{"cves":[{"id":"CVE-2009-4839","published":"2010-05-06T12:47:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nMultiple cross-site scripting (XSS) vulnerabilities in Basic Analysis and\nSecurity Engine (BASE), possibly 1.4.4 and earlier, allow remote attackers\nto inject arbitrary web script or HTML via unspecified parameters to (1)\nadmin/base_roleadmin.php, (2) admin/base_useradmin.php, (3)\nbase_conf_contents.php, (4) base_qry_sqlcalls.php, and (5)\nbase_ag_main.php.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2009-4839"],"bugs":[""],"patches":{"acidbase":[]},"tags":{},"packages":[{"name":"acidbase","source":"https://ubuntu.com/security/cve?package=acidbase","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=acidbase","debian":"https://tracker.debian.org/pkg/acidbase","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"karmic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"maverick","status":"not-affected","description":"1.4.5-1","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"1.4.5-1","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"1.4.5-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"not-affected","description":"1.4.5-1","component":null,"pocket":"security"},{"release_codename":"quantal","status":"not-affected","description":"1.4.5-1","component":null,"pocket":"security"},{"release_codename":"raring","status":"not-affected","description":"1.4.5-1","component":null,"pocket":"security"},{"release_codename":"saucy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.4.5","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2009-4838","published":"2010-05-06T12:47:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nSQL injection vulnerability in base_ag_common.php in Basic Analysis and\nSecurity Engine (BASE) before 1.4.3.1 allows remote attackers to execute\narbitrary SQL commands via unspecified parameters.  NOTE: some of these\ndetails are obtained from third party information.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2009-4838"],"bugs":[""],"patches":{"acidbase":[]},"tags":{},"packages":[{"name":"acidbase","source":"https://ubuntu.com/security/cve?package=acidbase","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=acidbase","debian":"https://tracker.debian.org/pkg/acidbase","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"karmic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"1.4.4-3ubuntu1","component":null,"pocket":"security"},{"release_codename":"maverick","status":"not-affected","description":"1.4.4-3ubuntu1","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"1.4.4-3ubuntu1","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"1.4.4-3ubuntu1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.4.4","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2009-4837","published":"2010-05-06T12:47:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nMultiple cross-site scripting (XSS) vulnerabilities in Basic Analysis and\nSecurity Engine (BASE) before 1.4.3.1 allow remote attackers to inject\narbitrary web script or HTML via the (1) sig[1] parameter to\nbase/base_qry_main.php, or the time[0][1] parameter to (2)\nbase/base_stat_alerts.php or (3) base/base_stat_uaddr.php.  NOTE: some of\nthese details are obtained from third party information.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2009-4837"],"bugs":[""],"patches":{"acidbase":[]},"tags":{},"packages":[{"name":"acidbase","source":"https://ubuntu.com/security/cve?package=acidbase","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=acidbase","debian":"https://tracker.debian.org/pkg/acidbase","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"karmic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"1.4.4-3ubuntu1","component":null,"pocket":"security"},{"release_codename":"maverick","status":"not-affected","description":"1.4.4-3ubuntu1","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"1.4.4-3ubuntu1","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"1.4.4-3ubuntu1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.4.3.1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2009-4835","published":"2010-05-06T12:47:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe (1) htk_read_header, (2) alaw_init, (3) ulaw_init, (4) pcm_init, (5)\nfloat32_init, and (6) sds_read_header functions in libsndfile 1.0.20 allow\ncontext-dependent attackers to cause a denial of service (divide-by-zero\nerror and application crash) via a crafted audio file.","ubuntu_description":"","notes":[{"author":"jdstrand","note":"simple application crasher\nupstream is the Debian maintainer. Patch to fix this is already in\nUbuntu 10.04 LTS and later (maybe earlier)"}],"codename":null,"priority":"negligible","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2009-4835"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=530831"],"patches":{"libsndfile":["upstream: http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=37;filename=sigfpe.diff;att=1;bug=530831"]},"tags":{},"packages":[{"name":"libsndfile","source":"https://ubuntu.com/security/cve?package=libsndfile","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libsndfile","debian":"https://tracker.debian.org/pkg/libsndfile","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"karmic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"1.0.21-2","component":null,"pocket":"security"},{"release_codename":"maverick","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.0.21","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2010-0406","published":"2010-05-05T13:22:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nOpenTTD before 1.0.1 allows remote attackers to cause a denial of service\n(file-descriptor exhaustion and daemon crash) by performing incomplete\ndownloads of the map.