CVE-2012-1973

Mozilla: Multiple Use-after-free issues (MFSA 2012-58)

Use-after-free vulnerability in the nsObjectLoadingContent::LoadObject function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

CVSS 2.0 · 10.0 Critical EPSS 5.6% KEV · Not listed

Vendors

Canonical Debian Mozilla and 3 more

Products

Ubuntu Linux Debian Linux Firefox and 13 more

CVE-2002-2443

krb5: UDP ping-pong flaw in kpasswd

schpw.c in the kpasswd service in kadmind in MIT Kerberos 5 (aka krb5) before 1.11.3 does not properly validate UDP packets before sending responses, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged packet that triggers a communication loop, as demonstrated by krb_pingpong.nasl, a related issue to CVE-1999-0103.

CVSS 2.0 · 5.0 Medium EPSS 6.4% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 8 more

CVE-2012-1972

Mozilla: Multiple Use-after-free issues (MFSA 2012-58)

Use-after-free vulnerability in the nsHTMLEditor::CollapseAdjacentTextNodes function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

CVSS 2.0 · 10.0 Critical EPSS 5.6% KEV · Not listed

Vendors

Canonical Debian Mozilla and 3 more

Products

Ubuntu Linux Debian Linux Firefox and 13 more

CVE-2012-1970

Mozilla: Miscellaneous memory safety hazards (rv:15.0/ rv:10.0.7) (MFSA 2012-57)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVSS 2.0 · 10.0 Critical EPSS 5.6% KEV · Not listed

Vendors

Canonical Debian Mozilla and 3 more

Products

Ubuntu Linux Debian Linux Firefox and 13 more

CVE-2012-1938

Mozilla: Miscellaneous memory safety hazards (rv:13.0/ rv:10.0.5) (MFSA 2012-34)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 13.0, Thunderbird before 13.0, and SeaMonkey before 2.10 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) methodjit/ImmutableSync.cpp, (2) the JSObject::makeDenseArraySlow function in js/src/jsarray.cpp, and unknown other components.

CVSS 2.0 · 9.3 Critical EPSS 4.8% KEV · Not listed

Vendors

Mozilla Opensuse Redhat and 1 more

Products

Firefox Seamonkey Thunderbird and 11 more

CVE-2012-1798

ImageMagick: Out-of-bounds buffer read by copying image bytes for TIFF images with crafted TIFF EXIF IFD value

The TIFFGetEXIFProperties function in coders/tiff.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted EXIF IFD in a TIFF image.

CVSS 3.1 · 6.5 Medium EPSS 2.4% KEV · Not listed

Vendors

Debian Imagemagick Opensuse and 1 more

Products

Debian Linux Imagemagick Opensuse and 8 more

CVE-2012-1734

mysql: unspecified DoS vulnerability related to Server Optimizer (CPU Jul 2012)

Unspecified vulnerability in Oracle MySQL Server 5.1.62 and earlier, and 5.5.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.

CVSS 2.0 · 4.0 Medium EPSS 3.9% KEV · Not listed

Vendors

Mariadb Oracle Redhat

Products

Mariadb Mysql Enterprise Linux and 4 more

CVE-2012-1717

OpenJDK: insecure temporary file permissions (JRE, 7143606)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows local users to affect confidentiality via unknown vectors related to printing on Solaris or Linux.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Linux Oracle Redhat and 2 more

Products

Linux Kernel Jdk Jre and 20 more

CVE-2012-1705

mysql: unspecified DoS vulnerability related to Server Optimizer (CPU Jan 2013)

Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier and 5.5.28 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.

CVSS 2.0 · 4.0 Medium EPSS 2.6% KEV · Not listed

Vendors

Canonical Mariadb Oracle and 1 more

Products

Ubuntu Linux Mariadb Mysql and 5 more

CVE-2012-1703

mysql: unspecified DoS vulnerability related to Server Optimizer (CPU Apr 2012)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.61 and earlier, and 5.5.21 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer, a different vulnerability than CVE-2012-1690.

