{"cves":[{"id":"CVE-2012-3497","published":"2012-11-23T20:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\n(1) TMEMC_SAVE_GET_CLIENT_WEIGHT, (2) TMEMC_SAVE_GET_CLIENT_CAP, (3)\nTMEMC_SAVE_GET_CLIENT_FLAGS and (4) TMEMC_SAVE_END in the Transcendent\nMemory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause\na denial of service (NULL pointer dereference or memory corruption and host\ncrash) or possibly have other unspecified impacts via a NULL client id.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"This is XSA-15\nonly 4.0 and higher\nONLY installations where \"tmem\" is specified on the hypervisor command\nline are vulnerable.  Most Xen installations do not do so.\nupstream says: \"TMEM has been described by its maintainers as a\ntechnology preview, and is therefore not supported by them for\nuse in production systems. Pending a full security audit of the\ncode, the Xen.org security team recommends that Xen users do not\nenable TMEM.\"\nWe will not be fixing this in Ubuntu. Marking as \"ignored\""}],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://www.openwall.com/lists/oss-security/2012/09/05/8","http://lists.xen.org/archives/html/xen-announce/2012-09/msg00006.html","https://www.cve.org/CVERecord?id=CVE-2012-3497"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686764"],"patches":{"xen-3.1":[],"xen-3.2":[],"xen-3.3":[],"xen":[]},"tags":{"xen-3.1":["universe-binary"],"xen-3.2":["universe-binary"],"xen-3.3":["universe-binary"],"xen":["universe-binary"]},"packages":[{"name":"xen","source":"https://ubuntu.com/security/cve?package=xen","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen","debian":"https://tracker.debian.org/pkg/xen","statuses":[{"release_codename":"oneiric","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"natty","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"xen-3.1","source":"https://ubuntu.com/security/cve?package=xen-3.1","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen-3.1","debian":"https://tracker.debian.org/pkg/xen-3.1","statuses":[{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"natty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"xen-3.2","source":"https://ubuntu.com/security/cve?package=xen-3.2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen-3.2","debian":"https://tracker.debian.org/pkg/xen-3.2","statuses":[{"release_codename":"hardy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"natty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"xen-3.3","source":"https://ubuntu.com/security/cve?package=xen-3.3","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen-3.3","debian":"https://tracker.debian.org/pkg/xen-3.3","statuses":[{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"natty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2012-3496","published":"2012-11-23T20:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nXENMEM_populate_physmap in Xen 4.0, 4.1, and 4.2, and Citrix XenServer\n6.0.2 and earlier, when translating paging mode is not used, allows local\nPV OS guest kernels to cause a denial of service (BUG triggered and host\ncrash) via invalid flags such as MEMF_populate_on_demand.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"This is XSA-14\n3.2 and 3.3 don't seem to have the offending code"}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://seclists.org/oss-sec/2012/q3/378","https://www.cve.org/CVERecord?id=CVE-2012-3496"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686764"],"patches":{"xen-3.1":[],"xen-3.2":[],"xen-3.3":[],"xen":[]},"tags":{"xen-3.1":["universe-binary"],"xen-3.2":["universe-binary"],"xen-3.3":["universe-binary"],"xen":["universe-binary"]},"packages":[{"name":"xen","source":"https://ubuntu.com/security/cve?package=xen","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen","debian":"https://tracker.debian.org/pkg/xen","statuses":[{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"natty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"released","description":"4.1.1-2ubuntu4.4","component":null,"pocket":"security"},{"release_codename":"precise","status":"released","description":"4.1.2-2ubuntu2.4","component":null,"pocket":"security"},{"release_codename":"quantal","status":"not-affected","description":"4.1.3-3ubuntu1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4.1.3-2","component":null,"pocket":"security"}]},{"name":"xen-3.1","source":"https://ubuntu.com/security/cve?package=xen-3.1","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen-3.1","debian":"https://tracker.debian.org/pkg/xen-3.1","statuses":[{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"natty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"xen-3.2","source":"https://ubuntu.com/security/cve?package=xen-3.2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen-3.2","debian":"https://tracker.debian.org/pkg/xen-3.2","statuses":[{"release_codename":"hardy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"natty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"xen-3.3","source":"https://ubuntu.com/security/cve?package=xen-3.3","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen-3.3","debian":"https://tracker.debian.org/pkg/xen-3.3","statuses":[{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"natty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2012-3495","published":"2012-11-23T20:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe physdev_get_free_pirq hypercall in arch/x86/physdev.c in Xen 4.1.x and\nCitrix XenServer 6.0.2 and earlier uses the return value of the\nget_free_pirq function as an array index without checking that the return\nvalue indicates an error, which allows guest OS users to cause a denial of\nservice (invalid memory write and host crash) and possibly gain privileges\nvia unspecified vectors.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"This is XSA-13\nonly affects 4.1"}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://seclists.org/oss-sec/2012/q3/377","https://www.cve.org/CVERecord?id=CVE-2012-3495"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686764"],"patches":{"xen-3.1":[],"xen-3.2":[],"xen-3.3":[],"xen":[]},"tags":{"xen-3.1":["universe-binary"],"xen-3.2":["universe-binary"],"xen-3.3":["universe-binary"],"xen":["universe-binary"]},"packages":[{"name":"xen","source":"https://ubuntu.com/security/cve?package=xen","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen","debian":"https://tracker.debian.org/pkg/xen","statuses":[{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"natty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"released","description":"4.1.1-2ubuntu4.4","component":null,"pocket":"security"},{"release_codename":"precise","status":"released","description":"4.1.2-2ubuntu2.4","component":null,"pocket":"security"},{"release_codename":"quantal","status":"not-affected","description":"4.1.3-3ubuntu1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4.1.3-2","component":null,"pocket":"security"}]},{"name":"xen-3.1","source":"https://ubuntu.com/security/cve?package=xen-3.1","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen-3.1","debian":"https://tracker.debian.org/pkg/xen-3.1","statuses":[{"release_codename":"hardy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"natty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"xen-3.2","source":"https://ubuntu.com/security/cve?package=xen-3.2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen-3.2","debian":"https://tracker.debian.org/pkg/xen-3.2","statuses":[{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"natty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"xen-3.3","source":"https://ubuntu.com/security/cve?package=xen-3.3","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen-3.3","debian":"https://tracker.debian.org/pkg/xen-3.3","statuses":[{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2012-3494","published":"2012-11-23T20:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe set_debugreg hypercall in include/asm-x86/debugreg.h in Xen 4.0, 4.1,\nand 4.2, and Citrix XenServer 6.0.2 and earlier, when running on x86-64\nsystems, allows local OS guest users to cause a denial of service (host\ncrash) by writing to the reserved bits of the DR7 debug control register.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"This is XSA-12"}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://seclists.org/oss-sec/2012/q3/376","https://www.cve.org/CVERecord?id=CVE-2012-3494"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686764"],"patches":{"xen-3.1":[],"xen-3.2":[],"xen-3.3":[],"xen":[]},"tags":{"xen-3.1":["universe-binary"],"xen-3.2":["universe-binary"],"xen-3.3":["universe-binary"],"xen":["universe-binary"]},"packages":[{"name":"xen","source":"https://ubuntu.com/security/cve?package=xen","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen","debian":"https://tracker.debian.org/pkg/xen","statuses":[{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"natty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"released","description":"4.1.1-2ubuntu4.4","component":null,"pocket":"security"},{"release_codename":"precise","status":"released","description":"4.1.2-2ubuntu2.4","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4.1.3-2","component":null,"pocket":"security"},{"release_codename":"quantal","status":"not-affected","description":"4.1.3-3ubuntu1","component":null,"pocket":"security"},{"release_codename":"raring","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"saucy","status":"not-affected","description":"","component":null,"pocket":"security"}]},{"name":"xen-3.1","source":"https://ubuntu.com/security/cve?package=xen-3.1","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen-3.1","debian":"https://tracker.debian.org/pkg/xen-3.1","statuses