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2010-0406"],"bugs":[""],"patches":{"openttd":[]},"tags":{},"packages":[{"name":"openttd","source":"https://ubuntu.com/security/cve?package=openttd","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openttd","debian":"https://tracker.debian.org/pkg/openttd","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"karmic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"maverick","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"raring","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"saucy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.0.1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2010-0402","published":"2010-05-05T13:22:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nOpenTTD before 1.0.1 does not properly validate index values of certain\nitems, which allows remote authenticated users to cause a denial of service\n(daemon crash) or possibly execute arbitrary code via a crafted in-game\ncommand.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2010-0402"],"bugs":[""],"patches":{"openttd":[]},"tags":{},"packages":[{"name":"openttd","source":"https://ubuntu.com/security/cve?package=openttd","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openttd","debian":"https://tracker.debian.org/pkg/openttd","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"karmic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"maverick","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"raring","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"saucy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.0.1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2010-0401","published":"2010-05-05T13:22:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nOpenTTD before 1.0.1 accepts a company password for authentication in\nresponse to a request for the server password, which allows remote\nauthenticated users to bypass intended access restrictions or cause a\ndenial of service (daemon crash) by sending a company password packet.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2010-0401"],"bugs":[""],"patches":{"openttd":[]},"tags":{},"packages":[{"name":"openttd","source":"https://ubuntu.com/security/cve?package=openttd","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openttd","debian":"https://tracker.debian.org/pkg/openttd","statuses":[{"release_codename":"maverick","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"karmic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"quantal","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"raring","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"saucy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.0.1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2010-1707","published":"2010-05-04T16:00:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nMultiple cross-site scripting (XSS) vulnerabilities in register.php in\nPiwigo 2.0.9 and earlier allow remote attackers to inject arbitrary web\nscript or HTML via the (1) login and (2) mail_address parameters.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2010-1707"],"bugs":[""],"patches":{"piwigo":[]},"tags":{},"packages":[{"name":"piwigo","source":"https://ubuntu.com/security/cve?package=piwigo","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=piwigo","debian":"https://tracker.debian.org/pkg/piwigo","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"karmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"maverick","status":"released","description":"2.0.10-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.0.9","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2010-1431","published":"2010-05-04T16:00:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nSQL injection vulnerability in templates_export.php in Cacti 0.8.7e and\nearlier allows remote attackers to execute arbitrary SQL commands via the\nexport_item_id parameter.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2010-1431"],"bugs":[""],"patches":{"cacti":["upstream: http://www.cacti.net/downloads/patches/0.8.7e/sql_injection_template_export.patch"]},"tags":{},"packages":[{"name":"cacti","source":"https://ubuntu.com/security/cve?package=cacti","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=cacti","debian":"https://tracker.debian.org/pkg/cacti","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"karmic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"released","description":"0.8.7e-2ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"maverick","status":"not-affected","description":"0.8.7e-4","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"0.8.7e-4","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"0.8.7e-4","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"0.8.7e-3","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2010-1665","published":"2010-05-03T13:51:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nGoogle Chrome before 4.1.249.1064 does not properly handle fonts, which\nallows remote attackers to cause a denial of service (memory corruption)\nand possibly have unspecified other impact via unknown vectors.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"chromium bug is private as of 2010-05-25\nfta said: \"2010-1665 fixed (in webkit) which landed in chromium\nboth in 249r45544 (not important for us) and in 375r45594; hence\n5.0.375.38~r46659 has it.