8ab7bbed8f2683698a3f493d56 corporate/4.0/i586/libpng3-static-devel-1.2.8-1.7.20060mlcs4.i586.rpm \n 76f958bdba2876ea2a36f42407aaa9dc corporate/4.0/SRPMS/libpng-1.2.8-1.7.20060mlcs4.src.rpm\n\n Corporate 4.0/X86_64:\n a19c0839e78e5d16cc159621ff8e3786 corporate/4.0/x86_64/lib64png3-1.2.8-1.7.20060mlcs4.x86_64.rpm\n 68d1b5c5174f6de15eb1d68735e45e0f corporate/4.0/x86_64/lib64png3-devel-1.2.8-1.7.20060mlcs4.x86_64.rpm\n d477b9271f6beba77435121f09dff09d corporate/4.0/x86_64/lib64png3-static-devel-1.2.8-1.7.20060mlcs4.x86_64.rpm \n 76f958bdba2876ea2a36f42407aaa9dc corporate/4.0/SRPMS/libpng-1.2.8-1.7.20060mlcs4.src.rpm\n\n Multi Network Firewall 2.0:\n 5fe2f05d45ebaac79c58e47429dedceb mnf/2.0/i586/libpng3-1.2.5-10.12.M20mdk.i586.rpm\n 0ebace3f9758ea06e6471317f95b253f mnf/2.0/i586/libpng3-devel-1.2.5-10.12.M20mdk.i586.rpm\n 3aa8ba999455eb190979ec7f6f22421a mnf/2.0/i586/libpng3-static-devel-1.2.5-10.12.M20mdk.i586.rpm \n 1ceca3083b90247ac1d1b68b4bf08f33 mnf/2.0/SRPMS/libpng-1.2.5-10.12.M20mdk.src.rpm\n _______________________________________________________________________\n\n To upgrade automatically use MandrivaUpdate or urpmi. The verification\n of md5 checksums and GPG signatures is performed automatically for you. \n\n All packages are signed by Mandriva for security. You can obtain the\n GPG public key of the Mandriva Security Team by executing:\n\n gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98\n\n You can view other update advisories for Mandriva Linux at:\n\n http://www.mandriva.com/security/advisories\n\n If you want to report vulnerabilities, please contact\n\n security_(at)_mandriva.com\n _______________________________________________________________________\n\n Type Bits/KeyID Date User ID\n pub 1024D/22458A98 2000-07-10 Mandriva Security Team\n \u003csecurity*mandriva.com\u003e\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.9 (GNU/Linux)\n\niD8DBQFLp88BmqjQ0CJFipgRAl2vAKCNCYs8gf3lw0tqgRMM6WC87P6roQCfZMU2\nM2vZq2Q3ZYYDuZssm6LfxaI=\n=dFcH\n-----END PGP SIGNATURE-----\n. ===========================================================\nUbuntu Security Notice USN-913-1 March 16, 2010\nlibpng vulnerabilities\nCVE-2009-2042, CVE-2010-0205\n===========================================================\n\nA security issue affects the following Ubuntu releases:\n\nUbuntu 6.06 LTS\nUbuntu 8.04 LTS\nUbuntu 8.10\nUbuntu 9.04\nUbuntu 9.10\n\nThis advisory also applies to the corresponding versions of\nKubuntu, Edubuntu, and Xubuntu. \n\nThe problem can be corrected by upgrading your system to the\nfollowing package versions:\n\nUbuntu 6.06 LTS:\n libpng12-0 1.2.8rel-5ubuntu0.5\n\nUbuntu 8.04 LTS:\n libpng12-0 1.2.15~beta5-3ubuntu0.2\n\nUbuntu 8.10:\n libpng12-0 1.2.27-1ubuntu0.2\n\nUbuntu 9.04:\n libpng12-0 1.2.27-2ubuntu2.1\n\nUbuntu 9.10:\n libpng12-0 1.2.37-1ubuntu0.1\n\nAfter a standard system upgrade you need to reboot your computer to effect\nthe necessary changes. \n\nDetails follow:\n\nIt was discovered that libpng did not properly initialize memory when\ndecoding certain 1-bit interlaced images. If a user or automated system\nwere tricked into processing crafted PNG images, an attacker could possibly\nuse this flaw to read sensitive information stored in memory. This issue\nonly affected Ubuntu 6.06 LTS, 8.04 LTS, 8.10 and 9.04. (CVE-2009-2042)\n\nIt was discovered that libpng did not properly handle certain excessively\ncompressed PNG images. If a user or automated system were tricked into\nprocessing a crafted PNG image, an attacker could possibly use this flaw to\nconsume all available resources, resulting in a denial of service. \n(CVE-2010-0205)\n\n\nUpdated packages for Ubuntu 6.06 LTS:\n\n Source archives:\n\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.8rel-5ubuntu0.5.diff.gz\n Size/MD5: 22337 fa254fcc4cb513e59eb9467abad87cca\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.8rel-5ubuntu0.5.dsc\n Size/MD5: 661 17f3956e31ccadfed0a3bfdc8f5f065a\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.8rel.orig.tar.gz\n Size/MD5: 510681 cac1512878fb98f2456df6dc50bc9bc7\n\n Architecture independent packages:\n\n http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng3_1.2.8rel-5ubuntu0.5_all.deb\n Size/MD5: 842 a5ab55fb1b372c9ac93493fd699b276f\n\n amd64 architecture (Athlon64, Opteron, EM64T Xeon):\n\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.8rel-5ubuntu0.5_amd64.deb\n Size/MD5: 114374 1315864425b2dfaea123fe05118de0b0\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.8rel-5ubuntu0.5_amd64.deb\n Size/MD5: 247552 4acf10d5d173d06843cb1dc9b1b894fe\n http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng12-0-udeb_1.2.8rel-5ubuntu0.5_amd64.udeb\n Size/MD5: 69464 1761fb1c524387b8aabd7bd3dccb2eda\n\n i386 architecture (x86 compatible Intel/AMD):\n\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.8rel-5ubuntu0.5_i386.deb\n Size/MD5: 111916 0043501424d2cee81d5f6229a2b3d166\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.8rel-5ubuntu0.5_i386.deb\n Size/MD5: 239610 8422b7b137f09b49d27541a87251cce4\n http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng12-0-udeb_1.2.8rel-5ubuntu0.5_i386.udeb\n Size/MD5: 66948 a8e6db358ed472eb9f18d3b51aed1347\n\n powerpc architecture (Apple Macintosh G3/G4/G5):\n\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.8rel-5ubuntu0.5_powerpc.deb\n Size/MD5: 111422 a0ea39141ce6319b057db22e9fcaf8d6\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.8rel-5ubuntu0.5_powerpc.deb\n Size/MD5: 245142 d2d7ed0b8fa777fd58fe78345625a1e7\n http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng12-0-udeb_1.2.8rel-5ubuntu0.5_powerpc.udeb\n Size/MD5: 66386 f65de398bac540da7a25370999eb9643\n\n sparc architecture (Sun SPARC/UltraSPARC):\n\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.8rel-5ubuntu0.5_sparc.deb\n Size/MD5: 108988 5bad496a668c87614866fe1f04c8c17e\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.8rel-5ubuntu0.5_sparc.deb\n Size/MD5: 239972 b3cf4fc712ab063ababdefc5030ad07a\n http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng12-0-udeb_1.2.8rel-5ubuntu0.5_sparc.udeb\n Size/MD5: 63832 148d28886ec7fdb3334196a762daad1c\n\nUpdated packages for Ubuntu 8.04 LTS:\n\n Source archives:\n\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.15~beta5-3ubuntu0.2.diff.gz\n Size/MD5: 21048 9f9e2ce175afd0a41bfa613c8672a164\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.15~beta5-3ubuntu0.2.dsc\n Size/MD5: 832 59b9f6994e1bef9b8f83561b70afda00\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.15~beta5.orig.tar.gz\n Size/MD5: 829038 77ca14fcee1f1f4daaaa28123bd0b22d\n\n Architecture independent packages:\n\n http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng3_1.2.15~beta5-3ubuntu0.2_all.deb\n Size/MD5: 940 e6cfd9d151530dac9ef81148e1690e61\n\n amd64 architecture (Athlon64, Opteron, EM64T Xeon):\n\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.15~beta5-3ubuntu0.2_amd64.deb\n Size/MD5: 190022 6a7c0dfd7c8501f8628178b5b0eee0cd\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.15~beta5-3ubuntu0.2_amd64.deb\n Size/MD5: 179662 bc60e9256f650d385f0c1d175c14fe80\n http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng12-0-udeb_1.2.15~beta5-3ubuntu0.2_amd64.udeb\n Size/MD5: 70430 a6782df5314e3c49137b1d3253c2c6b4\n\n i386 architecture (x86 compatible Intel/AMD):\n\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.15~beta5-3ubuntu0.2_i386.deb\n Size/MD5: 188650 0d4b87ea55d252a24bc74ebc4d748645\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.15~beta5-3ubuntu0.2_i386.deb\n Size/MD5: 171178 9608ecb2bd7697bbf4510822a6c61e32\n http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng12-0-udeb_1.2.15~beta5-3ubuntu0.2_i386.udeb\n Size/MD5: 69094 f39b5e822f4da67599876c68904ecad1\n\n lpia architecture (Low Power Intel Architecture):\n\n http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.15~beta5-3ubuntu0.2_lpia.deb\n Size/MD5: 189520 36f70d5b5d6cc10e89323efd72b3e061\n http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.15~beta5-3ubuntu0.2_lpia.deb\n Size/MD5: 172882 1b5a5a4d6198c0eb6b14dc89c5a9da19\n http://ports.ubuntu.com/pool/universe/libp/libpng/libpng12-0-udeb_1.2.15~beta5-3ubuntu0.2_lpia.udeb\n Size/MD5: 69994 a3e824e57de27f7b7ed1b93ddd6f6917\n\n powerpc architecture (Apple Macintosh G3/G4/G5):\n\n http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.15~beta5-3ubuntu0.2_powerpc.deb\n Size/MD5: 190076 8ec2399126dc45cb9069588dec4f23ef\n http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.15~beta5-3ubuntu0.2_powerpc.deb\n Size/MD5: 179070 3a16935d6ed3029b636f5a2277470659\n http://ports.ubuntu.com/pool/universe/libp/libpng/libpng12-0-udeb_1.2.15~beta5-3ubuntu0.2_powerpc.udeb\n Size/MD5: 70556 a2f68773735f91ca14c95fe374a56d7b\n\n sparc architecture (Sun SPARC/UltraSPARC):\n\n http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.15~beta5-3ubuntu0.2_sparc.deb\n Size/MD5: 185426 8755e9f8c1be78dbe2de213d9666fd7f\n http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.15~beta5-3ubuntu0.2_sparc.deb\n Size/MD5: 173332 f94ff6354e27bda2f21a8a542e77f274\n http://ports.ubuntu.com/pool/universe/libp/libpng/libpng12-0-udeb_1.2.15~beta5-3ubuntu0.2_sparc.udeb\n Size/MD5: 65854 2631780a00ee2727264e6d0f477daa83\n\nUpdated packages for Ubuntu 8.10:\n\n Source archives:\n\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.27-1ubuntu0.2.diff.gz\n Size/MD5: 19116 22de419d4a9203e183ccc14813b0d5e2\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.27-1ubuntu0.2.dsc\n Size/MD5: 1293 bd0ff3a04141fae88c8136f6f9ee63d4\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.27.orig.tar.gz\n Size/MD5: 783204 13a0de401db1972a8e68f47d5bdadd13\n\n Architecture independent packages:\n\n http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng3_1.2.27-1ubuntu0.2_all.deb\n Size/MD5: 934 cdd02e7c09b4bb61bd14670f155f81f4\n\n amd64 architecture (Athlon64, Opteron, EM64T Xeon):\n\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.27-1ubuntu0.2_amd64.deb\n Size/MD5: 168308 37a5c4970ffd3dc878026e66310bfecc\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.27-1ubuntu0.2_amd64.deb\n Size/MD5: 255526 df3e911f99e2d64d3246710e0dea9d49\n http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng12-0-udeb_1.2.27-1ubuntu0.2_amd64.udeb\n Size/MD5: 72758 6a64efb6a07e32ddfe80bed566e110c8\n\n i386 architecture (x86 compatible Intel/AMD):\n\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.27-1ubuntu0.2_i386.deb\n Size/MD5: 166630 08a7389cb42e41ebba773ecdb9e347fe\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.27-1ubuntu0.2_i386.deb\n Size/MD5: 247664 e39fbb64952529e977b335e308662782\n http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng12-0-udeb_1.2.27-1ubuntu0.2_i386.udeb\n Size/MD5: 71014 9e5c717ed5d4e17d86caabb80221030d\n\n lpia architecture (Low Power Intel Architecture):\n\n http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.27-1ubuntu0.2_lpia.deb\n Size/MD5: 167096 ed195852cc2b60cb0ddc9cccf87ed280\n http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.27-1ubuntu0.2_lpia.deb\n Size/MD5: 248616 dc85b020b9a129916f24618d3e27e684\n http://ports.ubuntu.com/pool/universe/libp/libpng/libpng12-0-udeb_1.2.27-1ubuntu0.2_lpia.udeb\n Size/MD5: 71418 e60289ac791f78aae8eb5598a3eacb5a\n\n powerpc architecture (Apple Macintosh G3/G4/G5):\n\n http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.27-1ubuntu0.2_powerpc.deb\n Size/MD5: 167230 5f8b71b3a98b1645727f1f4ae534f960\n http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.27-1ubuntu0.2_powerpc.deb\n Size/MD5: 254380 76ea57650fd01eb86a315ca0b73dcdca\n http://ports.ubuntu.com/pool/universe/libp/libpng/libpng12-0-udeb_1.2.27-1ubuntu0.2_powerpc.udeb\n Size/MD5: 71582 f9b8803343f2f61bf5f07b1fb4a25918\n\n sparc architecture (Sun SPARC/UltraSPARC):\n\n http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.27-1ubuntu0.2_sparc.deb\n Size/MD5: 162222 445a3d3abb843e73fbf89fe0520ab664\n http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.27-1ubuntu0.2_sparc.deb\n Size/MD5: 248216 768f20b123d1b0c1c448b3b240245d5c\n http://ports.ubuntu.com/pool/universe/libp/libpng/libpng12-0-udeb_1.2.27-1ubuntu0.2_sparc.udeb\n Size/MD5: 66728 cf376eab6461fdee69f0bbde6d58dc53\n\nUpdated packages for Ubuntu 9.04:\n\n Source archives:\n\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.27-2ubuntu2.1.diff.gz\n Size/MD5: 174503 ffa63cd1b57dc442faff9a65d2f25ee7\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.27-2ubuntu2.1.dsc\n Size/MD5: 1296 890ff19ff7b12aa90d0d38c0b1550055\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.27.orig.tar.gz\n Size/MD5: 783204 13a0de401db1972a8e68f47d5bdadd13\n\n Architecture independent packages:\n\n http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng3_1.2.27-2ubuntu2.1_all.deb\n Size/MD5: 936 3dee09961304f1caf76db0995a027b95\n\n amd64 architecture (Athlon64, Opteron, EM64T Xeon):\n\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0-udeb_1.2.27-2ubuntu2.1_amd64.udeb\n Size/MD5: 72778 30622682dc700cba1101384ab84fe7ca\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.27-2ubuntu2.1_amd64.deb\n Size/MD5: 168382 4be6ce864bf04169baf7d4b656ea8e02\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.27-2ubuntu2.1_amd64.deb\n Size/MD5: 255620 730ed6a69006fa14753ef99f89664d31\n\n i386 architecture (x86 compatible Intel/AMD):\n\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0-udeb_1.2.27-2ubuntu2.1_i386.udeb\n Size/MD5: 71084 5a3cc8f7589fae49e91689d85476b193\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.27-2ubuntu2.1_i386.deb\n Size/MD5: 166732 d674a5262197c091d9ca5b2370cff187\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.27-2ubuntu2.1_i386.deb\n Size/MD5: 247744 644a3757529a46d3389e2db18a566f3d\n\n lpia architecture (Low Power Intel Architecture):\n\n http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0-udeb_1.2.27-2ubuntu2.1_lpia.udeb\n Size/MD5: 71472 662aba7284b732240c2d7bff864eed12\n http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.27-2ubuntu2.1_lpia.deb\n Size/MD5: 167200 47dc03f91b37b73626e026cb7da28b15\n http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.27-2ubuntu2.1_lpia.deb\n Size/MD5: 248706 a01e8fe54d38f4101c6ad0f78eec4a7e\n\n powerpc architecture (Apple Macintosh G3/G4/G5):\n\n http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0-udeb_1.2.27-2ubuntu2.1_powerpc.udeb\n Size/MD5: 71564 96e3fb7342ab462db7a27fbd39a46649\n http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.27-2ubuntu2.1_powerpc.deb\n Size/MD5: 167254 90e1cb3da8cc85953442611cf0faaed8\n http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.27-2ubuntu2.1_powerpc.deb\n Size/MD5: 254444 4b89c89e031c0d4265b1eb3da45f06e9\n\n sparc architecture (Sun SPARC/UltraSPARC):\n\n http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0-udeb_1.2.27-2ubuntu2.1_sparc.udeb\n Size/MD5: 66646 ac9aa1a738ef8ed71bd8b876f1920098\n http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.27-2ubuntu2.1_sparc.deb\n Size/MD5: 162176 06a1b4ab47a39790da4e9b1e0967c1d2\n http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.27-2ubuntu2.1_sparc.deb\n Size/MD5: 248222 91cca4c40c4ce6ac41df52ea62e5008a\n\nUpdated packages for Ubuntu 9.10:\n\n Source archives:\n\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.37-1ubuntu0.1.diff.gz\n Size/MD5: 18107 a9bf93cac21b17a3589193ae511b75d2\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.37-1ubuntu0.1.dsc\n Size/MD5: 1293 dc9a20f9a129ad150f61ec9bb745b039\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.37.orig.tar.gz\n Size/MD5: 805380 7480dbbf9f6c3297faf6fe52ec9b91ab\n\n Architecture independent packages:\n\n http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng3_1.2.37-1ubuntu0.1_all.deb\n Size/MD5: 934 3d21bd9bf41fe210303474389cfeb0a8\n\n amd64 architecture (Athlon64, Opteron, EM64T Xeon):\n\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0-udeb_1.2.37-1ubuntu0.1_amd64.udeb\n Size/MD5: 73848 d436fc20150573d565017d9e29141484\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.37-1ubuntu0.1_amd64.deb\n Size/MD5: 174886 34607a76ee1ebdd82b5c71068e6e32b2\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.37-1ubuntu0.1_amd64.deb\n Size/MD5: 265214 f600588bdf4f00731d94ccd8bbc68455\n\n i386 architecture (x86 compatible Intel/AMD):\n\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0-udeb_1.2.37-1ubuntu0.1_i386.udeb\n Size/MD5: 70382 7d93414ce0e28351b972605abae92cd1\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.37-1ubuntu0.1_i386.deb\n Size/MD5: 171402 2b8f6f1c8e8300c3149c59d1fc107659\n http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.37-1ubuntu0.1_i386.deb\n Size/MD5: 255250 a033009f8d9a990655437c3d129668bf\n\n lpia architecture (Low Power Intel Architecture):\n\n http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0-udeb_1.2.37-1ubuntu0.1_lpia.udeb\n Size/MD5: 71012 d3df3a73bf61acb9f1d489a32b3b8a60\n http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.37-1ubuntu0.1_lpia.deb\n Size/MD5: 172126 1b94fcc470ba8878eace85240fae74cf\n http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.37-1ubuntu0.1_lpia.deb\n Size/MD5: 257172 3c3280435a2b7d1817b49cd4a3a14bef\n\n powerpc architecture (Apple Macintosh G3/G4/G5):\n\n http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0-udeb_1.2.37-1ubuntu0.1_powerpc.udeb\n Size/MD5: 72402 e0b80daed7db7e00d2a921ed5708ffe8\n http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.37-1ubuntu0.1_powerpc.deb\n Size/MD5: 173494 31c424c02fe594bb6cf9acd1bef1763f\n http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.37-1ubuntu0.1_powerpc.deb\n Size/MD5: 264450 b0546250e1804b0d385bb8eb714cd2da\n\n sparc architecture (Sun SPARC/UltraSPARC):\n\n http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0-udeb_1.2.37-1ubuntu0.1_sparc.udeb\n Size/MD5: 67312 0df0d665eeb40343b9d5485910101786\n http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.37-1ubuntu0.1_sparc.deb\n Size/MD5: 168372 2a079837d6b9f47c41a02340c5d9e27c\n http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.37-1ubuntu0.1_sparc.deb\n Size/MD5: 257434 05811c8ff658321e91078f280dacfbe7\n\n\n\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n- ------------------------------------------------------------------------\nDebian Security Advisory DSA-2032-1 security@debian.org\nhttp://www.debian.org/security/ Giuseppe Iuculano\nApril 11, 2010 http://www.debian.org/security/faq\n- ------------------------------------------------------------------------\n\nPackage : libpng\nVulnerability : several\nProblem type : local (remote)\nDebian-specific: no\nCVE Id(s) : CVE-2009-2042 CVE-2010-0205\nDebian Bugs : 533676 572308\n\n\nSeveral vulnerabilities have been discovered in libpng, a library for\nreading and writing PNG files. The Common Vulnerabilities and\nExposures project identifies the following problems:\n\nCVE-2009-2042\n\nlibpng does not properly parse 1-bit interlaced images with width values\nthat are not divisible by 8, which causes libpng to include\nuninitialized bits in certain rows of a PNG file and might allow remote\nattackers to read portions of sensitive memory via \"out-of-bounds\npixels\" in the file. \n\nFor the testing (squeeze) and unstable (sid) distribution, these\nproblems have been fixed in version 1.2.43-1\n\nWe recommend that you upgrade your libpng package. \n\nUpgrade instructions\n- --------------------\n\nwget url\n will fetch the file for you\ndpkg -i file.deb\n will install the referenced file. \n\nIf you are using the apt-get package manager, use the line for\nsources.list as given below:\n\napt-get update\n will update the internal database\napt-get upgrade\n will install corrected packages\n\nYou may use an automated update by adding the resources from the\nfooter to the proper configuration. \n\n\nDebian GNU/Linux 5.0 alias lenny\n- --------------------------------\n\nDebian (stable)\n- ---------------\n\nStable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc. \n\nSource archives:\n\n http://security.debian.org/pool/updates/main/libp/libpng/libpng_1.2.27-2+lenny3.dsc\n Size/MD5 checksum: 1201 abe81b0d3c4aa7a1fa418e29f2c5b297\n http://security.debian.org/pool/updates/main/libp/libpng/libpng_1.2.27.orig.tar.gz\n Size/MD5 checksum: 783204 13a0de401db1972a8e68f47d5bdadd13\n http://security.debian.org/pool/updates/main/libp/libpng/libpng_1.2.27-2+lenny3.diff.gz\n Size/MD5 checksum: 19687 60ede1843ceb8a1f127c54b847a74dfa\n\nArchitecture independent packages:\n\n http://security.debian.org/pool/updates/main/libp/libpng/libpng3_1.2.27-2+lenny3_all.deb\n Size/MD5 checksum: 880 028b00e28aad8282714776c5dcca64a8\n\nalpha architecture (DEC Alpha)\n\n http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0-udeb_1.2.27-2+lenny3_alpha.udeb\n Size/MD5 checksum: 86562 d9c50af59951e972557d393409b75bf2\n http://security.debian.org/pool/updates/main/libp/libpng/libpng12-dev_1.2.27-2+lenny3_alpha.deb\n Size/MD5 checksum: 287752 1d7d84aee223c0933d1a616722607096\n http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0_1.2.27-2+lenny3_alpha.deb\n Size/MD5 checksum: 182436 001ecbf421f70ca521a3968f1d14c874\n\namd64 architecture (AMD x86_64 (AMD64))\n\n http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0-udeb_1.2.27-2+lenny3_amd64.udeb\n Size/MD5 checksum: 71912 78fbe1a6568671e4c557ec12e29481b0\n http://security.debian.org/pool/updates/main/libp/libpng/libpng12-dev_1.2.27-2+lenny3_amd64.deb\n Size/MD5 checksum: 254500 481312a64867f31c363b7fbba9cfe171\n http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0_1.2.27-2+lenny3_amd64.deb\n Size/MD5 checksum: 167864 3d285c20d2f080313f82eb09dcb7261b\n\narm architecture (ARM)\n\n http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0-udeb_1.2.27-2+lenny3_arm.udeb\n Size/MD5 checksum: 64566 a4a9742190557d14beae40133fb46cf1\n http://security.debian.org/pool/updates/main/libp/libpng/libpng12-dev_1.2.27-2+lenny3_arm.deb\n Size/MD5 checksum: 245438 a16f62e771622e05812172f7c7066504\n http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0_1.2.27-2+lenny3_arm.deb\n Size/MD5 checksum: 159612 81facf06de458dd6b1e84a78bb1acfc8\n\narmel architecture (ARM EABI)\n\n http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0-udeb_1.2.27-2+lenny3_armel.udeb\n Size/MD5 checksum: 67028 56fc4199656d239231c7b8d8e035fead\n http://security.debian.org/pool/updates/main/libp/libpng/libpng12-dev_1.2.27-2+lenny3_armel.deb\n Size/MD5 checksum: 245930 9f64181bc16af0ad0de4ba2e86b25706\n http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0_1.2.27-2+lenny3_armel.deb\n Size/MD5 checksum: 162504 3129e1c2360fcba0309257e2b1dff8ca\n\nhppa architecture (HP PA RISC)\n\n http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0-udeb_1.2.27-2+lenny3_hppa.udeb\n Size/MD5 checksum: 73858 9d5a53e3258b5149bee68a4d20067bf9\n http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0_1.2.27-2+lenny3_hppa.deb\n Size/MD5 checksum: 169602 12ddce05c84ef675c348a1e64f1a277c\n http://security.debian.org/pool/updates/main/libp/libpng/libpng12-dev_1.2.27-2+lenny3_hppa.deb\n Size/MD5 checksum: 261788 9297cb916e57e2f912de3f16bcbae475\n\ni386 architecture (Intel ia32)\n\n http://security.debian.org/pool/updates/main/libp/libpng/libpng12-dev_1.2.27-2+lenny3_i386.deb\n Size/MD5 checksum: 246968 083d472fd65f884c91dff5926e538342\n http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0_1.2.27-2+lenny3_i386.deb\n Size/MD5 checksum: 165560 233945ee4b1e442357276431ce495a4c\n http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0-udeb_1.2.27-2+lenny3_i386.udeb\n Size/MD5 checksum: 70094 769336f4574678e56931e1a1eaf6be6a\n\nia64 architecture (Intel ia64)\n\n http://security.debian.org/pool/updates/main/libp/libpng/libpng12-dev_1.2.27-2+lenny3_ia64.deb\n Size/MD5 checksum: 305324 42d7265034b84662467bb75456653787\n http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0-udeb_1.2.27-2+lenny3_ia64.udeb\n Size/MD5 checksum: 111776 ad716022a6a22371bb83f3966ebe17d4\n http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0_1.2.27-2+lenny3_ia64.deb\n Size/MD5 checksum: 206866 572b9d18c5adba74a4e5b99714968a60\n\nmipsel architecture (MIPS (Little Endian))\n\n http://security.debian.org/pool/updates/main/libp/libpng/libpng12-dev_1.2.27-2+lenny3_mipsel.deb\n Size/MD5 checksum: 262242 e905771ac3fa905cc03a3ddc8f9872dd\n http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0-udeb_1.2.27-2+lenny3_mipsel.udeb\n Size/MD5 checksum: 68370 4d44877866357a0fd8474fd8fe183616\n http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0_1.2.27-2+lenny3_mipsel.deb\n Size/MD5 checksum: 164154 93c02dbae7dfe59b77ce4b683b82eaef\n\npowerpc architecture (PowerPC)\n\n http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0_1.2.27-2+lenny3_powerpc.deb\n Size/MD5 checksum: 166402 1d470464fe2b493aef8d95dde5fd95d8\n http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0-udeb_1.2.27-2+lenny3_powerpc.udeb\n Size/MD5 checksum: 70682 1dd9713672dbac4a7434f1f96a1184b5\n http://security.debian.org/pool/updates/main/libp/libpng/libpng12-dev_1.2.27-2+lenny3_powerpc.deb\n Size/MD5 checksum: 253478 7a87577e07ed0bb9e759b973b2d7cf18\n\ns390 architecture (IBM S/390)\n\n http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0-udeb_1.2.27-2+lenny3_s390.udeb\n Size/MD5 checksum: 73470 52b1a911a81f133a83a387663aa3ffb2\n http://security.debian.org/pool/updates/main/libp/libpng/libpng12-dev_1.2.27-2+lenny3_s390.deb\n Size/MD5 checksum: 252988 18b4c8b17b3e30ab6cce89c21c99fbfc\n http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0_1.2.27-2+lenny3_s390.deb\n Size/MD5 checksum: 169264 601982b9a97707ab05e1f4469cd8e20e\n\nsparc architecture (Sun SPARC/UltraSPARC)\n\n http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0_1.2.27-2+lenny3_sparc.deb\n Size/MD5 checksum: 161562 facd643206903acfa3a503c1d69e9248\n http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0-udeb_1.2.27-2+lenny3_sparc.udeb\n Size/MD5 checksum: 66032 cbbe521a9a5629987603a57b8c9f35be\n http://security.debian.org/pool/updates/main/libp/libpng/libpng12-dev_1.2.27-2+lenny3_sparc.deb\n Size/MD5 checksum: 247212 76b8fe782fd0e5f7546bd535f8d442bc\n\n\n These files will probably be moved into the stable distribution on\n its next update. \nCharter: http://lists.grok.org.uk/full-disclosure-charter.html\nHosted and sponsored by Secunia - http://secunia.com/\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2010-0205"
},
{
"db": "CERT/CC",
"id": "VU#576029"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001158"
},
{
"db": "BID",
"id": "38478"
},
{
"db": "VULHUB",
"id": "VHN-42810"
},
{
"db": "VULMON",
"id": "CVE-2010-0205"
},
{
"db": "PACKETSTORM",
"id": "94522"
},
{
"db": "PACKETSTORM",
"id": "94244"
},
{
"db": "PACKETSTORM",
"id": "87569"
},
{
"db": "PACKETSTORM",
"id": "87557"
},
{
"db": "PACKETSTORM",
"id": "87345"
},
{
"db": "PACKETSTORM",
"id": "88286"
}
],
"trust": 3.33
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-42810",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-42810"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#576029",
"trust": 3.7
},
{
"db": "NVD",
"id": "CVE-2010-0205",
"trust": 3.5
},
{
"db": "BID",
"id": "38478",
"trust": 2.9
},
{
"db": "SECUNIA",
"id": "38774",
"trust": 2.6
},
{
"db": "VUPEN",
"id": "ADV-2010-0517",
"trust": 2.5
},
{
"db": "SECUNIA",
"id": "39251",
"trust": 1.8
},
{
"db": "SECUNIA",
"id": "41574",
"trust": 1.8
},
{
"db": "OSVDB",
"id": "62670",
"trust": 1.8
},
{
"db": "SECTRACK",
"id": "1023674",
"trust": 1.7
},
{
"db": "VUPEN",
"id": "ADV-2010-0667",
"trust": 1.7
},
{
"db": "VUPEN",
"id": "ADV-2010-2491",
"trust": 1.7
},
{
"db": "VUPEN",
"id": "ADV-2010-0626",
"trust": 1.7
},
{
"db": "VUPEN",
"id": "ADV-2010-0686",
"trust": 1.7
},
{
"db": "VUPEN",
"id": "ADV-2010-1107",
"trust": 1.7
},
{
"db": "VUPEN",
"id": "ADV-2010-0682",
"trust": 1.7
},
{
"db": "VUPEN",
"id": "ADV-2010-0605",
"trust": 1.7
},
{
"db": "VUPEN",
"id": "ADV-2010-0637",
"trust": 1.7
},
{
"db": "VUPEN",
"id": "ADV-2010-0847",
"trust": 1.7
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001158",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201003-024",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "94522",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "87569",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-42810",
"trust": 0.1
},
{
"db": "VUPEN",
"id": "2010/0847",
"trust": 0.1
},
{
"db": "VUPEN",
"id": "2010/1107",
"trust": 0.1
},
{
"db": "VUPEN",
"id": "2010/0667",
"trust": 0.1
},
{
"db": "VUPEN",
"id": "2010/0605",
"trust": 0.1
},
{
"db": "VUPEN",
"id": "2010/2491",
"trust": 0.1
},
{
"db": "VUPEN",
"id": "2010/0626",
"trust": 0.1
},
{
"db": "VUPEN",
"id": "2010/0517",
"trust": 0.1
},
{
"db": "VUPEN",
"id": "2010/0686",
"trust": 0.1
},
{
"db": "VUPEN",
"id": "2010/0682",
"trust": 0.1
},
{
"db": "VUPEN",
"id": "2010/0637",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2010-0205",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "94244",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "87557",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "87345",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "88286",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#576029"
},
{
"db": "VULHUB",
"id": "VHN-42810"
},
{
"db": "VULMON",
"id": "CVE-2010-0205"
},
{
"db": "BID",
"id": "38478"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001158"
},
{
"db": "PACKETSTORM",
"id": "94522"
},
{
"db": "PACKETSTORM",
"id": "94244"
},
{
"db": "PACKETSTORM",
"id": "87569"
},
{
"db": "PACKETSTORM",
"id": "87557"
},
{
"db": "PACKETSTORM",
"id": "87345"
},
{
"db": "PACKETSTORM",
"id": "88286"
},
{
"db": "CNNVD",
"id": "CNNVD-201003-024"
},
{
"db": "NVD",
"id": "CVE-2010-0205"
}
]
},
"id": "VAR-201003-1082",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-42810"
}
],
"trust": 0.01
},
"last_update_date": "2024-07-23T21:04:41.162000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "HT4435",
"trust": 0.8,
"url": "http://support.apple.com/kb/ht4435"
},
{
"title": "HT4435",
"trust": 0.8,
"url": "http://support.apple.com/kb/ht4435?viewlocale=ja_jp"
},
{
"title": "libpng-1.2.10-7.1.3.0.1.AXS3",
"trust": 0.8,
"url": "https://tsn.miraclelinux.com/tsn_local/index.php?m=errata\u0026a=detail\u0026eid=1210"
},
{
"title": "Security Advisory for libpng-1.4.0 and earlier, 27 February 2010",
"trust": 0.8,
"url": "http://libpng.sourceforge.net/advisory-1.4.1.html"
},
{
"title": "Defending Libpng Applications Against Decompression Bombs",
"trust": 0.8,
"url": "http://libpng.sourceforge.net/decompression_bombs.html"
},
{
"title": "\u3010JVN \u306b\u63b2\u8f09\u3055\u308c\u305f\u8106\u5f31\u6027\u306b\u3064\u3044\u3066\u3011",
"trust": 0.8,
"url": "http://ja.bbs.luna.tv/viewtopic.php?f=68\u0026t=3721"
},
{
"title": "2078",
"trust": 0.8,
"url": "http://www.miraclelinux.com/support/index.php?q=node/99\u0026errata_id=2078"
},
{
"title": "2079",
"trust": 0.8,
"url": "http://www.miraclelinux.com/support/index.php?q=node/99\u0026errata_id=2079"
},
{
"title": "RHSA-2010:0534",
"trust": 0.8,
"url": "https://rhn.redhat.com/errata/rhsa-2010-0534.html"
},
{
"title": "multiple_vulnerabilities_in_libpng",
"trust": 0.8,
"url": "http://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_libpng"
},
{
"title": "VMSA-2010-0014",
"trust": 0.8,
"url": "http://www.vmware.com/security/advisories/vmsa-2010-0014.html"
},
{
"title": "pictbear",
"trust": 0.8,
"url": "http://www.fenrir.co.jp/pictbear/"
},
{
"title": "libpng-1.4.1.tar.bz2",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=214"
},
{
"title": "lpng141.zip",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=218"
},
{
"title": "lpng141.7z",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=217"
},
{
"title": "libpng-1.4.1.tar.xz",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=216"
},
{
"title": "libpng-1.4.1.tar.gz",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=215"
},
{
"title": "linpng_txt.zip",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=219"
},
{
"title": "Debian CVElist Bug Report Logs: CVE-2010-0205 VU#576029 libpng stalls on highly compressed ancillary chunks",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=068ed551f848e5205f1c655154c5d17e"
},
{
"title": "Debian CVElist Bug Report Logs: libpng: CVE-2009-2042 \"out-of-bounds pixels\" vulnerability",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=5f5cf6ccf38dd0426354a95830317f34"
},
{
"title": "Debian Security Advisories: DSA-2032-1 libpng -- several vulnerabilities",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories\u0026qid=7efe228231e53c876f6e76ff8b041bb6"
},
{
"title": "Ubuntu Security Notice: libpng vulnerabilities",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=usn-913-1"
},
{
"title": "VMware Security Advisories: VMware Workstation, Player, and ACE address several security issues.",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=vmware_security_advisories\u0026qid=b3571bd7da36d47dd9d3066ad9612f4c"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2010-0205"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001158"
},
{
"db": "CNNVD",
"id": "CNNVD-201003-024"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-400",
"trust": 1.1
},
{
"problemtype": "CWE-399",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-42810"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001158"
},
{
"db": "NVD",
"id": "CVE-2010-0205"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.0,
"url": "http://www.kb.cert.org/vuls/id/576029"
},
{
"trust": 2.9,
"url": "http://libpng.sourceforge.net/advisory-1.4.1.html"
},
{
"trust": 2.6,
"url": "http://libpng.sourceforge.net/decompression_bombs.html"
},
{
"trust": 2.6,
"url": "http://www.securityfocus.com/bid/38478"
},
{
"trust": 2.6,
"url": "http://secunia.com/advisories/38774"
},
{
"trust": 2.6,
"url": "http://www.vupen.com/english/advisories/2010/0517"
},
{
"trust": 1.8,
"url": "http://lists.apple.com/archives/security-announce/2010//nov/msg00000.html"
},
{
"trust": 1.8,
"url": "http://support.apple.com/kb/ht4435"
},
{
"trust": 1.8,
"url": "http://www.vmware.com/security/advisories/vmsa-2010-0014.html"
},
{
"trust": 1.8,
"url": "http://www.debian.org/security/2010/dsa-2032"
},
{
"trust": 1.8,
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-march/037237.html"
},
{
"trust": 1.8,
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-march/037355.html"
},
{
"trust": 1.8,
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-march/037364.html"
},
{
"trust": 1.8,
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-march/037607.html"
},
{
"trust": 1.8,
"url": "http://www.mandriva.com/security/advisories?name=mdvsa-2010:063"
},
{
"trust": 1.8,
"url": "http://www.mandriva.com/security/advisories?name=mdvsa-2010:064"
},
{
"trust": 1.8,
"url": "http://lists.vmware.com/pipermail/security-announce/2010/000105.html"
},
{
"trust": 1.8,
"url": "http://osvdb.org/62670"
},
{
"trust": 1.8,
"url": "http://www.securitytracker.com/id?1023674"
},
{
"trust": 1.8,
"url": "http://secunia.com/advisories/39251"
},
{
"trust": 1.8,
"url": "http://secunia.com/advisories/41574"
},
{
"trust": 1.8,
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html"
},
{
"trust": 1.8,
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html"
},
{
"trust": 1.8,
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html"
},
{
"trust": 1.8,
"url": "http://ubuntu.com/usn/usn-913-1"
},
{
"trust": 1.8,
"url": "http://www.vupen.com/english/advisories/2010/0605"
},
{
"trust": 1.8,
"url": "http://www.vupen.com/english/advisories/2010/0626"
},
{
"trust": 1.8,
"url": "http://www.vupen.com/english/advisories/2010/0637"
},
{
"trust": 1.8,
"url": "http://www.vupen.com/english/advisories/2010/0667"
},
{
"trust": 1.8,
"url": "http://www.vupen.com/english/advisories/2010/0682"
},
{
"trust": 1.8,
"url": "http://www.vupen.com/english/advisories/2010/0686"
},
{
"trust": 1.8,
"url": "http://www.vupen.com/english/advisories/2010/0847"
},
{
"trust": 1.8,
"url": "http://www.vupen.com/english/advisories/2010/1107"
},
{
"trust": 1.8,
"url": "http://www.vupen.com/english/advisories/2010/2491"
},
{
"trust": 1.8,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56661"
},
{
"trust": 1.2,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0205"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnvu331391"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnvu576029/"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-0205"
},
{
"trust": 0.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-0205"
},
{
"trust": 0.3,
"url": "http://www.libpng.org/pub/png/libpng.html"
},
{
"trust": 0.3,
"url": "http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_libpng"
},
{
"trust": 0.3,
"url": "http://support.avaya.com/css/p8/documents/100108439"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-2042"
},
{
"trust": 0.2,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2249"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-1205"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-2249"
},
{
"trust": 0.2,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-1205"
},
{
"trust": 0.2,
"url": "http://www.mandriva.com/security/"
},
{
"trust": 0.2,
"url": "http://www.mandriva.com/security/advisories"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/400.html"
},
{
"trust": 0.1,
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=572308"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://usn.ubuntu.com/913-1/"
},
{
"trust": 0.1,
"url": "http://creativecommons.org/licenses/by-sa/2.5"
},
{
"trust": 0.1,
"url": "https://bugs.gentoo.org."
