{"cves":[{"id":"CVE-2013-4394","published":"2013-10-28T22:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe SetX11Keyboard function in systemd, when PolicyKit Local Authority\n(PKLA) is used to change the group permissions on the X Keyboard Extension\n(XKB) layouts description, allows local users in the group to modify the\nXorg X11 Server configuration file and possibly gain privileges via vectors\ninvolving \"special and control characters.\"","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2013-4394"],"bugs":["https://bugzilla.redhat.com/show_bug.cgi?id=862324","http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357"],"patches":{"systemd":["upstream: http://cgit.freedesktop.org/systemd/systemd/commit/?id=0b507b17a760b21e33fc52ff377db6aa5086c680"]},"tags":{},"packages":[{"name":"systemd","source":"https://ubuntu.com/security/cve?package=systemd","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=systemd","debian":"https://tracker.debian.org/pkg/systemd","statuses":[{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"raring","status":"not-affected","description":"198-0ubuntu11.2","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2013-4393","published":"2013-10-28T22:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\njournald in systemd, when the origin of native messages is set to file,\nallows local users to cause a denial of service (logging service blocking)\nvia a crafted file descriptor.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2013-4393"],"bugs":["https://bugzilla.redhat.com/show_bug.cgi?id=859104","http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357"],"patches":{"systemd":["upstream: http://cgit.freedesktop.org/systemd/systemd/commit/?id=1dfa7e79a60de680086b1d93fcc3629b463f58bd"]},"tags":{},"packages":[{"name":"systemd","source":"https://ubuntu.com/security/cve?package=systemd","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=systemd","debian":"https://tracker.debian.org/pkg/systemd","statuses":[{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"raring","status":"not-affected","description":"198-0ubuntu11.2","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2013-4392","published":"2013-10-28T22:55:00","updated_at":"2025-08-25T20:55:47.299343+00:00","description":"\nsystemd, when updating file permissions, allows local users to change the\npermissions and SELinux security contexts for arbitrary files via a symlink\nattack on unspecified files.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"this is likely in a systemd component we don't ship"},{"author":"sbeattie","note":"it also is mitigated by hardlink protections"}],"codename":null,"priority":"low","cvss3":5.0,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5.0,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://github.com/systemd/systemd/pull/8583","https://lists.freedesktop.org/archives/systemd-devel/2018-March/040587.html","https://www.cve.org/CVERecord?id=CVE-2013-4392"],"bugs":["https://bugzilla.redhat.com/show_bug.cgi?id=859060","http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357"],"patches":{"systemd":["upstream: https://github.com/systemd/systemd/commit/08c849815c8db19ab0ab1ca226354d4a104041f0","upstream: https://github.com/systemd/systemd/commit/ee9e629eea3e959f0833f299c870d320354af2f5"]},"tags":{"systemd":["hardlink-restriction"]},"packages":[{"name":"systemd","source":"https://ubuntu.com/security/cve?package=systemd","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=systemd","debian":"https://tracker.debian.org/pkg/systemd","statuses":[{"release_codename":"upstream","status":"released","description":"239","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"raring","status":"not-affected","description":"code not built","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2013-4391","published":"2013-10-28T22:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nInteger overflow in the valid_user_field function in\njournal/journald-native.c in systemd allows remote attackers to cause a\ndenial of service (crash) and possibly execute arbitrary code via a large\njournal data field, which triggers a heap-based buffer overflow.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2013-4391"],"bugs":["https://bugzilla.redhat.com/show_bug.cgi?id=859051","http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357"],"patches":{"systemd":["upstream: http://cgit.freedesktop.org/systemd/systemd/commit/?id=505b6a61c22d5565e9308045c7b9bf79f7d0517e"]},"tags":{},"packages":[{"name":"systemd","source":"https://ubuntu.com/security/cve?package=systemd","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=systemd","debian":"https://tracker.debian.org/pkg/systemd","statuses":[{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"raring","status":"not-affected","description":"198-0ubuntu11.2","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2013-2208","published":"2013-10-28T22:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\ntpp 1.3.1 allows remote attackers to execute arbitrary commands via a\n--exec command in a TPP template file.