":[{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"natty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"raring","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"saucy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"xen-3.2","source":"https://ubuntu.com/security/cve?package=xen-3.2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen-3.2","debian":"https://tracker.debian.org/pkg/xen-3.2","statuses":[{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"natty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"raring","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"saucy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"xen-3.3","source":"https://ubuntu.com/security/cve?package=xen-3.3","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen-3.3","debian":"https://tracker.debian.org/pkg/xen-3.3","statuses":[{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"natty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"raring","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"saucy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2012-2377","published":"2012-11-23T20:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nJGroups diagnostics service in JBoss Enterprise Portal Platform before\n5.2.2, SOA Platform before 5.3.0, and BRMS Platform before 5.3.0, is\nenabled without authentication when started by the JGroups channel, which\nallows remote attackers in adjacent networks to read diagnostics\ninformation via a crafted IP multicast.","ubuntu_description":"","notes":[{"author":"tyhicks","note":"Per Debian, not affected"}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://rhn.redhat.com/errata/RHSA-2012-1028.html","https://www.cve.org/CVERecord?id=CVE-2012-2377"],"bugs":[""],"patches":{"jbossas4":[]},"tags":{},"packages":[{"name":"jbossas4","source":"https://ubuntu.com/security/cve?package=jbossas4","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=jbossas4","debian":"https://tracker.debian.org/pkg/jbossas4","statuses":[{"release_codename":"hardy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2012-2086","published":"2012-11-23T20:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nSQL injection vulnerability in the get_last_conversation_lines function in\ncommon/logger.py in Gajim before 0.15 allows remote attackers to execute\narbitrary SQL commands via the jig parameter.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2012-2086"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=668038","https://trac.gajim.org/ticket/7034","https://bugs.launchpad.net/ubuntu/+source/gajim/+bug/984616"],"patches":{"gajim":[]},"tags":{},"packages":[{"name":"gajim","source":"https://ubuntu.com/security/cve?package=gajim","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=gajim","debian":"https://tracker.debian.org/pkg/gajim","statuses":[{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"released","description":"0.13-0ubuntu2.1","component":null,"pocket":"security"},{"release_codename":"maverick","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"natty","status":"released","description":"0.13.4-3ubuntu2.1","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"released","description":"0.14.1-1ubuntu1.1","component":null,"pocket":"security"},{"release_codename":"precise","status":"released","description":"0.15-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"0.15-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2012-1167","published":"2012-11-23T20:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe JBoss Server in JBoss Enterprise Application Platform 5.1.x before\n5.1.2 and 5.2.x before 5.2.2, Web Platform before 5.1.2, BRMS Platform\nbefore 5.3.0, and SOA Platform before 5.3.0, when the server is configured\nto use the JaccAuthorizationRealm and the ignoreBaseDecision property is\nset to true on the JBossWebRealm, does not properly check the permissions\ncreated by the WebPermissionMapping class, which allows remote\nauthenticated users to access arbitrary applications.","ubuntu_description":"","notes":[{"author":"jdstrand","note":"per Debian, <not-affected> (Only builds a few libraries, not the\nfull application server)"}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://rhn.redhat.com/errata/RHSA-2012-1013.html","https://www.cve.org/CVERecord?id=CVE-2012-1167"],"bugs":[""],"patches":{"jbossas4":[]},"tags":{},"packages":[{"name":"jbossas4","source":"https://ubuntu.com/security/cve?package=jbossas4","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=jbossas4","debian":"https://tracker.debian.org/pkg/jbossas4","statuses":[{"release_codename":"hardy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2011-4605","published":"2012-11-23T20:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker\nservlet in JBoss Enterprise Application Platform 4.3.0 CP10 and 5.1.2, Web\nPlatform 5.1.2, SOA Platform 4.2.0.CP05 and 4.3.0.CP05, Portal Platform 4.3\nCP07 and 5.2.x before 5.2.2, and BRMS Platform before 5.3.0 do not properly\nrestrict write access, which allows remote attackers to add, delete, or\nmodify items in a JNDI tree via unspecified vectors.