},
{
"trust": 0.1,
"url": "http://security.gentoo.org/"
},
{
"trust": 0.1,
"url": "http://security.gentoo.org/glsa/glsa-201010-01.xml"
},
{
"trust": 0.1,
"url": "http://www.vmware.com/security/advisoiries"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-0434"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-0425"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-3277"
},
{
"trust": 0.1,
"url": "http://www.vmware.com/download/player/"
},
{
"trust": 0.1,
"url": "http://www.vmware.com/security"
},
{
"trust": 0.1,
"url": "http://downloads.vmware.com/d/info/desktop_downloads/vmware_ace/2_7"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3277"
},
{
"trust": 0.1,
"url": "http://kb.vmware.com/kb/1055"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0434"
},
{
"trust": 0.1,
"url": "http://www.vmware.com/download/ws/"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0425"
},
{
"trust": 0.1,
"url": "http://downloads.vmware.com/support/ws71/doc/releasenotes_ws712.html"
},
{
"trust": 0.1,
"url": "http://www.vmware.com/support/policies/security_response.html"
},
{
"trust": 0.1,
"url": "http://downloads.vmware.com/support/player31/doc/releasenotes_player312.html"
},
{
"trust": 0.1,
"url": "http://www.vmware.com/support/policies/eos.html"
},
{
"trust": 0.1,
"url": "http://downloads.vmware.com/support/ace27/doc/releasenotes_ace272.html"
},
{
"trust": 0.1,
"url": "http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce"
},
{
"trust": 0.1,
"url": "http://www.vmware.com/support/policies/eos_vi.html"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-2042"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0-udeb_1.2.27-2ubuntu2.1_sparc.udeb"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0-udeb_1.2.27-2ubuntu2.1_lpia.udeb"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.27-1ubuntu0.2_powerpc.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.15~beta5-3ubuntu0.2_amd64.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.15~beta5-3ubuntu0.2.diff.gz"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.27-1ubuntu0.2_lpia.deb"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/universe/libp/libpng/libpng12-0-udeb_1.2.27-1ubuntu0.2_powerpc.udeb"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.27-2ubuntu2.1_powerpc.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.15~beta5-3ubuntu0.2_i386.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng12-0-udeb_1.2.8rel-5ubuntu0.5_powerpc.udeb"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.15~beta5-3ubuntu0.2_lpia.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.27-2ubuntu2.1.dsc"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.37-1ubuntu0.1.dsc"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.27.orig.tar.gz"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.27-2ubuntu2.1_amd64.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.15~beta5-3ubuntu0.2_i386.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.8rel-5ubuntu0.5.dsc"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng12-0-udeb_1.2.27-1ubuntu0.2_amd64.udeb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.37-1ubuntu0.1_i386.deb"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.27-2ubuntu2.1_sparc.deb"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0-udeb_1.2.37-1ubuntu0.1_powerpc.udeb"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/universe/libp/libpng/libpng12-0-udeb_1.2.15~beta5-3ubuntu0.2_powerpc.udeb"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.27-2ubuntu2.1_powerpc.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng12-0-udeb_1.2.8rel-5ubuntu0.5_i386.udeb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng12-0-udeb_1.2.27-1ubuntu0.2_i386.udeb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.27-2ubuntu2.1_i386.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.37.orig.tar.gz"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.8rel-5ubuntu0.5_sparc.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.15~beta5-3ubuntu0.2_amd64.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng12-0-udeb_1.2.15~beta5-3ubuntu0.2_amd64.udeb"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.15~beta5-3ubuntu0.2_powerpc.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.37-1ubuntu0.1_amd64.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng3_1.2.27-2ubuntu2.1_all.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0-udeb_1.2.27-2ubuntu2.1_amd64.udeb"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.37-1ubuntu0.1_powerpc.deb"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.27-1ubuntu0.2_powerpc.deb"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0-udeb_1.2.37-1ubuntu0.1_sparc.udeb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.8rel-5ubuntu0.5_i386.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.27-1ubuntu0.2.dsc"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.15~beta5-3ubuntu0.2_sparc.deb"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.15~beta5-3ubuntu0.2_sparc.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.8rel-5ubuntu0.5_amd64.deb"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.37-1ubuntu0.1_lpia.deb"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/universe/libp/libpng/libpng12-0-udeb_1.2.15~beta5-3ubuntu0.2_lpia.udeb"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0-udeb_1.2.27-2ubuntu2.1_powerpc.udeb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.27-2ubuntu2.1_amd64.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng3_1.2.8rel-5ubuntu0.5_all.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.37-1ubuntu0.1_amd64.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.15~beta5.orig.tar.gz"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.8rel-5ubuntu0.5_i386.deb"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/universe/libp/libpng/libpng12-0-udeb_1.2.27-1ubuntu0.2_lpia.udeb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.15~beta5-3ubuntu0.2.dsc"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng12-0-udeb_1.2.8rel-5ubuntu0.5_amd64.udeb"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.37-1ubuntu0.1_powerpc.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.8rel-5ubuntu0.5_sparc.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.8rel-5ubuntu0.5_powerpc.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.27-2ubuntu2.1.diff.gz"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.27-1ubuntu0.2_sparc.deb"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.27-2ubuntu2.1_lpia.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.37-1ubuntu0.1_i386.deb"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/universe/libp/libpng/libpng12-0-udeb_1.2.27-1ubuntu0.2_sparc.udeb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.8rel-5ubuntu0.5_powerpc.deb"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.15~beta5-3ubuntu0.2_lpia.deb"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.37-1ubuntu0.1_sparc.deb"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.27-2ubuntu2.1_lpia.deb"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.37-1ubuntu0.1_lpia.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.27-1ubuntu0.2_i386.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.37-1ubuntu0.1.diff.gz"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0-udeb_1.2.37-1ubuntu0.1_lpia.udeb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng3_1.2.27-1ubuntu0.2_all.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.27-1ubuntu0.2_i386.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng3_1.2.15~beta5-3ubuntu0.2_all.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0-udeb_1.2.37-1ubuntu0.1_i386.udeb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.8rel-5ubuntu0.5.diff.gz"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.8rel.orig.tar.gz"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.27-2ubuntu2.1_sparc.deb"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.27-1ubuntu0.2_sparc.deb"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/universe/libp/libpng/libpng12-0-udeb_1.2.15~beta5-3ubuntu0.2_sparc.udeb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng3_1.2.37-1ubuntu0.1_all.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.27-1ubuntu0.2.diff.gz"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng12-0-udeb_1.2.15~beta5-3ubuntu0.2_i386.udeb"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.27-1ubuntu0.2_lpia.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng12-0-udeb_1.2.8rel-5ubuntu0.5_sparc.udeb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.27-1ubuntu0.2_amd64.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.8rel-5ubuntu0.5_amd64.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.27-2ubuntu2.1_i386.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0-udeb_1.2.37-1ubuntu0.1_amd64.udeb"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.37-1ubuntu0.1_sparc.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.27-1ubuntu0.2_amd64.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0-udeb_1.2.27-2ubuntu2.1_i386.udeb"
},
{
"trust": 0.1,
"url": "http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.15~beta5-3ubuntu0.2_powerpc.deb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng_1.2.27-2+lenny3.diff.gz"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0-udeb_1.2.27-2+lenny3_amd64.udeb"
},
{
"trust": 0.1,
"url": "http://secunia.com/"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng12-dev_1.2.27-2+lenny3_amd64.deb"
},
{
"trust": 0.1,
"url": "http://www.debian.org/security/faq"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng12-dev_1.2.27-2+lenny3_ia64.deb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0-udeb_1.2.27-2+lenny3_mipsel.udeb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng3_1.2.27-2+lenny3_all.deb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0-udeb_1.2.27-2+lenny3_i386.udeb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0_1.2.27-2+lenny3_mipsel.deb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng12-dev_1.2.27-2+lenny3_powerpc.deb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng12-dev_1.2.27-2+lenny3_hppa.deb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng12-dev_1.2.27-2+lenny3_mipsel.deb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0-udeb_1.2.27-2+lenny3_ia64.udeb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0-udeb_1.2.27-2+lenny3_sparc.udeb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng12-dev_1.2.27-2+lenny3_sparc.deb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0_1.2.27-2+lenny3_powerpc.deb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0_1.2.27-2+lenny3_armel.deb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0_1.2.27-2+lenny3_amd64.deb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng12-dev_1.2.27-2+lenny3_alpha.deb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0-udeb_1.2.27-2+lenny3_hppa.udeb"
},
{
"trust": 0.1,
"url": "http://lists.grok.org.uk/full-disclosure-charter.html"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0_1.2.27-2+lenny3_i386.deb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng12-dev_1.2.27-2+lenny3_s390.deb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0_1.2.27-2+lenny3_arm.deb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng12-dev_1.2.27-2+lenny3_i386.deb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0_1.2.27-2+lenny3_sparc.deb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0-udeb_1.2.27-2+lenny3_alpha.udeb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0-udeb_1.2.27-2+lenny3_s390.udeb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng_1.2.27-2+lenny3.dsc"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0-udeb_1.2.27-2+lenny3_powerpc.udeb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng_1.2.27.orig.tar.gz"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0_1.2.27-2+lenny3_ia64.deb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0_1.2.27-2+lenny3_alpha.deb"
},
{
"trust": 0.1,
"url": "http://packages.debian.org/\u003cpkg\u003e"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0-udeb_1.2.27-2+lenny3_arm.udeb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng12-dev_1.2.27-2+lenny3_armel.deb"
},
{
"trust": 0.1,
"url": "http://www.debian.org/security/"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng12-dev_1.2.27-2+lenny3_arm.deb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0-udeb_1.2.27-2+lenny3_armel.udeb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0_1.2.27-2+lenny3_s390.deb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/libp/libpng/libpng12-0_1.2.27-2+lenny3_hppa.deb"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#576029"
},
{
"db": "VULHUB",
"id": "VHN-42810"
},
{
"db": "VULMON",
"id": "CVE-2010-0205"
},
{
"db": "BID",
"id": "38478"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001158"
},
{
"db": "PACKETSTORM",
"id": "94522"
},
{
"db": "PACKETSTORM",
"id": "94244"
},
{
"db": "PACKETSTORM",
"id": "87569"
},
{
"db": "PACKETSTORM",
"id": "87557"
},
{
"db": "PACKETSTORM",
"id": "87345"
},
{
"db": "PACKETSTORM",
"id": "88286"
},
{
"db": "CNNVD",
"id": "CNNVD-201003-024"
},
{
"db": "NVD",
"id": "CVE-2010-0205"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#576029"
},
{
"db": "VULHUB",
"id": "VHN-42810"
},
{
"db": "VULMON",
"id": "CVE-2010-0205"
},
{
"db": "BID",
"id": "38478"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001158"
},
{
"db": "PACKETSTORM",
"id": "94522"
},
{
"db": "PACKETSTORM",
"id": "94244"
},
{
"db": "PACKETSTORM",
"id": "87569"
},
{
"db": "PACKETSTORM",
"id": "87557"
},
{
"db": "PACKETSTORM",
"id": "87345"
},
{
"db": "PACKETSTORM",
"id": "88286"
},
{
"db": "CNNVD",
"id": "CNNVD-201003-024"
},
{
"db": "NVD",
"id": "CVE-2010-0205"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-03-02T00:00:00",
"db": "CERT/CC",
"id": "VU#576029"
},
{
"date": "2010-03-03T00:00:00",
"db": "VULHUB",
"id": "VHN-42810"
},
{
"date": "2010-03-03T00:00:00",
"db": "VULMON",
"id": "CVE-2010-0205"
},
{
"date": "2010-03-02T00:00:00",
"db": "BID",
"id": "38478"
},
{
"date": "2010-03-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001158"
},
{
"date": "2010-10-05T22:16:57",
"db": "PACKETSTORM",
"id": "94522"
},
{
"date": "2010-09-25T18:50:30",
"db": "PACKETSTORM",
"id": "94244"
},
{
"date": "2010-03-23T23:16:59",
"db": "PACKETSTORM",
"id": "87569"
},
{
"date": "2010-03-23T22:20:24",
"db": "PACKETSTORM",
"id": "87557"
},
{
"date": "2010-03-17T00:04:21",
"db": "PACKETSTORM",
"id": "87345"
},
{
"date": "2010-04-13T00:25:27",
"db": "PACKETSTORM",
"id": "88286"
},
{
"date": "2010-03-03T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201003-024"
},
{
"date": "2010-03-03T19:30:00.493000",
"db": "NVD",
"id": "CVE-2010-0205"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-03-02T00:00:00",
"db": "CERT/CC",
"id": "VU#576029"
},
{
"date": "2020-08-07T00:00:00",
"db": "VULHUB",
"id": "VHN-42810"
},
{
"date": "2020-08-07T00:00:00",
"db": "VULMON",
"id": "CVE-2010-0205"
},
{
"date": "2015-04-13T20:16:00",
"db": "BID",
"id": "38478"
},
{
"date": "2012-03-27T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001158"
},
{
"date": "2020-08-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201003-024"
},
{
"date": "2020-08-07T13:26:06.807000",
"db": "NVD",
"id": "CVE-2010-0205"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "87569"
},
{
"db": "CNNVD",
"id": "CNNVD-201003-024"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "libpng stalls on highly compressed ancillary chunks",
"sources": [
{
"db": "CERT/CC",
"id": "VU#576029"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "resource management error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201003-024"
}
],
"trust": 0.6
}
}
VAR-200009-0023
Vulnerability from variot - Updated: 2024-07-23 20:18VMware Tools in VMware Workstation 6.5.x before 6.5.4 build 246459; VMware Player 2.5.x before 2.5.4 build 246459; VMware ACE 2.5.x before 2.5.4 build 246459; VMware Server 2.x before 2.0.2 build 203138; VMware Fusion 2.x before 2.0.6 build 246742; VMware ESXi 3.5 and 4.0; and VMware ESX 2.5.5, 3.0.3, 3.5, and 4.0 does not properly access libraries, which allows user-assisted remote attackers to execute arbitrary code by tricking a Windows guest OS user into clicking on a file that is stored on a network share. Some applications for Microsoft Windows may use unsafe methods for determining how to load DLLs. As a result, these applications can be forced to load a DLL from an attacker-controlled source rather than a trusted location. Windows Program DLL There is an attackable vulnerability in reading. Dynamic link Library (DLL) Is a software component that is loaded at run time, not at program compile time. The program is LoadLibrary() And LoadLibraryEx() Using DLL Is read. Read DLL If no path is specified, specific directories are searched in order and found first. DLL Is loaded. Since this directory group includes the current directory of the process, the directory that can be operated by the attacker is set as the current directory. LoadLibrary() If is called, attack code may be executed. This issue can occur when browsing files located in directories that an attacker can manipulate. Read DLL The name depends on the program. DLL Read Windows The entire program may be affected. " Opera Software "and" Adobe Vulnerability information on " : Mitsui Bussan Secure Direction Co., Ltd. Takashi Yoshikawa MrA remote attacker could execute arbitrary code with the authority to execute the program. Attacker crafted DLL The USB Placing it on a drive or network drive may cause an attack. VMWare is a virtual PC software that allows two or more Windows, DOS, and LINUX systems to run simultaneously on a single machine. The VMWare Tools package used in VMWare products does not properly access the function library. An attacker can exploit this issue by enticing a user to open a malicious file from a network share. The issue can be exploited on Windows guest operating systems Successful exploits will allow attackers to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. This issue affects the following products: Workstation Player ACE Server Fusion ESX ESXi NOTE: This issue was previously covered in BID 39345 (VMware Hosted Products VMSA-2010-0007 Multiple Remote and Local Vulnerabilities), but has been given its own record to better document it. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
VMware Security Advisory
Advisory ID: VMSA-2010-0007 Synopsis: VMware hosted products, vCenter Server and ESX patches resolve multiple security issues Issue date: 2010-04-09 Updated on: 2010-04-09 (initial release of advisory) CVE numbers: CVE-2010-1142 CVE-2010-1140 CVE-2009-2042 CVE-2009-1564 CVE-2009-1565 CVE-2009-3732 CVE-2009-3707 CVE-2010-1138 CVE-2010-1139 CVE-2010-1141
Notes: Effective May 2010, VMware's patch and update release program during Extended Support will be continued with the condition that all subsequent patch and update releases will be based on the latest baseline release version as of May 2010 (i.e. ESX 3.0.3 Update 1, ESX 3.5 Update 5, and VirtualCenter 2.5 Update 6). Refer to section "End of Product Availability FAQs" at http://www.vmware.com/support/policies/lifecycle/vi/faq.html for details.
Extended support for ESX 2.5.5 ends on 2010-06-15. Users should plan to upgrade to at least ESX 3.0.3 and preferably to the newest release available.
Extended support for ESX 3.0.3 ends on 2011-12-10. Users should plan to upgrade to at least ESX 3.5 and preferably to the newest release available.
End of General Support for VMware Workstation 6.x is 2011-04-27, users should plan to upgrade to the newest release available.
End of General Support for VMware Server 2.0 is 2011-06-30, users should plan to upgrade to the newest release of either ESXi or VMware Player.
Extended support for Virtual Center 2.0.2 is 2011-12-10, users should plan to upgrade to the newest release of vCenter Server.
- Problem Description
a. This file could be in any file format.
VMware would like to thank Jure Skofic and Mitja Kolsek of ACROS
Security (http://www.acrossecurity.com) for reporting this issue
to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-1141 to this issue.
Steps needed to remediate this vulnerability:
Guest systems on VMware Workstation, Player, ACE, Server, Fusion
- Install the remediated version of Workstation, Player, ACE,
Server and Fusion.
- Upgrade tools in the virtual machine (virtual machine users
will be prompted to upgrade).
Guest systems on ESX 4.0, 3.5, 3.0.3, 2.5.5, ESXi 4.0, 3.5
- Install the relevant patches (see below for patch identifiers)
- Manually upgrade tools in the virtual machine (virtual machine
users will not be prompted to upgrade). Note the VI Client will
not show the VMware tools is out of date in the summary tab.
Please see http://tinyurl.com/27mpjo page 80 for details.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available. See above for remediation
details. On most
recent versions of Windows (XP, Vista) the attacker would need to
have administrator privileges to plant the malicious executable in
the right location.
Steps needed to remediate this vulnerability: See section 3.a.
VMware would like to thank Mitja Kolsek of ACROS Security
(http://www.acrossecurity.com) for reporting this issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-1142 to this issue.
Refer to the previous table in section 3.a for what action
remediates the vulnerability (column 4) if a solution is
available. See above for remediation details.
c. Windows-based VMware Workstation and Player host privilege escalation
A vulnerability in the USB service allows for a privilege
escalation. A local attacker on the host of a Windows-based
Operating System where VMware Workstation or VMware Player
is installed could plant a malicious executable on the host and
elevate their privileges.
In order for an attacker to exploit the vulnerability, the attacker
would need to be able to plant their malicious executable in a
certain location on the host machine. On most recent versions of
Windows (XP, Vista) the attacker would need to have administrator
privileges to plant the malicious executable in the right location.
VMware would like to thank Thierry Zoller for reporting this issue
to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-1140 to this issue.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
Workstation 7.0 Windows 7.0.1 build 227600 or later
Workstation 7.0 Linux not affected
Workstation 6.5.x any not affected
Player 3.0 Windows 3.0.1 build 227600 or later
Player 3.0 Linux not affected
Player 2.5.x any not affected
Ace any any not affected
Server 2.x any not affected
Fusion any Mac OS/X not affected
ESXi any ESXi not affected
ESX any ESX not affected
d. Third party library update for libpng to version 1.2.37
The libpng libraries through 1.2.35 contain an uninitialized-
memory-read bug that may have security implications.
Specifically, 1-bit (2-color) interlaced images whose widths are
not divisible by 8 may result in several uninitialized bits at the
end of certain rows in certain interlace passes being returned to
the user. An application that failed to mask these out-of-bounds
pixels might display or process them, albeit presumably with benign
results in most cases.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2009-2042 to this issue.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available. VMware VMnc Codec heap overflow vulnerabilities
The VMware movie decoder contains the VMnc media codec that is
required to play back movies recorded with VMware Workstation,
VMware Player and VMware ACE, in any compatible media player. The
movie decoder is installed as part of VMware Workstation, VMware
Player and VMware ACE, or can be downloaded as a stand alone
package.
For an attack to be successful the user must be tricked into
visiting a malicious web page or opening a malicious video file on
a system that has the vulnerable version of the VMnc codec installed.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the names CVE-2009-1564 and CVE-2009-1565 to these
issues.
VMware would like to thank iDefense, Sebastien Renaud of VUPEN
Vulnerability Research Team (http://www.vupen.com) and Alin Rad Pop
of Secunia Research for reporting these issues to us.
To remediate the above issues either install the stand alone movie
decoder or update your product using the table below.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
Movie Decoder any Windows 6.5.4 Build 246459 or later
Workstation 7.x any not affected
Workstation 6.5.x Windows 6.5.4 build 246459 or later
Workstation 6.5.x Linux not affected
Player 3.x any not affected
Player 2.5.x Windows 2.5.4 build 246459 or later
Player 2.5.x Linux not affected
ACE any any not affected
Server 2.x Window not being addressed at this time
Server 2.x Linux not affected
Fusion any Mac OS/X not affected
ESXi any ESXi not affected
ESX any ESX not affected
f. Exploitation of this issue may lead to arbitrary code execution on the system where VMrc is installed. Code execution would be at the privilege level of the user.
VMrc is present on a system if the VMrc browser plug-in has been
installed. This plug-in is required when using the console feature in
WebAccess. Installation of the plug-in follows after visiting the
console tab in WebAccess and choosing "Install plug-in". The plug-
in can only be installed on Internet Explorer and Firefox.
Under the following two conditions your version of VMrc is likely
to be affected:
- the VMrc plug-in was obtained from vCenter 4.0 or from ESX 4.0
without patch ESX400-200911223-UG and
- VMrc is installed on a Windows-based system
The following steps allow you to determine if you have an affected
version of VMrc installed:
- Locate the VMrc executable vmware-vmrc.exe on your Windows-based
system
- Right click and go to Properties
- Go to the tab "Versions"
- Click "File Version" in the "Item Name" window
- If the "Value" window shows "e.x.p build-158248", the version of
VMrc is affected
Remediation of this issue on Windows-based systems requires the
following steps (Linux-based systems are not affected):
- Uninstall affected versions of VMrc from the systems where the
VMrc plug-in has been installed (use the Windows Add/Remove
Programs interface)
- Install vCenter 4.0 Update 1 or install the ESX 4.0 patch
ESX400-200911223-UG
- Login into vCenter 4.0 Update 1 or ESX 4.0 with patch
ESX400-200911223-UG using WebAccess on the system where the VMrc
needs to be re-installed
- Re-install VMrc by going to the console tab in WebAccess. The
Console tab is selectable after selecting a virtual machine.
Note: the VMrc plug-in for Firefox on Windows-based operating
systems is no longer compatible after the above remediation steps.
Users are advised to use the Internet Explorer VMrc plug-in.
VMware would like to thank Alexey Sintsov from Digital Security
Research Group for reporting this issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2009-3732 to this issue.
g. Windows-based VMware authd remote denial of service
A vulnerability in vmware-authd could cause a denial of service
condition on Windows-based hosts. The denial of service is limited
to a crash of authd.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2009-3707 to this issue.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available. Potential information leak via hosted networking stack
A vulnerability in the virtual networking stack of VMware hosted
products could allow host information disclosure.