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2013-2208"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=706644"],"patches":{"tpp":[]},"tags":{},"packages":[{"name":"tpp","source":"https://ubuntu.com/security/cve?package=tpp","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=tpp","debian":"https://tracker.debian.org/pkg/tpp","statuses":[{"release_codename":"wily","status":"not-affected","description":"1.3.1-3","component":null,"pocket":"security"},{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"quantal","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"raring","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"saucy","status":"not-affected","description":"1.3.1-3","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.3.1-3","component":null,"pocket":"security"},{"release_codename":"utopic","status":"not-affected","description":"1.3.1-3","component":null,"pocket":"security"},{"release_codename":"vivid","status":"not-affected","description":"1.3.1-3","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"1.3.1-3","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"1.3.1-3","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"1.3.1-3","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was not-affected [1.3.1-3]","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2012-6303","published":"2013-10-28T22:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nHeap-based buffer overflow in the GetWavHeader function in\ngeneric/jkSoundFile.c in the Snack Sound Toolkit, as used in WaveSurfer\n1.8.8p4, allows remote attackers to cause a denial of service (crash) and\npossibly execute arbitrary code via a large chunk size in a WAV file.","ubuntu_description":"","notes":[{"author":"jdstrand","note":"per Debian, affects snack, not wavesurfer"}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://secunia.com/advisories/49889/","http://www.openwall.com/lists/oss-security/2012/12/10/2","https://www.cve.org/CVERecord?id=CVE-2012-6303"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=695614"],"patches":{"wavesurfer":[],"snack":[]},"tags":{},"packages":[{"name":"snack","source":"https://ubuntu.com/security/cve?package=snack","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=snack","debian":"https://tracker.debian.org/pkg/snack","statuses":[{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"quantal","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"raring","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"saucy","status":"not-affected","description":"2.2.10-dfsg1-12.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.2.10-dfsg1-12.1","component":null,"pocket":"security"},{"release_codename":"utopic","status":"not-affected","description":"2.2.10.20090623-dfsg-4","component":null,"pocket":"security"},{"release_codename":"vivid","status":"not-affected","description":"2.2.10.20090623-dfsg-4","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"2.2.10.20090623-dfsg-4","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"2.2.10.20090623-dfsg-4","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"2.2.10.20090623-dfsg-4","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"2.2.10.20090623-dfsg-4","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was not-affected [2.2.10.20090623-dfsg-4]","component":null,"pocket":"security"}]},{"name":"wavesurfer","source":"https://ubuntu.com/security/cve?package=wavesurfer","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=wavesurfer","debian":"https://tracker.debian.org/pkg/wavesurfer","statuses":[{"release_codename":"hardy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"raring","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"saucy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was not-affected","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2012-0827","published":"2013-10-28T22:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe File module in Drupal 7.x before 7.11, when using unspecified field\naccess modules, allows remote authenticated users to read arbitrary private\nfiles that are associated with restricted fields via unspecified vectors.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://drupal.org/node/1425084","https://www.cve.org/CVERecord?id=CVE-2012-0827"],"bugs":[""],"patches":{"drupal7":[]},"tags":{},"packages":[{"name":"drupal7","source":"https://ubuntu.com/security/cve?package=drupal7","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=drupal7","debian":"https://tracker.debian.org/pkg/drupal7","statuses":[{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"maverick","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"natty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"not-affected","description":"7.12-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"7.11","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2012-0826","published":"2013-10-28T22:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nCross-site request forgery (CSRF) vulnerability in the Aggregator module in\nDrupal 6.x before 6.23 and 7.x before 7.11 allows remote attackers to\nhijack the authentication of unspecified victims for requests that update\nfeeds and possibly cause a denial of service (loss of updates due to rate\nlimit) via unspecified vectors.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://drupal.org/node/1425084","https://www.cve.org/CVERecord?id=CVE-2012-0826"],"bugs":[""],"patches":{"drupal6":[],"drupal7":[]},"tags":{},"packages":[{"name":"drupal6","source":"https://ubuntu.com/security/cve?package=drupal6","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=drupal6","debian":"https://tracker.debian.org/pkg/drupal6","statuses":[{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"maverick","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"natty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"quantal","status":"not-affected","description":"6.26-1.1ubuntu1","component":null,"pocket":"security"},{"release_codename":"raring","status":"not-affected","description":"6.26-1.1ubuntu1","component":null,"pocket":"security"},{"release_codename":"saucy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