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://rhn.redhat.com/errata/RHSA-2012-1022.html","https://www.cve.org/CVERecord?id=CVE-2011-4605"],"bugs":[""],"patches":{"jbossas4":[]},"tags":{},"packages":[{"name":"jbossas4","source":"https://ubuntu.com/security/cve?package=jbossas4","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=jbossas4","debian":"https://tracker.debian.org/pkg/jbossas4","statuses":[{"release_codename":"artful","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"natty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"quantal","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"raring","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"saucy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"vivid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty/esm was DNE [trusty was needs-triage]","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2012-0960","published":"2012-11-22T00:00:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nUnity integration extension (unity-firefox-extension) before 2.4.1 for\nFirefox does not properly handle callbacks, which allows remote attackers\nto cause a denial of service (Firefox crash) and possibly execute arbitrary\ncode via a crafted request.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-1639-1","https://www.cve.org/CVERecord?id=CVE-2012-0960"],"bugs":["https://bugs.launchpad.net/unity-firefox-extension/+bug/1076350"],"patches":{"unity-firefox-extension":[]},"tags":{},"packages":[{"name":"unity-firefox-extension","source":"https://ubuntu.com/security/cve?package=unity-firefox-extension","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=unity-firefox-extension","debian":"https://tracker.debian.org/pkg/unity-firefox-extension","statuses":[{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"released","description":"2.4.1-0ubuntu1.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-1639-1"],"notices":[{"id":"USN-1639-1","title":"unity-firefox-extension vulnerability","summary":"unity-firefox-extension could be made to crash or run programs as your\nlogin if it opened a malicious website.\n","instructions":"After a standard system update you need to restart Firefox to make all the\nnecessary changes.\n","references":[],"published":"2012-11-22T17:47:23.669335","description":"It was discovered that unity-firefox-extension incorrectly handled certain\ncallbacks. A remote attacker could use this issue to cause\nunity-firefox-extension to crash, resulting in a denial of service, or\npossibly execute arbitrary code.\n","is_hidden":false,"release_packages":{"quantal":[{"name":"unity-firefox-extension","version":"2.4.1-0ubuntu1.1","description":"Firefox extension: Unity Integration","is_source":true},{"name":"xul-ext-unity","version":"2.4.1-0ubuntu1.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/unity-firefox-extension","version_link":"https://launchpad.net/ubuntu/+source/unity-firefox-extension/2.4.1-0ubuntu1.1"}]},"type":"USN","cves_ids":["CVE-2012-0960"]}]},{"id":"CVE-2012-4539","published":"2012-11-21T23:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nXen 4.0 through 4.2, when running 32-bit x86 PV guests on 64-bit\nhypervisors, allows local guest OS administrators to cause a denial of\nservice (infinite loop and hang or crash) via invalid arguments to\nGNTTABOP_get_status_frames, aka \"Grant table hypercall infinite loop DoS\nvulnerability.\"","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"4.0 and higher"}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://xforce.iss.net/xforce/xfdb/80026","http://www.securitytracker.com/id?1027763","http://www.openwall.com/lists/oss-security/2012/11/13/4","http://lists.xen.org/archives/html/xen-announce/2012-11/msg00002.html","https://www.cve.org/CVERecord?id=CVE-2012-4539"],"bugs":[""],"patches":{"xen-3.1":[],"xen-3.2":[],"xen-3.3":[],"xen":[]},"tags":{},"packages":[{"name":"xen","source":"https://ubuntu.com/security/cve?package=xen","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen","debian":"https://tracker.debian.org/pkg/xen","statuses":[{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"released","description":"4.1.1-2ubuntu4.3","component":null,"pocket":"security"},{"release_codename":"precise","status":"released","description":"4.1.2-2ubuntu2.3","component":null,"pocket":"security"},{"release_codename":"quantal","status":"released","description":"4.1.3-3ubuntu1.