A guest operating system could send memory from the host vmware-vmx
process to the virtual network adapter and potentially to the
host's physical Ethernet wire.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2010-1138 to this issue.
VMware would like to thank Johann MacDonagh for reporting this
issue to us.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available. Linux-based vmrun format string vulnerability
A format string vulnerability in vmrun could allow arbitrary code
execution.
If a vmrun command is issued and processes are listed, code could
be executed in the context of the user listing the processes.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2010-1139 to this issue.
VMware would like to thank Thomas Toth-Steiner for reporting this
issue to us.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
VIX API any Windows not affected
VIX API 1.6.x Linux upgrade to VIX API 1.7 or later
VIX API 1.6.x Linux64 upgrade to VIX API 1.7 or later
Workstation 7.x any not affected
Workstation 6.5.x Windows not affected
Workstation 6.5.x Linux 6.5.4 build 246459 or later
Player 3.x any not affected
Player 2.5.x Windows not affected
Player 2.5.x Linux 2.5.4 build 246459 or later
Ace any Windows not affected
Server 2.x Windows not affected
Server 2.x Linux not being fixed at this time
Fusion 3.x Mac OS/X not affected
Fusion 2.x Mac OS/X 2.0.7 build 246742 or later
ESXi any any not affected
ESX any any not affected
- Solution
Please review the patch/release notes for your product and version and verify the md5sum and/or the sha1sum of your downloaded file.
VMware Workstation Movie Decoder stand alone 6.5.4
http://download3.vmware.com/software/wkst/VMware-moviedecoder-6.5.4-246459.exe md5sum: ea2ac5907ae4c5c323147fe155443ab8 sha1sum: 5ca8d1fd45f6a7a6f38019b259c3e836ee4e8f29
VMware Workstation 7.0.1
For Windows
http://downloads.vmware.com/download/download.do?downloadGroup=WKST-701-WIN Release notes: http://downloads.vmware.com/support/ws7/doc/releasenotes_ws701.html
Workstation for Windows 32-bit and 64-bit with VMware Tools md5sum: fc8502a748de3b8f94c5c9571c1f17d2 sha1sum: 3de01b355b17363a92d80200ff5e7267b3bde206
Workstation for Windows 32-bit and 64-bit without VMware Tools md5sum: 6a18ea3847cb727b03f7890f5643db79 sha1sum: 260b019db4619b0d1d775e5c38cc46b6db250984
For Linux http://downloads.vmware.com/download/download.do?downloadGroup=WKST-701-LX Release notes: http://downloads.vmware.com/support/ws7/doc/releasenotes_ws701.html
Workstation for Linux 32-bit with VMware Tools md5sum: a896f7aaedde8799f21b52b89f5fc9ef sha1sum: f6d0789afa7927ca154973a071603a0bd098e697
Workstation for Linux 32-bit without VMware Tools md5sum: 59ecd27bdf3f59be3b4df8f04d1b3874 sha1sum: 22e1a475069fca5e8d2446bf14661fa6d894d34f
Workstation for Linux 64-bit with VMware Tools md5sum: 808682eaa6b202fa29172821f7378768 sha1sum: a901c45a2a02678b0d1722e8f27152c3af12a7ac
Workstation for Linux 64-bit without VMware Tools md5sum: 5116e27e7b13a76693402577bd9fda58 sha1sum: dbcd045a889b95ac14828b8106631b678354e30a
VMware Workstation 6.5.4
For Windows
http://downloads.vmware.com/download/download.do?downloadGroup=WKST-654-WIN Release Notes: http://downloads.vmware.com/support/ws65/doc/releasenotes_ws654.html
Workstation for Windows 32-bit and 64-bit Windows 32-bit and 64-bit .exe md5sum: 2dc393fcc4e78dcf2165098a4938699a sha1sum: acfff457860c8c53c637c01f74f8aaa72d1c9569
For Linux http://downloads.vmware.com/download/download.do?downloadGroup=WKST-654-LX Release Notes: http://downloads.vmware.com/support/ws65/doc/releasenotes_ws654.html
Workstation for Linux 32-bit Linux 32-bit .rpm md5sum: 9efb43a604d50e541eb3be7081b8b198 sha1sum: 4240d664f85a11f47288d2279224b26bef92aa8b
Workstation for Linux 32-bit Linux 32-bit .bundle md5sum: 38760682ad3b2f6bfb4e40f424c95c2a sha1sum: ec78099322b5fb2a737cd74a1978a5c07382dc8a
Workstation for Linux 64-bit Linux 64-bit .rpm md5sum: 24311492bc515e9bc98eff9b2e7d33a2 sha1sum: b4947ef09f740440e8a24fc2ba05c0a7c11b82f5
Workstation for Linux 64-bit Linux 64-bit .bundle md5sum: ed24296705ad48442549d9cb2b3c0d8d sha1sum: 3c0f1efae0a64fa3a41be21b0bfc962f12e0e6d8
VMware Player 3.0.1
http://downloads.vmware.com/tryvmware/?p=player&lp=default Release notes: http://downloads.vmware.com/support/player30/doc/releasenotes_player301.html
Player for Windows 32-bit and 64-bit md5sum: 78c92c0242c9540f68a629d4ac49c516 sha1sum: 7fc255fcd1a6784458012314db1206ed922e92cf
Player for Linux 32-bit (.bundle) md5sum: e7cd19d39c7bbd1aee582743d76a7863 sha1sum: cff76010f0429576288ea1e5a594cd47a2c64f4a
Player for Linux 64-bit (.bundle) md5sum: 88b08537c6eea705883dc1755b97738c sha1sum: 84f25370d24c03a18968a4f4c8e06cef3d21c2df
VMware VIX API for Windows 32-bit and 64-bit md5sum: 2c46fc7e2516f331eb4dd23154d00a54 sha1sum: 85ceb1b718806c6870e3a918bcc772d1486ccdc9
VMware VIX API for 32-bit Linux md5sum: 8b0994a26363246b5e954f97bd5a088d sha1sum: af93da138a158ee6e05780a5c4042414735987b6
VMware VIX API for 64-bit Linux md5sum: ef7b9890c52b1e333f2357760a7fff85 sha1sum: dfef8531356de78171e13c4c108ebaeb43eaa62d
VMware Player 2.5.4
http://downloads.vmware.com/download/player/player_reg.html Release notes: http://downloads.vmware.com/support/player25/doc/releasenotes_player254.html
Player for Windows 32-bit and 64-bit (.exe) md5sum: 531140a1eeed7d8b71f726b3d32a9174 sha1sum: 2500fa8af48452bd0e97040b80c569c3cb4f73e5
Player for Linux (.rpm) md5sum: 1905f61af490f9760bef54450747e708 sha1sum: cf7444c0a6331439c5479a4158112a60eb0e6e8d
Player for Linux (.bundle) md5sum: 74f539005687a4efce7971f7ef019af5 sha1sum: 4c4412c5807ecd00e66886e0e7c43ed61b62aab7
Player for Linux - 64-bit (.rpm) md5sum: 013078d7f6adcdbcbaafbf5e0ae11a39 sha1sum: 7c434173a3fe446ebefce4803bfaa7ab67d1ff72
Player for Linux - 64-bit (.bundle) md5sum: 175ce2f9656ff10a1327c0d48f80c65f sha1sum: bf7acfdcb44bf345d58f79ad1bcb04816f262d22
VMware ACE 2.6.1
http://downloads.vmware.com/download/download.do?downloadGroup=ACE-261-WIN Release notes: http://downloads.vmware.com/support/ace26/doc/releasenotes_ace261.html
VMware Workstation for 32-bit and 64-bit Windows with tools md5sum: fc8502a748de3b8f94c5c9571c1f17d2 sha1sum: 3de01b355b17363a92d80200ff5e7267b3bde206
VMware Workstation for Windows 32-bit and 64-bit without tools md5sum: 6a18ea3847cb727b03f7890f5643db79 sha1sum: 260b019db4619b0d1d775e5c38cc46b6db250984
ACE Management Server Virtual Appliance md5sum: e26d258c511572064e99774fbac9184c sha1sum: 9363656b70caa11a31a6229451202d9f8203c1f5
ACE Management Server for Windows md5sum: e970828f2a5a62ac108879033a70f4b6 sha1sum: eca89372eacc78c3130781d0d183715055d64798
ACE Management Server for SUSE Enterprise Linux 9 md5sum: 59b3ad5964daef2844e72fd1765590fc sha1sum: 91048de7665f5dc466f06e2ebc4c08f08026a97f
ACE Management Server for Red Hat Enterprise Linux 4 md5sum: 6623f6a8a645402a1c8c351ec99a1889 sha1sum: a6d74ba072c5a513fcf8993edebaaf7f8225c05d
VMware ACE 2.5.4
http://downloads.vmware.com/download/download.do?downloadGroup=ACE-254-WIN Release notes: http://downloads.vmware.com/support/ace25/doc/releasenotes_ace254.html
VMware ACE for Windows 32-bit and 64-bit Windows 32-bit and 64-bit .exe md5sum: 2dc393fcc4e78dcf2165098a4938699a sha1sum: acfff457860c8c53c637c01f74f8aaa72d1c9569
ACE Management Server Virtual Appliance AMS Virtual Appliance .zip md5sum: 3935f23d4a074e7a3429a1c80cfd2155 sha1sum: 5b09439a9c840d39ae49fbd7a79732ecd58c52a3
ACE Management Server for Windows Windows .exe md5sum: 1173bd7da6ed330a262ed4e2eff6562c sha1sum: d9bce88a350aa957f3387f870af763875d4d9110
ACE Management Server for SUSE Enterprise Linux 9 SLES 9 .rpm md5sum: 0bec2cf8d6ae3bb6976c9d8cc2573208 sha1sum: f3c6d9ee3357535b1540cedd9e86d723e2ed2134
ACE Management Server for Red Hat Enterprise Linux 4 RHEL 4 .rpm md5sum: 17caa522af79cf1f6b2ebad16a4ac8a5 sha1sum: cdd6e2a4e3d7ad89f95e60f1af024bea7eaba0fe
VMware Server 2.0.2
http://www.vmware.com/download/server/ Release notes: http://www.vmware.com/support/server2/doc/releasenotes_vmserver202.html
VMware Server 2 Version 2.0.2 | 203138 - 10/26/09 507 MB EXE image VMware Server 2 for Windows Operating Systems. A master installer file containing all Windows components of VMware Server. md5sum: a6430bcc16ff7b3a29bb8da1704fc38a sha1sum: 39683e7333732cf879ff0b34f66e693dde0e340b
VIX API 1.6 for Windows Version 2.0.2 | 203138 - 10/26/09 37 MB image md5sum: 827e65e70803ec65ade62dd27a74407a sha1sum: a14281bc055271a19be3c88026e92304bc3f0e22
For Linux
VMware Server 2 for Linux Operating Systems. Version 2.0.2 | 203138 - 10/26/09 37 MB TAR image md5sum: 95ddea5a0579a35887bd15b083ffea20 sha1sum: 14cf12063a7480f240ccd96178ad4258cb26a747
VMware Server 2 for Linux Operating Systems 64-bit version. Version 2.0.2 | 203138 - 10/26/09 452 MB RPM image md5sum: 35c8b176601133749e4055e0034f8be6 sha1sum: e8dc842d89899df5cd3e1136af76f19ca5ccbece
The core application needed to run VMware Server 2, 64-bit version. Version 2.0.2 | 203138 - 10/26/09 451 MB TAR image md5sum: cc7aef813008eeb7150c21547d431b39 sha1sum: b65d3d46dc947fc7995bda354c4947afabd23474
VMware Fusion 3.0.2
http://downloads.vmware.com/download/download.do?downloadGroup=FUS-302 Release notes: http://downloads.vmware.com/support/fusion3/doc/releasenotes_fusion_302.html
VMware Fusion 3.0.2 (for Intel-based Macs) md5sum: aa17278a4a668eeb9f9467e4e3111ccc sha1sum: 58c3d63705ac90839f7c1ae14264177e1fd56df3
VMware Fusion 3.0.2 Light for Mac (for Intel-based Macs) md5sum: 052ecbbfc4f59a85e2d08b4bd3ef0896 sha1sum: 61e00487f4c649588099647d4a5f47ddf5b8ad01
VMware Fusion 2.0.7
http://downloads.vmware.com/download/download.do?downloadGroup=FUS-207 Release notes: http://downloads.vmware.com/support/fusion2/doc/releasenotes_fusion_207.html
VMware Fusion 2.0.7 (for Intel-based Macs) md5sum: a293f5ce6ccc227760640753386e9da6 sha1sum: ddfda92f9baf30e536bc485e42325d173a1aa370
VMware Fusion 2.0.7 Light (for Intel-based Macs) md5sum: d4772d118fb90323f598849e70c21189 sha1sum: 5c1df1597e77ebe0f0555749b281008ca5f2fb77
VIX API 1.7 Version: 1.7 | 2009-08-26 | 186713
VIX API for Window 32-bit and 64-bit Main installation file for Windows 32-bit and 64-bit host md5sum:b494fc3092f07d0f29cc06a19fe61306 sha1sum:aa8638424cb7f25c1e42343134ac9f0bd2c2e0c9
VIX API for Linux 32-bit md5sum:6b0ed8872d8b714363cddc68b6a77008 sha1sum:8a9b12a61641394b347488119a7120eaa47dc2a1
VIX API for Linux 64-bit md5sum:d57aa9f98058d5a386c18e14cc05bf4d sha1sum:3b7d4461ea257e795b322cc080f4ae29a230666b
VIX API Version: 1.8.1 | 2009-10-11 | 207905
VIX API for Windows 32-bit and 64-bit md5sum:4f21e4cb518767bc08045f5a39f5d41f sha1sum:5b8275c549f9d9498bd2ed078557f1ce1986ac12
VIX API for Linux 32-bit md5sum:f347e94d907c26754540d59956ee5d53 sha1sum:6ddc6c9371ba127d04bc83bd55988a6c83366907
VIX API for Linux 64-bit md5sum:b8a3982072d0d42c0c37dd7eb49d686c sha1sum:d044ac3dd42f806bc4ff48ddf584b5e3d82910c8
VIX API Version: 1.10 Beta | 01/28/10 | 222403
VIX API for Windows 32-bit and 64-bit md5sum:ac5b6e9197cb68c302bfac9ed683e3af sha1sum:0d942e7409e88e684bdb65811e7be7f47d631a73
VIX API for Linux 32-bit md5sum:07d1989d042e317eb9d2b3daf269dda7 sha1sum:1e3840d426d7dfff53fa7e1bd22b09b56cf2362c
VIX API for Linux 64-bit md5sum:9b345008e0adec3c044988307294944b sha1sum:7a54a893369c2227f7e8058430c40983168c6e0b
ESXi
ESXi 4.0 bulletin ESXi400-201002402-BG https://hostupdate.vmware.com/software/VUM/OFFLINE/release-193-20100228-731251/ESXi400-201002001.zip md5sum: e5aa2968d389594abdc59cbac7b0183d sha1sum: bb50b3ad7934e3f9e24edc879b35e83b357343b2 http://kb.vmware.com/kb/1018404
ESXi 3.5
ESXi 3.5 patch ESXe350-200912402-T-BG was first contained in ESXe350-200912401-O-BG from December 2009.
The same patch, ESXe350-200912402-T-BG, is also contained in ESXe350-201002401-O-SG from February 2010 ESXi 3.5 security update.
In latest non-security ESXi 3.5 update, ESXe350-201003402-T-BG is also included in ESXe350-201003401-O-BG from March 2010.
ESXe350-201002401-O-SG (latest security update) http://download3.vmware.com/software/vi/ESXe350-201002401-O-SG.zip
md5sum: 0c8d4d1c0e3c2aed9f785cf081225d83
http://kb.vmware.com/kb/1015047 (Vi Client)
http://kb.vmware.com/kb/1016665 (VM Tools)
http://kb.vmware.com/kb/1017685 (Firmware)
The three ESXi patches for Firmware "I", VMware Tools "T," and the VI Client "C" are contained in a single offline "O" download file.
ESX
ESX 4.0 bulletin ESX400-201002401-BG https://hostupdate.vmware.com/software/VUM/OFFLINE/release-192-20100228-732240/ESX400-201002001.zip md5sum: de62cbccaffa4b2b6831617f18c1ccb4 sha1sum: 4083f191fa4acd6600c9a87e4852f9f5700e91ab http://kb.vmware.com/kb/1018403
Note: ESX400-201002001 contains the bundle with the security fix, ESX400-201002401-BG To install an individual bulletin use esxupdate with the -b option. esxupdate --bundle ESX400-201002001 -b ESX400-201002401-BG
ESX 4.0 bulletin ESX400-200911223-UG https://hostupdate.vmware.com/software/VUM/OFFLINE/release-166-20091202-254879/ESX-4.0.0-update01a.zip md5sum: 99c1fcafbf0ca105ce73840d686e9914 sha1sum: aa8a23416271bc28b6b8f6bdbe00045e36314ebb http://kb.vmware.com/kb/1014842
Note: ESX-4.0.0-update01a contains the bundle with the security fix, ESX400-200911223-UG To install an individual bulletin use esxupdate with the -b option. esxupdate --bundle ESX-4.0.0-update01a -b ESX400-200911223-UG
ESX 3.5 patch ESX350-200912401-BG http://download3.vmware.com/software/vi/ESX350-200912401-BG.zip md5sum: f1d3589745b4ae933554785aef22bacc sha1sum: d1e5a9209b165d43d75f076e556fc028bec4cc47 http://kb.vmware.com/kb/1016657
ESX 3.0.3 patch ESX303-201002203-UG http://download3.vmware.com/software/vi/ESX303-201002203-UG.zip md5sum: 49ee56b687707cbe6999836c315f081a http://kb.vmware.com/kb/1018030
ESX 2.5.5 Upgrade Patch 15 http://download3.vmware.com/software/esx/esx-2.5.5-191611-upgrade.tar.gz md5sum: c346fe510b6e51145570e03083f77357 sha1sum: ef6b19247825fb3fe2c55f8fda3cdd05ac7bb1f4 http://www.vmware.com/support/esx25/doc/esx-255-200910-patch.html
-
References http://www.acrossecurity.com/advisories.htm http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1564 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1565 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2042 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3707 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3732 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1138 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1139 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1140 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1142 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1141
-
Change log 2010-04-09 VMSA-2010-0007 Initial security advisory after release of Workstation 6.5.4 and Fusion 2.0.7 on 2010-04-08.
- Contact
E-mail list for product security notifications and announcements: http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
- security-announce at lists.vmware.com
- bugtraq at securityfocus.com
- full-disclosure at lists.grok.org.uk
E-mail: security at vmware.com PGP key at: http://kb.vmware.com/kb/1055
VMware Security Center http://www.vmware.com/security
VMware security response policy http://www.vmware.com/support/policies/security_response.html
General support life cycle policy http://www.vmware.com/support/policies/eos.html
VMware Infrastructure support life cycle policy http://www.vmware.com/support/policies/eos_vi.html
Copyright 2010 VMware Inc. All rights reserved.
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (MingW32)
iD8DBQFLvvM8S2KysvBH1xkRAgu/AJ9RrzlOq/5Ug0t8R4qoi/UwDVJDpACbBGgT d58bjKG6Ic7m/TsoJP4M2tw= =Q1zv -----END PGP SIGNATURE----- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
National Cyber Alert System
Technical Cyber Security Alert TA10-238A
Microsoft Windows Insecurely Loads Dynamic Libraries
Original release date: August 26, 2010 Last revised: -- Source: US-CERT
Systems Affected
Any application running on the Microsoft Windows platform that
uses dynamically linked libraries (DLLs) may be affected. Please see the Vendor Information
section of Vulnerability Note VU#707943 for information about
specific vendors. DLLs are typically loaded
when the application is first started; however DLLs may be loaded and unloaded while the application is running. An application can request a DLL file in a variety of ways, and Windows uses several different search algorithms to find DLL files. The interaction between the application and Windows can result in a DLL file being loaded from the current working directory of the application, instead of the Windows system directory or the directory where the application is installed.
The current working directory could be the desktop, a removable storage device such as a USB key, a Windows file share, or a WebDAV location. When a file associated with an application is opened, a DLL in the same directory as the file may be loaded. Although an attacker may not have permission to write to the Windows system or application directories, the attacker may be able to write a DLL to a directory used to store files, or the attacker could provide their own directory.
Attacks against this type of vulnerability have been referred to as "binary planting." Please see Vulnerability Note VU#707943 and Microsoft Security Advisory 2269637 for more information.
II. Impact
By placing a DLL with the correct name (and possibly the relative directory path) in the current working directory, an attacker could execute arbitrary code with the privileges of the application that loads the DLL.
III. Solution
Individual applications that run on the Windows platform may require patches or updates. Microsoft Knowledge Base article KB2264107 describes an update that provides a registry key that can prevent Windows from searching the current working directory for DLL files.
Information about specific solutions for different vendors, general mitigation techniques, and secure ways for applications to load DLLs can be found in the Vendor Information and Solution sections of Vulnerability Note VU#707943.
IV. References
-
Vulnerability Note VU#707943 - http://www.kb.cert.org/vuls/id/707943
-
Microsoft Security Advisory (2269637) - http://www.microsoft.com/technet/security/advisory/2269637.mspx
-
A new CWDIllegalInDllSearch registry entry is available to control the DLL search path algorithm - http://support.microsoft.com/kb/2264107
The most recent version of this document can be found at:
<http://www.us-cert.gov/cas/techalerts/TA10-238A.html>
Feedback can be directed to US-CERT Technical Staff. Please send email to cert@cert.org with "TA10-238A Feedback VU#707943" in the subject.
For instructions on subscribing to or unsubscribing from this mailing list, visit http://www.us-cert.gov/cas/signup.html.
Produced 2010 by US-CERT, a government organization.
Background
VMware Player, Server, and Workstation allow emulation of a complete PC on a PC without the usual performance overhead of most emulators.
Affected packages
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 app-emulation/vmware-player <= 2.5.5.328052 Vulnerable! 2 app-emulation/vmware-workstation <= 6.5.5.328052 Vulnerable! 3 app-emulation/vmware-server <= 1.0.9.156507 Vulnerable! ------------------------------------------------------------------- NOTE: Certain packages are still vulnerable. Users should migrate to another package if one is available or wait for the existing packages to be marked stable by their architecture maintainers. Please review the CVE identifiers referenced below for details.
Impact
Local users may be able to gain escalated privileges, cause a Denial of Service, or gain sensitive information.
A remote attacker could entice a user to open a specially crafted file, possibly resulting in the remote execution of arbitrary code, or a Denial of Service. Remote attackers also may be able to spoof DNS traffic, read arbitrary files, or inject arbitrary web script to the VMware Server Console.
Furthermore, guest OS users may be able to execute arbitrary code on the host OS, gain escalated privileges on the guest OS, or cause a Denial of Service (crash the host OS).
Workaround
There is no known workaround at this time.