"6.23","component":null,"pocket":"security"},{"release_codename":"utopic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"drupal7","source":"https://ubuntu.com/security/cve?package=drupal7","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=drupal7","debian":"https://tracker.debian.org/pkg/drupal7","statuses":[{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"maverick","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"natty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"not-affected","description":"7.12-1","component":null,"pocket":"security"},{"release_codename":"quantal","status":"not-affected","description":"7.14-1","component":null,"pocket":"security"},{"release_codename":"raring","status":"not-affected","description":"7.14-1","component":null,"pocket":"security"},{"release_codename":"saucy","status":"not-affected","description":"7.14-1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"not-affected","description":"7.14-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"7.11","component":null,"pocket":"security"},{"release_codename":"utopic","status":"not-affected","description":"7.14-1","component":null,"pocket":"security"},{"release_codename":"vivid","status":"not-affected","description":"7.14-1","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"7.14-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"7.14-1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"7.14-1","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"7.14-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2012-0825","published":"2013-10-28T22:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nDrupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute\nExchange (AX) information is signed, which allows remote attackers to\nmodify potentially sensitive AX information without detection via a\nman-in-the-middle (MITM) attack.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://drupal.org/node/1425084","https://www.cve.org/CVERecord?id=CVE-2012-0825"],"bugs":[""],"patches":{"drupal6":[],"drupal7":[]},"tags":{},"packages":[{"name":"drupal6","source":"https://ubuntu.com/security/cve?package=drupal6","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=drupal6","debian":"https://tracker.debian.org/pkg/drupal6","statuses":[{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"maverick","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"natty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"quantal","status":"not-affected","description":"6.26-1.1ubuntu1","component":null,"pocket":"security"},{"release_codename":"raring","status":"not-affected","description":"6.26-1.1ubuntu1","component":null,"pocket":"security"},{"release_codename":"saucy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"6.23","component":null,"pocket":"security"},{"release_codename":"utopic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"drupal7","source":"https://ubuntu.com/security/cve?package=drupal7","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=drupal7","debian":"https://tracker.debian.org/pkg/drupal7","statuses":[{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"maverick","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"natty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"7.11","component":null,"pocket":"security"},{"release_codename":"precise","status":"not-affected","description":"7.12-1","component":null,"pocket":"security"},{"release_codename":"quantal","status":"not-affected","description":"7.14-1","component":null,"pocket":"security"},{"release_codename":"raring","status":"not-affected","description":"7.14-1","component":null,"pocket":"security"},{"release_codename":"saucy","status":"not-affected","description":"7.14-1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"not-affected","description":"7.14-1","component":null,"pocket":"security"},{"release_codename":"utopic","status":"not-affected","description":"7.14-1","component":null,"pocket":"security"},{"release_codename":"vivid","status":"not-affected","description":"7.14-1","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"7.14-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"7.14-1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"7.14-1","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"7.14-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2010-1159","published":"2013-10-28T22:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nMultiple heap-based buffer overflows in Aircrack-ng before 1.1 allow remote\nattackers to cause a denial of service (crash) and execute arbitrary code\nvia a (1) large length value in an EAPOL packet or (2) long EAPOL packet.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"1.1 was released with r1676, but more issues where discovered\nafter release."