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"xen-3.1","source":"https://ubuntu.com/security/cve?package=xen-3.1","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen-3.1","debian":"https://tracker.debian.org/pkg/xen-3.1","statuses":[{"release_codename":"hardy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"xen-3.2","source":"https://ubuntu.com/security/cve?package=xen-3.2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen-3.2","debian":"https://tracker.debian.org/pkg/xen-3.2","statuses":[{"release_codename":"hardy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"xen-3.3","source":"https://ubuntu.com/security/cve?package=xen-3.3","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen-3.3","debian":"https://tracker.debian.org/pkg/xen-3.3","statuses":[{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"doesn't affect 3.x","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2012-4537","published":"2012-11-21T23:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nXen 3.4 through 4.2, and possibly earlier versions, does not properly\nsynchronize the p2m and m2p tables when the set_p2m_entry function fails,\nwhich allows local HVM guest OS administrators to cause a denial of service\n(memory consumption and assertion failure), aka \"Memory mapping failure DoS\nvulnerability.\"","ubuntu_description":"","notes":[{"author":"kees","note":"for full-virtualization issues, add qemu (and kvm)"}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://xforce.iss.net/xforce/xfdb/80024","http://www.securitytracker.com/id?1027761","http://www.openwall.com/lists/oss-security/2012/11/13/6","http://osvdb.org/87307","http://lists.xen.org/archives/html/xen-announce/2012-11/msg00005.html","https://www.cve.org/CVERecord?id=CVE-2012-4537"],"bugs":[""],"patches":{"xen-3.1":[],"xen-3.2":[],"xen-3.3":[],"xen":[]},"tags":{"xen-3.1":["universe-binary"],"xen-3.2":["universe-binary"],"xen-3.3":["universe-binary"],"xen":["universe-binary"]},"packages":[{"name":"xen","source":"https://ubuntu.com/security/cve?package=xen","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen","debian":"https://tracker.debian.org/pkg/xen","statuses":[{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"released","description":"4.1.1-2ubuntu4.3","component":null,"pocket":"security"},{"release_codename":"precise","status":"released","description":"4.1.2-2ubuntu2.3","component":null,"pocket":"security"},{"release_codename":"quantal","status":"released","description":"4.1.3-3ubuntu1.1","component":null,"pocket":"security"},{"release_codename":"raring","status":"released","description":"4.2.0-1ubuntu2","component":null,"pocket":"security"},{"release_codename":"saucy","status":"released","description":"4.2.0-1ubuntu2","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"xen-3.1","source":"https://ubuntu.com/security/cve?package=xen-3.1","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen-3.1","debian":"https://tracker.debian.org/pkg/xen-3.1","statuses":[{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"raring","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"saucy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"xen-3.2","source":"https://ubuntu.com/security/cve?package=xen-3.2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen-3.2","debian":"https://tracker.debian.org/pkg/xen-3.2","statuses":[{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"raring","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"saucy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"xen-3.3","source":"https://ubuntu.com/security/cve?package=xen-3.3","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen-3.3","debian":"https://tracker.debian.org/pkg/xen-3.3","statuses":[{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"raring","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"saucy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2012-4536","published":"2012-11-21T23:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe (1) domain_pirq_to_emuirq and (2) physdev_unmap_pirq functions in Xen\n2.2 allows local guest OS administrators to cause a denial of service (Xen\ncrash) via a crafted pirq value that triggers an out-of-bounds read.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"only xen 4.1 is vulnerable"}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://xforce.iss.net/xforce/xfdb/80023","http://www.securitytracker.com/id?1027760","http://www.openwall.com/lists/oss-security/2012/11/13/2","http://osvdb.org/87297","http://lists.xen.org/archives/html/xen-announce/2012-11/msg00003.html","https://www.cve.org/CVERecord?id=CVE-2012-4536"],"bugs":[""],"patches":{"xen-3.1":[],"xen-3.2":[],"xen-3.3":[],"xen":[]},"tags":{},"packages":[{"name":"xen","source":"https://ubuntu.com/security/cve?package=xen","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen","debian":"https://tracker.debian.org/pkg/xen","statuses":[{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"released","description":"4.1.1-2ubuntu4.3","component":null,"pocket":"security"},{"release_codename":"precise","status":"released","description":"4.1.2-2ubuntu2.3","component":null,"pocket":"security"},{"release_codename":"quantal","status":"released","description":"4.1.3-3ubuntu1.