Gentoo discontinued support for VMware Workstation. We recommend that users unmerge VMware Server:
# emerge --unmerge "app-emulation/vmware-server"
References
[ 1 ] CVE-2007-5269 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5269 [ 2 ] CVE-2007-5503 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5503 [ 3 ] CVE-2007-5671 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5671 [ 4 ] CVE-2008-0967 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-0967 [ 5 ] CVE-2008-1340 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1340 [ 6 ] CVE-2008-1361 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1361 [ 7 ] CVE-2008-1362 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1362 [ 8 ] CVE-2008-1363 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1363 [ 9 ] CVE-2008-1364 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1364 [ 10 ] CVE-2008-1392 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1392 [ 11 ] CVE-2008-1447 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1447 [ 12 ] CVE-2008-1806 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1806 [ 13 ] CVE-2008-1807 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1807 [ 14 ] CVE-2008-1808 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1808 [ 15 ] CVE-2008-2098 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2098 [ 16 ] CVE-2008-2100 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2100 [ 17 ] CVE-2008-2101 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2101 [ 18 ] CVE-2008-4915 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4915 [ 19 ] CVE-2008-4916 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4916 [ 20 ] CVE-2008-4917 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4917 [ 21 ] CVE-2009-0040 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0040 [ 22 ] CVE-2009-0909 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0909 [ 23 ] CVE-2009-0910 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0910 [ 24 ] CVE-2009-1244 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-1244 [ 25 ] CVE-2009-2267 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-2267 [ 26 ] CVE-2009-3707 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3707 [ 27 ] CVE-2009-3732 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3732 [ 28 ] CVE-2009-3733 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3733 [ 29 ] CVE-2009-4811 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-4811 [ 30 ] CVE-2010-1137 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1137 [ 31 ] CVE-2010-1138 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1138 [ 32 ] CVE-2010-1139 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1139 [ 33 ] CVE-2010-1140 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1140 [ 34 ] CVE-2010-1141 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1141 [ 35 ] CVE-2010-1142 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1142 [ 36 ] CVE-2010-1143 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1143 [ 37 ] CVE-2011-3868 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3868
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201209-25.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2012 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200009-0023",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "esx",
"scope": "eq",
"trust": 3.0,
"vendor": "vmware",
"version": "2.5.5"
},
{
"model": "esx",
"scope": "eq",
"trust": 3.0,
"vendor": "vmware",
"version": "3.0.3"
},
{
"model": "esx",
"scope": "eq",
"trust": 3.0,
"vendor": "vmware",
"version": "3.5"
},
{
"model": "esx",
"scope": "eq",
"trust": 3.0,
"vendor": "vmware",
"version": "4.0"
},
{
"model": "esxi",
"scope": "eq",
"trust": 3.0,
"vendor": "vmware",
"version": "3.5"
},
{
"model": "esxi",
"scope": "eq",
"trust": 3.0,
"vendor": "vmware",
"version": "4.0"
},
{
"model": "fusion",
"scope": "eq",
"trust": 1.9,
"vendor": "vmware",
"version": "2.0.5"
},
{
"model": "fusion",
"scope": "eq",
"trust": 1.9,
"vendor": "vmware",
"version": "2.0.4"
},
{
"model": "fusion",
"scope": "eq",
"trust": 1.9,
"vendor": "vmware",
"version": "2.0.3"
},
{
"model": "fusion",
"scope": "eq",
"trust": 1.6,
"vendor": "vmware",
"version": "2.0"
},
{
"model": "server",
"scope": "eq",
"trust": 1.4,
"vendor": "vmware",
"version": "2.x"
},
{
"model": "fusion",
"scope": "eq",
"trust": 1.4,
"vendor": "vmware",
"version": "2.x"
},
{
"model": "player",
"scope": "eq",
"trust": 1.4,
"vendor": "vmware",
"version": "2.5.x"
},
{
"model": "ace",
"scope": "eq",
"trust": 1.4,
"vendor": "vmware",
"version": "2.5.x"
},
{
"model": "workstation",
"scope": "eq",
"trust": 1.3,
"vendor": "vmware",
"version": "6.5.3"
},
{
"model": "workstation",
"scope": "eq",
"trust": 1.3,
"vendor": "vmware",
"version": "6.5.2"
},
{
"model": "workstation",
"scope": "eq",
"trust": 1.3,
"vendor": "vmware",
"version": "6.5.1"
},
{
"model": "server",
"scope": "eq",
"trust": 1.3,
"vendor": "vmware",
"version": "2.0.2"
},
{
"model": "server",
"scope": "eq",
"trust": 1.3,
"vendor": "vmware",
"version": "2.0.1"
},
{
"model": "player",
"scope": "eq",
"trust": 1.3,
"vendor": "vmware",
"version": "2.5.3"
},
{
"model": "player",
"scope": "eq",
"trust": 1.3,
"vendor": "vmware",
"version": "2.5.2"
},
{
"model": "player",
"scope": "eq",
"trust": 1.3,
"vendor": "vmware",
"version": "2.5.1"
},
{
"model": "fusion",
"scope": "eq",
"trust": 1.0,
"vendor": "vmware",
"version": "2.0.2"
},
{
"model": "ace",
"scope": "eq",
"trust": 1.0,
"vendor": "vmware",
"version": "2.5.1"
},
{
"model": "fusion",
"scope": "eq",
"trust": 1.0,
"vendor": "vmware",
"version": "2.0.1"
},
{
"model": "fusion",
"scope": "eq",
"trust": 1.0,
"vendor": "vmware",
"version": "3.0"
},
{
"model": "server",
"scope": "eq",
"trust": 1.0,
"vendor": "vmware",
"version": "2.0.0"
},
{
"model": "ace",
"scope": "eq",
"trust": 1.0,
"vendor": "vmware",
"version": "2.5.0"
},
{
"model": "workstation",
"scope": "eq",
"trust": 1.0,
"vendor": "vmware",
"version": "6.5.0"
},
{
"model": "ace",
"scope": "eq",
"trust": 1.0,
"vendor": "vmware",
"version": "2.5.3"
},
{
"model": "player",
"scope": "eq",
"trust": 1.0,
"vendor": "vmware",
"version": "2.5"
},
{
"model": "ace",
"scope": "eq",
"trust": 1.0,
"vendor": "vmware",
"version": "2.5.2"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "abvent",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "adobe",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "apple",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "atomix productions",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "autodesk",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "avast antivirus",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "bentley",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "bittorrent",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "bitmanagement",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "conceiva",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "corel",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "cyberlink",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "daemon tools",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "dassault systemes",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "divx",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "ezb",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "ecava",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "fengtao",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "gfi",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "graphisoft",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "gilles vollant",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "guidance",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "httrack",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "ibm",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "izarc",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "inkscape",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "maxthon",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "microchip",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "microsoft",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "mozilla",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "netstumbler",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "nokia",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "norman",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "nullsoft",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "opera",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "pgp",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "pkware",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "pixia",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "realnetworks",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sisoftware",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "smart projects",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sonic",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sony",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sweetscape",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "teamviewer",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "techsmith",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "tortoisesvn",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "tracker",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "vmware",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "videolan",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "winmerge",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "wireshark",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "wolters kluwer",
"version": null
},
{
"model": "workstation",
"scope": "eq",
"trust": 0.8,
"vendor": "vmware",
"version": "6.5.x"
},
{
"model": "lhaforge",
"scope": "lte",
"trust": 0.8,
"vendor": "claybird",
"version": "1.5.1 and earlier"
},
{
"model": "webotx",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "v8.3"
},
{
"model": "enterprisedirectoryserver",
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": "webotx",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "v8.4"
},
{
"model": "securebranch",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "soho xp dedicated application securebranch accessmanager ver2.2.18 before"
},
{
"model": "webotx",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "v6.4"
},
{
"model": "webotx",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "v6.2"
},
{
"model": "webotx",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "v8.2"
},
{
"model": "explzh",
"scope": "lte",
"trust": 0.8,
"vendor": "pon",
"version": "v.5.65 and earlier"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "9"
},
{
"model": "securebranch",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "soho vista dedicated application securebranch accessmanager ver3.0.13 before"
},
{
"model": "lunascape",
"scope": "lte",
"trust": 0.8,
"vendor": "lunascape",
"version": "6.3.0 and earlier"
},
{
"model": "securefinger",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "fingerprint authentication runtime ( c / s edition) all versions"
},
{
"model": "webotx",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "client v7.1"
},
{
"model": "webotx",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "v6.5"
},
{
"model": "esmpro/serveragentservice",
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": "lhmelt",
"scope": "lte",
"trust": 0.8,
"vendor": "micco",
"version": "1.65.1.2 and earlier"
},
{
"model": "webotx",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "download server v7.1"
},
{
"model": "esmpro/serveragent",
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": "webotx",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "client v5.3"
},
{
"model": "terapad",
"scope": "lte",
"trust": 0.8,
"vendor": "terao progress",
"version": "ver.1.00\\u3000 and earlier"
},
{
"model": "sleipnir",
"scope": "lte",
"trust": 0.8,
"vendor": "fenrir",
"version": "2.9.5 and earlier"
},
{
"model": "securefinger",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "fingerprint authentication utility ad all versions"
},
{
"model": "lhaplus",
"scope": "lte",
"trust": 0.8,
"vendor": "schezo",
"version": "1.57 and earlier"
},
{
"model": "webotx",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "v6.3"
},
{
"model": "infoframe documentskipper",
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": "webotx",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "downloader v5.3"
},
{
"model": "webotx",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "download contents v8.2"
},
{
"model": "workstation",
"scope": "eq",
"trust": 0.6,
"vendor": "vmware",
"version": "5.5.x"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "workstation",
"version": "6.5.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "workstation",
"version": "6.5.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "workstation",
"version": "6.5.2"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "workstation",
"version": "6.5.3"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "player",
"version": "2.5"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "player",
"version": "2.5.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "player",
"version": "2.5.2"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "player",
"version": "2.5.3"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "ace",
"version": "2.5.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "ace",
"version": "2.5.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "ace",
"version": "2.5.2"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "ace",
"version": "2.5.3"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "server",
"version": "2.0.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "server",
"version": "2.0.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "server",
"version": "2.0.2"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "fusion",
"version": "2.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "fusion",
"version": "2.0.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "fusion",
"version": "2.0.2"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "fusion",
"version": "2.0.3"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "fusion",
"version": "2.0.4"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "fusion",
"version": "2.0.5"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "fusion",
"version": "3.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "esxi",
"version": "3.5"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "esxi",
"version": "4.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "esx",
"version": "2.5.5"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "esx",
"version": "3.0.3"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "esx",
"version": "3.5"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "esx",
"version": "4.0"
},
{
"model": "workstation build",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "6.5118166"
},
{
"model": "server build",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "2.0.2203138"
},
{
"model": "server build",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "2.0.1156745"
},
{
"model": "server",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "2.0"
},
{
"model": "player",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "2.5.4"
},
{
"model": "player build",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "2.5118166"
},
{
"model": "movie decoder",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "6.5.4"
},
{
"model": "fusion",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "2.0.6"
},
{
"model": "fusion build",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "2.0.2147997"
},
{
"model": "fusion",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "2"
},
{
"model": "esxi server",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "4.0"
},
{
"model": "esxi server",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "3.5"
},
{
"model": "esx server",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "3.0.3"
},
{
"model": "esx server",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "2.5.5"
},
{
"model": "esx server",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "4.0"
},
{
"model": "esx server",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "3.5"
},
{
"model": "linux",
"scope": null,
"trust": 0.3,
"vendor": "gentoo",
"version": null
}
],
"sources": [
{
"db": "IVD",
"id": "7d7c8fb0-463f-11e9-a735-000c29342cb1"
},
{
"db": "IVD",
"id": "46c824c0-2356-11e6-abef-000c29c66e3d"
},
{
"db": "CERT/CC",
"id": "VU#707943"
},
{
"db": "CNVD",
"id": "CNVD-2010-0574"
},
{
"db": "BID",
"id": "39392"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001364"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001999"
},
{
"db": "CNNVD",
"id": "CNNVD-201004-160"
},
{
"db": "NVD",
"id": "CVE-2010-1141"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:vmware:workstation:6.5.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:vmware:workstation:6.5.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:vmware:workstation:6.5.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:vmware:workstation:6.5.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:vmware:player:2.5.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:vmware:player:2.5.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:vmware:player:2.5.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:vmware:player:2.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:vmware:ace:2.5.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:vmware:ace:2.5.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:vmware:ace:2.5.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:vmware:ace:2.5.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:vmware:server:2.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:vmware:server:2.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:vmware:server:2.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:vmware:fusion:3.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:vmware:fusion:2.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:vmware:fusion:2.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:vmware:fusion:2.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:vmware:fusion:2.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:vmware:fusion:2.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:vmware:fusion:2.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:vmware:esxi:3.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:vmware:esxi:4.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:vmware:esx:4.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:vmware:esx:2.5.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:vmware:esx:3.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:vmware:esx:3.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2010-1141"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Alin Rad Pop",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201004-160"
}
],
"trust": 0.6
},
"cve": "CVE-2010-1141",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 8.5,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 6.8,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "Single",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 8.5,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2010-1141",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 8.5,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 6.8,
"id": "7d7c8fb0-463f-11e9-a735-000c29342cb1",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 8.5,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 6.8,
"id": "46c824c0-2356-11e6-abef-000c29c66e3d",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2010-1141",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#707943",
"trust": 0.8,
"value": "64.13"
},
{
"author": "CNNVD",
"id": "CNNVD-201004-160",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "7d7c8fb0-463f-11e9-a735-000c29342cb1",
"trust": 0.2,
"value": "HIGH"
},
{
"author": "IVD",
"id": "46c824c0-2356-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2010-1141",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "7d7c8fb0-463f-11e9-a735-000c29342cb1"
},
{
"db": "IVD",
"id": "46c824c0-2356-11e6-abef-000c29c66e3d"
},
{
"db": "CERT/CC",
"id": "VU#707943"
},
{
"db": "VULMON",
"id": "CVE-2010-1141"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001364"
},
{
"db": "CNNVD",
"id": "CNNVD-201004-160"
},
{
"db": "NVD",
"id": "CVE-2010-1141"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "VMware Tools in VMware Workstation 6.5.x before 6.5.4 build 246459; VMware Player 2.5.x before 2.5.4 build 246459; VMware ACE 2.5.x before 2.5.4 build 246459; VMware Server 2.x before 2.0.2 build 203138; VMware Fusion 2.x before 2.0.6 build 246742; VMware ESXi 3.5 and 4.0; and VMware ESX 2.5.5, 3.0.3, 3.5, and 4.0 does not properly access libraries, which allows user-assisted remote attackers to execute arbitrary code by tricking a Windows guest OS user into clicking on a file that is stored on a network share. Some applications for Microsoft Windows may use unsafe methods for determining how to load DLLs. As a result, these applications can be forced to load a DLL from an attacker-controlled source rather than a trusted location. Windows Program DLL There is an attackable vulnerability in reading. Dynamic link Library (DLL) Is a software component that is loaded at run time, not at program compile time. The program is LoadLibrary() And LoadLibraryEx() Using DLL Is read. Read DLL If no path is specified, specific directories are searched in order and found first. DLL Is loaded. Since this directory group includes the current directory of the process, the directory that can be operated by the attacker is set as the current directory. LoadLibrary() If is called, attack code may be executed. This issue can occur when browsing files located in directories that an attacker can manipulate. Read DLL The name depends on the program. DLL Read Windows The entire program may be affected. \" Opera Software \"and\" Adobe Vulnerability information on \" : Mitsui Bussan Secure Direction Co., Ltd. Takashi Yoshikawa MrA remote attacker could execute arbitrary code with the authority to execute the program. Attacker crafted DLL The USB Placing it on a drive or network drive may cause an attack. VMWare is a virtual PC software that allows two or more Windows, DOS, and LINUX systems to run simultaneously on a single machine. The VMWare Tools package used in VMWare products does not properly access the function library. \nAn attacker can exploit this issue by enticing a user to open a malicious file from a network share. The issue can be exploited on Windows guest operating systems\nSuccessful exploits will allow attackers to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. \nThis issue affects the following products:\nWorkstation\nPlayer\nACE\nServer\nFusion\nESX\nESXi\nNOTE: This issue was previously covered in BID 39345 (VMware Hosted Products VMSA-2010-0007 Multiple Remote and Local Vulnerabilities), but has been given its own record to better document it. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n- -------------------------------------------------------------------------\n VMware Security Advisory\n\nAdvisory ID: VMSA-2010-0007\nSynopsis: VMware hosted products, vCenter Server and ESX\n patches resolve multiple security issues\nIssue date: 2010-04-09\nUpdated on: 2010-04-09 (initial release of advisory)\nCVE numbers: CVE-2010-1142 CVE-2010-1140 CVE-2009-2042\n CVE-2009-1564 CVE-2009-1565 CVE-2009-3732\n CVE-2009-3707 CVE-2010-1138 CVE-2010-1139\n CVE-2010-1141\n- -------------------------------------------------------------------------\n\n1. \n\n2. \n\n Notes:\n Effective May 2010, VMware\u0027s patch and update release program during\n Extended Support will be continued with the condition that all\n subsequent patch and update releases will be based on the latest\n baseline release version as of May 2010 (i.e. ESX 3.0.3 Update 1,\n ESX 3.5 Update 5, and VirtualCenter 2.5 Update 6). Refer to section\n \"End of Product Availability FAQs\" at\n http://www.vmware.com/support/policies/lifecycle/vi/faq.html for\n details. \n\n Extended support for ESX 2.5.5 ends on 2010-06-15. Users should plan\n to upgrade to at least ESX 3.0.3 and preferably to the newest\n release available. \n\n Extended support for ESX 3.0.3 ends on 2011-12-10. Users should plan\n to upgrade to at least ESX 3.5 and preferably to the newest release\n available. \n\n End of General Support for VMware Workstation 6.x is 2011-04-27,\n users should plan to upgrade to the newest release available. \n\n End of General Support for VMware Server 2.0 is 2011-06-30, users\n should plan to upgrade to the newest release of either ESXi or\n VMware Player. \n\n Extended support for Virtual Center 2.0.2 is 2011-12-10, users\n should plan to upgrade to the newest release of vCenter Server. \n\n3. Problem Description\n\n a. This file could be in any file format. \n\n VMware would like to thank Jure Skofic and Mitja Kolsek of ACROS\n Security (http://www.acrossecurity.com) for reporting this issue\n to us. \n\n The Common Vulnerabilities and Exposures project (cve.mitre.org)\n has assigned the name CVE-2010-1141 to this issue. \n\n Steps needed to remediate this vulnerability:\n\n Guest systems on VMware Workstation, Player, ACE, Server, Fusion\n - Install the remediated version of Workstation, Player, ACE,\n Server and Fusion. \n - Upgrade tools in the virtual machine (virtual machine users\n will be prompted to upgrade). \n\n Guest systems on ESX 4.0, 3.5, 3.0.3, 2.5.5, ESXi 4.0, 3.5\n - Install the relevant patches (see below for patch identifiers)\n - Manually upgrade tools in the virtual machine (virtual machine\n users will not be prompted to upgrade). Note the VI Client will\n not show the VMware tools is out of date in the summary tab. \n Please see http://tinyurl.com/27mpjo page 80 for details. \n\n The following table lists what action remediates the vulnerability\n (column 4) if a solution is available. See above for remediation\n details. On most\n recent versions of Windows (XP, Vista) the attacker would need to\n have administrator privileges to plant the malicious executable in\n the right location. \n\n Steps needed to remediate this vulnerability: See section 3.a. \n\n VMware would like to thank Mitja Kolsek of ACROS Security\n (http://www.acrossecurity.com) for reporting this issue to us. \n\n The Common Vulnerabilities and Exposures project (cve.mitre.org)\n has assigned the name CVE-2010-1142 to this issue. \n\n Refer to the previous table in section 3.a for what action\n remediates the vulnerability (column 4) if a solution is\n available. See above for remediation details. \n\n c. Windows-based VMware Workstation and Player host privilege\n escalation\n\n A vulnerability in the USB service allows for a privilege\n escalation. A local attacker on the host of a Windows-based\n Operating System where VMware Workstation or VMware Player\n is installed could plant a malicious executable on the host and\n elevate their privileges. \n\n In order for an attacker to exploit the vulnerability, the attacker\n would need to be able to plant their malicious executable in a\n certain location on the host machine. On most recent versions of\n Windows (XP, Vista) the attacker would need to have administrator\n privileges to plant the malicious executable in the right location. \n\n VMware would like to thank Thierry Zoller for reporting this issue\n to us. \n\n The Common Vulnerabilities and Exposures project (cve.mitre.org)\n has assigned the name CVE-2010-1140 to this issue. \n\n The following table lists what action remediates the vulnerability\n (column 4) if a solution is available. \n\n VMware Product Running Replace with/\n Product Version on Apply Patch\n ============= ======== ======= =================\n VirtualCenter any Windows not affected\n\n Workstation 7.0 Windows 7.0.1 build 227600 or later\n Workstation 7.0 Linux not affected\n Workstation 6.5.x any not affected\n\n Player 3.0 Windows 3.0.1 build 227600 or later\n Player 3.0 Linux not affected\n Player 2.5.x any not affected\n\n Ace any any not affected\n\n Server 2.x any not affected\n\n Fusion any Mac OS/X not affected\n\n ESXi any ESXi not affected\n\n ESX any ESX not affected\n\n d. Third party library update for libpng to version 1.2.37\n\n The libpng libraries through 1.2.35 contain an uninitialized-\n memory-read bug that may have security implications. \n Specifically, 1-bit (2-color) interlaced images whose widths are\n not divisible by 8 may result in several uninitialized bits at the\n end of certain rows in certain interlace passes being returned to\n the user. An application that failed to mask these out-of-bounds\n pixels might display or process them, albeit presumably with benign\n results in most cases. \n\n The Common Vulnerabilities and Exposures Project (cve.mitre.org)\n has assigned the name CVE-2009-2042 to this issue. \n\n The following table lists what action remediates the vulnerability\n (column 4) if a solution is available. VMware VMnc Codec heap overflow vulnerabilities\n\n The VMware movie decoder contains the VMnc media codec that is\n required to play back movies recorded with VMware Workstation,\n VMware Player and VMware ACE, in any compatible media player. The\n movie decoder is installed as part of VMware Workstation, VMware\n Player and VMware ACE, or can be downloaded as a stand alone\n package. \n\n For an attack to be successful the user must be tricked into\n visiting a malicious web page or opening a malicious video file on\n a system that has the vulnerable version of the VMnc codec installed. \n\n The Common Vulnerabilities and Exposures project (cve.mitre.org)\n has assigned the names CVE-2009-1564 and CVE-2009-1565 to these\n issues. \n\n VMware would like to thank iDefense, Sebastien Renaud of VUPEN\n Vulnerability Research Team (http://www.vupen.com) and Alin Rad Pop\n of Secunia Research for reporting these issues to us. \n\n To remediate the above issues either install the stand alone movie\n decoder or update your product using the table below. \n\n VMware Product Running Replace with/\n Product Version on Apply Patch\n ============= ======== ======= =================\n VirtualCenter any Windows not affected\n\n Movie Decoder any Windows 6.5.4 Build 246459 or later\n\n Workstation 7.x any not affected\n Workstation 6.5.x Windows 6.5.4 build 246459 or later\n Workstation 6.5.x Linux not affected\n\n Player 3.x any not affected\n Player 2.5.x Windows 2.5.4 build 246459 or later\n Player 2.5.x Linux not affected\n\n ACE any any not affected\n\n Server 2.x Window not being addressed at this time\n Server 2.x Linux not affected\n\n Fusion any Mac OS/X not affected\n\n ESXi any ESXi not affected\n\n ESX any ESX not affected\n\nf. \n Exploitation of this issue may lead to arbitrary code execution on\n the system where VMrc is installed. Code execution would be at the privilege level of the user. \n\n VMrc is present on a system if the VMrc browser plug-in has been\n installed. This plug-in is required when using the console feature in\n WebAccess. Installation of the plug-in follows after visiting the\n console tab in WebAccess and choosing \"Install plug-in\". The plug-\n in can only be installed on Internet Explorer and Firefox. \n\n Under the following two conditions your version of VMrc is likely\n to be affected:\n\n - the VMrc plug-in was obtained from vCenter 4.0 or from ESX 4.0\n without patch ESX400-200911223-UG and\n - VMrc is installed on a Windows-based system\n\n The following steps allow you to determine if you have an affected\n version of VMrc installed:\n\n - Locate the VMrc executable vmware-vmrc.exe on your Windows-based\n system\n - Right click and go to Properties\n - Go to the tab \"Versions\"\n - Click \"File Version\" in the \"Item Name\" window\n - If the \"Value\" window shows \"e.x.p build-158248\", the version of\n VMrc is affected\n\n Remediation of this issue on Windows-based systems requires the\n following steps (Linux-based systems are not affected):\n\n - Uninstall affected versions of VMrc from the systems where the\n VMrc plug-in has been installed (use the Windows Add/Remove\n Programs interface)\n - Install vCenter 4.0 Update 1 or install the ESX 4.0 patch\n ESX400-200911223-UG\n - Login into vCenter 4.0 Update 1 or ESX 4.0 with patch\n ESX400-200911223-UG using WebAccess on the system where the VMrc\n needs to be re-installed\n - Re-install VMrc by going to the console tab in WebAccess. The\n Console tab is selectable after selecting a virtual machine. \n\n Note: the VMrc plug-in for Firefox on Windows-based operating\n systems is no longer compatible after the above remediation steps. \n Users are advised to use the Internet Explorer VMrc plug-in. \n\n VMware would like to thank Alexey Sintsov from Digital Security\n Research Group for reporting this issue to us. \n\n The Common Vulnerabilities and Exposures project (cve.mitre.org)\n has assigned the name CVE-2009-3732 to this issue. \n\n\n g. Windows-based VMware authd remote denial of service\n\n A vulnerability in vmware-authd could cause a denial of service\n condition on Windows-based hosts. The denial of service is limited\n to a crash of authd. \n\n The Common Vulnerabilities and Exposures Project (cve.mitre.org)\n has assigned the name CVE-2009-3707 to this issue. \n\n The following table lists what action remediates the vulnerability\n (column 4) if a solution is available. Potential information leak via hosted networking stack\n\n A vulnerability in the virtual networking stack of VMware hosted\n products could allow host information disclosure. \n\n A guest operating system could send memory from the host vmware-vmx\n process to the virtual network adapter and potentially to the\n host\u0027s physical Ethernet wire. \n\n The Common Vulnerabilities and Exposures Project (cve.mitre.org)\n has assigned the name CVE-2010-1138 to this issue. \n\n VMware would like to thank Johann MacDonagh for reporting this\n issue to us. \n\n The following table lists what action remediates the vulnerability\n (column 4) if a solution is available. Linux-based vmrun format string vulnerability\n\n A format string vulnerability in vmrun could allow arbitrary code\n execution. \n\n If a vmrun command is issued and processes are listed, code could\n be executed in the context of the user listing the processes. \n\n The Common Vulnerabilities and Exposures Project (cve.mitre.org)\n has assigned the name CVE-2010-1139 to this issue. \n\n VMware would like to thank Thomas Toth-Steiner for reporting this\n issue to us. \n\n The following table lists what action remediates the vulnerability\n (column 4) if a solution is available. \n\n VMware Product Running Replace with/\n Product Version on Apply Patch\n ============= ======== ======= =================\n VirtualCenter any Windows not affected\n\n VIX API any Windows not affected\n VIX API 1.6.x Linux upgrade to VIX API 1.7 or later\n VIX API 1.6.x Linux64 upgrade to VIX API 1.7 or later\n\n Workstation 7.x any not affected\n Workstation 6.5.x Windows not affected\n Workstation 6.5.x Linux 6.5.4 build 246459 or later\n\n Player 3.x any not affected\n Player 2.5.x Windows not affected\n Player 2.5.x Linux 2.5.4 build 246459 or later\n\n Ace any Windows not affected\n\n Server 2.x Windows not affected\n Server 2.x Linux not being fixed at this time\n\n Fusion 3.x Mac OS/X not affected\n Fusion 2.x Mac OS/X 2.0.7 build 246742 or later\n\n ESXi any any not affected\n\n ESX any any not affected\n\n4. Solution\n\n Please review the patch/release notes for your product and version\n and verify the md5sum and/or the sha1sum of your downloaded file. \n\n VMware Workstation Movie Decoder stand alone 6.5.4\n --------------------------------------------------\n\nhttp://download3.vmware.com/software/wkst/VMware-moviedecoder-6.5.4-246459.exe\n md5sum: ea2ac5907ae4c5c323147fe155443ab8\n sha1sum: 5ca8d1fd45f6a7a6f38019b259c3e836ee4e8f29\n\n VMware Workstation 7.0.1\n ------------------------\n For Windows\n\nhttp://downloads.vmware.com/download/download.do?downloadGroup=WKST-701-WIN\n Release notes:\n http://downloads.vmware.com/support/ws7/doc/releasenotes_ws701.html\n\n Workstation for Windows 32-bit and 64-bit with VMware Tools\n md5sum: fc8502a748de3b8f94c5c9571c1f17d2\n sha1sum: 3de01b355b17363a92d80200ff5e7267b3bde206\n\n Workstation for Windows 32-bit and 64-bit without VMware Tools\n md5sum: 6a18ea3847cb727b03f7890f5643db79\n sha1sum: 260b019db4619b0d1d775e5c38cc46b6db250984\n\n For Linux\n http://downloads.vmware.com/download/download.do?downloadGroup=WKST-701-LX\n Release notes:\n http://downloads.vmware.com/support/ws7/doc/releasenotes_ws701.html\n\n Workstation for Linux 32-bit with VMware Tools\n md5sum: a896f7aaedde8799f21b52b89f5fc9ef\n sha1sum: f6d0789afa7927ca154973a071603a0bd098e697\n\n Workstation for Linux 32-bit without VMware Tools\n md5sum: 59ecd27bdf3f59be3b4df8f04d1b3874\n sha1sum: 22e1a475069fca5e8d2446bf14661fa6d894d34f\n\n Workstation for Linux 64-bit with VMware Tools\n md5sum: 808682eaa6b202fa29172821f7378768\n sha1sum: a901c45a2a02678b0d1722e8f27152c3af12a7ac\n\n Workstation for Linux 64-bit without VMware Tools\n md5sum: 5116e27e7b13a76693402577bd9fda58\n sha1sum: dbcd045a889b95ac14828b8106631b678354e30a\n\n VMware Workstation 6.5.4\n ------------------------\n For Windows\n\nhttp://downloads.vmware.com/download/download.do?downloadGroup=WKST-654-WIN\n Release Notes:\n http://downloads.vmware.com/support/ws65/doc/releasenotes_ws654.html\n\n Workstation for Windows 32-bit and 64-bit\n Windows 32-bit and 64-bit .exe\n md5sum: 2dc393fcc4e78dcf2165098a4938699a\n sha1sum: acfff457860c8c53c637c01f74f8aaa72d1c9569\n\n For Linux\n http://downloads.vmware.com/download/download.do?downloadGroup=WKST-654-LX\n Release Notes:\n http://downloads.vmware.com/support/ws65/doc/releasenotes_ws654.html\n\n Workstation for Linux 32-bit\n Linux 32-bit .rpm\n md5sum: 9efb43a604d50e541eb3be7081b8b198\n sha1sum: 4240d664f85a11f47288d2279224b26bef92aa8b\n\n Workstation for Linux 32-bit\n Linux 32-bit .bundle\n md5sum: 38760682ad3b2f6bfb4e40f424c95c2a\n sha1sum: ec78099322b5fb2a737cd74a1978a5c07382dc8a\n\n Workstation for Linux 64-bit\n Linux 64-bit .rpm\n md5sum: 24311492bc515e9bc98eff9b2e7d33a2\n sha1sum: b4947ef09f740440e8a24fc2ba05c0a7c11b82f5\n\n Workstation for Linux 64-bit\n Linux 64-bit .bundle\n md5sum: ed24296705ad48442549d9cb2b3c0d8d\n sha1sum: 3c0f1efae0a64fa3a41be21b0bfc962f12e0e6d8\n\n\n VMware Player 3.0.1\n -------------------\n http://downloads.vmware.com/tryvmware/?p=player\u0026lp=default\n Release