}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://seclists.org/bugtraq/2010/Mar/236","http://pyrit.wordpress.com/2010/03/28/remote-exploit-against-aircrack-ng/","https://www.cve.org/CVERecord?id=CVE-2010-1159"],"bugs":["http://trac.aircrack-ng.org/ticket/728","https://bugzilla.redhat.com/show_bug.cgi?id=577654","https://bugzilla.redhat.com/show_bug.cgi?id=582416","http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=577758"],"patches":{"aircrack-ng":["upstream: http://trac.aircrack-ng.org/changeset/1676","upstream: http://trac.aircrack-ng.org/changeset/1683","upstream: http://trac.aircrack-ng.org/changeset/1687","upstream: http://trac.aircrack-ng.org/changeset/1699","upstream: http://trac.aircrack-ng.org/changeset/1701","upstream: http://trac.aircrack-ng.org/changeset/1702"]},"tags":{},"packages":[{"name":"aircrack-ng","source":"https://ubuntu.com/security/cve?package=aircrack-ng","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=aircrack-ng","debian":"https://tracker.debian.org/pkg/aircrack-ng","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"karmic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"maverick","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"natty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"not-affected","description":"1:1.1-3","component":null,"pocket":"security"},{"release_codename":"raring","status":"not-affected","description":"1:1.1-3","component":null,"pocket":"security"},{"release_codename":"saucy","status":"not-affected","description":"1:1.1-3","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2013-2186","published":"2013-10-28T21:55:00","updated_at":"2025-05-26T12:48:21.401313+00:00","description":"\nThe DiskFileItem class in Apache Commons FileUpload, as used in Red Hat\nJBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat\nJBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files\nvia a NULL byte in a file name in a serialized instance.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2013-2186","https://ubuntu.com/security/notices/USN-2029-1"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=726601","https://bugzilla.redhat.com/show_bug.cgi?id=974814","https://bugzilla.novell.com/show_bug.cgi?id=846174"],"patches":{"libcommons-fileupload-java":["upstream: http://svn.apache.org/viewvc/commons/proper/fileupload/trunk/src/main/java/org/apache/commons/fileupload/disk/DiskFileItem.java?r1=1460343&r2=1507048"]},"tags":{},"packages":[{"name":"libcommons-fileupload-java","source":"https://ubuntu.com/security/cve?package=libcommons-fileupload-java","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libcommons-fileupload-java","debian":"https://tracker.debian.org/pkg/libcommons-fileupload-java","statuses":[{"release_codename":"saucy","status":"released","description":"1.3-2ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"lucid","status":"released","description":"1.2.1-3ubuntu2.1","component":null,"pocket":"security"},{"release_codename":"precise","status":"released","description":"1.2.2-1ubuntu0.12.04.1","component":null,"pocket":"security"},{"release_codename":"quantal","status":"released","description":"1.2.2-1ubuntu0.12.10.1","component":null,"pocket":"security"},{"release_codename":"raring","status":"released","description":"1.2.2-1ubuntu0.13.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-2029-1"],"notices":[{"id":"USN-2029-1","title":"Apache Commons FileUpload vulnerability","summary":"Apache Commons FileUpload could be made to overwrite files.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2013-11-13T15:11:48.831403","description":"It was discovered that Apache Commons FileUpload incorrectly handled file\nnames with NULL bytes in serialized instances. An attacker could use this\nissue to possibly write to arbitrary files.\n","is_hidden":false,"release_packages":{"lucid":[{"name":"libcommons-fileupload-java","version":"1.2.1-3ubuntu2.1","description":"File upload capability for servlets and web applications","is_source":true},{"name":"libcommons-fileupload-java","version":"1.2.1-3ubuntu2.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/libcommons-fileupload-java","version_link":"https://launchpad.net/ubuntu/+source/libcommons-fileupload-java/1.2.1-3ubuntu2.1"}]},"type":"USN","cves_ids":["CVE-2013-2186"]}]},{"id":"CVE-2012-4572","published":"2013-10-28T21:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nRed Hat JBoss Enterprise Application Platform (EAP) before 6.1.0 and JBoss\nPortal before 6.1.0 does not load the implementation of a custom\nauthorization module for a new application when an implementation is\nalready loaded and the modules share class names, which allows local users\nto control certain applications' authorization decisions via a crafted\napplication.","ubuntu_description":"","notes":[{"author":"ebarretto","note":"only builds a few libraries, not the full application server"}],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://rhn.redhat.com/errata/RHSA-2013-0833.html","https://www.cve.org/CVERecord?id=CVE-2012-4572"],"bugs":[""],"patches":{"jbossas4":[]},"tags":{},"packages":[{"name":"jbossas4","source":"https://ubuntu.com/security/cve?package=jbossas4","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=jbossas4","debian":"https://tracker.debian.org/pkg/jbossas4","statuses":[{"release_codename":"artful","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"quantal","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"raring","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"saucy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"vivid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty/esm was DNE [trusty was not-affected]","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2012-4529","published":"2013-10-28T21:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe org.apache.catalina.connector.Response.encodeURL method in Red Hat\nJBoss Web 7.1.x and earlier, when the tracking mode is set to COOKIE, sends\nthe jsessionid in the URL of the first response of a session, which allows\nremote attackers to obtain the session id (1) via a man-in-the-middle\nattack or (2) by reading a log.","ubuntu_description":"","notes":[{"author":"ebarretto","note":"only builds a few libraries, not the full application