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"xen-3.1","source":"https://ubuntu.com/security/cve?package=xen-3.1","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen-3.1","debian":"https://tracker.debian.org/pkg/xen-3.1","statuses":[{"release_codename":"hardy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"xen-3.2","source":"https://ubuntu.com/security/cve?package=xen-3.2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen-3.2","debian":"https://tracker.debian.org/pkg/xen-3.2","statuses":[{"release_codename":"hardy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"xen-3.3","source":"https://ubuntu.com/security/cve?package=xen-3.3","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen-3.3","debian":"https://tracker.debian.org/pkg/xen-3.3","statuses":[{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"4.1.x only","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2012-4535","published":"2012-11-21T23:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nXen 3.4 through 4.2, and possibly earlier versions, allows local guest OS\nadministrators to cause a denial of service (Xen infinite loop and physical\nCPU consumption) by setting a VCPU with an \"inappropriate deadline.\"","ubuntu_description":"","notes":[{"author":"kees","note":"for full-virtualization issues, add qemu (and kvm)"}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://xforce.iss.net/xforce/xfdb/80022","http://www.securitytracker.com/id?1027759","http://www.openwall.com/lists/oss-security/2012/11/13/1","http://osvdb.org/87298","http://lists.xen.org/archives/html/xen-announce/2012-11/msg00001.html","https://www.cve.org/CVERecord?id=CVE-2012-4535"],"bugs":[""],"patches":{"xen-3.1":[],"xen-3.2":[],"xen-3.3":[],"xen":[]},"tags":{"xen-3.1":["universe-binary"],"xen-3.2":["universe-binary"],"xen-3.3":["universe-binary"],"xen":["universe-binary"]},"packages":[{"name":"xen","source":"https://ubuntu.com/security/cve?package=xen","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen","debian":"https://tracker.debian.org/pkg/xen","statuses":[{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"released","description":"4.1.1-2ubuntu4.3","component":null,"pocket":"security"},{"release_codename":"precise","status":"released","description":"4.1.2-2ubuntu2.3","component":null,"pocket":"security"},{"release_codename":"quantal","status":"released","description":"4.1.3-3ubuntu1.1","component":null,"pocket":"security"},{"release_codename":"raring","status":"released","description":"4.2.0-1ubuntu2","component":null,"pocket":"security"},{"release_codename":"saucy","status":"released","description":"4.2.0-1ubuntu2","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"xen-3.1","source":"https://ubuntu.com/security/cve?package=xen-3.1","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen-3.1","debian":"https://tracker.debian.org/pkg/xen-3.1","statuses":[{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"raring","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"saucy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"xen-3.2","source":"https://ubuntu.com/security/cve?package=xen-3.2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen-3.2","debian":"https://tracker.debian.org/pkg/xen-3.2","statuses":[{"release_codename":"saucy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"raring","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"xen-3.3","source":"https://ubuntu.com/security/cve?package=xen-3.3","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen-3.3","debian":"https://tracker.debian.org/pkg/xen-3.3","statuses":[{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"raring","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"saucy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2012-4527","published":"2012-11-21T23:55:00","updated_at":"2025-08-04T19:24:16.829397+00:00","description":"\nStack-based buffer overflow in mcrypt 2.6.8 and earlier allows\nuser-assisted remote attackers to cause a denial of service (crash) and\npossibly execute arbitrary code via a long file name.  NOTE: it is not\nclear whether this is a vulnerability.