notes:\nhttp://downloads.vmware.com/support/player30/doc/releasenotes_player301.html\n\n Player for Windows 32-bit and 64-bit\n md5sum: 78c92c0242c9540f68a629d4ac49c516\n sha1sum: 7fc255fcd1a6784458012314db1206ed922e92cf\n\n Player for Linux 32-bit (.bundle)\n md5sum: e7cd19d39c7bbd1aee582743d76a7863\n sha1sum: cff76010f0429576288ea1e5a594cd47a2c64f4a\n\n Player for Linux 64-bit (.bundle)\n md5sum: 88b08537c6eea705883dc1755b97738c\n sha1sum: 84f25370d24c03a18968a4f4c8e06cef3d21c2df\n\n VMware VIX API for Windows 32-bit and 64-bit\n md5sum: 2c46fc7e2516f331eb4dd23154d00a54\n sha1sum: 85ceb1b718806c6870e3a918bcc772d1486ccdc9\n\n VMware VIX API for 32-bit Linux\n md5sum: 8b0994a26363246b5e954f97bd5a088d\n sha1sum: af93da138a158ee6e05780a5c4042414735987b6\n\n VMware VIX API for 64-bit Linux\n md5sum: ef7b9890c52b1e333f2357760a7fff85\n sha1sum: dfef8531356de78171e13c4c108ebaeb43eaa62d\n\n VMware Player 2.5.4\n -------------------\n http://downloads.vmware.com/download/player/player_reg.html\n Release notes:\nhttp://downloads.vmware.com/support/player25/doc/releasenotes_player254.html\n\n Player for Windows 32-bit and 64-bit (.exe)\n md5sum: 531140a1eeed7d8b71f726b3d32a9174\n sha1sum: 2500fa8af48452bd0e97040b80c569c3cb4f73e5\n\n Player for Linux (.rpm)\n md5sum: 1905f61af490f9760bef54450747e708\n sha1sum: cf7444c0a6331439c5479a4158112a60eb0e6e8d\n\n Player for Linux (.bundle)\n md5sum: 74f539005687a4efce7971f7ef019af5\n sha1sum: 4c4412c5807ecd00e66886e0e7c43ed61b62aab7\n\n Player for Linux - 64-bit (.rpm)\n md5sum: 013078d7f6adcdbcbaafbf5e0ae11a39\n sha1sum: 7c434173a3fe446ebefce4803bfaa7ab67d1ff72\n\n Player for Linux - 64-bit (.bundle)\n md5sum: 175ce2f9656ff10a1327c0d48f80c65f\n sha1sum: bf7acfdcb44bf345d58f79ad1bcb04816f262d22\n\n\n VMware ACE 2.6.1\n ----------------\nhttp://downloads.vmware.com/download/download.do?downloadGroup=ACE-261-WIN\n Release notes:\n http://downloads.vmware.com/support/ace26/doc/releasenotes_ace261.html\n\n VMware Workstation for 32-bit and 64-bit Windows with tools\n md5sum: fc8502a748de3b8f94c5c9571c1f17d2\n sha1sum: 3de01b355b17363a92d80200ff5e7267b3bde206\n\n VMware Workstation for Windows 32-bit and 64-bit without tools\n md5sum: 6a18ea3847cb727b03f7890f5643db79\n sha1sum: 260b019db4619b0d1d775e5c38cc46b6db250984\n\n ACE Management Server Virtual Appliance\n md5sum: e26d258c511572064e99774fbac9184c\n sha1sum: 9363656b70caa11a31a6229451202d9f8203c1f5\n\n ACE Management Server for Windows\n md5sum: e970828f2a5a62ac108879033a70f4b6\n sha1sum: eca89372eacc78c3130781d0d183715055d64798\n\n ACE Management Server for SUSE Enterprise Linux 9\n md5sum: 59b3ad5964daef2844e72fd1765590fc\n sha1sum: 91048de7665f5dc466f06e2ebc4c08f08026a97f\n\n ACE Management Server for Red Hat Enterprise Linux 4\n md5sum: 6623f6a8a645402a1c8c351ec99a1889\n sha1sum: a6d74ba072c5a513fcf8993edebaaf7f8225c05d\n\n VMware ACE 2.5.4\n ----------------\nhttp://downloads.vmware.com/download/download.do?downloadGroup=ACE-254-WIN\n Release notes:\n http://downloads.vmware.com/support/ace25/doc/releasenotes_ace254.html\n\n VMware ACE for Windows 32-bit and 64-bit\n Windows 32-bit and 64-bit .exe\n md5sum: 2dc393fcc4e78dcf2165098a4938699a\n sha1sum: acfff457860c8c53c637c01f74f8aaa72d1c9569\n\n ACE Management Server Virtual Appliance\n AMS Virtual Appliance .zip\n md5sum: 3935f23d4a074e7a3429a1c80cfd2155\n sha1sum: 5b09439a9c840d39ae49fbd7a79732ecd58c52a3\n\n ACE Management Server for Windows\n Windows .exe\n md5sum: 1173bd7da6ed330a262ed4e2eff6562c\n sha1sum: d9bce88a350aa957f3387f870af763875d4d9110\n\n ACE Management Server for SUSE Enterprise Linux 9\n SLES 9 .rpm\n md5sum: 0bec2cf8d6ae3bb6976c9d8cc2573208\n sha1sum: f3c6d9ee3357535b1540cedd9e86d723e2ed2134\n\n ACE Management Server for Red Hat Enterprise Linux 4\n RHEL 4 .rpm\n md5sum: 17caa522af79cf1f6b2ebad16a4ac8a5\n sha1sum: cdd6e2a4e3d7ad89f95e60f1af024bea7eaba0fe\n\n\n VMware Server 2.0.2\n -------------------\n http://www.vmware.com/download/server/\n Release notes:\n http://www.vmware.com/support/server2/doc/releasenotes_vmserver202.html\n\n VMware Server 2\n Version 2.0.2 | 203138 - 10/26/09\n 507 MB EXE image VMware Server 2 for Windows Operating Systems. A\n master installer file containing all Windows components of VMware\n Server. \n md5sum: a6430bcc16ff7b3a29bb8da1704fc38a\n sha1sum: 39683e7333732cf879ff0b34f66e693dde0e340b\n\n VIX API 1.6 for Windows\n Version 2.0.2 | 203138 - 10/26/09\n 37 MB image\n md5sum: 827e65e70803ec65ade62dd27a74407a\n sha1sum: a14281bc055271a19be3c88026e92304bc3f0e22\n\n For Linux\n\n VMware Server 2 for Linux Operating Systems. \n Version 2.0.2 | 203138 - 10/26/09\n 37 MB TAR image\n md5sum: 95ddea5a0579a35887bd15b083ffea20\n sha1sum: 14cf12063a7480f240ccd96178ad4258cb26a747\n\n VMware Server 2 for Linux Operating Systems 64-bit version. \n Version 2.0.2 | 203138 - 10/26/09\n 452 MB RPM image\n md5sum: 35c8b176601133749e4055e0034f8be6\n sha1sum: e8dc842d89899df5cd3e1136af76f19ca5ccbece\n\n The core application needed to run VMware Server 2, 64-bit version. \n Version 2.0.2 | 203138 - 10/26/09\n 451 MB TAR image\n md5sum: cc7aef813008eeb7150c21547d431b39\n sha1sum: b65d3d46dc947fc7995bda354c4947afabd23474\n\n\n VMware Fusion 3.0.2\n -------------------\n http://downloads.vmware.com/download/download.do?downloadGroup=FUS-302\n Release notes:\nhttp://downloads.vmware.com/support/fusion3/doc/releasenotes_fusion_302.html\n\n VMware Fusion 3.0.2 (for Intel-based Macs)\n md5sum: aa17278a4a668eeb9f9467e4e3111ccc\n sha1sum: 58c3d63705ac90839f7c1ae14264177e1fd56df3\n\n VMware Fusion 3.0.2 Light for Mac (for Intel-based Macs)\n md5sum: 052ecbbfc4f59a85e2d08b4bd3ef0896\n sha1sum: 61e00487f4c649588099647d4a5f47ddf5b8ad01\n\n VMware Fusion 2.0.7\n -------------------\n http://downloads.vmware.com/download/download.do?downloadGroup=FUS-207\n Release notes:\nhttp://downloads.vmware.com/support/fusion2/doc/releasenotes_fusion_207.html\n\n VMware Fusion 2.0.7 (for Intel-based Macs)\n md5sum: a293f5ce6ccc227760640753386e9da6\n sha1sum: ddfda92f9baf30e536bc485e42325d173a1aa370\n\n VMware Fusion 2.0.7 Light (for Intel-based Macs)\n md5sum: d4772d118fb90323f598849e70c21189\n sha1sum: 5c1df1597e77ebe0f0555749b281008ca5f2fb77\n\n\n VIX API 1.7 Version: 1.7 | 2009-08-26 | 186713\n ----------------------------------------------\n VIX API for Window 32-bit and 64-bit\n Main installation file for Windows 32-bit and 64-bit host\n md5sum:b494fc3092f07d0f29cc06a19fe61306\n sha1sum:aa8638424cb7f25c1e42343134ac9f0bd2c2e0c9\n\n VIX API for Linux 32-bit\n md5sum:6b0ed8872d8b714363cddc68b6a77008\n sha1sum:8a9b12a61641394b347488119a7120eaa47dc2a1\n\n VIX API for Linux 64-bit\n md5sum:d57aa9f98058d5a386c18e14cc05bf4d\n sha1sum:3b7d4461ea257e795b322cc080f4ae29a230666b\n\n VIX API Version: 1.8.1 | 2009-10-11 | 207905\n ---------------------------------------------\n VIX API for Windows 32-bit and 64-bit\n md5sum:4f21e4cb518767bc08045f5a39f5d41f\n sha1sum:5b8275c549f9d9498bd2ed078557f1ce1986ac12\n\n VIX API for Linux 32-bit\n md5sum:f347e94d907c26754540d59956ee5d53\n sha1sum:6ddc6c9371ba127d04bc83bd55988a6c83366907\n\n VIX API for Linux 64-bit\n md5sum:b8a3982072d0d42c0c37dd7eb49d686c\n sha1sum:d044ac3dd42f806bc4ff48ddf584b5e3d82910c8\n\n VIX API Version: 1.10 Beta | 01/28/10 | 222403\n ----------------------------------------------\n VIX API for Windows 32-bit and 64-bit\n md5sum:ac5b6e9197cb68c302bfac9ed683e3af\n sha1sum:0d942e7409e88e684bdb65811e7be7f47d631a73\n\n VIX API for Linux 32-bit\n md5sum:07d1989d042e317eb9d2b3daf269dda7\n sha1sum:1e3840d426d7dfff53fa7e1bd22b09b56cf2362c\n\n VIX API for Linux 64-bit\n md5sum:9b345008e0adec3c044988307294944b\n sha1sum:7a54a893369c2227f7e8058430c40983168c6e0b\n\n\n ESXi\n ----\n ESXi 4.0 bulletin ESXi400-201002402-BG\nhttps://hostupdate.vmware.com/software/VUM/OFFLINE/release-193-20100228-731251/ESXi400-201002001.zip\n md5sum: e5aa2968d389594abdc59cbac7b0183d\n sha1sum: bb50b3ad7934e3f9e24edc879b35e83b357343b2\n http://kb.vmware.com/kb/1018404\n\n ESXi 3.5\n --------\n ESXi 3.5 patch ESXe350-200912402-T-BG was first contained in\n ESXe350-200912401-O-BG from December 2009. \n\n The same patch, ESXe350-200912402-T-BG, is also contained in\n ESXe350-201002401-O-SG from February 2010 ESXi 3.5 security update. \n\n In latest non-security ESXi 3.5 update, ESXe350-201003402-T-BG is also\n included in ESXe350-201003401-O-BG from March 2010. \n\n\n ESXe350-201002401-O-SG (latest security update)\n http://download3.vmware.com/software/vi/ESXe350-201002401-O-SG.zip\n\n md5sum: 0c8d4d1c0e3c2aed9f785cf081225d83\n\n http://kb.vmware.com/kb/1015047 (Vi Client)\n\n http://kb.vmware.com/kb/1016665 (VM Tools)\n\n http://kb.vmware.com/kb/1017685 (Firmware)\n\n\n\n The three ESXi patches for Firmware \"I\", VMware Tools \"T,\" and the\n VI Client \"C\" are contained in a single offline \"O\" download file. \n\n\n ESX\n ---\n ESX 4.0 bulletin ESX400-201002401-BG\nhttps://hostupdate.vmware.com/software/VUM/OFFLINE/release-192-20100228-732240/ESX400-201002001.zip\n md5sum: de62cbccaffa4b2b6831617f18c1ccb4\n sha1sum: 4083f191fa4acd6600c9a87e4852f9f5700e91ab\n http://kb.vmware.com/kb/1018403\n\n Note: ESX400-201002001 contains the bundle with the security fix,\n ESX400-201002401-BG\n To install an individual bulletin use esxupdate with the -b option. \n esxupdate --bundle ESX400-201002001 -b ESX400-201002401-BG\n\n ESX 4.0 bulletin ESX400-200911223-UG\nhttps://hostupdate.vmware.com/software/VUM/OFFLINE/release-166-20091202-254879/ESX-4.0.0-update01a.zip\n md5sum: 99c1fcafbf0ca105ce73840d686e9914\n sha1sum: aa8a23416271bc28b6b8f6bdbe00045e36314ebb\n http://kb.vmware.com/kb/1014842\n\n Note: ESX-4.0.0-update01a contains the bundle with the security fix,\n ESX400-200911223-UG\n To install an individual bulletin use esxupdate with the -b option. \n esxupdate --bundle ESX-4.0.0-update01a -b ESX400-200911223-UG\n\n ESX 3.5 patch ESX350-200912401-BG\n http://download3.vmware.com/software/vi/ESX350-200912401-BG.zip\n md5sum: f1d3589745b4ae933554785aef22bacc\n sha1sum: d1e5a9209b165d43d75f076e556fc028bec4cc47\n http://kb.vmware.com/kb/1016657\n\n ESX 3.0.3 patch ESX303-201002203-UG\n http://download3.vmware.com/software/vi/ESX303-201002203-UG.zip\n md5sum: 49ee56b687707cbe6999836c315f081a\n http://kb.vmware.com/kb/1018030\n\n ESX 2.5.5 Upgrade Patch 15\n http://download3.vmware.com/software/esx/esx-2.5.5-191611-upgrade.tar.gz\n md5sum: c346fe510b6e51145570e03083f77357\n sha1sum: ef6b19247825fb3fe2c55f8fda3cdd05ac7bb1f4\n http://www.vmware.com/support/esx25/doc/esx-255-200910-patch.html\n\n\n5. References\n http://www.acrossecurity.com/advisories.htm\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1564\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1565\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2042\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3707\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3732\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1138\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1139\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1140\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1142\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1141\n\n6. Change log\n2010-04-09 VMSA-2010-0007\nInitial security advisory after release of Workstation 6.5.4 and Fusion\n2.0.7 on 2010-04-08. \n\n- ------------------------------------------------------------------------\n7. Contact\n\nE-mail list for product security notifications and announcements:\nhttp://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce\n\nThis Security Advisory is posted to the following lists:\n\n * security-announce at lists.vmware.com\n * bugtraq at securityfocus.com\n * full-disclosure at lists.grok.org.uk\n\nE-mail: security at vmware.com\nPGP key at: http://kb.vmware.com/kb/1055\n\nVMware Security Center\nhttp://www.vmware.com/security\n\nVMware security response policy\nhttp://www.vmware.com/support/policies/security_response.html\n\nGeneral support life cycle policy\nhttp://www.vmware.com/support/policies/eos.html\n\nVMware Infrastructure support life cycle policy\nhttp://www.vmware.com/support/policies/eos_vi.html\n\nCopyright 2010 VMware Inc. All rights reserved. \n\n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.5 (MingW32)\n\niD8DBQFLvvM8S2KysvBH1xkRAgu/AJ9RrzlOq/5Ug0t8R4qoi/UwDVJDpACbBGgT\nd58bjKG6Ic7m/TsoJP4M2tw=\n=Q1zv\n-----END PGP SIGNATURE-----\n. \n-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n\n National Cyber Alert System\n\n Technical Cyber Security Alert TA10-238A\n\n\nMicrosoft Windows Insecurely Loads Dynamic Libraries\n\n Original release date: August 26, 2010\n Last revised: --\n Source: US-CERT\n\n\nSystems Affected\n\n Any application running on the Microsoft Windows platform that\n uses dynamically linked libraries (DLLs) may be affected. Please see the Vendor Information\n section of Vulnerability Note VU#707943 for information about\n specific vendors. DLLs are typically loaded\n when the application is first started; however DLLs may be loaded\n and unloaded while the application is running. An application can\n request a DLL file in a variety of ways, and Windows uses several\n different search algorithms to find DLL files. The interaction\n between the application and Windows can result in a DLL file being\n loaded from the current working directory of the application,\n instead of the Windows system directory or the directory where the\n application is installed. \n\n The current working directory could be the desktop, a removable\n storage device such as a USB key, a Windows file share, or a WebDAV\n location. When a file associated with an application is opened, a\n DLL in the same directory as the file may be loaded. Although an\n attacker may not have permission to write to the Windows system or\n application directories, the attacker may be able to write a DLL to\n a directory used to store files, or the attacker could provide\n their own directory. \n\n Attacks against this type of vulnerability have been referred to as\n \"binary planting.\" Please see Vulnerability Note VU#707943 and\n Microsoft Security Advisory 2269637 for more information. \n\n\nII. Impact\n\n By placing a DLL with the correct name (and possibly the relative\n directory path) in the current working directory, an attacker could\n execute arbitrary code with the privileges of the application that\n loads the DLL. \n\n\nIII. Solution\n\n Individual applications that run on the Windows platform may\n require patches or updates. Microsoft Knowledge Base article\n KB2264107 describes an update that provides a registry key that can\n prevent Windows from searching the current working directory for\n DLL files. \n\n Information about specific solutions for different vendors, general\n mitigation techniques, and secure ways for applications to load\n DLLs can be found in the Vendor Information and Solution sections\n of Vulnerability Note VU#707943. \n\n\nIV. References\n\n * Vulnerability Note VU#707943 -\n \u003chttp://www.kb.cert.org/vuls/id/707943\u003e\n\n * Microsoft Security Advisory (2269637) -\n \u003chttp://www.microsoft.com/technet/security/advisory/2269637.mspx\u003e\n\n * A new CWDIllegalInDllSearch registry entry is available to control\n the DLL search path algorithm -\n \u003chttp://support.microsoft.com/kb/2264107\u003e\n\n ____________________________________________________________________\n\n The most recent version of this document can be found at:\n\n \u003chttp://www.us-cert.gov/cas/techalerts/TA10-238A.html\u003e\n ____________________________________________________________________\n\n Feedback can be directed to US-CERT Technical Staff. Please send\n email to \u003ccert@cert.org\u003e with \"TA10-238A Feedback VU#707943\" in\n the subject. \n ____________________________________________________________________\n\n For instructions on subscribing to or unsubscribing from this\n mailing list, visit \u003chttp://www.us-cert.gov/cas/signup.html\u003e. \n ____________________________________________________________________\n\n Produced 2010 by US-CERT, a government organization. \n\nBackground\n==========\n\nVMware Player, Server, and Workstation allow emulation of a complete PC\non a PC without the usual performance overhead of most emulators. \n\nAffected packages\n=================\n\n -------------------------------------------------------------------\n Package / Vulnerable / Unaffected\n -------------------------------------------------------------------\n 1 app-emulation/vmware-player\n \u003c= 2.5.5.328052 Vulnerable!\n 2 app-emulation/vmware-workstation\n \u003c= 6.5.5.328052 Vulnerable!\n 3 app-emulation/vmware-server\n \u003c= 1.0.9.156507 Vulnerable!\n -------------------------------------------------------------------\n NOTE: Certain packages are still vulnerable. Users should migrate\n to another package if one is available or wait for the\n existing packages to be marked stable by their\n architecture maintainers. Please review the CVE identifiers referenced below for\ndetails. \n\nImpact\n======\n\nLocal users may be able to gain escalated privileges, cause a Denial of\nService, or gain sensitive information. \n\nA remote attacker could entice a user to open a specially crafted file,\npossibly resulting in the remote execution of arbitrary code, or a\nDenial of Service. Remote attackers also may be able to spoof DNS\ntraffic, read arbitrary files, or inject arbitrary web script to the\nVMware Server Console. \n\nFurthermore, guest OS users may be able to execute arbitrary code on\nthe host OS, gain escalated privileges on the guest OS, or cause a\nDenial of Service (crash the host OS). \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nGentoo discontinued support for VMware Workstation. We recommend that users\nunmerge VMware Server:\n\n # emerge --unmerge \"app-emulation/vmware-server\"\n\nReferences\n==========\n\n[ 1 ] CVE-2007-5269\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5269\n[ 2 ] CVE-2007-5503\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5503\n[ 3 ] CVE-2007-5671\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5671\n[ 4 ] CVE-2008-0967\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-0967\n[ 5 ] CVE-2008-1340\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1340\n[ 6 ] CVE-2008-1361\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1361\n[ 7 ] CVE-2008-1362\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1362\n[ 8 ] CVE-2008-1363\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1363\n[ 9 ] CVE-2008-1364\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1364\n[ 10 ] CVE-2008-1392\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1392\n[ 11 ] CVE-2008-1447\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1447\n[ 12 ] CVE-2008-1806\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1806\n[ 13 ] CVE-2008-1807\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1807\n[ 14 ] CVE-2008-1808\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1808\n[ 15 ] CVE-2008-2098\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2098\n[ 16 ] CVE-2008-2100\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2100\n[ 17 ] CVE-2008-2101\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2101\n[ 18 ] CVE-2008-4915\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4915\n[ 19 ] CVE-2008-4916\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4916\n[ 20 ] CVE-2008-4917\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4917\n[ 21 ] CVE-2009-0040\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0040\n[ 22 ] CVE-2009-0909\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0909\n[ 23 ] CVE-2009-0910\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0910\n[ 24 ] CVE-2009-1244\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-1244\n[ 25 ] CVE-2009-2267\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-2267\n[ 26 ] CVE-2009-3707\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3707\n[ 27 ] CVE-2009-3732\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3732\n[ 28 ] CVE-2009-3733\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3733\n[ 29 ] CVE-2009-4811\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-4811\n[ 30 ] CVE-2010-1137\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1137\n[ 31 ] CVE-2010-1138\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1138\n[ 32 ] CVE-2010-1139\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1139\n[ 33 ] CVE-2010-1140\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1140\n[ 34 ] CVE-2010-1141\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1141\n[ 35 ] CVE-2010-1142\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1142\n[ 36 ] CVE-2010-1143\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1143\n[ 37 ] CVE-2011-3868\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3868\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n http://security.gentoo.org/glsa/glsa-201209-25.xml\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2012 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttp://creativecommons.org/licenses/by-sa/2.5\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2010-1141"
},
{
"db": "CERT/CC",
"id": "VU#707943"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001364"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001999"
},
{
"db": "CNVD",
"id": "CNVD-2010-0574"
},
{
"db": "BID",
"id": "39392"
},
{
"db": "IVD",
"id": "7d7c8fb0-463f-11e9-a735-000c29342cb1"
},
{
"db": "IVD",
"id": "46c824c0-2356-11e6-abef-000c29c66e3d"
},
{
"db": "VULMON",
"id": "CVE-2010-1141"
},
{
"db": "PACKETSTORM",
"id": "88215"
},
{
"db": "PACKETSTORM",
"id": "93209"
},
{
"db": "PACKETSTORM",
"id": "117012"
}
],
"trust": 4.59
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2010-1141",
"trust": 4.0
},
{
"db": "SECUNIA",
"id": "39198",
"trust": 3.1
},
{
"db": "SECUNIA",
"id": "39206",
"trust": 2.5
},
{
"db": "SECTRACK",
"id": "1023832",
"trust": 1.8
},
{
"db": "SECTRACK",
"id": "1023833",
"trust": 1.8
},
{
"db": "CERT/CC",
"id": "VU#707943",
"trust": 1.7
},
{
"db": "USCERT",
"id": "TA10-238A",
"trust": 1.7
},
{
"db": "BID",
"id": "39392",
"trust": 1.2
},
{
"db": "CNVD",
"id": "CNVD-2010-0574",
"trust": 1.0
},
{
"db": "CNNVD",
"id": "CNNVD-201004-160",
"trust": 1.0
},
{
"db": "BID",
"id": "1699",
"trust": 0.8
},
{
"db": "VUPEN",
"id": "ADV-2010-0852",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001364",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001999",
"trust": 0.8
},
{
"db": "NSFOCUS",
"id": "14789",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "14788\u203b14789",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "14788",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20100409 VMSA-2010-0007 VMWARE HOSTED PRODUCTS, VCENTER SERVER AND ESX PATCHES RESOLVE MULTIPLE SECURITY ISSUES",
"trust": 0.6
},
{
"db": "MLIST",
"id": "[SECURITY-ANNOUNCE] 20100409 VMSA-2010-0007 VMWARE HOSTED PRODUCTS, VCENTER SERVER AND ESX PATCHES RESOLVE MULTIPLE SECURITY ISSUES",
"trust": 0.6
},
{
"db": "FULLDISC",
"id": "20100409 VMSA-2010-0007 VMWARE HOSTED PRODUCTS, VCENTER SERVER AND ESX PATCHES RESOLVE MULTIPLE SECURITY ISSUES",
"trust": 0.6
},
{
"db": "IVD",
"id": "7D7C8FB0-463F-11E9-A735-000C29342CB1",
"trust": 0.2
},
{
"db": "IVD",
"id": "46C824C0-2356-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "VULMON",
"id": "CVE-2010-1141",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "88215",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "93209",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "117012",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "7d7c8fb0-463f-11e9-a735-000c29342cb1"
},
{
"db": "IVD",
"id": "46c824c0-2356-11e6-abef-000c29c66e3d"
},
{
"db": "CERT/CC",
"id": "VU#707943"
},
{
"db": "CNVD",
"id": "CNVD-2010-0574"
},
{
"db": "VULMON",
"id": "CVE-2010-1141"
},
{
"db": "BID",
"id": "39392"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001364"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001999"
},
{
"db": "PACKETSTORM",
"id": "88215"
},
{
"db": "PACKETSTORM",
"id": "93209"
},
{
"db": "PACKETSTORM",
"id": "117012"
},
{
"db": "CNNVD",
"id": "CNNVD-201004-160"
},
{
"db": "NVD",
"id": "CVE-2010-1141"
}
]
},
"id": "VAR-200009-0023",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "7d7c8fb0-463f-11e9-a735-000c29342cb1"
},
{
"db": "IVD",
"id": "46c824c0-2356-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2010-0574"
}
],
"trust": 0.1
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 1.0
}
],
"sources": [
{
"db": "IVD",
"id": "7d7c8fb0-463f-11e9-a735-000c29342cb1"
},
{
"db": "IVD",
"id": "46c824c0-2356-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2010-0574"
}
]
},
"last_update_date": "2024-07-23T20:18:16.537000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "VMSA-2010-0007",
"trust": 0.8,
"url": "http://www.vmware.com/security/advisories/vmsa-2010-0007.html"
},
{
"title": "HT4105",
"trust": 0.8,
"url": "http://support.apple.com/kb/ht4105"
},
{
"title": "HT4105",
"trust": 0.8,
"url": "http://support.apple.com/kb/ht4105?viewlocale=ja_jp"
},
{
"title": "Opera Software\u304b\u3089\u306e\u60c5\u5831",
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu707943/844993/index.html"
},
{
"title": "Adobe\u304b\u3089\u306e\u60c5\u5831",
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu707943/244523/index.html"
},
{
"title": "LhaForge",
"trust": 0.8,
"url": "http://claybird.sakura.ne.jp/garage/lhaforge/index.html"
},
{
"title": "2010.2F9.2F7_ver_6.3.1",
"trust": 0.8,
"url": "http://lunapedia.lunascape.jp/index.php?title=lunascape6#2010.2f9.2f7_ver_6.3.1"
},
{
"title": "Another technique for Fixing DLL Preloading attacks",
"trust": 0.8,
"url": "http://blogs.msdn.com/b/david_leblanc/archive/2010/08/23/another-technique-for-fixing-dll-preloading-attacks.aspx"
},
{
"title": "More information about the DLL Preloading remote attack vector",
"trust": 0.8,
"url": "http://blogs.technet.com/b/srd/archive/2010/08/23/more-information-about-dll-preloading-remote-attack-vector.aspx"
},
{
"title": "Secure loading of libraries to prevent DLL preloading attacks - Guidance for Software Developers\u3000(Word \u6587\u66f8)",
"trust": 0.8,
"url": "http://blogs.technet.com/cfs-file.ashx/__key/communityserver-components-postattachments/00-03-35-14-21/secure-loading-of-libraries-to-prevent-dll-preloading.docx"
},
{
"title": "Dynamic-Link Library Security",
"trust": 0.8,
"url": "http://msdn.microsoft.com/ja-jp/library/ff919712%28v=vs.85%29.aspx"
},
{
"title": "2269637",
"trust": 0.8,
"url": "http://www.microsoft.com/technet/security/advisory/2269637.mspx"
},
{
"title": "Load Library Safely",
"trust": 0.8,
"url": "https://blogs.technet.microsoft.com/srd/2014/05/13/load-library-safely/"
},
{
"title": "DLL \u691c\u7d22\u30d1\u30b9\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0\u3092\u5236\u5fa1\u3059\u308b\u65b0\u3057\u3044 CWDIllegalInDllSearch \u30ec\u30b8\u30b9\u30c8\u30ea\u30a8\u30f3\u30c8\u30ea\u306b\u3064\u3044\u3066",
"trust": 0.8,
"url": "http://support.microsoft.com/kb/2264107"
},
{
"title": "NV11-003",
"trust": 0.8,
"url": "http://www.nec.co.jp/security-info/secinfo/nv11-003.html"
},
{
"title": "Microsoft Windows \u306b\u304a\u3051\u308b DLL \u8aad\u307f\u8fbc\u307f\u306b\u95a2\u3059\u308b\u8106\u5f31\u6027",
"trust": 0.8,
"url": "http://www.ponsoftware.com/archiver/bug.htm#load_lib"
},
{
"title": "\u691c\u7d22\u30d1\u30b9\u306e\u554f\u984c\u306b\u8d77\u56e0\u3059\u308b\u8106\u5f31\u6027",
"trust": 0.8,
"url": "http://www7a.biglobe.ne.jp/~schezo/dll_vul.html"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www5f.biglobe.ne.jp/~t-susumu"
},
{
"title": "MHSVI#20100824",
"trust": 0.8,
"url": "http://homepage3.nifty.com/micco/vul/2010/mhsvi20100824.htm"
},
{
"title": "sleipnirsleipnir_295",
"trust": 0.8,
"url": "http://www.fenrir.co.jp/blog/2010/10/sleipnirsleipnir_295.html"
},
{
"title": "2269637",
"trust": 0.8,
"url": "https://www.microsoft.com/japan/technet/security/advisory/2269637.mspx"
},
{
"title": "\u65b0\u305f\u306a\u30ea\u30e2\u30fc\u30c8\u306e\u653b\u6483\u624b\u6cd5\u306b\u95a2\u3059\u308b\u30a2\u30c9\u30d0\u30a4\u30b6\u30ea 2269637 \u3092\u516c\u958b",
"trust": 0.8,
"url": "http://blogs.technet.com/b/jpsecurity/archive/2010/08/24/3351474.aspx"
},
{
"title": "\u30e9\u30a4\u30d6\u30e9\u30ea\u3092\u5b89\u5168\u306b\u30ed\u30fc\u30c9\u3057\u3066 DLL \u306e\u30d7\u30ea\u30ed\u30fc\u30c9\u653b\u6483\u3092\u9632\u3050 - \u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u958b\u767a\u8005\u5411\u3051\u30ac\u30a4\u30c0\u30f3\u30b9 (Word \u6587\u66f8)",
"trust": 0.8,
"url": "http://blogs.technet.com/cfs-file.ashx/__key/communityserver-components-postattachments/00-03-35-14-74/secure-loading-of-libraries-to-prevent-dll-preloading_5f00_j.docx"
},
{
"title": "TA10-238A",
"trust": 0.8,
"url": "http://software.fujitsu.com/jp/security/vulnerabilities/ta10-238a.html"
},
{
"title": "VMSA - 2010 - 0007: VMware Managed Products, vCenter Server and ESX Multiple Security Patches",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/155"
},
{
"title": "VMware Security Advisories: VMware hosted products, vCenter Server and ESX patches resolve multiple security issues",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=vmware_security_advisories\u0026qid=9a156b22cf9a31c993f6585b6881d5a5"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2010-0574"
},
{
"db": "VULMON",
"id": "CVE-2010-1141"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001364"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001999"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-264",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-001364"
},
{
"db": "NVD",
"id": "CVE-2010-1141"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.1,
"url": "http://secunia.com/advisories/39198"
},
{
"trust": 2.5,
"url": "http://secunia.com/advisories/39206"
},
{
"trust": 1.9,
"url": "http://www.securitytracker.com/id?1023832"
},
{
"trust": 1.9,
"url": "http://www.securitytracker.com/id?1023833"
},
{
"trust": 1.8,
"url": "http://www.vmware.com/security/advisories/vmsa-2010-0007.html"
},
{
"trust": 1.7,
"url": "http://archives.neohapsis.com/archives/bugtraq/2010-04/0077.html"
},
{
"trust": 1.7,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0121.html"
},
{
"trust": 1.7,
"url": "http://lists.vmware.com/pipermail/security-announce/2010/000090.html"
},
{
"trust": 1.6,
"url": "http://www.us-cert.gov/cas/techalerts/ta10-238a.html"
},
{
"trust": 1.2,
"url": "http://security.gentoo.org/glsa/glsa-201209-25.xml"
},
{
"trust": 1.1,
"url": "http://www.acrossecurity.com/aspr/aspr-2010-04-12-1-pub.txt"
},
{
"trust": 1.1,
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a7020"
},
{
"trust": 0.9,
"url": "http://www.securityfocus.com/bid/39392"
},
{
"trust": 0.9,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-1141"
},
{
"trust": 0.8,
"url": "http://www.cert.org/blogs/vuls/2008/09/carpet_bombing_and_directory_p.html"
},
{
"trust": 0.8,
"url": "http://blog.mandiant.com/archives/1207"
},
{
"trust": 0.8,
"url": "http://msdn.microsoft.com/en-us/library/aa297182"
},
{
"trust": 0.8,
"url": "http://blog.zoller.lu/2010/08/cve-2010-xn-loadlibrarygetprocaddress.html"
},
{
"trust": 0.8,
"url": "http://msdn.microsoft.com/en-us/library/ms684175%28vs.85%29.aspx"
},
{
"trust": 0.8,
"url": "http://www.acrossecurity.com/aspr/aspr-2010-04-12-2-pub.txt"
},
{
"trust": 0.8,
"url": "http://www.acrossecurity.com/aspr/aspr-2010-08-18-1-pub.txt"
},
{
"trust": 0.8,
"url": "http://www.securityfocus.com/bid/1699/discuss"
},
{
"trust": 0.8,
"url": "http://blog.metasploit.com/2010/08/exploiting-dll-hijacking-flaws.html"
},
{
"trust": 0.8,
"url": "http://blog.rapid7.com/?p=5325"
},
{
"trust": 0.8,
"url": "http://www.cs.ucdavis.edu/research/tech-reports/2010/cse-2010-2.pdf"
},
{
"trust": 0.8,
"url": "https://www.microsoft.com/technet/security/advisory/2269637.mspx"
},
{
"trust": 0.8,
"url": "http://blogs.technet.com/b/srd/archive/2010/08/23/more-information-about-dll-preloading-remote-attack-vector.aspx"
},
{
"trust": 0.8,
"url": "http://blogs.msdn.com/b/david_leblanc/archive/2010/08/23/another-technique-for-fixing-dll-preloading-attacks.aspx"
},
{
"trust": 0.8,
"url": "http://support.microsoft.com/kb/2264107"
},
{
"trust": 0.8,
"url": "http://www.guninski.com/officedll.html"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnta10-238a/index.html"
},
{
"trust": 0.8,
"url": "http://jvn.jp/tr/jvntr-2010-23"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-1141"
},
{
"trust": 0.8,
"url": "http://www.vupen.com/english/advisories/2010/0852"
},
{
"trust": 0.8,
"url": "http://www.ipa.go.jp/about/press/20101111.html"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnta10-238a"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnvu707943"
},
{
"trust": 0.8,
"url": "http://jvn.jp/tr/jvntr-2010-23/"
},
{
"trust": 0.8,
"url": "http://www.kb.cert.org/vuls/id/707943"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/14788\u203b14789"
},
{
"trust": 0.3,
"url": "http://www.vmware.com"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-3732"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-3707"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/264.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "http://kb.vmware.com/kb/1015047"
},
{
"trust": 0.1,
"url": "http://download3.vmware.com/software/wkst/vmware-moviedecoder-6.5.4-246459.exe"
},
{
"trust": 0.1,
"url": "http://download3.vmware.com/software/esx/esx-2.5.5-191611-upgrade.tar.gz"
},
{
"trust": 0.1,
"url": "http://kb.vmware.com/kb/1016665"
},
{
"trust": 0.1,
"url": "http://www.vmware.com/support/esx25/doc/esx-255-200910-patch.html"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-3707"
},
{
"trust": 0.1,
"url": "https://hostupdate.vmware.com/software/vum/offline/release-192-20100228-732240/esx400-201002001.zip"
},
{
"trust": 0.1,
"url": "http://kb.vmware.com/kb/1018404"
},
{
"trust": 0.1,
"url": "http://download3.vmware.com/software/vi/esx303-201002203-ug.zip"
},
{
"trust": 0.1,
"url": "http://www.vmware.com/support/policies/lifecycle/vi/faq.html"
},
{
"trust": 0.1,
"url": "http://downloads.vmware.com/download/download.do?downloadgroup=fus-302"
},
{
"trust": 0.1,
"url": "http://downloads.vmware.com/download/download.do?downloadgroup=ace-254-win"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-1140"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-1140"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-1141"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-2042"
},
{
"trust": 0.1,
"url": "http://downloads.vmware.com/support/fusion3/doc/releasenotes_fusion_302.html"
},
{
"trust": 0.1,
"url": "http://downloads.vmware.com/tryvmware/?p=player\u0026lp=default"
},
{
"trust": 0.1,
"url": "http://kb.vmware.com/kb/1016657"
},
{
"trust": 0.1,
"url": "http://www.vmware.com/security"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-1565"
},
{
"trust": 0.1,
"url": "http://downloads.vmware.com/download/download.do?downloadgroup=wkst-701-lx"
},
{
"trust": 0.1,
"url": "http://kb.vmware.com/kb/1055"
},
{
"trust": 0.1,
"url": "https://hostupdate.vmware.com/software/vum/offline/release-193-20100228-731251/esxi400-201002001.zip"
},
{
"trust": 0.1,
"url": "http://downloads.vmware.com/support/player30/doc/releasenotes_player301.html"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-1142"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-1142"
},
{
"trust": 0.1,
"url": "http://downloads.vmware.com/download/download.do?downloadgroup=fus-207"
},
{
"trust": 0.1,
"url": "http://kb.vmware.com/kb/1017685"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-1139"
},
{
"trust": 0.1,
"url": "http://downloads.vmware.com/download/player/player_reg.html"
},
{
"trust": 0.1,
"url": "http://downloads.vmware.com/support/fusion2/doc/releasenotes_fusion_207.html"
},
{
"trust": 0.1,
"url": "http://www.vmware.com/support/policies/security_response.html"
},
{
"trust": 0.1,
"url": "http://downloads.vmware.com/support/ws65/doc/releasenotes_ws654.html"
},
{
"trust": 0.1,
"url": "http://downloads.vmware.com/support/ace26/doc/releasenotes_ace261.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-1139"
},
{
"trust": 0.1,
"url": "http://www.vmware.com/support/server2/doc/releasenotes_vmserver202.html"
},
{
"trust": 0.1,
"url": "http://www.vmware.com/support/policies/eos_vi.html"
},
{
"trust": 0.1,
"url": "http://kb.vmware.com/kb/1018030"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-2042"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-3732"
},
{
"trust": 0.1,
"url": "http://downloads.vmware.com/support/ws7/doc/releasenotes_ws701.html"
},
{
"trust": 0.1,
"url": "http://www.vmware.com/support/policies/eos.html"
},
{
"trust": 0.1,
"url": "http://downloads.vmware.com/support/player25/doc/releasenotes_player254.html"
},
{
"trust": 0.1,
"url": "http://downloads.vmware.com/download/download.do?downloadgroup=ace-261-win"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-1565"
},
{
"trust": 0.1,
"url": "http://www.vmware.com/download/server/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-1138"
},
{
"trust": 0.1,
"url": "http://downloads.vmware.com/download/download.do?downloadgroup=wkst-654-win"
},
{
"trust": 0.1,
"url": "http://www.vupen.com)"
},
{
"trust": 0.1,
"url": "http://download3.vmware.com/software/vi/esx350-200912401-bg.zip"
},
{
"trust": 0.1,
"url": "http://tinyurl.com/27mpjo"
},
{
"trust": 0.1,
"url": "http://www.acrossecurity.com)"
},
{
"trust": 0.1,
"url": "http://downloads.vmware.com/download/download.do?downloadgroup=wkst-701-win"
},
{
"trust": 0.1,
"url": "http://kb.vmware.com/kb/1014842"
},
{
"trust": 0.1,
"url": "https://hostupdate.vmware.com/software/vum/offline/release-166-20091202-254879/esx-4.0.0-update01a.zip"
},
{
"trust": 0.1,
"url": "http://www.acrossecurity.com/advisories.htm"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-1138"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-1564"
},
{
"trust": 0.1,
"url": "http://download3.vmware.com/software/vi/esxe350-201002401-o-sg.zip"
},
{
"trust": 0.1,
"url": "http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce"
},
{
"trust": 0.1,
"url": "http://downloads.vmware.com/support/ace25/doc/releasenotes_ace254.html"
},
{
"trust": 0.1,
"url": "http://downloads.vmware.com/download/download.do?downloadgroup=wkst-654-lx"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-1564"
},
{
"trust": 0.1,
"url": "http://kb.vmware.com/kb/1018403"
},
{
"trust": 0.1,
"url": "http://www.kb.cert.org/vuls/id/707943\u003e"
},
{
"trust": 0.1,
"url": "http://www.us-cert.gov/cas/techalerts/ta10-238a.html\u003e"
},
{
"trust": 0.1,
"url": "http://support.microsoft.com/kb/2264107\u003e"
},
{
"trust": 0.1,
"url": "http://www.microsoft.com/technet/security/advisory/2269637.mspx\u003e"
},
{
"trust": 0.1,
"url": "http://www.us-cert.gov/cas/signup.html\u003e."