CVSS 2.0 · 6.8 Medium EPSS 3.7% KEV · Not listed

Vendors

Mariadb Oracle Redhat

Products

Mariadb Mysql Enterprise Linux and 5 more

CVE-2012-1702

mysql: unspecified unauthenticated DoS vulnerability related to Server (CPU Jan 2013)

Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier and 5.5.28 and earlier allows remote attackers to affect availability via unknown vectors.

CVSS 2.0 · 5.0 Medium EPSS 3.2% KEV · Not listed

Vendors

Canonical Mariadb Oracle and 1 more

Products

Ubuntu Linux Mariadb Mysql and 5 more

CVE-2012-1690

mysql: unspecified DoS vulnerability related to Server Optimizer (CPU Apr 2012)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.61 and earlier, and 5.5.21 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer, a different vulnerability than CVE-2012-1703.

CVSS 2.0 · 4.0 Medium EPSS 3.3% KEV · Not listed

Vendors

Mariadb Oracle Redhat

Products

Mariadb Mysql Enterprise Linux and 4 more

CVE-2012-1689

mysql: unspecified DoS vulnerability related to Server Optimizer (CPU Jul 2012)

Unspecified vulnerability in Oracle MySQL Server 5.1.62 and earlier, and 5.5.22 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.

CVSS 2.0 · 4.0 Medium EPSS 3.7% KEV · Not listed

Vendors

Mariadb Oracle Redhat

Products

Mariadb Mysql Enterprise Linux and 4 more

CVE-2012-1688

mysql: unspecified DoS vulnerability related to DML (CPU Apr 2012)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.61 and earlier, and 5.5.21 and earlier, allows remote authenticated users to affect availability, related to Server DML.

CVSS 2.0 · 4.0 Medium EPSS 3.5% KEV · Not listed

Vendors

Mariadb Oracle Redhat

Products

Mariadb Mysql Enterprise Linux and 4 more

CVE-2012-1149

libreoffice: Integer overflows, leading to heap-buffer overflows in JPEG, PNG and BMP reader implementations

Integer overflow in the vclmi.dll module in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted embedded image object, as demonstrated by a JPEG image in a .DOC file, which triggers a heap-based buffer overflow.

CVSS 2.0 · 7.5 High EPSS 14.0% KEV · Not listed

Vendors

Apache Debian Fedoraproject and 2 more

Products

Openoffice.org Debian Linux Fedora and 7 more

CVE-2012-0876

expat: hash table collisions CPU usage DoS

The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the same value.

CVSS 2.0 · 4.3 Medium EPSS 5.7% KEV · Not listed

Vendors

Canonical Debian Libexpat Project and 3 more

Products

Ubuntu Linux Debian Linux Libexpat and 12 more

CVE-2012-0867

postgresql: MITM due improper x509_v3 CN validation during certificate verification

PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote attackers to spoof connections when the host name is exactly 32 characters.

CVSS 2.0 · 4.3 Medium EPSS 2.3% KEV · Not listed

Vendors

Debian Opensuse Project Postgresql and 1 more

Products

Debian Linux Opensuse Postgresql and 8 more

CVE-2012-0574

mysql: unspecified DoS vulnerability related to Server (CPU Jan 2013)

Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.5.28 and earlier, allows remote authenticated users to affect availability via unknown vectors.

CVSS 2.0 · 4.0 Medium EPSS 2.8% KEV · Not listed

Vendors

Canonical Mariadb Oracle and 1 more

Products

Ubuntu Linux Mariadb Mysql and 5 more

CVE-2012-0572

mysql: unspecified DoS vulnerability related to InnoDB (CPU Jan 2013)

Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier and 5.5.28 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB.

CVSS 2.0 · 4.0 Medium EPSS 2.6% KEV · Not listed

Vendors

Canonical Mariadb Oracle and 1 more

Products

Ubuntu Linux Mariadb Mysql and 5 more

CVE-2012-0540

mysql: unspecified vulnerability related to GIS extension DoS (CPU Jul 2012)

Unspecified vulnerability in Oracle MySQL Server 5.1.62 and earlier and 5.5.23 and earlier allows remote authenticated users to affect availability, related to GIS Extension.

CVSS 2.0 · 4.0 Medium EPSS 3.7% KEV · Not listed

Vendors

Mariadb Oracle Redhat

Products

Mariadb Mysql Enterprise Linux and 4 more