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://www.openwall.com/lists/oss-security/2012/10/18","https://www.cve.org/CVERecord?id=CVE-2012-4527"],"bugs":[""],"patches":{"mcrypt":[]},"tags":{"mcrypt_natty":["stack-protector"],"mcrypt_oneiric":["stack-protector"],"mcrypt_precise":["stack-protector"],"mcrypt_devel":["stack-protector"]},"packages":[{"name":"mcrypt","source":"https://ubuntu.com/security/cve?package=mcrypt","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mcrypt","debian":"https://tracker.debian.org/pkg/mcrypt","statuses":[{"release_codename":"artful","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"2.6.8-1.3","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"2.6.8-1.3","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"natty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"quantal","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"raring","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"saucy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.6.8-1.3","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"vivid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"2.6.8-1.3","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was not-affected [2.6.8-1.3]","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2012-4426","published":"2012-11-21T23:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nMultiple format string vulnerabilities in mcrypt 2.6.8 and earlier might\nallow user-assisted remote attackers to cause a denial of service (crash)\nor possibly execute arbitrary code via vectors involving (1) errors.c or\n(2) mcrypt.c.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://www.openwall.com/lists/oss-security/2012/09/11/5","http://www.openwall.com/lists/oss-security/2012/09/13/17","https://www.cve.org/CVERecord?id=CVE-2012-4426"],"bugs":[""],"patches":{"mcrypt":[]},"tags":{"mcrypt":["stack-protector"]},"packages":[{"name":"mcrypt","source":"https://ubuntu.com/security/cve?package=mcrypt","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mcrypt","debian":"https://tracker.debian.org/pkg/mcrypt","statuses":[{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"natty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"quantal","status":"not-affected","description":"2.6.8-1.2","component":null,"pocket":"security"},{"release_codename":"raring","status":"not-affected","description":"2.6.8-1.2","component":null,"pocket":"security"},{"release_codename":"saucy","status":"not-affected","description":"2.6.8-1.2","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.6.8-1.1","component":null,"pocket":"security"},{"release_codename":"utopic","status":"not-affected","description":"2.6.8-1.2","component":null,"pocket":"security"},{"release_codename":"vivid","status":"not-affected","description":"2.6.8-1.2","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"2.6.8-1.2","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"2.6.8-1.2","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"2.6.8-1.2","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"2.6.8-1.2","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was not-affected [2.6.8-1.2]","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2012-4409","published":"2012-11-21T23:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nStack-based buffer overflow in the check_file_head function in extra.c in\nmcrypt 2.6.8 and earlier allows user-assisted remote attackers to execute\narbitrary code via an encrypted file with a crafted header containing long\nsalt data that is not properly handled during decryption.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://packetstormsecurity.org/files/116268/mcrypt-2.6.8-Buffer-Overflow-Proof-Of-Concept.html","http://www.openwall.com/lists/oss-security/2012/09/06","https://www.cve.org/CVERecord?id=CVE-2012-4409"],"bugs":[""],"patches":{"mcrypt":[]},"tags":{},"packages":[{"name":"mcrypt","source":"https://ubuntu.com/security/cve?package=mcrypt","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mcrypt","debian":"https://tracker.debian.org/pkg/mcrypt","statuses":[{"release_codename":"vivid","status":"not-affected","description":"2.6.8-1.2","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"2.6.8-1.2","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"2.6.8-1.2","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"2.6.8-1.2","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"2.6.8-1.2","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"natty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"quantal","status":"not-affected","description":"2.6.8-1.2","component":null,"pocket":"security"},{"release_codename":"raring","status":"not-affected","description":"2.6.8-1.2","component":null,"pocket":"security"},{"release_codename":"saucy","status":"not-affected","description":"2.6.8-1.2","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.6.8-1.1","component":null,"pocket":"security"},{"release_codename":"utopic","status":"not-affected","description":"2.6.8-1.2","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was not-affected [2.6.8-1.2]","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2012-5481","published":"2012-11-21T12:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nMoodle 2.3.x before 2.3.3 allows remote authenticated users to bypass the\nmoodle/role:manage capability requirement and read all capability data by\nvisiting the Check Permissions page.