},
{
"trust": 0.1,
"url": "http://www.us-cert.gov/legal.html\u003e"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2008-1363"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-3733"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-0909"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2008-1361"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2008-4915"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2008-4915"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2007-5269"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-3868"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2009-3732"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-1142"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2008-4917"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2008-2098"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2008-4916"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-1140"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-1141"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2008-1447"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2009-2267"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2009-0910"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2008-1362"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-1137"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-1138"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2007-5269"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2008-1447"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2008-1361"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-1139"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-1143"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2008-2098"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2008-1807"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2009-0040"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2008-2100"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2008-1340"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2008-4916"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2009-1244"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2009-3733"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2008-1808"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2008-1807"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2008-1392"
},
{
"trust": 0.1,
"url": "http://creativecommons.org/licenses/by-sa/2.5"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2008-2101"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2008-1806"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2009-0909"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-0040"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-2267"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2009-3707"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2008-2101"
},
{
"trust": 0.1,
"url": "http://security.gentoo.org/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2007-5671"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2008-4917"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2008-2100"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2008-1364"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2007-5503"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2008-0967"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2007-5671"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2008-1806"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2007-5503"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2008-1340"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2009-4811"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2008-1364"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2008-1363"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-0910"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2008-1392"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2008-1808"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2008-1362"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-1244"
},
{
"trust": 0.1,
"url": "https://bugs.gentoo.org."
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2008-0967"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#707943"
},
{
"db": "CNVD",
"id": "CNVD-2010-0574"
},
{
"db": "VULMON",
"id": "CVE-2010-1141"
},
{
"db": "BID",
"id": "39392"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001364"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001999"
},
{
"db": "PACKETSTORM",
"id": "88215"
},
{
"db": "PACKETSTORM",
"id": "93209"
},
{
"db": "PACKETSTORM",
"id": "117012"
},
{
"db": "CNNVD",
"id": "CNNVD-201004-160"
},
{
"db": "NVD",
"id": "CVE-2010-1141"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "7d7c8fb0-463f-11e9-a735-000c29342cb1"
},
{
"db": "IVD",
"id": "46c824c0-2356-11e6-abef-000c29c66e3d"
},
{
"db": "CERT/CC",
"id": "VU#707943"
},
{
"db": "CNVD",
"id": "CNVD-2010-0574"
},
{
"db": "VULMON",
"id": "CVE-2010-1141"
},
{
"db": "BID",
"id": "39392"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001364"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001999"
},
{
"db": "PACKETSTORM",
"id": "88215"
},
{
"db": "PACKETSTORM",
"id": "93209"
},
{
"db": "PACKETSTORM",
"id": "117012"
},
{
"db": "CNNVD",
"id": "CNNVD-201004-160"
},
{
"db": "NVD",
"id": "CVE-2010-1141"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-04-13T00:00:00",
"db": "IVD",
"id": "7d7c8fb0-463f-11e9-a735-000c29342cb1"
},
{
"date": "2010-04-13T00:00:00",
"db": "IVD",
"id": "46c824c0-2356-11e6-abef-000c29c66e3d"
},
{
"date": "2010-08-25T00:00:00",
"db": "CERT/CC",
"id": "VU#707943"
},
{
"date": "2010-04-13T00:00:00",
"db": "CNVD",
"id": "CNVD-2010-0574"
},
{
"date": "2010-04-12T00:00:00",
"db": "VULMON",
"id": "CVE-2010-1141"
},
{
"date": "2010-04-09T00:00:00",
"db": "BID",
"id": "39392"
},
{
"date": "2010-05-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001364"
},
{
"date": "2010-09-14T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001999"
},
{
"date": "2010-04-10T03:16:16",
"db": "PACKETSTORM",
"id": "88215"
},
{
"date": "2010-08-27T02:58:57",
"db": "PACKETSTORM",
"id": "93209"
},
{
"date": "2012-09-30T16:40:15",
"db": "PACKETSTORM",
"id": "117012"
},
{
"date": "2010-04-12T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201004-160"
},
{
"date": "2010-04-12T18:30:00.663000",
"db": "NVD",
"id": "CVE-2010-1141"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-10-13T00:00:00",
"db": "CERT/CC",
"id": "VU#707943"
},
{
"date": "2010-04-13T00:00:00",
"db": "CNVD",
"id": "CNVD-2010-0574"
},
{
"date": "2017-09-19T00:00:00",
"db": "VULMON",
"id": "CVE-2010-1141"
},
{
"date": "2012-10-01T19:10:00",
"db": "BID",
"id": "39392"
},
{
"date": "2010-05-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001364"
},
{
"date": "2016-11-09T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001999"
},
{
"date": "2010-04-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201004-160"
},
{
"date": "2017-09-19T01:30:34.547000",
"db": "NVD",
"id": "CVE-2010-1141"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201004-160"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "VMWare Tools Package Library Reference Code Execution Vulnerability",
"sources": [
{
"db": "IVD",
"id": "7d7c8fb0-463f-11e9-a735-000c29342cb1"
},
{
"db": "IVD",
"id": "46c824c0-2356-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2010-0574"
}
],
"trust": 1.0
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201004-160"
}
],
"trust": 0.6
}
}
VAR-201008-0241
Vulnerability from variot - Updated: 2024-07-23 19:34Untrusted search path vulnerability in the Microsoft Foundation Class (MFC) Library in Microsoft Visual Studio .NET 2003 SP1; Visual Studio 2005 SP1, 2008 SP1, and 2010; Visual C++ 2005 SP1, 2008 SP1, and 2010; and Exchange Server 2010 Service Pack 3, 2013, and 2013 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory during execution of an MFC application such as AtlTraceTool8.exe (aka ATL MFC Trace Tool), as demonstrated by a directory that contains a TRC, cur, rs, rct, or res file, aka "MFC Insecure Library Loading Vulnerability.". Some applications for Microsoft Windows may use unsafe methods for determining how to load DLLs. As a result, these applications can be forced to load a DLL from an attacker-controlled source rather than a trusted location. dwmapi.dll It may be possible to get permission through the file. Windows Program DLL There is an attackable vulnerability in reading. Dynamic link Library (DLL) Is a software component that is loaded at run time, not at program compile time. The program is LoadLibrary() And LoadLibraryEx() Using DLL Is read. Read DLL If no path is specified, specific directories are searched in order and found first. DLL Is loaded. Since this directory group includes the current directory of the process, the directory that can be operated by the attacker is set as the current directory. LoadLibrary() If is called, attack code may be executed. This issue can occur when browsing files located in directories that an attacker can manipulate. Read DLL The name depends on the program. DLL Read Windows The entire program may be affected. " Opera Software "and" Adobe Vulnerability information on " : Mitsui Bussan Secure Direction Co., Ltd. Takashi Yoshikawa MrA remote attacker could execute arbitrary code with the authority to execute the program. Attacker crafted DLL The USB Placing it on a drive or network drive may cause an attack. An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file. Microsoft ATL/MFC Trace Tool build 10.0.30319.1 is vulnerable; other versions may also be affected. Microsoft Visual Studio is a series of development tool suite products of Microsoft (Microsoft), and it is also a basically complete set of development tools. It includes most of the tools needed throughout the software lifecycle. A remote attacker could exploit this vulnerability to take complete control of an affected system and subsequently install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured with fewer system user rights are less affected than users with administrative user rights. ----------------------------------------------------------------------
Join Secunia @ FIRST Conference, 12-17 June, Hilton Vienna, Austria See to the presentation "The Dynamics and Threats of End-Point Software Portfolios" by Secunia's Research Analyst Director, Stefan Frei. Read more: http://conference.first.org/
TITLE: Attachmate Reflection for Secure IT Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA44906
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/44906/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=44906
RELEASE DATE: 2011-06-10
DISCUSS ADVISORY: http://secunia.com/advisories/44906/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/44906/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=44906
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Attachmate has acknowledged multiple vulnerabilities in Reflection for Secure IT, which can be exploited by malicious people to bypass certain security restrictions, cause a DoS (Denial of Service), and compromise a user's system.
For more information: SA36093 (vulnerability #2) SA44905
The vulnerabilities are reported in version 7.2 prior to SP1 in the following components: * Reflection for Secure IT Windows Server. * Reflection for Secure IT UNIX Client. * Reflection for Secure IT UNIX Server.
SOLUTION: Update to version 7.2 SP1.
ORIGINAL ADVISORY: Attachmate: http://support.attachmate.com/techdocs/2560.html http://support.attachmate.com/techdocs/2564.html http://support.attachmate.com/techdocs/2565.html http://support.attachmate.com/techdocs/2566.html
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
APPLE-SA-2015-09-16-3 iTunes 12.3
iTunes 12.3 is now available and addresses the following:
iTunes Available for: Windows 7 and later Impact: Applications that use CoreText may be vulnerable to unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in the processing of text files. These issues were addressed through improved memory handling. CVE-ID CVE-2015-1157 : Apple CVE-2015-3686 : John Villamil (@day6reak), Yahoo Pentest Team CVE-2015-3687 : John Villamil (@day6reak), Yahoo Pentest Team CVE-2015-3688 : John Villamil (@day6reak), Yahoo Pentest Team CVE-2015-5755 : John Villamil (@day6reak), Yahoo Pentest Team CVE-2015-5761 : John Villamil (@day6reak), Yahoo Pentest Team CVE-2015-5874 : John Villamil (@day6reak), Yahoo Pentest Team
iTunes Available for: Windows 7 and later Impact: Applications that use ICU may be vulnerable to unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in the processing of unicode strings. These issues were addressed by updating ICU to version 55. CVE-ID CVE-2014-8146 CVE-2015-1205
iTunes Available for: Windows 7 and later Impact: Opening a media file may lead to arbitrary code execution Description: A security issue existed in Microsoft Foundation Class's handling of library loading. This issue was addressed by updating to the latest version of the Microsoft Visual C++ Redistributable Package. CVE-ID CVE-2010-3190 : Stefan Kanthak
iTunes Available for: Windows 7 and later Impact: A man-in-the-middle attack while browsing the iTunes Store via iTunes may result in unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in WebKit. These issues were addressed through improved memory handling. CVE-ID CVE-2015-1152 : Apple CVE-2015-1153 : Apple CVE-2015-3730 : Apple CVE-2015-3731 : Apple CVE-2015-3733 : Apple CVE-2015-3734 : Apple CVE-2015-3735 : Apple CVE-2015-3736 : Apple CVE-2015-3737 : Apple CVE-2015-3738 : Apple CVE-2015-3739 : Apple CVE-2015-3740 : Apple CVE-2015-3741 : Apple CVE-2015-3742 : Apple CVE-2015-3743 : Apple CVE-2015-3744 : Apple CVE-2015-3745 : Apple CVE-2015-3746 : Apple CVE-2015-3747 : Apple CVE-2015-3748 : Apple CVE-2015-3749 : Apple CVE-2015-5789 : Apple CVE-2015-5790 : Apple CVE-2015-5791 : Apple CVE-2015-5792 : Apple CVE-2015-5793 : Apple CVE-2015-5794 : Apple CVE-2015-5795 : Apple CVE-2015-5796 : Apple CVE-2015-5797 : Apple CVE-2015-5798 : Apple CVE-2015-5799 : Apple CVE-2015-5800 : Apple CVE-2015-5801 : Apple CVE-2015-5802 : Apple CVE-2015-5803 : Apple CVE-2015-5804 : Apple CVE-2015-5805 CVE-2015-5806 : Apple CVE-2015-5807 : Apple CVE-2015-5808 : Joe Vennix CVE-2015-5809 : Apple CVE-2015-5810 : Apple CVE-2015-5811 : Apple CVE-2015-5812 : Apple CVE-2015-5813 : Apple CVE-2015-5814 : Apple CVE-2015-5815 : Apple CVE-2015-5816 : Apple CVE-2015-5817 : Apple CVE-2015-5818 : Apple CVE-2015-5819 : Apple CVE-2015-5821 : Apple CVE-2015-5822 : Mark S. Miller of Google CVE-2015-5823 : Apple
Software Update Impact: An attacker in a privileged network position may be able to obtain encrypted SMB credentials Description: A redirection issue existed in the handling of certain network connections. This issue was addressed through improved resource validation. CVE-ID CVE-2015-5920 : Cylance
iTunes 12.3 may be obtained from: http://www.apple.com/itunes/download/
You may also update to the latest version of iTunes via Apple Software Update, which can be found in the Start menu.
Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org
iQIcBAEBCAAGBQJV+axbAAoJEBcWfLTuOo7tLSYP/1NCYHZeWYxqLnLgHgCcNRF/ iqZ7hq9UgxomXxoDVknvvWc61Z+UW6VIgGzEfzSlO9APIGC7ia1tdKl66oMEYSal aGt5AJc9c55RuuvgF/IxgICRsuXjHsAmlQb5FPqwe2gSJYxggCfhObdQ/ShbP2kp mV8sYiJJiKkYZqFDH17fvtAWV3GZ7CtXfneWDHlerJunbuUzWLpjWcYwbaiD/1C2 5CTohgHbTMtG2MGRacFXeYAXFhbnr6mXcxy+7Zee3B6x33/ypA/Q+KaIxPv4bssr 7XXzYin8bdMHlW6MWuCmyzJd2P/4opKvzNeyoZb1BM02k0Fb7SWDMwFA9UVovsX5 yCNKn0rg1nMhbXLjpob7G0GYfHNeGOy5PqKu3PXF++R4H5kGr9v2CZH+8dIU5+J7 LFyDSBZ4vlMsCYTRfI1PEUM6w3d+whrBl9vagVeJZG5gkSrZXftALjZsQXUhgqZH mKDcSj/leCTbbbHMPq/NngQuUXzVRe+SJwVtSJEfQSg2yGCdBGTsjqftcOeDgVUL vHR0KkZ4lVx5Aq48XFfXXvn5d3g+kP5pTeVbGdWFmf7XNDp3Vap5ATlTF5UF4EKt jHPGMzWZwvEkdzDryynsTzrMR3TjTb7dDtXH6LEoKfOwIyxnH6+g8K1DbgdXgiJo dL48EUi+MBq820BzP1fp =cz5N -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201008-0241",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "visual studio",
"scope": "eq",
"trust": 2.7,
"vendor": "microsoft",
"version": "2005"
},
{
"model": "visual studio",
"scope": "eq",
"trust": 2.4,
"vendor": "microsoft",
"version": "2008"
},
{
"model": "visual studio",
"scope": "eq",
"trust": 2.4,
"vendor": "microsoft",
"version": "2010"
},
{
"model": "visual c\\+\\+",
"scope": "eq",
"trust": 1.6,
"vendor": "microsoft",
"version": "2008"
},
{
"model": "visual c\\+\\+",
"scope": "eq",
"trust": 1.6,
"vendor": "microsoft",
"version": "2010"
},
{
"model": "visual c\\+\\+",
"scope": "eq",
"trust": 1.6,
"vendor": "microsoft",
"version": "2005"
},
{
"model": "visual studio .net",
"scope": "eq",
"trust": 1.3,
"vendor": "microsoft",
"version": "2003"
},
{
"model": "itunes",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "12.1.3"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "abvent",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "adobe",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "apple",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "atomix productions",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "autodesk",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "avast antivirus",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "bentley",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "bittorrent",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "bitmanagement",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "conceiva",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "corel",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "cyberlink",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "daemon tools",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "dassault systemes",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "divx",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "ezb",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "ecava",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "fengtao",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "gfi",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "graphisoft",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "gilles vollant",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "guidance",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "httrack",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "ibm",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "izarc",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "inkscape",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "maxthon",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "microchip",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "microsoft",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "mozilla",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "netstumbler",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "nokia",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "norman",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "nullsoft",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "opera",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "pgp",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "pkware",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "pixia",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "realnetworks",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sisoftware",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "smart projects",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sonic",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sony",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sweetscape",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "teamviewer",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "techsmith",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "tortoisesvn",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "tracker",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "vmware",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "videolan",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "winmerge",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "wireshark",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "wolters kluwer",
"version": null
},
{
"model": "itunes",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "12.3 (windows 7 or later )"
},
{
"model": "visual c++",
"scope": "eq",
"trust": 0.8,
"vendor": "microsoft",
"version": "2005"
},
{
"model": "visual c++",
"scope": "eq",
"trust": 0.8,
"vendor": "microsoft",
"version": "2008"
},
{
"model": "visual c++",
"scope": "eq",
"trust": 0.8,
"vendor": "microsoft",
"version": "2010"
},
{
"model": "visual studio",
"scope": "eq",
"trust": 0.8,
"vendor": "microsoft",
"version": ".net 2003"
},
{
"model": "lhaforge",
"scope": "lte",
"trust": 0.8,
"vendor": "claybird",
"version": "1.5.1 and earlier"
},
{
"model": "webotx",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "v8.3"
},
{
"model": "enterprisedirectoryserver",
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": "webotx",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "v8.4"
},
{
"model": "securebranch",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "soho xp dedicated application securebranch accessmanager ver2.2.18 before"
},
{
"model": "webotx",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "v6.4"
},
{
"model": "webotx",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "v6.2"
},
{
"model": "webotx",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "v8.2"
},
{
"model": "explzh",
"scope": "lte",
"trust": 0.8,
"vendor": "pon",
"version": "v.5.65 and earlier"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "9"
},
{
"model": "securebranch",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "soho vista dedicated application securebranch accessmanager ver3.0.13 before"
},
{
"model": "lunascape",
"scope": "lte",
"trust": 0.8,
"vendor": "lunascape",
"version": "6.3.0 and earlier"
},
{
"model": "securefinger",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "fingerprint authentication runtime ( c / s edition) all versions"
},
{
"model": "webotx",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "client v7.1"
},
{
"model": "webotx",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "v6.5"
},
{
"model": "esmpro/serveragentservice",
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": "lhmelt",
"scope": "lte",
"trust": 0.8,
"vendor": "micco",
"version": "1.65.1.2 and earlier"
},
{
"model": "webotx",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "download server v7.1"
},
{
"model": "esmpro/serveragent",
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": "webotx",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "client v5.3"
},
{
"model": "terapad",
"scope": "lte",
"trust": 0.8,
"vendor": "terao progress",
"version": "ver.1.00\\u3000 and earlier"
},
{
"model": "sleipnir",
"scope": "lte",
"trust": 0.8,
"vendor": "fenrir",
"version": "2.9.5 and earlier"
},
{
"model": "securefinger",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "fingerprint authentication utility ad all versions"
},
{
"model": "lhaplus",
"scope": "lte",
"trust": 0.8,
"vendor": "schezo",
"version": "1.57 and earlier"
},
{
"model": "webotx",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "v6.3"
},
{
"model": "infoframe documentskipper",
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": "webotx",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "downloader v5.3"
},
{
"model": "webotx",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "download contents v8.2"
},
{
"model": "visual studio sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "2010"
},
{
"model": "visual studio",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "20100"
},
{
"model": "visual studio sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "2008"
},
{
"model": "visual studio",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "20080"
},
{
"model": "visual studio team edition for testers",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "20050"
},
{
"model": "visual studio team edition for developers",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "20050"
},
{
"model": "visual studio team edition for architects",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "20050"
},
{
"model": "visual studio team edition",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "20050"
},
{
"model": "visual studio standard edition",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "20050"
},
{
"model": "visual studio professional edition",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "20050"
},
{
"model": "visual studio premier partner edition enu",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "2005-8.0.50727.42"
},
{
"model": "visual studio 64-bit hosted visual c++ tools sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "2005"
},
{
"model": "visual studio sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "2005"
},
{
"model": "visual studio .net",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "20050"
},
{
"model": "visual studio .net enterprise architect",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "2003"
},
{
"model": "visual studio .net sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "2003"
},
{
"model": "visual c++ redistributable package sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "2010"
},
{
"model": "visual c++ redistributable package",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "20100"
},
{
"model": "visual c++ redistributable package sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "2008"
},
{
"model": "visual c++ redistributable package",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "20080"
},
{
"model": "visual c++ redistributable package sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "2005"
},
{
"model": "visual c++ redistributable package",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "20050"
},
{
"model": "exchange server",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "20160"
},
{
"model": "exchange server",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "20130"
},
{
"model": "exchange server sp3",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "2010"
},
{
"model": "atl/mfc trace tool build",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "10.0.30319.1"
},
{
"model": "messaging application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"model": "messaging application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5"
},
{
"model": "messaging application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "4"
},
{
"model": "meeting exchange webportal",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "-6.0"
},
{
"model": "meeting exchange web conferencing server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "-0"
},
{
"model": "meeting exchange streaming server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "-0"
},
{
"model": "meeting exchange recording server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "-0"
},
{
"model": "meeting exchange client registration server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "-0"
},
{
"model": "meeting exchange",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0.0.52"
},
{
"model": "meeting exchange sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"model": "meeting exchange sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"model": "meeting exchange",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"model": "meeting exchange sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.1"
},
{
"model": "meeting exchange",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.1"
},
{
"model": "meeting exchange sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0"
},
{
"model": "meeting exchange sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0"
},
{
"model": "meeting exchange",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0"
},
{
"model": "communication server telephony manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "10004.0"
},
{
"model": "communication server telephony manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "10003.0"
},
{
"model": "callpilot",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0"
},
{
"model": "callpilot",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "4.0"
},
{
"model": "aura conferencing standard",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "aura conferencing sp1 standard",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "reflection",
"scope": "eq",
"trust": 0.3,
"vendor": "attachmate",
"version": "x2011"
},
{
"model": "reflection suite for",
"scope": "eq",
"trust": 0.3,
"vendor": "attachmate",
"version": "x2011"
},
{
"model": "reflection for secure it windows server",
"scope": "eq",
"trust": 0.3,
"vendor": "attachmate",
"version": "7.2"
},
{
"model": "reflection for secure it windows server sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "attachmate",
"version": "7.0"
},
{
"model": "reflection for secure it windows server sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "attachmate",
"version": "7.0"
},
{
"model": "reflection for secure it windows server",
"scope": "eq",
"trust": 0.3,
"vendor": "attachmate",
"version": "6.0"
},
{
"model": "reflection for secure it unix server",
"scope": "eq",
"trust": 0.3,
"vendor": "attachmate",
"version": "7.2"
},
{
"model": "reflection for secure it unix server sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "attachmate",
"version": "7.0"
},
{
"model": "reflection for secure it unix server",
"scope": "eq",
"trust": 0.3,
"vendor": "attachmate",
"version": "6.0"
},
{
"model": "reflection for secure it unix client",
"scope": "eq",
"trust": 0.3,
"vendor": "attachmate",
"version": "7.2"
},
{
"model": "reflection for secure it unix client sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "attachmate",
"version": "7.0"
},
{
"model": "reflection for secure it unix client",
"scope": "eq",
"trust": 0.3,
"vendor": "attachmate",
"version": "6.0"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "11.2.1"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "11.1.5"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "11.1.4"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "11.1.3"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "11.1.2"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "11.0.5"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "11.0.4"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "11.0.2"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.6.3"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.6.1"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.5.1"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.1.2"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.0.2"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.0.1"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.0"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.3.2"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.3"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.2"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.0.5"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.0.4"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.0.1"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.0"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.0"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.8"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.7.1"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.6"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.5"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.72"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.2.1"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.2"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.1.1"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.1"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.0.3"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.2"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.1"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.0.2.20"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.4"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "12.2"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "12.0.1"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "11.2"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "11.1.1"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "11.1"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "11.0.3"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "11.0.1"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "11.0.0.163"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "11.0"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.7"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.6.1.7"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.6"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.5.2"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.5.1.42"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.5"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.4.1.10"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.4.1"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.4.0.80"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.4"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.3.1"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.3"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.2.2.12"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.2.2"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.2"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.1.1.4"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.1.1"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.1"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.0.1"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10"
},
{
"model": "reflection for secure it windows server sp1",
"scope": "ne",
"trust": 0.3,
"vendor": "attachmate",
"version": "7.2"
},
{
"model": "reflection for secure it unix server sp1",
"scope": "ne",
"trust": 0.3,
"vendor": "attachmate",
"version": "7.2"
},
{
"model": "reflection for secure it unix client sp1",
"scope": "ne",
"trust": 0.3,
"vendor": "attachmate",
"version": "7.2"
},
{
"model": "itunes",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "12.3"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#707943"
},
{
"db": "BID",
"id": "42811"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001916"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001999"
},
{
"db": "CNNVD",
"id": "CNNVD-201008-381"
},
{
"db": "NVD",
"id": "CVE-2010-3190"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:apple:itunes:12.1.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:microsoft:visual_c\\+\\+:2005:sp1:*:*:redistributable_package:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:visual_c\\+\\+:2008:sp1:*:*:redistributable_package:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:visual_c\\+\\+:2010:sp1:*:*:redistributable_package:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:visual_studio:2005:sp1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:visual_studio:2008:sp1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:visual_studio:2010:-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:visual_studio_.net:2003:sp1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2010-3190"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "0xjudd",
"sources": [
{
"db": "BID",
"id": "42811"
}
],
"trust": 0.3
},
"cve": "CVE-2010-3190",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 9.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2010-3190",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-45795",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2010-3190",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#707943",
"trust": 0.8,
"value": "64.13"
},
{
"author": "CNNVD",
"id": "CNNVD-201008-381",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-45795",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#707943"
},
{
"db": "VULHUB",
"id": "VHN-45795"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001916"
},
{
"db": "CNNVD",
"id": "CNNVD-201008-381"
},
{
"db": "NVD",