server"}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://rhn.redhat.com/errata/RHSA-2013-0833.html","https://www.cve.org/CVERecord?id=CVE-2012-4529"],"bugs":[""],"patches":{"jbossas4":[]},"tags":{},"packages":[{"name":"jbossas4","source":"https://ubuntu.com/security/cve?package=jbossas4","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=jbossas4","debian":"https://tracker.debian.org/pkg/jbossas4","statuses":[{"release_codename":"artful","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"quantal","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"raring","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"saucy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"vivid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty/esm was DNE [trusty was not-affected]","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2013-4302","published":"2013-10-27T00:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\n(1) ApiBlock.php, (2) ApiCreateAccount.php, (3) ApiLogin.php, (4)\nApiMain.php, (5) ApiQueryDeletedrevs.php, (6) ApiTokens.php, and (7)\nApiUnblock.php in includes/api/ in MediaWiki 1.19.x before 1.19.8, 1.20.x\nbefore 1.20.7, and 1.21.x before 1.21.2 allow remote attackers to obtain\nCSRF tokens and bypass the cross-site request forgery (CSRF) protection\nmechanism via a JSONP request to wiki/api.php.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://bugzilla.wikimedia.org/show_bug.cgi?id=49090","https://www.cve.org/CVERecord?id=CVE-2013-4302"],"bugs":[""],"patches":{"mediawiki":[]},"tags":{},"packages":[{"name":"mediawiki","source":"https://ubuntu.com/security/cve?package=mediawiki","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mediawiki","debian":"https://tracker.debian.org/pkg/mediawiki","statuses":[{"release_codename":"artful","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"1:1.27.4-3","component":null,"pocket":"security"},{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"quantal","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"raring","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"saucy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1:1.19.8+dfsg-1","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"vivid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty/esm was DNE [trusty was not-affected [1:1.19.14+dfsg-1]]","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2013-4301","published":"2013-10-27T00:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nincludes/resourceloader/ResourceLoaderContext.php in MediaWiki 1.19.x\nbefore 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allows remote\nattackers to obtain sensitive information via a \"<\" (open angle bracket)\ncharacter in the lang parameter to w/load.php, which reveals the\ninstallation path in an error message.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"ubuntu packages have fixed paths. ignoring."}],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://bugzilla.wikimedia.org/show_bug.cgi?id=46332","https://www.cve.org/CVERecord?id=CVE-2013-4301"],"bugs":[""],"patches":{"mediawiki":[]},"tags":{},"packages":[{"name":"mediawiki","source":"https://ubuntu.com/security/cve?package=mediawiki","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mediawiki","debian":"https://tracker.debian.org/pkg/mediawiki","statuses":[{"release_codename":"lucid","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"raring","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1:1.19.8+dfsg-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2013-0337","published":"2013-10-27T00:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe default configuration of nginx, possibly 1.3.13 and earlier, uses\nworld-readable permissions for the (1) access.log and (2) error.log files,\nwhich allows local users to obtain sensitive information by reading the\nfiles.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"The fix for CVE-2016-1247 in USN-3114-1 technically\nre-introduced this issue, but only for environments that\nconfigure non-default log filenames.\nUpstream will not be fixing the default permissions on log\nfiles.\nMarking this CVE as ignored, since the default configuration is\nnot vulnerable and we will not be fixing this any further."}],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://www.openwall.com/lists/oss-security/2013/02/21/15","https://www.cve.org/CVERecord?id=CVE-2013-0337"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=701112","https://bugs.launchpad.net/debian/+source/nginx/+bug/1193445","https://trac.nginx.org/nginx/ticket/376"],"patches":{"nginx":[]},"tags":{},"packages":[{"name":"nginx","source":"https://ubuntu.com/security/cve?package=nginx","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=nginx","debian":"https://tracker.debian.org/pkg/nginx","statuses":[{"release_codename":"artful","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"quantal","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"raring","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"saucy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.6.2-5, 1.4.4-2","component":null,"pocket":"security"},{"release_codename":"utopic","status":"not-affected","description":"1.4.4-4ubuntu1","component":null,"pocket":"security"},{"release_codename":"vivid","status":"not-affected","description":"1.4.4-4ubuntu1","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"1.4.4-4ubuntu1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2013-5914","published":"2013-10-26T17:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nBuffer overflow in the ssl_read_record function in ssl_tls.c in PolarSSL\nbefore 1.1.8, when using TLS 1.1, might allow remote attackers to execute\narbitrary code via a long packet.