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://moodle.org/mod/forum/discuss.php?d=216161","http://openwall.com/lists/oss-security/2012/11/19/1","http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-35381","https://www.cve.org/CVERecord?id=CVE-2012-5481"],"bugs":[""],"patches":{"moodle":[]},"tags":{},"packages":[{"name":"moodle","source":"https://ubuntu.com/security/cve?package=moodle","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=moodle","debian":"https://tracker.debian.org/pkg/moodle","statuses":[{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.3.3","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2012-5480","published":"2012-11-21T12:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe Database activity module in Moodle 2.1.x before 2.1.9, 2.2.x before\n2.2.6, and 2.3.x before 2.3.3 allows remote attackers to bypass intended\nrestrictions on reading other participants' entries via an advanced search.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://moodle.org/mod/forum/discuss.php?d=216160","http://openwall.com/lists/oss-security/2012/11/19/1","http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-35558","https://www.cve.org/CVERecord?id=CVE-2012-5480"],"bugs":[""],"patches":{"moodle":[]},"tags":{},"packages":[{"name":"moodle","source":"https://ubuntu.com/security/cve?package=moodle","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=moodle","debian":"https://tracker.debian.org/pkg/moodle","statuses":[{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"not-affected","description":"1.9.9.dfsg2-6","component":null,"pocket":"security"},{"release_codename":"quantal","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"raring","status":"not-affected","description":"2.2.6.dfsg-1","component":null,"pocket":"security"},{"release_codename":"saucy","status":"not-affected","description":"2.2.6.dfsg-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty/esm was DNE [trusty was not-affected [2.2.6.dfsg-1]]","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2012-5479","published":"2012-11-21T12:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe Portfolio plugin in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and\n2.3.x before 2.3.3 allows remote authenticated users to upload and execute\nfiles via a modified Portfolio API callback.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://moodle.org/mod/forum/discuss.php?d=216159","http://openwall.com/lists/oss-security/2012/11/19/1","http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-36346","http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-33791","https://www.cve.org/CVERecord?id=CVE-2012-5479"],"bugs":[""],"patches":{"moodle":[]},"tags":{},"packages":[{"name":"moodle","source":"https://ubuntu.com/security/cve?package=moodle","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=moodle","debian":"https://tracker.debian.org/pkg/moodle","statuses":[{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"not-affected","description":"1.9.9.dfsg2-6","component":null,"pocket":"security"},{"release_codename":"quantal","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"raring","status":"not-affected","description":"2.2.6.dfsg-1","component":null,"pocket":"security"},{"release_codename":"saucy","status":"not-affected","description":"2.2.6.dfsg-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty/esm was DNE [trusty was not-affected [2.2.6.dfsg-1]]","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2012-5473","published":"2012-11-21T12:55:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe Database activity module in Moodle 2.1.x before 2.1.9, 2.2.x before\n2.2.6, and 2.3.x before 2.3.3 allows remote authenticated users to read\nactivity entries of a different group's users via an advanced search.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://moodle.org/mod/forum/discuss.php?d=216157","http://openwall.com/lists/oss-security/2012/11/19/1","http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-34448","https://www.cve.org/CVERecord?id=CVE-2012-5473"],"bugs":[""],"patches":{"moodle":[]},"tags":{},"packages":[{"name":"moodle","source":"https://ubuntu.com/security/cve?package=moodle","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=moodle","debian":"https://tracker.debian.org/pkg/moodle","statuses":[{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"not-affected","description":"1.9.9.dfsg2-6","component":null,"pocket":"security"},{"release_codename":"quantal","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"raring","status":"not-affected","description":"2.2.6.dfsg-1","component":null,"pocket":"security"},{"release_codename":"saucy","status":"not-affected","description":"2.2.6.dfsg-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty/esm was DNE [trusty was not-affected [2.2.6.dfsg-1]]","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]}],"offset":68500,"limit":20,"total_results":79316}