"id": "CVE-2010-3190"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Untrusted search path vulnerability in the Microsoft Foundation Class (MFC) Library in Microsoft Visual Studio .NET 2003 SP1; Visual Studio 2005 SP1, 2008 SP1, and 2010; Visual C++ 2005 SP1, 2008 SP1, and 2010; and Exchange Server 2010 Service Pack 3, 2013, and 2013 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory during execution of an MFC application such as AtlTraceTool8.exe (aka ATL MFC Trace Tool), as demonstrated by a directory that contains a TRC, cur, rs, rct, or res file, aka \"MFC Insecure Library Loading Vulnerability.\". Some applications for Microsoft Windows may use unsafe methods for determining how to load DLLs. As a result, these applications can be forced to load a DLL from an attacker-controlled source rather than a trusted location. dwmapi.dll It may be possible to get permission through the file. Windows Program DLL There is an attackable vulnerability in reading. Dynamic link Library (DLL) Is a software component that is loaded at run time, not at program compile time. The program is LoadLibrary() And LoadLibraryEx() Using DLL Is read. Read DLL If no path is specified, specific directories are searched in order and found first. DLL Is loaded. Since this directory group includes the current directory of the process, the directory that can be operated by the attacker is set as the current directory. LoadLibrary() If is called, attack code may be executed. This issue can occur when browsing files located in directories that an attacker can manipulate. Read DLL The name depends on the program. DLL Read Windows The entire program may be affected. \" Opera Software \"and\" Adobe Vulnerability information on \" : Mitsui Bussan Secure Direction Co., Ltd. Takashi Yoshikawa MrA remote attacker could execute arbitrary code with the authority to execute the program. Attacker crafted DLL The USB Placing it on a drive or network drive may cause an attack. \nAn attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file. \nMicrosoft ATL/MFC Trace Tool build 10.0.30319.1 is vulnerable; other versions may also be affected. Microsoft Visual Studio is a series of development tool suite products of Microsoft (Microsoft), and it is also a basically complete set of development tools. It includes most of the tools needed throughout the software lifecycle. A remote attacker could exploit this vulnerability to take complete control of an affected system and subsequently install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured with fewer system user rights are less affected than users with administrative user rights. ----------------------------------------------------------------------\n\n\nJoin Secunia @ FIRST Conference, 12-17 June, Hilton Vienna, Austria\nSee to the presentation \"The Dynamics and Threats of End-Point Software Portfolios\" by Secunia\u0027s Research Analyst Director, Stefan Frei. \nRead more:\nhttp://conference.first.org/ \n\n\n----------------------------------------------------------------------\n\nTITLE:\nAttachmate Reflection for Secure IT Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA44906\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/44906/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=44906\n\nRELEASE DATE:\n2011-06-10\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/44906/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/44906/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=44906\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nAttachmate has acknowledged multiple vulnerabilities in Reflection\nfor Secure IT, which can be exploited by malicious people to bypass\ncertain security restrictions, cause a DoS (Denial of Service), and\ncompromise a user\u0027s system. \n\nFor more information:\nSA36093 (vulnerability #2)\nSA44905\n\nThe vulnerabilities are reported in version 7.2 prior to SP1 in the\nfollowing components:\n* Reflection for Secure IT Windows Server. \n* Reflection for Secure IT UNIX Client. \n* Reflection for Secure IT UNIX Server. \n\nSOLUTION:\nUpdate to version 7.2 SP1. \n\nORIGINAL ADVISORY:\nAttachmate:\nhttp://support.attachmate.com/techdocs/2560.html\nhttp://support.attachmate.com/techdocs/2564.html\nhttp://support.attachmate.com/techdocs/2565.html\nhttp://support.attachmate.com/techdocs/2566.html\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-2015-09-16-3 iTunes 12.3\n\niTunes 12.3 is now available and addresses the following:\n\niTunes\nAvailable for: Windows 7 and later\nImpact: Applications that use CoreText may be vulnerable to\nunexpected application termination or arbitrary code execution\nDescription: Multiple memory corruption issues existed in the\nprocessing of text files. These issues were addressed through\nimproved memory handling. \nCVE-ID\nCVE-2015-1157 : Apple\nCVE-2015-3686 : John Villamil (@day6reak), Yahoo Pentest Team\nCVE-2015-3687 : John Villamil (@day6reak), Yahoo Pentest Team\nCVE-2015-3688 : John Villamil (@day6reak), Yahoo Pentest Team\nCVE-2015-5755 : John Villamil (@day6reak), Yahoo Pentest Team\nCVE-2015-5761 : John Villamil (@day6reak), Yahoo Pentest Team\nCVE-2015-5874 : John Villamil (@day6reak), Yahoo Pentest Team\n\niTunes\nAvailable for: Windows 7 and later\nImpact: Applications that use ICU may be vulnerable to unexpected\napplication termination or arbitrary code execution\nDescription: Multiple memory corruption issues existed in the\nprocessing of unicode strings. These issues were addressed by\nupdating ICU to version 55. \nCVE-ID\nCVE-2014-8146\nCVE-2015-1205\n\niTunes\nAvailable for: Windows 7 and later\nImpact: Opening a media file may lead to arbitrary code execution\nDescription: A security issue existed in Microsoft Foundation\nClass\u0027s handling of library loading. This issue was addressed by\nupdating to the latest version of the Microsoft Visual C++\nRedistributable Package. \nCVE-ID\nCVE-2010-3190 : Stefan Kanthak\n\niTunes\nAvailable for: Windows 7 and later\nImpact: A man-in-the-middle attack while browsing the iTunes Store\nvia iTunes may result in unexpected application termination or\narbitrary code execution\nDescription: Multiple memory corruption issues existed in WebKit. \nThese issues were addressed through improved memory handling. \nCVE-ID\nCVE-2015-1152 : Apple\nCVE-2015-1153 : Apple\nCVE-2015-3730 : Apple\nCVE-2015-3731 : Apple\nCVE-2015-3733 : Apple\nCVE-2015-3734 : Apple\nCVE-2015-3735 : Apple\nCVE-2015-3736 : Apple\nCVE-2015-3737 : Apple\nCVE-2015-3738 : Apple\nCVE-2015-3739 : Apple\nCVE-2015-3740 : Apple\nCVE-2015-3741 : Apple\nCVE-2015-3742 : Apple\nCVE-2015-3743 : Apple\nCVE-2015-3744 : Apple\nCVE-2015-3745 : Apple\nCVE-2015-3746 : Apple\nCVE-2015-3747 : Apple\nCVE-2015-3748 : Apple\nCVE-2015-3749 : Apple\nCVE-2015-5789 : Apple\nCVE-2015-5790 : Apple\nCVE-2015-5791 : Apple\nCVE-2015-5792 : Apple\nCVE-2015-5793 : Apple\nCVE-2015-5794 : Apple\nCVE-2015-5795 : Apple\nCVE-2015-5796 : Apple\nCVE-2015-5797 : Apple\nCVE-2015-5798 : Apple\nCVE-2015-5799 : Apple\nCVE-2015-5800 : Apple\nCVE-2015-5801 : Apple\nCVE-2015-5802 : Apple\nCVE-2015-5803 : Apple\nCVE-2015-5804 : Apple\nCVE-2015-5805\nCVE-2015-5806 : Apple\nCVE-2015-5807 : Apple\nCVE-2015-5808 : Joe Vennix\nCVE-2015-5809 : Apple\nCVE-2015-5810 : Apple\nCVE-2015-5811 : Apple\nCVE-2015-5812 : Apple\nCVE-2015-5813 : Apple\nCVE-2015-5814 : Apple\nCVE-2015-5815 : Apple\nCVE-2015-5816 : Apple\nCVE-2015-5817 : Apple\nCVE-2015-5818 : Apple\nCVE-2015-5819 : Apple\nCVE-2015-5821 : Apple\nCVE-2015-5822 : Mark S. Miller of Google\nCVE-2015-5823 : Apple\n\nSoftware Update\nImpact: An attacker in a privileged network position may be able to\nobtain encrypted SMB credentials\nDescription: A redirection issue existed in the handling of certain\nnetwork connections. This issue was addressed through improved\nresource validation. \nCVE-ID\nCVE-2015-5920 : Cylance\n\n\niTunes 12.3 may be obtained from:\nhttp://www.apple.com/itunes/download/\n\nYou may also update to the latest version of iTunes via Apple\nSoftware Update, which can be found in the Start menu. \n\nInformation will also be posted to the Apple Security Updates\nweb site: https://support.apple.com/kb/HT201222\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\nComment: GPGTools - http://gpgtools.org\n\niQIcBAEBCAAGBQJV+axbAAoJEBcWfLTuOo7tLSYP/1NCYHZeWYxqLnLgHgCcNRF/\niqZ7hq9UgxomXxoDVknvvWc61Z+UW6VIgGzEfzSlO9APIGC7ia1tdKl66oMEYSal\naGt5AJc9c55RuuvgF/IxgICRsuXjHsAmlQb5FPqwe2gSJYxggCfhObdQ/ShbP2kp\nmV8sYiJJiKkYZqFDH17fvtAWV3GZ7CtXfneWDHlerJunbuUzWLpjWcYwbaiD/1C2\n5CTohgHbTMtG2MGRacFXeYAXFhbnr6mXcxy+7Zee3B6x33/ypA/Q+KaIxPv4bssr\n7XXzYin8bdMHlW6MWuCmyzJd2P/4opKvzNeyoZb1BM02k0Fb7SWDMwFA9UVovsX5\nyCNKn0rg1nMhbXLjpob7G0GYfHNeGOy5PqKu3PXF++R4H5kGr9v2CZH+8dIU5+J7\nLFyDSBZ4vlMsCYTRfI1PEUM6w3d+whrBl9vagVeJZG5gkSrZXftALjZsQXUhgqZH\nmKDcSj/leCTbbbHMPq/NngQuUXzVRe+SJwVtSJEfQSg2yGCdBGTsjqftcOeDgVUL\nvHR0KkZ4lVx5Aq48XFfXXvn5d3g+kP5pTeVbGdWFmf7XNDp3Vap5ATlTF5UF4EKt\njHPGMzWZwvEkdzDryynsTzrMR3TjTb7dDtXH6LEoKfOwIyxnH6+g8K1DbgdXgiJo\ndL48EUi+MBq820BzP1fp\n=cz5N\n-----END PGP SIGNATURE-----\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2010-3190"
},
{
"db": "CERT/CC",
"id": "VU#707943"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001916"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001999"
},
{
"db": "BID",
"id": "42811"
},
{
"db": "VULHUB",
"id": "VHN-45795"
},
{
"db": "PACKETSTORM",
"id": "102169"
},
{
"db": "PACKETSTORM",
"id": "133618"
}
],
"trust": 3.6
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-45795",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-45795"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2010-3190",
"trust": 2.9
},
{
"db": "BID",
"id": "42811",
"trust": 2.8
},
{
"db": "USCERT",
"id": "TA11-102A",
"trust": 2.5
},
{
"db": "SECUNIA",
"id": "41212",
"trust": 2.5
},
{
"db": "CERT/CC",
"id": "VU#707943",
"trust": 1.6
},
{
"db": "USCERT",
"id": "TA10-238A",
"trust": 1.6
},
{
"db": "SECUNIA",
"id": "44906",
"trust": 0.9
},
{
"db": "BID",
"id": "1699",
"trust": 0.8
},
{
"db": "SECUNIA",
"id": "44905",
"trust": 0.8
},
{
"db": "SECUNIA",
"id": "40983",
"trust": 0.8
},
{
"db": "SECTRACK",
"id": "1025630",
"trust": 0.8
},
{
"db": "SECTRACK",
"id": "1025346",
"trust": 0.8
},
{
"db": "USCERT",
"id": "SA11-102A",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU99970459",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001916",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001999",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201008-381",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "133618",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-45795",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "102169",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#707943"
},
{
"db": "VULHUB",
"id": "VHN-45795"
},
{
"db": "BID",
"id": "42811"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001916"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001999"
},
{
"db": "PACKETSTORM",
"id": "102169"
},
{
"db": "PACKETSTORM",
"id": "133618"
},
{
"db": "CNNVD",
"id": "CNNVD-201008-381"
},
{
"db": "NVD",
"id": "CVE-2010-3190"
}
]
},
"id": "VAR-201008-0241",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-45795"
}
],
"trust": 0.01
},
"last_update_date": "2024-07-23T19:34:29.934000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "APPLE-SA-2015-09-16-3 iTunes 12.3",
"trust": 0.8,
"url": "http://lists.apple.com/archives/security-announce/2015/sep/msg00003.html"
},
{
"title": "HT205221",
"trust": 0.8,
"url": "https://support.apple.com/en-us/ht205221"
},
{
"title": "HT205221",
"trust": 0.8,
"url": "http://support.apple.com/ja-jp/ht205221"
},
{
"title": "MS11-025",
"trust": 0.8,
"url": "http://www.microsoft.com/technet/security/bulletin/ms11-025.mspx"
},
{
"title": "MS11-025",
"trust": 0.8,
"url": "http://www.microsoft.com/japan/technet/security/bulletin/ms11-025.mspx"
},
{
"title": "MS11-025e",
"trust": 0.8,
"url": "http://www.microsoft.com/japan/security/bulletins/ms11-025e.mspx"
},
{
"title": "TA11-102A",
"trust": 0.8,
"url": "http://software.fujitsu.com/jp/security/vulnerabilities/ta11-102a.html"
},
{
"title": "HT4105",
"trust": 0.8,
"url": "http://support.apple.com/kb/ht4105"
},
{
"title": "HT4105",
"trust": 0.8,
"url": "http://support.apple.com/kb/ht4105?viewlocale=ja_jp"
},
{
"title": "Opera Software\u304b\u3089\u306e\u60c5\u5831",
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu707943/844993/index.html"
},
{
"title": "Adobe\u304b\u3089\u306e\u60c5\u5831",
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu707943/244523/index.html"
},
{
"title": "LhaForge",
"trust": 0.8,
"url": "http://claybird.sakura.ne.jp/garage/lhaforge/index.html"
},
{
"title": "2010.2F9.2F7_ver_6.3.1",
"trust": 0.8,
"url": "http://lunapedia.lunascape.jp/index.php?title=lunascape6#2010.2f9.2f7_ver_6.3.1"
},
{
"title": "Another technique for Fixing DLL Preloading attacks",
"trust": 0.8,
"url": "http://blogs.msdn.com/b/david_leblanc/archive/2010/08/23/another-technique-for-fixing-dll-preloading-attacks.aspx"
},
{
"title": "More information about the DLL Preloading remote attack vector",
"trust": 0.8,
"url": "http://blogs.technet.com/b/srd/archive/2010/08/23/more-information-about-dll-preloading-remote-attack-vector.aspx"
},
{
"title": "Secure loading of libraries to prevent DLL preloading attacks - Guidance for Software Developers\u3000(Word \u6587\u66f8)",
"trust": 0.8,
"url": "http://blogs.technet.com/cfs-file.ashx/__key/communityserver-components-postattachments/00-03-35-14-21/secure-loading-of-libraries-to-prevent-dll-preloading.docx"
},
{
"title": "Dynamic-Link Library Security",
"trust": 0.8,
"url": "http://msdn.microsoft.com/ja-jp/library/ff919712%28v=vs.85%29.aspx"
},
{
"title": "2269637",
"trust": 0.8,
"url": "http://www.microsoft.com/technet/security/advisory/2269637.mspx"
},
{
"title": "Load Library Safely",
"trust": 0.8,
"url": "https://blogs.technet.microsoft.com/srd/2014/05/13/load-library-safely/"
},
{
"title": "DLL \u691c\u7d22\u30d1\u30b9\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0\u3092\u5236\u5fa1\u3059\u308b\u65b0\u3057\u3044 CWDIllegalInDllSearch \u30ec\u30b8\u30b9\u30c8\u30ea\u30a8\u30f3\u30c8\u30ea\u306b\u3064\u3044\u3066",
"trust": 0.8,
"url": "http://support.microsoft.com/kb/2264107"
},
{
"title": "NV11-003",
"trust": 0.8,
"url": "http://www.nec.co.jp/security-info/secinfo/nv11-003.html"
},
{
"title": "Microsoft Windows \u306b\u304a\u3051\u308b DLL \u8aad\u307f\u8fbc\u307f\u306b\u95a2\u3059\u308b\u8106\u5f31\u6027",
"trust": 0.8,
"url": "http://www.ponsoftware.com/archiver/bug.htm#load_lib"
},
{
"title": "\u691c\u7d22\u30d1\u30b9\u306e\u554f\u984c\u306b\u8d77\u56e0\u3059\u308b\u8106\u5f31\u6027",
"trust": 0.8,
"url": "http://www7a.biglobe.ne.jp/~schezo/dll_vul.html"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www5f.biglobe.ne.jp/~t-susumu"
},
{
"title": "MHSVI#20100824",
"trust": 0.8,
"url": "http://homepage3.nifty.com/micco/vul/2010/mhsvi20100824.htm"
},
{
"title": "sleipnirsleipnir_295",
"trust": 0.8,
"url": "http://www.fenrir.co.jp/blog/2010/10/sleipnirsleipnir_295.html"
},
{
"title": "2269637",
"trust": 0.8,
"url": "https://www.microsoft.com/japan/technet/security/advisory/2269637.mspx"
},
{
"title": "\u65b0\u305f\u306a\u30ea\u30e2\u30fc\u30c8\u306e\u653b\u6483\u624b\u6cd5\u306b\u95a2\u3059\u308b\u30a2\u30c9\u30d0\u30a4\u30b6\u30ea 2269637 \u3092\u516c\u958b",
"trust": 0.8,
"url": "http://blogs.technet.com/b/jpsecurity/archive/2010/08/24/3351474.aspx"
},
{
"title": "\u30e9\u30a4\u30d6\u30e9\u30ea\u3092\u5b89\u5168\u306b\u30ed\u30fc\u30c9\u3057\u3066 DLL \u306e\u30d7\u30ea\u30ed\u30fc\u30c9\u653b\u6483\u3092\u9632\u3050 - \u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u958b\u767a\u8005\u5411\u3051\u30ac\u30a4\u30c0\u30f3\u30b9 (Word \u6587\u66f8)",
"trust": 0.8,
"url": "http://blogs.technet.com/cfs-file.ashx/__key/communityserver-components-postattachments/00-03-35-14-74/secure-loading-of-libraries-to-prevent-dll-preloading_5f00_j.docx"
},
{
"title": "TA10-238A",
"trust": 0.8,
"url": "http://software.fujitsu.com/jp/security/vulnerabilities/ta10-238a.html"
},
{
"title": "Microsoft ATL/MFC Tracking tool DLL Fixing measures for loading code bugs",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=134164"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-001916"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001999"
},
{
"db": "CNNVD",
"id": "CNNVD-201008-381"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-426",
"trust": 1.0
},
{
"problemtype": "CWE-Other",
"trust": 0.8
},
{
"problemtype": "CWE-264",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-45795"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001916"
},
{
"db": "NVD",
"id": "CVE-2010-3190"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "http://www.securityfocus.com/bid/42811"
},
{
"trust": 2.5,
"url": "http://www.us-cert.gov/cas/techalerts/ta11-102a.html"
},
{
"trust": 2.0,
"url": "https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/cve-2010-3190"
},
{
"trust": 1.7,
"url": "http://lists.apple.com/archives/security-announce/2015/sep/msg00003.html"
},
{
"trust": 1.7,
"url": "https://support.apple.com/ht205221"
},
{
"trust": 1.7,
"url": "http://www.corelan.be:8800/index.php/2010/08/25/dll-hijacking-kb-2269637-the-unofficial-list/"
},
{
"trust": 1.7,
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-025"
},
{
"trust": 1.7,
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a12457"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/41212"
},
{
"trust": 1.6,
"url": "http://jvn.jp/cert/jvnta10-238a"
},
{
"trust": 1.1,
"url": "http://blog.metasploit.com/2010/08/exploiting-dll-hijacking-flaws.html"
},
{
"trust": 1.1,
"url": "http://blog.rapid7.com/?p=5325"
},
{
"trust": 1.1,
"url": "https://www.microsoft.com/technet/security/advisory/2269637.mspx"
},
{
"trust": 1.1,
"url": "http://blogs.technet.com/b/srd/archive/2010/08/23/more-information-about-dll-preloading-remote-attack-vector.aspx"
},
{
"trust": 0.9,
"url": "http://secunia.com/advisories/44906/"
},
{
"trust": 0.8,
"url": "http://www.cert.org/blogs/vuls/2008/09/carpet_bombing_and_directory_p.html"
},
{
"trust": 0.8,
"url": "http://blog.mandiant.com/archives/1207"
},
{
"trust": 0.8,
"url": "http://msdn.microsoft.com/en-us/library/aa297182"
},
{
"trust": 0.8,
"url": "http://blog.zoller.lu/2010/08/cve-2010-xn-loadlibrarygetprocaddress.html"
},
{
"trust": 0.8,
"url": "http://msdn.microsoft.com/en-us/library/ms684175%28vs.85%29.aspx"
},
{
"trust": 0.8,
"url": "http://www.acrossecurity.com/aspr/aspr-2010-04-12-1-pub.txt"
},
{
"trust": 0.8,
"url": "http://www.acrossecurity.com/aspr/aspr-2010-04-12-2-pub.txt"
},
{
"trust": 0.8,
"url": "http://www.acrossecurity.com/aspr/aspr-2010-08-18-1-pub.txt"
},
{
"trust": 0.8,
"url": "http://www.securityfocus.com/bid/1699/discuss"
},
{
"trust": 0.8,
"url": "http://www.cs.ucdavis.edu/research/tech-reports/2010/cse-2010-2.pdf"
},
{
"trust": 0.8,
"url": "http://blogs.msdn.com/b/david_leblanc/archive/2010/08/23/another-technique-for-fixing-dll-preloading-attacks.aspx"
},
{
"trust": 0.8,
"url": "http://support.microsoft.com/kb/2264107"
},
{
"trust": 0.8,
"url": "http://www.guninski.com/officedll.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3190"
},
{
"trust": 0.8,
"url": "https://www.jpcert.or.jp/at/2011/at110008.txt"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnta11-102a"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu99970459/index.html"
},
{
"trust": 0.8,
"url": "http://jvn.jp/tr/jvntr-2010-23"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-3190"
},
{
"trust": 0.8,
"url": "http://secunia.com/advisories/40983/"
},
{
"trust": 0.8,
"url": "http://secunia.com/advisories/41212/"
},
{
"trust": 0.8,
"url": "http://secunia.com/advisories/44905/"
},
{
"trust": 0.8,
"url": "http://securitytracker.com/id/1025630"
},
{
"trust": 0.8,
"url": "http://securitytracker.com/id/1025346"
},
{
"trust": 0.8,
"url": "http://www.us-cert.gov/cas/alerts/sa11-102a.html"
},
{
"trust": 0.8,
"url": "http://www.npa.go.jp/cyberpolice/important/topics-bn.html"
},
{
"trust": 0.8,
"url": "http://www.ipa.go.jp/about/press/20101111.html"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnvu707943"
},
{
"trust": 0.8,
"url": "http://jvn.jp/tr/jvntr-2010-23/"
},
{
"trust": 0.8,
"url": "http://www.us-cert.gov/cas/techalerts/ta10-238a.html"
},
{
"trust": 0.8,
"url": "http://www.kb.cert.org/vuls/id/707943"
},
{
"trust": 0.4,
"url": "http://support.attachmate.com/techdocs/2566.html"
},
{
"trust": 0.4,
"url": "http://support.attachmate.com/techdocs/2564.html"
},
{
"trust": 0.4,
"url": "http://support.attachmate.com/techdocs/2560.html"
},
{
"trust": 0.3,
"url": "http://www.microsoft.com"
},
{
"trust": 0.3,
"url": "http://blogs.technet.com/b/msrc/archive/2010/08/21/microsoft-security-advisory-2269637-released.aspx"
},
{
"trust": 0.3,
"url": "https://support.apple.com/en-us/ht205221"
},
{
"trust": 0.3,
"url": "http://support.avaya.com/css/p8/documents/100133982"
},
{
"trust": 0.3,
"url": "http://www.microsoft.com/technet/security/bulletin/ms11-018.mspx"
},
{
"trust": 0.3,
"url": "http://www.microsoft.com/technet/security/bulletin/ms11-025.mspx"
},
{
"trust": 0.3,
"url": "http://www.microsoft.com/en-us/download/details.aspx?id=27049"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://conference.first.org/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=44906"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/44906/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://support.attachmate.com/techdocs/2565.html"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-3733"
},
{
"trust": 0.1,
"url": "https://support.apple.com/kb/ht201222"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-3741"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-3736"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-3687"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-3730"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-8146"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-3688"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-3190"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-1153"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-3686"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-3748"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-3749"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-3738"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-3744"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-1152"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-1157"
},
{
"trust": 0.1,
"url": "https://www.apple.com/support/security/pgp/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-1205"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-3746"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-3742"
},
{
"trust": 0.1,
"url": "http://gpgtools.org"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-3731"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-3734"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-3740"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-3743"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-3747"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-3735"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-3737"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-3745"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-3739"
},
{
"trust": 0.1,
"url": "http://www.apple.com/itunes/download/"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#707943"
},
{
"db": "VULHUB",
"id": "VHN-45795"
},
{
"db": "BID",
"id": "42811"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001916"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001999"
},
{
"db": "PACKETSTORM",
"id": "102169"
},
{
"db": "PACKETSTORM",
"id": "133618"
},
{
"db": "CNNVD",
"id": "CNNVD-201008-381"
},
{
"db": "NVD",
"id": "CVE-2010-3190"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#707943"
},
{
"db": "VULHUB",
"id": "VHN-45795"
},
{
"db": "BID",
"id": "42811"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001916"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001999"
},
{
"db": "PACKETSTORM",
"id": "102169"
},
{
"db": "PACKETSTORM",
"id": "133618"
},
{
"db": "CNNVD",
"id": "CNNVD-201008-381"
},
{
"db": "NVD",
"id": "CVE-2010-3190"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-08-25T00:00:00",
"db": "CERT/CC",
"id": "VU#707943"
},
{
"date": "2010-08-31T00:00:00",
"db": "VULHUB",
"id": "VHN-45795"
},
{
"date": "2010-08-27T00:00:00",
"db": "BID",
"id": "42811"
},
{
"date": "2011-07-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-001916"
},
{
"date": "2010-09-14T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001999"
},
{
"date": "2011-06-10T12:17:07",
"db": "PACKETSTORM",
"id": "102169"
},
{
"date": "2015-09-19T15:35:19",
"db": "PACKETSTORM",
"id": "133618"
},
{
"date": "2010-08-31T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201008-381"
},
{
"date": "2010-08-31T20:00:02.297000",
"db": "NVD",
"id": "CVE-2010-3190"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-10-13T00:00:00",
"db": "CERT/CC",
"id": "VU#707943"
},
{
"date": "2018-10-10T00:00:00",
"db": "VULHUB",
"id": "VHN-45795"
},
{
"date": "2018-10-09T19:00:00",
"db": "BID",
"id": "42811"
},
{
"date": "2015-10-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-001916"
},
{
"date": "2016-11-09T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001999"
},
{
"date": "2021-07-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201008-381"
},
{
"date": "2020-11-16T19:33:52.007000",
"db": "NVD",
"id": "CVE-2010-3190"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201008-381"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Microsoft Windows based applications may insecurely load dynamic libraries",
"sources": [
{
"db": "CERT/CC",
"id": "VU#707943"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "code problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201008-381"
}
],
"trust": 0.6
}
}
FKIE_CVE-2011-0452
Vulnerability from fkie_nvd - Published: 2011-02-24 21:00 - Updated: 2025-04-11 00:51
Severity ?
Summary
Untrusted search path vulnerability in the script function in Lunascape before 6.4.3 allows local users to gain privileges via a Trojan horse executable file in the current working directory.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lunascape:lunascape:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5896F80A-53AF-4FB2-A0CD-A570D3FDC953",
"versionEndIncluding": "6.4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "16CA0DA9-AD0D-4FAD-BFE9-73EA7E7D87BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:3.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B68D5D56-0D8D-4A59-8B7B-8F8644D0E8C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C20BF135-256C-45EF-AE79-9AD4B1406436",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:3.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "33010A8D-CEBE-4F74-8E67-03C54E73207F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:3.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "382DD625-268F-4F93-AD3E-E97A7F905CAD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:3.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F0F42391-53FB-4C35-AED7-BD450D18419B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:3.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C5941AA4-6410-4496-B76B-177ABB800BA1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:3.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "7B83BD56-C3C7-4C2E-83DC-7983C19B2EFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:3.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3FBF8509-44F2-4D25-B397-10892ACA0863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:3.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C8614513-2993-4C88-8EC2-A5884613FE9C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:3.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "84008601-8D28-436E-8955-F4A5A1D3081F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:3.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5D05C0D8-2FDA-4CAE-A529-E84A97340DB0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:3.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "A7372AFC-7031-4533-9AD1-78F8F2E1EFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:3.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1875597F-94CA-4DBA-8246-0BEE99DA55AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E8F774C2-43FC-492B-903A-F02E67C4246D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E8B0AF36-F832-43AE-ABC6-EE78609EFFA7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B1812163-AE15-4E59-833E-6829B84E66A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "9A475B0E-98A9-43AC-BD26-B420ECAF98E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "66266B90-3021-4A79-857A-5BCDDBF31210",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DF3A23F0-F664-4901-9186-5153F0BCFE3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "1AA620EE-1E39-413B-888D-8E07D5D66659",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "1553FBA7-C616-4A30-BEFC-9402CDE91276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "BC1A8935-84F1-4E6F-8B25-17DC812E2D2D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E33DB810-2186-48A8-BC8C-11A5150B2797",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "EB5406C0-3018-442E-9754-F07D7CF7AE22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "29D26E3C-D92F-44C1-90F9-BB4BABEE6F42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8CB4B4D0-5920-451F-9C16-9BD658C71446",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "7AF8781A-35A7-4D5B-8F5E-64AD62964C9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "76A7070E-DC05-4B07-A5E0-D7D067CC713E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0CAB8C1C-2FE3-4EAE-B098-5CD9E2800757",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E81E7FAF-2BF5-4D6D-A41F-8C55CDF2ABD3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B7B53D1E-F307-43AA-8164-F6BD4ED86D6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.3.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FC3CE46F-3FD5-41A0-981C-76C2FBB0B34D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A383F91B-23B4-4806-A85B-9E091799CD98",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B22AE4C8-1D54-4494-8519-E5499D112805",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0EADEAD1-5C78-4ACD-9C23-9C44A445B486",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "93B5FE36-5C3E-4ADA-BBAC-B89F324B2052",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A524EC5A-4274-4347-90D3-F98D5238F449",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "8D30AC08-8E93-4BDC-AE5D-02E2FA44EFDC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F1592E96-222E-4BB8-B50E-F697EB390623",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "003CDA46-91D1-47EA-B1E2-8966EE72A654",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "12EFBC7F-547F-4205-A6D7-57CC904D4965",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0906DA9C-C57D-4BA1-BF75-B575F11FD23B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F13576CA-BA43-4689-9B7D-ABC92D2965CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "ABAE6A57-CD71-43FF-AD0B-6778FB30EC5D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "EE7DEA84-623B-4556-99F8-17A56932C343",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.7.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6BBBBC42-5B90-44B7-A785-801786024CBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2AE175F7-775B-41B3-85E6-3F7AE8D8CCDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8AF50027-1B90-48BB-8755-A2E84CECE353",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:5.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "403BCDF8-D0A1-4BB0-A808-005EE9CAAAC6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "526EAA73-97A7-4177-A1C6-E30B93605A16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "53FC1DF9-E335-47A3-9592-37281A75A8F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FA3F46C9-80E7-43DE-B6F4-9D12FA2B9D0A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:5.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F3EEC22D-1078-4EB8-A041-0CACACB8E484",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:5.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "878AB53C-AE6A-4162-8741-B8C480F0EED5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:5.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "24D43C8F-CF91-4481-826D-7304F44E0353",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:5.1:beta:*:*:*:*:*:*",
"matchCriteriaId": "EBA9BDC9-7D00-452C-A9C4-973841654145",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:5.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E5555A26-44D1-44BB-9694-33C4015D58E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:5.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4C80E59A-9E16-428D-BF53-73CFEB594C93",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:5.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BFE44A65-CD20-4C12-8EB1-8CD54D6FBF86",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:5.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "9233B883-5C93-41CB-83BD-973BE4E53BB0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:5.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4ADC6FB9-477C-48A3-A34A-3E8D2C9D4FFC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:5.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1874AB38-7662-462F-98DC-6998F6CF469C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:5.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "C87E3BC1-6BC9-46AE-9834-D863C32EEDC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9B8C2717-A12C-44F9-8FEA-3A3A2EFA4788",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0F1F510F-A160-47F5-B2E2-BC49387C86E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "49753DA6-CE23-4AE7-B372-084C39174AEA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "6B4580AC-D819-4EDD-96E2-A58A8AD3C740",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "64374E58-C15D-4762-AB05-1355ADD5A114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8E76E82B-74B5-45C8-B4EA-A41A909C755E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "12C101C7-2E42-474F-8DD7-74C87882FBFD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E15D231-BAF5-4DCE-9A1B-4B5D30ECCE7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "B24C4F11-63AE-4E7C-99FB-D54463B64228",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "E3A9C158-DD92-44B9-8B82-FD9857F8E602",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "C3244221-9489-41D5-B432-A26F92EA6320",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "B4B972D6-D745-4698-B4F4-DAF5D6BC3035",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "3D947F44-56D2-4CF2-870E-CF8A0F6482C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A834C210-BF89-4EEF-A03D-3778DB0DFB16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "7C3EC652-9BD5-4F6F-B1C3-8C4FD335D4AA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3F7593D7-936C-4869-92A5-7BFED4F856F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9C0ABE7C-8DDD-4664-94FD-0B53CA41CBF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.3.3:*:*:*:*:*:*:*",
"matchCriteriaId": "3410BDBD-7709-4C3D-AB56-A3D2017DC711",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "D71B401B-93B2-481D-9BD1-793F1931DB17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "32D5A18D-FE54-410A-A950-5724D818FF79",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Untrusted search path vulnerability in the script function in Lunascape before 6.4.3 allows local users to gain privileges via a Trojan horse executable file in the current working directory."
},
{
"lang": "es",
"value": "Vulnerabilidad de ruta de b\u00fasqueda no confiable en la funci\u00f3n de secuencia de comandos en Lunascape anterior a v6.4.3 permite a usuarios locales conseguir privilegios a trav\u00e9s de un archivo ejecutable de caballo de Troya en el directorio de trabajo actual."
}
],
"evaluatorComment": "Per: http://cwe.mitre.org/data/definitions/426.html \r\n\u0027CWE-426: Untrusted Search Path\u0027",
"id": "CVE-2011-0452",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.2,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 1.9,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2011-02-24T21:00:01.287",
"references": [
{
"source": "vultures@jpcert.or.jp",
"url": "http://jvn.jp/en/jp/JVN38362957/"
},
{
"source": "vultures@jpcert.or.jp",
"url": "http://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000012.html"
},
{
"source": "vultures@jpcert.or.jp",
"url": "http://lunapedia.lunascape.jp/index.php?title=Lunascape6#2011.2F02.2F18_ver_6.4.3"
},
{
"source": "vultures@jpcert.or.jp",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/43441"
},
{
"source": "vultures@jpcert.or.jp",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65592"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://jvn.jp/en/jp/JVN38362957/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000012.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lunapedia.lunascape.jp/index.php?title=Lunascape6#2011.2F02.2F18_ver_6.4.3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/43441"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65592"
}
],
"sourceIdentifier": "vultures@jpcert.or.jp",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2010-3927
Vulnerability from fkie_nvd - Published: 2011-01-24 18:00 - Updated: 2025-04-11 00:51
Severity ?
Summary
Untrusted search path vulnerability in Lunascape before 6.4.0 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| lunascape | lunascape | * | |
| lunascape | lunascape | 4.1 | |
| lunascape | lunascape | 4.1.1 | |
| lunascape | lunascape | 4.1.2 | |
| lunascape | lunascape | 4.1.3 | |
| lunascape | lunascape | 5.0 | |
| lunascape | lunascape | 5.1 | |
| lunascape | lunascape | 5.1.0 | |
| lunascape | lunascape | 5.1.2 | |
| lunascape | lunascape | 5.1.3 | |
| lunascape | lunascape | 5.1.4 | |
| lunascape | lunascape | 5.1.5 | |
| lunascape | lunascape | 5.1.6 | |
| lunascape | lunascape | 6.0 | |
| lunascape | lunascape | 6.0.1 | |
| lunascape | lunascape | 6.0.2 | |
| lunascape | lunascape | 6.0.3 | |
| lunascape | lunascape | 6.1 | |
| lunascape | lunascape | 6.1.1 | |
| lunascape | lunascape | 6.1.2 | |
| lunascape | lunascape | 6.1.3 | |
| lunascape | lunascape | 6.1.4 | |
| lunascape | lunascape | 6.1.5 | |
| lunascape | lunascape | 6.1.6 | |
| lunascape | lunascape | 6.1.7 | |
| lunascape | lunascape | 6.2 | |
| lunascape | lunascape | 6.2.0 | |
| lunascape | lunascape | 6.3 | |
| lunascape | lunascape | 6.3.0 | |
| lunascape | lunascape | 6.3.1 | |
| lunascape | lunascape | 6.3.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lunascape:lunascape:*:*:*:*:*:*:*:*",
"matchCriteriaId": "795212A8-874E-4FCF-81AB-3A05D2F3DE44",
"versionEndIncluding": "6.3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B810B329-0924-42F6-979B-21B319EA5D7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E33DB810-2186-48A8-BC8C-11A5150B2797",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "EB5406C0-3018-442E-9754-F07D7CF7AE22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "29D26E3C-D92F-44C1-90F9-BB4BABEE6F42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DC2658C4-5527-4BB7-98D1-BD3FC4282D40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3F3B01E8-5E88-4ED5-9233-C01E77BC81BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:5.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E5555A26-44D1-44BB-9694-33C4015D58E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:5.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BFE44A65-CD20-4C12-8EB1-8CD54D6FBF86",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:5.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "9233B883-5C93-41CB-83BD-973BE4E53BB0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:5.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4ADC6FB9-477C-48A3-A34A-3E8D2C9D4FFC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:5.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1874AB38-7662-462F-98DC-6998F6CF469C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:5.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "C87E3BC1-6BC9-46AE-9834-D863C32EEDC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3440E5FF-959D-47A8-83D0-44A7683CB216",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0F1F510F-A160-47F5-B2E2-BC49387C86E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "49753DA6-CE23-4AE7-B372-084C39174AEA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "6B4580AC-D819-4EDD-96E2-A58A8AD3C740",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "64374E58-C15D-4762-AB05-1355ADD5A114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8E76E82B-74B5-45C8-B4EA-A41A909C755E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "12C101C7-2E42-474F-8DD7-74C87882FBFD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E15D231-BAF5-4DCE-9A1B-4B5D30ECCE7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "B24C4F11-63AE-4E7C-99FB-D54463B64228",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "E3A9C158-DD92-44B9-8B82-FD9857F8E602",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "C3244221-9489-41D5-B432-A26F92EA6320",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "B4B972D6-D745-4698-B4F4-DAF5D6BC3035",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "3D947F44-56D2-4CF2-870E-CF8A0F6482C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "5E4DEE0D-10E9-4F7B-A229-86A27F5C3A55",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "7C3EC652-9BD5-4F6F-B1C3-8C4FD335D4AA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "90678FFA-0994-42C9-99D6-CDA36385C266",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3F7593D7-936C-4869-92A5-7BFED4F856F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:6.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9C0ABE7C-8DDD-4664-94FD-0B53CA41CBF0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Untrusted search path vulnerability in Lunascape before 6.4.0 allows local users to gain privileges via a Trojan horse DLL in the current working directory."