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-04","https://www.cve.org/CVERecord?id=CVE-2013-5914"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725359"],"patches":{"polarssl":["other: https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-04"],"mbedtls":[]},"tags":{},"packages":[{"name":"mbedtls","source":"https://ubuntu.com/security/cve?package=mbedtls","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mbedtls","debian":"https://tracker.debian.org/pkg/mbedtls","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.2.0-1","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"1.2.8-2","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"1.2.8-2","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"1.2.8-2","component":null,"pocket":"security"}]},{"name":"polarssl","source":"https://ubuntu.com/security/cve?package=polarssl","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=polarssl","debian":"https://tracker.debian.org/pkg/polarssl","statuses":[{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"quantal","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"raring","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"saucy","status":"not-affected","description":"1.2.8-2","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.2.0-1","component":null,"pocket":"security"},{"release_codename":"utopic","status":"not-affected","description":"1.2.8-2","component":null,"pocket":"security"},{"release_codename":"vivid","status":"not-affected","description":"1.2.8-2","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"1.2.8-2","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was not-affected [1.2.8-2]","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2013-4885","published":"2013-10-26T17:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe http-domino-enum-passwords.nse script in NMap before 6.40, when\ndomino-enum-passwords.idpath is set, allows remote servers to upload\n\"arbitrarily named\" files via a crafted FullName parameter in a response,\nas demonstrated using directory traversal sequences.","ubuntu_description":"","notes":[{"author":"jdstrand","note":"see full-disclosure for PoC"}],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://seclists.org/fulldisclosure/2013/Aug/67","https://www.cve.org/CVERecord?id=CVE-2013-4885"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=719289"],"patches":{"nmap":[]},"tags":{},"packages":[{"name":"nmap","source":"https://ubuntu.com/security/cve?package=nmap","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=nmap","debian":"https://tracker.debian.org/pkg/nmap","statuses":[{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"precise","status":"not-affected","description":"code-not-present","component":null,"pocket":"security"},{"release_codename":"quantal","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"raring","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"saucy","status":"released","description":"6.40-0.1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"6.40-0.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"6.40","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2013-1445","published":"2013-10-26T17:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe Crypto.Random.atfork function in PyCrypto before 2.6.1 does not\nproperly reseed the pseudo-random number generator (PRNG) before allowing a\nchild process to access it, which makes it easier for context-dependent\nattackers to obtain sensitive information by leveraging a race condition in\nwhich a child process is created and accesses the PRNG within the same\nrate-limit period as another process.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://www.openwall.com/lists/oss-security/2013/10/17/3","https://www.cve.org/CVERecord?id=CVE-2013-1445"],"bugs":[""],"patches":{"python-crypto":["upstream: http://www.openwall.com/lists/oss-security/2013/10/17/3"]},"tags":{},"packages":[{"name":"python-crypto","source":"https://ubuntu.com/security/cve?package=python-crypto","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=python-crypto","debian":"https://tracker.debian.org/pkg/python-crypto","statuses":[{"release_codename":"groovy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"artful","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"quantal","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"raring","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"saucy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.6.1-1, 2.6-4+deb7u3, 2.1.0-2+squeeze2","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2013-6283","published":"2013-10-25T23:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nVideoLAN VLC Media Player 2.0.8 and earlier allows remote attackers to\ncause a denial of service (crash) and possibly execute arbitrary code via a\nlong string in a URL in a m3u file.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"can't reproduce"}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://www.exploit-db.com/exploits/27700","https://www.cve.org/CVERecord?id=CVE-2013-6283"],"bugs":[""],"patches":{"vlc":[]},"tags":{},"packages":[{"name":"vlc","source":"https://ubuntu.com/security/cve?package=vlc","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=vlc","debian":"https://tracker.debian.org/pkg/vlc","statuses":[{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"precise","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"raring","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"saucy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty/esm was not-affected","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]}],"offset":66740,"limit":20,"total_results":79316}