\""}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://googlechromereleases.blogspot.com/2010/04/stable-update-bug-and-security-fixes.html","https://www.cve.org/CVERecord?id=CVE-2010-1665"],"bugs":["http://code.google.com/p/chromium/issues/detail?id=42294"],"patches":{"chromium-browser":[]},"tags":{},"packages":[{"name":"chromium-browser","source":"https://ubuntu.com/security/cve?package=chromium-browser","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=chromium-browser","debian":"https://tracker.debian.org/pkg/chromium-browser","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"karmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"released","description":"5.0.375.38~r46659-0ubuntu0.10.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2010-1664","published":"2010-05-03T13:51:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nGoogle Chrome before 4.1.249.1064 does not properly handle HTML5 media,\nwhich allows remote attackers to cause a denial of service (memory\ncorruption) and possibly have unspecified other impact via unknown vectors.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://googlechromereleases.blogspot.com/2010/04/stable-update-bug-and-security-fixes.html","https://www.cve.org/CVERecord?id=CVE-2010-1664"],"bugs":["http://bugs.chromium.org/40487","https://bugs.webkit.org/show_bug.cgi?id=37331"],"patches":{"chromium-browser":["upstream: http://src.chromium.org/viewvc/chrome?view=rev&revision=45141","upstream: http://trac.webkit.org/changeset/57922"]},"tags":{},"packages":[{"name":"chromium-browser","source":"https://ubuntu.com/security/cve?package=chromium-browser","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=chromium-browser","debian":"https://tracker.debian.org/pkg/chromium-browser","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"karmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"released","description":"5.0.375.38~r46659-0ubuntu0.10.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2010-1663","published":"2010-05-03T13:51:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe Google URL Parsing Library (aka google-url or GURL) in Google Chrome\nbefore 4.1.249.1064 allows remote attackers to bypass the Same Origin\nPolicy via unspecified vectors.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://googlechromereleases.blogspot.com/2010/04/stable-update-bug-and-security-fixes.html","https://www.cve.org/CVERecord?id=CVE-2010-1663"],"bugs":["http://code.google.com/p/chromium/issues/detail?id=40445","https://bugs.webkit.org/show_bug.cgi?id=37128"],"patches":{"chromium-browser":["upstream: http://code.google.com/p/google-url/source/detail?r=129"]},"tags":{},"packages":[{"name":"chromium-browser","source":"https://ubuntu.com/security/cve?package=chromium-browser","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=chromium-browser","debian":"https://tracker.debian.org/pkg/chromium-browser","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"karmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"released","description":"5.0.375.38~r46659-0ubuntu0.10.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2010-1440","published":"2010-05-03T00:00:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nMultiple integer overflows in dvipsk/dospecial.c in dvips in TeX Live 2009\nand earlier, and teTeX, allow remote attackers to cause a denial of service\n(application crash) or possibly execute arbitrary code via a special\ncommand in a DVI file, related to the (1) predospecial and (2) bbdospecial\nfunctions, a different vulnerability than CVE-2010-0739.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-937-1","https://www.cve.org/CVERecord?id=CVE-2010-1440"],"bugs":["https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-1440"],"patches":{"texlive-bin":[]},"tags":{},"packages":[{"name":"texlive-bin","source":"https://ubuntu.com/security/cve?package=texlive-bin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=texlive-bin","debian":"https://tracker.debian.org/pkg/texlive-bin","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"released","description":"2007.dfsg.1-2ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"released","description":"2007.dfsg.2-4ubuntu2.1","component":null,"pocket":"security"},{"release_codename":"karmic","status":"released","description":"2007.dfsg.2-7ubuntu1.1","component":null,"pocket":"security"},{"release_codename":"lucid","status":"released","description":"2009-5ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needed","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-937-1"],"notices":[{"id":"USN-937-1","title":"TeX Live vulnerabilities","summary":"TeX Live vulnerabilities","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2010-05-06T13:13:52.576865","description":"It was discovered that TeX Live incorrectly handled certain long .bib\nbibliography files. If a user or automated system were tricked into\nprocessing a specially crafted bib file, an attacker could cause a denial\nof service via application crash. This issue only affected Ubuntu 8.04 LTS,\n9.04 and 9.10. (CVE-2009-1284)\n\nMarc Schoenefeld, Karel Šrot and Ludwig Nussel discovered that TeX Live\nincorrectly handled certain malformed dvi files. If a user or automated\nsystem were tricked into processing a specially crafted dvi file, an\nattacker could cause a denial of service via application crash, or possibly\nexecute arbitrary code with the privileges of the user invoking the\nprogram. (CVE-2010-0739, CVE-2010-1440)\n\nDan Rosenberg discovered that TeX Live incorrectly handled certain\nmalformed dvi files. If a user or automated system were tricked into\nprocessing a specially crafted dvi file, an attacker could cause a denial\nof service via application crash, or possibly execute arbitrary code with\nthe privileges of the user invoking the program. (CVE-2010-0827)\n","is_hidden":false,"release_packages":{"hardy":[{"name":"texlive-bin","version":"2007.dfsg.1-2ubuntu0.1","description":"","is_source":true},{"name":"texlive-base-bin","version":"2007.dfsg.1-2ubuntu0.