},
{
"lang": "es",
"value": "Vulnerabilidad de ruta de b\u00fasqueda no confiable en Lunascape en versiones anteriores a v6.4.0. Permite a usuarios locales, y posiblemente atacantes remotos, ejecutar c\u00f3digo de su elecci\u00f3n y realizar ataques de suplantaci\u00f3n de DLLs (\"DLL hijacking attacks\") a trav\u00e9s de un troyano que se encuentre en la misma carpeta."
}
],
"id": "CVE-2010-3927",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.9,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.4,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2011-01-24T18:00:03.610",
"references": [
{
"source": "vultures@jpcert.or.jp",
"url": "http://help.lunascape.tv/LunascapeHelp-en/page.aspx?pageid=ver_6_4_11"
},
{
"source": "vultures@jpcert.or.jp",
"url": "http://jvn.jp/en/jp/JVN94695018/296426/index.html"
},
{
"source": "vultures@jpcert.or.jp",
"url": "http://jvn.jp/en/jp/JVN94695018/index.html"
},
{
"source": "vultures@jpcert.or.jp",
"url": "http://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000004.html"
},
{
"source": "vultures@jpcert.or.jp",
"url": "http://lunapedia.lunascape.jp/index.php?title=Lunascape6#2011.2F01.2F19_ver_6.4.1"
},
{
"source": "vultures@jpcert.or.jp",
"url": "http://osvdb.org/70604"
},
{
"source": "vultures@jpcert.or.jp",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/43003"
},
{
"source": "vultures@jpcert.or.jp",
"url": "http://www.securityfocus.com/bid/45945"
},
{
"source": "vultures@jpcert.or.jp",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64849"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://help.lunascape.tv/LunascapeHelp-en/page.aspx?pageid=ver_6_4_11"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://jvn.jp/en/jp/JVN94695018/296426/index.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://jvn.jp/en/jp/JVN94695018/index.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000004.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lunapedia.lunascape.jp/index.php?title=Lunascape6#2011.2F01.2F19_ver_6.4.1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/70604"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/43003"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/45945"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64849"
}
],
"sourceIdentifier": "vultures@jpcert.or.jp",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2009-3005
Vulnerability from fkie_nvd - Published: 2009-08-28 15:30 - Updated: 2025-04-09 00:30
Severity ?
Summary
Lunascape 5.1.3 and 5.1.4 allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for the site containing that page. NOTE: a related attack was reported in which an arbitrary file: URL is shown.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lunascape:lunascape:5.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "9233B883-5C93-41CB-83BD-973BE4E53BB0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:5.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4ADC6FB9-477C-48A3-A34A-3E8D2C9D4FFC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Lunascape 5.1.3 and 5.1.4 allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for the site containing that page. NOTE: a related attack was reported in which an arbitrary file: URL is shown."
},
{
"lang": "es",
"value": "Lunascape v5.1.3 y v5.1.4 permiten falsificar la barra de direcciones a atacantes remotos, a trav\u00e9s de window.open con una URI relativa, que muestra una direcci\u00f3n URL arbitraria de un sitio web visitado por la v\u00edctima, como lo demuestra la visita a una web controlada por el atacante, que lanza un formulario de acceso falso para el sitio que contiene esa p\u00e1gina. NOTA: Se ha informado de un ataque relacionado en el que se muestra una URL arbitraria de tipo File:"
}
],
"id": "CVE-2009-3005",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2009-08-28T15:30:00.780",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lostmon.blogspot.com/2009/08/multiple-browsers-fake-url-folder-file.html"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53008"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lostmon.blogspot.com/2009/08/multiple-browsers-fake-url-folder-file.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53008"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2007-2335
Vulnerability from fkie_nvd - Published: 2007-04-27 16:19 - Updated: 2025-04-09 00:30
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the RSS feed reader functionality in Lunascape 4.1.3 build2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B810B329-0924-42F6-979B-21B319EA5D7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E33DB810-2186-48A8-BC8C-11A5150B2797",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "EB5406C0-3018-442E-9754-F07D7CF7AE22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lunascape:lunascape:4.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "29D26E3C-D92F-44C1-90F9-BB4BABEE6F42",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the RSS feed reader functionality in Lunascape 4.1.3 build2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
},
{
"lang": "es",
"value": "Vulnerabilidad de secuencia de comandos en sitios cruzados (XSS) en la funcionalidad de alimentador de lectura RSS en Lunascape 4.1.3 build2 y anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s de vectores no especificados."
}
],
"id": "CVE-2007-2335",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2007-04-27T16:19:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://jvn.jp/jp/JVN%2336628264/index.html"
},
{
"source": "cve@mitre.org",
"url": "http://lunapedia.lunascape.jp/index.php?title=Lunascape_4#2007.2F04.2F25_ver_4.2.0"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/35364"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/25000"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/23665"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/1538"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34074"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://jvn.jp/jp/JVN%2336628264/index.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lunapedia.lunascape.jp/index.php?title=Lunascape_4#2007.2F04.2F25_ver_4.2.0"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/35364"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/25000"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/23665"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/1538"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34074"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2011-0452 (GCVE-0-2011-0452)
Vulnerability from cvelistv5 – Published: 2011-02-24 20:00 – Updated: 2024-08-06 21:51
VLAI?
Summary
Untrusted search path vulnerability in the script function in Lunascape before 6.4.3 allows local users to gain privileges via a Trojan horse executable file in the current working directory.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:51:08.960Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "JVN#38362957",
"tags": [
"third-party-advisory",
"x_refsource_JVN",
"x_transferred"
],
"url": "http://jvn.jp/en/jp/JVN38362957/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://lunapedia.lunascape.jp/index.php?title=Lunascape6#2011.2F02.2F18_ver_6.4.3"
},
{
"name": "43441",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/43441"
},
{
"name": "lunascape-dll-code-execution(65592)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65592"
},
{
"name": "JVNDB-2011-000012",
"tags": [
"third-party-advisory",
"x_refsource_JVNDB",
"x_transferred"
],
"url": "http://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000012.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-02-18T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Untrusted search path vulnerability in the script function in Lunascape before 6.4.3 allows local users to gain privileges via a Trojan horse executable file in the current working directory."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"name": "JVN#38362957",
"tags": [
"third-party-advisory",
"x_refsource_JVN"
],
"url": "http://jvn.jp/en/jp/JVN38362957/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://lunapedia.lunascape.jp/index.php?title=Lunascape6#2011.2F02.2F18_ver_6.4.3"
},
{
"name": "43441",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/43441"
},
{
"name": "lunascape-dll-code-execution(65592)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65592"
},
{
"name": "JVNDB-2011-000012",
"tags": [
"third-party-advisory",
"x_refsource_JVNDB"
],
"url": "http://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000012.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vultures@jpcert.or.jp",
"ID": "CVE-2011-0452",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Untrusted search path vulnerability in the script function in Lunascape before 6.4.3 allows local users to gain privileges via a Trojan horse executable file in the current working directory."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "JVN#38362957",
"refsource": "JVN",
"url": "http://jvn.jp/en/jp/JVN38362957/"
},
{
"name": "http://lunapedia.lunascape.jp/index.php?title=Lunascape6#2011.2F02.2F18_ver_6.4.3",
"refsource": "CONFIRM",
"url": "http://lunapedia.lunascape.jp/index.php?title=Lunascape6#2011.2F02.2F18_ver_6.4.3"
},
{
"name": "43441",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/43441"
},
{
"name": "lunascape-dll-code-execution(65592)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65592"
},
{
"name": "JVNDB-2011-000012",
"refsource": "JVNDB",
"url": "http://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000012.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2011-0452",
"datePublished": "2011-02-24T20:00:00",
"dateReserved": "2011-01-14T00:00:00",
"dateUpdated": "2024-08-06T21:51:08.960Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2010-3927 (GCVE-0-2010-3927)
Vulnerability from cvelistv5 – Published: 2011-01-24 17:00 – Updated: 2024-08-07 03:26
VLAI?
Summary
Untrusted search path vulnerability in Lunascape before 6.4.0 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T03:26:12.205Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "45945",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/45945"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://lunapedia.lunascape.jp/index.php?title=Lunascape6#2011.2F01.2F19_ver_6.4.1"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://jvn.jp/en/jp/JVN94695018/296426/index.html"
},
{
"name": "lunascape-library-code-execution(64849)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64849"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://help.lunascape.tv/LunascapeHelp-en/page.aspx?pageid=ver_6_4_11"
},
{
"name": "70604",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/70604"
},
{
"name": "JVNDB-2011-000004",
"tags": [
"third-party-advisory",
"x_refsource_JVNDB",
"x_transferred"
],
"url": "http://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000004.html"
},
{
"name": "43003",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/43003"
},
{
"name": "JVN#94695018",
"tags": [
"third-party-advisory",
"x_refsource_JVN",
"x_transferred"
],
"url": "http://jvn.jp/en/jp/JVN94695018/index.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-01-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Untrusted search path vulnerability in Lunascape before 6.4.0 allows local users to gain privileges via a Trojan horse DLL in the current working directory."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"name": "45945",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/45945"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://lunapedia.lunascape.jp/index.php?title=Lunascape6#2011.2F01.2F19_ver_6.4.1"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://jvn.jp/en/jp/JVN94695018/296426/index.html"
},
{
"name": "lunascape-library-code-execution(64849)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64849"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://help.lunascape.tv/LunascapeHelp-en/page.aspx?pageid=ver_6_4_11"
},
{
"name": "70604",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/70604"
},
{
"name": "JVNDB-2011-000004",
"tags": [
"third-party-advisory",
"x_refsource_JVNDB"
],
"url": "http://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000004.html"
},
{
"name": "43003",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/43003"
},
{
"name": "JVN#94695018",
"tags": [
"third-party-advisory",
"x_refsource_JVN"
],
"url": "http://jvn.jp/en/jp/JVN94695018/index.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vultures@jpcert.or.jp",
"ID": "CVE-2010-3927",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Untrusted search path vulnerability in Lunascape before 6.4.0 allows local users to gain privileges via a Trojan horse DLL in the current working directory."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "45945",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/45945"
},
{
"name": "http://lunapedia.lunascape.jp/index.php?title=Lunascape6#2011.2F01.2F19_ver_6.4.1",
"refsource": "CONFIRM",
"url": "http://lunapedia.lunascape.jp/index.php?title=Lunascape6#2011.2F01.2F19_ver_6.4.1"
},
{
"name": "http://jvn.jp/en/jp/JVN94695018/296426/index.html",
"refsource": "MISC",
"url": "http://jvn.jp/en/jp/JVN94695018/296426/index.html"
},
{
"name": "lunascape-library-code-execution(64849)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64849"
},
{
"name": "http://help.lunascape.tv/LunascapeHelp-en/page.aspx?pageid=ver_6_4_11",
"refsource": "CONFIRM",
"url": "http://help.lunascape.tv/LunascapeHelp-en/page.aspx?pageid=ver_6_4_11"
},
{
"name": "70604",
"refsource": "OSVDB",
"url": "http://osvdb.org/70604"
},
{
"name": "JVNDB-2011-000004",
"refsource": "JVNDB",
"url": "http://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000004.html"
},
{
"name": "43003",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/43003"
},
{
"name": "JVN#94695018",
"refsource": "JVN",
"url": "http://jvn.jp/en/jp/JVN94695018/index.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2010-3927",
"datePublished": "2011-01-24T17:00:00",
"dateReserved": "2010-10-12T00:00:00",
"dateUpdated": "2024-08-07T03:26:12.205Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2009-3005 (GCVE-0-2009-3005)
Vulnerability from cvelistv5 – Published: 2009-08-28 15:00 – Updated: 2024-08-07 06:14
VLAI?
Summary
Lunascape 5.1.3 and 5.1.4 allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for the site containing that page. NOTE: a related attack was reported in which an arbitrary file: URL is shown.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T06:14:55.219Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://lostmon.blogspot.com/2009/08/multiple-browsers-fake-url-folder-file.html"
},
{
"name": "lunascape-windowopen-spoofing(53008)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53008"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-08-15T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Lunascape 5.1.3 and 5.1.4 allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for the site containing that page. NOTE: a related attack was reported in which an arbitrary file: URL is shown."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://lostmon.blogspot.com/2009/08/multiple-browsers-fake-url-folder-file.html"
},
{
"name": "lunascape-windowopen-spoofing(53008)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53008"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-3005",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Lunascape 5.1.3 and 5.1.4 allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for the site containing that page. NOTE: a related attack was reported in which an arbitrary file: URL is shown."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://lostmon.blogspot.com/2009/08/multiple-browsers-fake-url-folder-file.html",
"refsource": "MISC",
"url": "http://lostmon.blogspot.com/2009/08/multiple-browsers-fake-url-folder-file.html"
},
{
"name": "lunascape-windowopen-spoofing(53008)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53008"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-3005",
"datePublished": "2009-08-28T15:00:00",
"dateReserved": "2009-08-28T00:00:00",
"dateUpdated": "2024-08-07T06:14:55.219Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2007-2335 (GCVE-0-2007-2335)
Vulnerability from cvelistv5 – Published: 2007-04-27 16:00 – Updated: 2024-08-07 13:33
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in the RSS feed reader functionality in Lunascape 4.1.3 build2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T13:33:28.797Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "35364",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/35364"
},
{
"name": "ADV-2007-1538",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/1538"
},
{
"name": "23665",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/23665"
},
{
"name": "JVN#36628264",
"tags": [
"third-party-advisory",
"x_refsource_JVN",
"x_transferred"
],
"url": "http://jvn.jp/jp/JVN%2336628264/index.html"
},
{
"name": "lunascape-rssfeed-xss(34074)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34074"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://lunapedia.lunascape.jp/index.php?title=Lunascape_4#2007.2F04.2F25_ver_4.2.0"
},
{
"name": "25000",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/25000"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-04-26T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the RSS feed reader functionality in Lunascape 4.1.3 build2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "35364",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/35364"
},
{
"name": "ADV-2007-1538",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/1538"
},
{
"name": "23665",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/23665"
},
{
"name": "JVN#36628264",
"tags": [
"third-party-advisory",
"x_refsource_JVN"
],
"url": "http://jvn.jp/jp/JVN%2336628264/index.html"
},
{
"name": "lunascape-rssfeed-xss(34074)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34074"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://lunapedia.lunascape.jp/index.php?title=Lunascape_4#2007.2F04.2F25_ver_4.2.0"
},
{
"name": "25000",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/25000"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-2335",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the RSS feed reader functionality in Lunascape 4.1.3 build2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "35364",
"refsource": "OSVDB",
"url": "http://osvdb.org/35364"
},
{
"name": "ADV-2007-1538",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/1538"
},
{
"name": "23665",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/23665"
},
{
"name": "JVN#36628264",
"refsource": "JVN",
"url": "http://jvn.jp/jp/JVN%2336628264/index.html"
},
{
"name": "lunascape-rssfeed-xss(34074)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34074"
},
{
"name": "http://lunapedia.lunascape.jp/index.php?title=Lunascape_4#2007.2F04.2F25_ver_4.2.0",
"refsource": "CONFIRM",
"url": "http://lunapedia.lunascape.jp/index.php?title=Lunascape_4#2007.2F04.2F25_ver_4.2.0"
},
{
"name": "25000",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/25000"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-2335",
"datePublished": "2007-04-27T16:00:00",
"dateReserved": "2007-04-27T00:00:00",
"dateUpdated": "2024-08-07T13:33:28.797Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-0452 (GCVE-0-2011-0452)
Vulnerability from nvd – Published: 2011-02-24 20:00 – Updated: 2024-08-06 21:51
VLAI?
Summary
Untrusted search path vulnerability in the script function in Lunascape before 6.4.3 allows local users to gain privileges via a Trojan horse executable file in the current working directory.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:51:08.960Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "JVN#38362957",
"tags": [
"third-party-advisory",
"x_refsource_JVN",
"x_transferred"
],
"url": "http://jvn.jp/en/jp/JVN38362957/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://lunapedia.lunascape.jp/index.php?title=Lunascape6#2011.2F02.2F18_ver_6.4.3"
},
{
"name": "43441",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/43441"
},
{
"name": "lunascape-dll-code-execution(65592)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65592"
},
{
"name": "JVNDB-2011-000012",
"tags": [
"third-party-advisory",
"x_refsource_JVNDB",
"x_transferred"
],
"url": "http://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000012.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-02-18T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Untrusted search path vulnerability in the script function in Lunascape before 6.4.3 allows local users to gain privileges via a Trojan horse executable file in the current working directory."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"name": "JVN#38362957",
"tags": [
"third-party-advisory",
"x_refsource_JVN"
],
"url": "http://jvn.jp/en/jp/JVN38362957/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://lunapedia.lunascape.jp/index.php?title=Lunascape6#2011.2F02.2F18_ver_6.4.3"
},
{
"name": "43441",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/43441"
},
{
"name": "lunascape-dll-code-execution(65592)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65592"
},
{
"name": "JVNDB-2011-000012",
"tags": [
"third-party-advisory",
"x_refsource_JVNDB"
],
"url": "http://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000012.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vultures@jpcert.or.jp",
"ID": "CVE-2011-0452",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Untrusted search path vulnerability in the script function in Lunascape before 6.4.3 allows local users to gain privileges via a Trojan horse executable file in the current working directory."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "JVN#38362957",
"refsource": "JVN",
"url": "http://jvn.jp/en/jp/JVN38362957/"
},
{
"name": "http://lunapedia.lunascape.jp/index.php?title=Lunascape6#2011.2F02.2F18_ver_6.4.3",
"refsource": "CONFIRM",
"url": "http://lunapedia.lunascape.jp/index.php?title=Lunascape6#2011.2F02.2F18_ver_6.4.3"
},
{
"name": "43441",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/43441"
},
{
"name": "lunascape-dll-code-execution(65592)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65592"
},
{
"name": "JVNDB-2011-000012",
"refsource": "JVNDB",
"url": "http://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000012.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2011-0452",
"datePublished": "2011-02-24T20:00:00",
"dateReserved": "2011-01-14T00:00:00",
"dateUpdated": "2024-08-06T21:51:08.960Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2010-3927 (GCVE-0-2010-3927)
Vulnerability from nvd – Published: 2011-01-24 17:00 – Updated: 2024-08-07 03:26
VLAI?
Summary
Untrusted search path vulnerability in Lunascape before 6.4.0 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T03:26:12.205Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "45945",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/45945"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://lunapedia.lunascape.jp/index.php?title=Lunascape6#2011.2F01.2F19_ver_6.4.1"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://jvn.jp/en/jp/JVN94695018/296426/index.html"
},
{
"name": "lunascape-library-code-execution(64849)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64849"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://help.lunascape.tv/LunascapeHelp-en/page.aspx?pageid=ver_6_4_11"
},
{
"name": "70604",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/70604"
},
{
"name": "JVNDB-2011-000004",
"tags": [
"third-party-advisory",
"x_refsource_JVNDB",
"x_transferred"
],
"url": "http://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000004.html"
},
{
"name": "43003",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/43003"
},
{
"name": "JVN#94695018",
"tags": [
"third-party-advisory",
"x_refsource_JVN",
"x_transferred"
],
"url": "http://jvn.jp/en/jp/JVN94695018/index.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-01-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Untrusted search path vulnerability in Lunascape before 6.4.0 allows local users to gain privileges via a Trojan horse DLL in the current working directory."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"name": "45945",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/45945"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://lunapedia.lunascape.jp/index.php?title=Lunascape6#2011.2F01.2F19_ver_6.4.1"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://jvn.jp/en/jp/JVN94695018/296426/index.html"
},
{
"name": "lunascape-library-code-execution(64849)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64849"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://help.lunascape.tv/LunascapeHelp-en/page.aspx?pageid=ver_6_4_11"
},
{
"name": "70604",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/70604"
},
{
"name": "JVNDB-2011-000004",
"tags": [
"third-party-advisory",
"x_refsource_JVNDB"
],
"url": "http://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000004.html"
},
{
"name": "43003",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/43003"
},
{
"name": "JVN#94695018",
"tags": [
"third-party-advisory",
"x_refsource_JVN"
],
"url": "http://jvn.jp/en/jp/JVN94695018/index.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vultures@jpcert.or.jp",
"ID": "CVE-2010-3927",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Untrusted search path vulnerability in Lunascape before 6.4.0 allows local users to gain privileges via a Trojan horse DLL in the current working directory."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "45945",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/45945"
},
{
"name": "http://lunapedia.lunascape.jp/index.php?title=Lunascape6#2011.2F01.2F19_ver_6.4.1",
"refsource": "CONFIRM",
"url": "http://lunapedia.lunascape.jp/index.php?title=Lunascape6#2011.2F01.2F19_ver_6.4.1"
},
{
"name": "http://jvn.jp/en/jp/JVN94695018/296426/index.html",
"refsource": "MISC",
"url": "http://jvn.jp/en/jp/JVN94695018/296426/index.html"
},
{
"name": "lunascape-library-code-execution(64849)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64849"
},
{
"name": "http://help.lunascape.tv/LunascapeHelp-en/page.aspx?pageid=ver_6_4_11",
"refsource": "CONFIRM",
"url": "http://help.lunascape.tv/LunascapeHelp-en/page.aspx?pageid=ver_6_4_11"
},
{
"name": "70604",
"refsource": "OSVDB",
"url": "http://osvdb.org/70604"
},
{
"name": "JVNDB-2011-000004",
"refsource": "JVNDB",
"url": "http://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000004.html"
},
{
"name": "43003",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/43003"
},
{
"name": "JVN#94695018",
"refsource": "JVN",
"url": "http://jvn.jp/en/jp/JVN94695018/index.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2010-3927",
"datePublished": "2011-01-24T17:00:00",
"dateReserved": "2010-10-12T00:00:00",
"dateUpdated": "2024-08-07T03:26:12.205Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2009-3005 (GCVE-0-2009-3005)
Vulnerability from nvd – Published: 2009-08-28 15:00 – Updated: 2024-08-07 06:14
VLAI?
Summary
Lunascape 5.1.3 and 5.1.4 allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for the site containing that page. NOTE: a related attack was reported in which an arbitrary file: URL is shown.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T06:14:55.219Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://lostmon.blogspot.com/2009/08/multiple-browsers-fake-url-folder-file.html"
},
{
"name": "lunascape-windowopen-spoofing(53008)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53008"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-08-15T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Lunascape 5.1.3 and 5.1.4 allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for the site containing that page. NOTE: a related attack was reported in which an arbitrary file: URL is shown."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://lostmon.blogspot.com/2009/08/multiple-browsers-fake-url-folder-file.html"
},
{
"name": "lunascape-windowopen-spoofing(53008)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53008"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-3005",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Lunascape 5.1.3 and 5.1.4 allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for the site containing that page. NOTE: a related attack was reported in which an arbitrary file: URL is shown."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://lostmon.blogspot.com/2009/08/multiple-browsers-fake-url-folder-file.html",
"refsource": "MISC",
"url": "http://lostmon.blogspot.com/2009/08/multiple-browsers-fake-url-folder-file.html"
},
{
"name": "lunascape-windowopen-spoofing(53008)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53008"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-3005",
"datePublished": "2009-08-28T15:00:00",
"dateReserved": "2009-08-28T00:00:00",
"dateUpdated": "2024-08-07T06:14:55.219Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2007-2335 (GCVE-0-2007-2335)
Vulnerability from nvd – Published: 2007-04-27 16:00 – Updated: 2024-08-07 13:33
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in the RSS feed reader functionality in Lunascape 4.1.3 build2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T13:33:28.797Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "35364",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/35364"
},
{
"name": "ADV-2007-1538",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/1538"
},
{
"name": "23665",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/23665"
},
{
"name": "JVN#36628264",
"tags": [
"third-party-advisory",
"x_refsource_JVN",
"x_transferred"
],
"url": "http://jvn.jp/jp/JVN%2336628264/index.html"
},
{
"name": "lunascape-rssfeed-xss(34074)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34074"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://lunapedia.lunascape.jp/index.php?title=Lunascape_4#2007.2F04.2F25_ver_4.2.0"
},
{
"name": "25000",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/25000"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-04-26T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the RSS feed reader functionality in Lunascape 4.1.3 build2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "35364",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/35364"
},
{
"name": "ADV-2007-1538",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/1538"
},
{
"name": "23665",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/23665"
},
{
"name": "JVN#36628264",
"tags": [
"third-party-advisory",
"x_refsource_JVN"
],
"url": "http://jvn.jp/jp/JVN%2336628264/index.html"
},
{
"name": "lunascape-rssfeed-xss(34074)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34074"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://lunapedia.lunascape.jp/index.php?title=Lunascape_4#2007.2F04.2F25_ver_4.2.0"
},
{
"name": "25000",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/25000"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-2335",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the RSS feed reader functionality in Lunascape 4.1.3 build2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "35364",
"refsource": "OSVDB",
"url": "http://osvdb.org/35364"
},
{
"name": "ADV-2007-1538",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/1538"
},
{
"name": "23665",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/23665"
},
{
"name": "JVN#36628264",
"refsource": "JVN",
"url": "http://jvn.jp/jp/JVN%2336628264/index.html"
},
{
"name": "lunascape-rssfeed-xss(34074)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34074"
},
{
"name": "http://lunapedia.lunascape.jp/index.php?title=Lunascape_4#2007.2F04.2F25_ver_4.2.0",
"refsource": "CONFIRM",
"url": "http://lunapedia.lunascape.jp/index.php?title=Lunascape_4#2007.2F04.2F25_ver_4.2.0"
},
{
"name": "25000",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/25000"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-2335",
"datePublished": "2007-04-27T16:00:00",
"dateReserved": "2007-04-27T00:00:00",
"dateUpdated": "2024-08-07T13:33:28.797Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
JVNDB-2011-000012
Vulnerability from jvndb - Published: 2011-02-23 15:41 - Updated:2011-02-23 15:41Summary
Lunascape may insecurely load executable files
Details
Lunascape may use unsafe methods for determining how to load executables (.exe).
Lunascape is a web browser. Lunascape loads certain executables when using the "script" function. Lunascape contain an issue with the file search path, which may insecurely load executables.
Makoto Shiotsuki reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000012.html",
"dc:date": "2011-02-23T15:41+09:00",
"dcterms:issued": "2011-02-23T15:41+09:00",
"dcterms:modified": "2011-02-23T15:41+09:00",
"description": "Lunascape may use unsafe methods for determining how to load executables (.exe).\r\n\r\nLunascape is a web browser. Lunascape loads certain executables when using the \"script\" function. Lunascape contain an issue with the file search path, which may insecurely load executables.\r\n\r\nMakoto Shiotsuki reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
"link": "https://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000012.html",
"sec:cpe": {
"#text": "cpe:/a:lunascape:lunascape",
"@product": "Lunascape",
"@vendor": "Lunascape",
"@version": "2.2"
},
"sec:cvss": {
"@score": "5.1",
"@severity": "Medium",
"@type": "Base",
"@vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"@version": "2.0"
},
"sec:identifier": "JVNDB-2011-000012",
"sec:references": [
{
"#text": "http://jvn.jp/en/jp/JVN38362957",
"@id": "JVN#38362957",
"@source": "JVN"
},
{
"#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0452",
"@id": "CVE-2011-0452",
"@source": "CVE"
},
{
"#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0452",
"@id": "CVE-2011-0452",
"@source": "NVD"
},
{
"#text": "http://secunia.com/advisories/43441",
"@id": "SA43441",
"@source": "SECUNIA"
},
{
"#text": "http://xforce.iss.net/xforce/xfdb/65592",
"@id": "65592",
"@source": "XF"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-Other",
"@title": "No Mapping(CWE-Other)"
}
],
"title": "Lunascape may insecurely load executable files"
}
JVNDB-2011-000004
Vulnerability from jvndb - Published: 2011-01-21 18:30 - Updated:2011-01-21 18:30Summary
Lunascape may insecurely load dynamic libraries
Details
Lunascape may use unsafe methods for determining how to load DLLs.
Lunascape is a web browser. Lunascape loads certain DLL's when HTML files are opened. Lunascape contains an issue with the DLL search path, which may lead to insecurely loading dynamic libraries.
Makoto Shiotsuki reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
| Type | URL | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000004.html",
"dc:date": "2011-01-21T18:30+09:00",
"dcterms:issued": "2011-01-21T18:30+09:00",
"dcterms:modified": "2011-01-21T18:30+09:00",
"description": "Lunascape may use unsafe methods for determining how to load DLLs.\r\n\r\nLunascape is a web browser. Lunascape loads certain DLL\u0027s when HTML files are opened. Lunascape contains an issue with the DLL search path, which may lead to insecurely loading dynamic libraries.\r\n\r\nMakoto Shiotsuki reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
"link": "https://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000004.html",
"sec:cpe": {
"#text": "cpe:/a:lunascape:lunascape",
"@product": "Lunascape",
"@vendor": "Lunascape",
"@version": "2.2"
},
"sec:cvss": {
"@score": "6.8",
"@severity": "Medium",
"@type": "Base",
"@vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"@version": "2.0"
},
"sec:identifier": "JVNDB-2011-000004",
"sec:references": [
{
"#text": "http://jvn.jp/en/jp/JVN94695018/index.html",
"@id": "JVN#94695018",
"@source": "JVN"
},
{
"#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3927",
"@id": "CVE-2010-3927",
"@source": "CVE"
},
{
"#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-3927",
"@id": "CVE-2010-3927",
"@source": "NVD"
},
{
"#text": "http://www.kb.cert.org/vuls/id/707943",
"@id": "VU#707943",
"@source": "CERT-VN"
},
{
"#text": "http://secunia.com/advisories/43003",
"@id": "SA43003",
"@source": "SECUNIA"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-Other",
"@title": "No Mapping(CWE-Other)"
}
],
"title": "Lunascape may insecurely load dynamic libraries"
}
JVNDB-2007-000322
Vulnerability from jvndb - Published: 2008-05-21 00:00 - Updated:2008-05-21 00:00Summary
Lunascape RSS reader arbitrary script execution vulnerability
Details
A vulnerability exists in the web browser Lunascape's RSS reader. An arbitrary script embedded in RSS feeds could be executed as the output of RSS information is not properly handled.
References
| Type | URL | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2007/JVNDB-2007-000322.html",
"dc:date": "2008-05-21T00:00+09:00",
"dcterms:issued": "2008-05-21T00:00+09:00",
"dcterms:modified": "2008-05-21T00:00+09:00",
"description": "A vulnerability exists in the web browser Lunascape\u0027s RSS reader. An arbitrary script embedded in RSS feeds could be executed as the output of RSS information is not properly handled.",
"link": "https://jvndb.jvn.jp/en/contents/2007/JVNDB-2007-000322.html",
"sec:cpe": {
"#text": "cpe:/a:lunascape:lunascape",
"@product": "Lunascape",
"@vendor": "Lunascape",
"@version": "2.2"
},
"sec:cvss": {
"@score": "4.3",
"@severity": "Medium",
"@type": "Base",
"@vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"@version": "2.0"
},
"sec:identifier": "JVNDB-2007-000322",
"sec:references": [
{
"#text": "http://jvn.jp/en/jp/JVN36628264/index.html",
"@id": "JVN#36628264",
"@source": "JVN"
},
{
"#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2335",
"@id": "CVE-2007-2335",
"@source": "CVE"
},
{
"#text": "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-2335",
"@id": "CVE-2007-2335",
"@source": "NVD"
},
{
"#text": "http://secunia.com/advisories/25000",
"@id": "SA25000",
"@source": "SECUNIA"
},
{
"#text": "http://www.securityfocus.com/bid/23665",
"@id": "23665",
"@source": "BID"
},
{
"#text": "http://www.frsirt.com/english/advisories/2007/1538",
"@id": "FrSIRT/ADV-2007-1538",
"@source": "FRSIRT"
}
],
"title": "Lunascape RSS reader arbitrary script execution vulnerability"
}