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/texlive-bin","version_link":"https://launchpad.net/ubuntu/+source/texlive-bin/2007.dfsg.1-2ubuntu0.1"}],"lucid":[{"name":"texlive-bin","version":"2009-5ubuntu0.1","description":"","is_source":true},{"name":"texlive-binaries","version":"2009-5ubuntu0.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/texlive-bin","version_link":"https://launchpad.net/ubuntu/+source/texlive-bin/2009-5ubuntu0.1"}],"jaunty":[{"name":"texlive-bin","version":"2007.dfsg.2-4ubuntu2.1","description":"","is_source":true},{"name":"texlive-base-bin","version":"2007.dfsg.2-4ubuntu2.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/texlive-bin","version_link":"https://launchpad.net/ubuntu/+source/texlive-bin/2007.dfsg.2-4ubuntu2.1"}],"karmic":[{"name":"texlive-bin","version":"2007.dfsg.2-7ubuntu1.1","description":"","is_source":true},{"name":"texlive-base-bin","version":"2007.dfsg.2-7ubuntu1.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/texlive-bin","version_link":"https://launchpad.net/ubuntu/+source/texlive-bin/2007.dfsg.2-7ubuntu1.1"}]},"type":"USN","cves_ids":["CVE-2009-1284","CVE-2010-0739","CVE-2010-0827","CVE-2010-1440"]}]},{"id":"CVE-2010-1619","published":"2010-04-29T21:30:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nCross-site scripting (XSS) vulnerability in the fix_non_standard_entities\nfunction in the KSES HTML text cleaning library (weblib.php), as used in\nMoodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers\nto inject arbitrary web script or HTML via crafted HTML entities.","ubuntu_description":"","notes":[{"author":"kees","note":"MSA-10-0001 http://tracker.moodle.org/browse/MDL-21026"}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2010-1619"],"bugs":[""],"patches":{"moodle":["upstream: http://cvs.moodle.org/moodle/lib/weblib.php?r1=1.1349&r2=1.1350"]},"tags":{},"packages":[{"name":"moodle","source":"https://ubuntu.com/security/cve?package=moodle","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=moodle","debian":"https://tracker.debian.org/pkg/moodle","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"karmic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"maverick","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"1.9.9.dfsg2-3","component":null,"pocket":"security"},{"release_codename":"precise","status":"not-affected","description":"1.9.9.dfsg2-5","component":null,"pocket":"security"},{"release_codename":"quantal","status":"not-affected","description":"1.9.9.dfsg2-5","component":null,"pocket":"security"},{"release_codename":"raring","status":"not-affected","description":"1.9.9.dfsg2-5","component":null,"pocket":"security"},{"release_codename":"saucy","status":"not-affected","description":"1.9.9.dfsg2-5","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2010-1618","published":"2010-04-29T21:30:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nCross-site scripting (XSS) vulnerability in the phpCAS client library\nbefore 1.1.0, as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8,\nallows remote attackers to inject arbitrary web script or HTML via a\ncrafted URL, which is not properly handled in an error message.","ubuntu_description":"","notes":[{"author":"kees","note":"MSA-10-0002 http://tracker.moodle.org/browse/MDL-21802"}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2010-1618"],"bugs":[""],"patches":{"moodle":[]},"tags":{},"packages":[{"name":"moodle","source":"https://ubuntu.com/security/cve?package=moodle","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=moodle","debian":"https://tracker.debian.org/pkg/moodle","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"karmic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"maverick","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"precise","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"quantal","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"raring","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"saucy","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.9.8","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2010-1617","published":"2010-04-29T21:30:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nuser/view.php in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 does not\nproperly check a role, which allows remote authenticated users to obtain\nthe full names of other users via the course profile page.","ubuntu_description":"","notes":[{"author":"kees","note":"MSA-10-0003 http://tracker.moodle.org/browse/MDL-21830"}],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2010-1617"],"bugs":[""],"patches":{"moodle":["upstream: http://cvs.moodle.org/moodle/user/view.php?r1=1.168.2.28&r2=1.168.2.29"]},"tags":{},"packages":[{"name":"moodle","source":"https://ubuntu.com/security/cve?package=moodle","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=moodle","debian":"https://tracker.debian.org/pkg/moodle","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"karmic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"maverick","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"precise","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"quantal","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"raring","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"saucy","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.9.8","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2010-1616","published":"2010-04-29T21:30:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nMoodle 1.8.x and 1.9.x before 1.9.8 can create new roles when restoring a\ncourse, which allows teachers to create new accounts even if they do not\nhave the moodle/user:create capability.","ubuntu_description":"","notes":[{"author":"kees","note":"MSA-10-0004\nhttp://tracker.moodle.org/browse/MDL-16658\nhttp://tracker.moodle.org/browse/MDL-19233"}],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2010-1616"],"bugs":[""],"patches":{"moodle":[]},"tags":{},"packages":[{"name":"moodle","source":"https://ubuntu.com/security/cve?package=moodle","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=moodle","debian":"https://tracker.debian.org/pkg/moodle","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"karmic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"maverick","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"precise","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"quantal","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"raring","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"saucy","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.9.8","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2010-1615","published":"2010-04-29T21:30:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nMultiple SQL injection vulnerabilities in Moodle 1.8.x before 1.8.12 and\n1.9.x before 1.9.8 allow remote attackers to execute arbitrary SQL commands\nvia vectors related to (1) the add_to_log function in mod/wiki/view.php in\nthe wiki module, or (2) \"data validation in some forms elements\" related to\nlib/form/selectgroups.php.","ubuntu_description":"","notes":[{"author":"kees","note":"MSA-10-0006 http://tracker.moodle.org/browse/MDL-21818"}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2010-1615"],"bugs":[""],"patches":{"moodle":["upstream: http://cvs.moodle.org/moodle/mod/wiki/view.php?r1=1.76.2.6&r2=1.76.2.7"]},"tags":{},"packages":[{"name":"moodle","source":"https://ubuntu.com/security/cve?package=moodle","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=moodle","debian":"https://tracker.debian.org/pkg/moodle","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"karmic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"maverick","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"precise","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"quantal","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"raring","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"saucy","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.9.8","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2010-1614","published":"2010-04-29T21:30:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nMultiple cross-site scripting (XSS) vulnerabilities in Moodle 1.8.x before\n1.8.12 and 1.9.x before 1.9.8 allow remote attackers to inject arbitrary\nweb script or HTML via vectors related to (1) the Login-As feature or (2)\nwhen the global search feature is enabled, unspecified global search forms\nin the Global Search Engine.  NOTE: vector 1 might be resultant from a\ncross-site request forgery (CSRF) vulnerability.","ubuntu_description":"","notes":[{"author":"kees","note":"MSA-10-0008 http://tracker.moodle.org/browse/MDL-21769"}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2010-1614"],"bugs":[""],"patches":{"moodle":[]},"tags":{},"packages":[{"name":"moodle","source":"https://ubuntu.com/security/cve?package=moodle","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=moodle","debian":"https://tracker.debian.org/pkg/moodle","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"karmic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"maverick","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"precise","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"quantal","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"raring","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"saucy","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.9.8","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2010-1613","published":"2010-04-29T21:30:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nMoodle 1.8.x and 1.9.x before 1.9.8 does not enable the \"Regenerate session\nid during login\" setting by default, which makes it easier for remote\nattackers to conduct session fixation attacks.","ubuntu_description":"","notes":[{"author":"kees","note":"MSA-10-0009 http://tracker.moodle.org/browse/MDL-21788"}],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2010-1613"],"bugs":[""],"patches":{"moodle":[]},"tags":{},"packages":[{"name":"moodle","source":"https://ubuntu.com/security/cve?package=moodle","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=moodle","debian":"https://tracker.debian.org/pkg/moodle","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"karmic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"maverick","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"precise","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"quantal","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"raring","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"saucy","status":"not-affected","description":"1.9.9.dfsg2-2","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.9.8","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]}],"offset":72920,"limit":20,"total_results":79316}