Find a vulnerability
Search criteria
392 vulnerabilities by Parallels
VAR-201205-0246
Vulnerability from variot - Updated: 2026-04-10 23:37sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that contain a %3D sequence but no = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823. PHP-CGI-based setups contain a vulnerability when parsing query string parameters from php files. PHP is prone to an information-disclosure vulnerability. Exploiting this issue allows remote attackers to view the source code of files in the context of the server process. This may allow the attacker to obtain sensitive information and to run arbitrary PHP code on the affected computer; other attacks are also possible. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201209-03
http://security.gentoo.org/
Severity: High Title: PHP: Multiple vulnerabilities Date: September 24, 2012 Bugs: #384301, #396311, #396533, #399247, #399567, #399573, #401997, #410957, #414553, #421489, #427354, #429630 ID: 201209-03
Synopsis
Multiple vulnerabilities were found in PHP, the worst of which lead to remote execution of arbitrary code.
Background
PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML.
Affected packages
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 dev-lang/php < 5.3.15 >= 5.3.15 < 5.4.5 >= 5.4.5 ------------------------------------------------------------------- # Package 1 only applies to users of these architectures: arm
Description
Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details.
Workaround
There is no known workaround at this time.
Resolution
All PHP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-5.3.15"
All PHP users on ARM should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-5.4.5"
References
[ 1 ] CVE-2011-1398 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1398 [ 2 ] CVE-2011-3379 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3379 [ 3 ] CVE-2011-4566 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4566 [ 4 ] CVE-2011-4885 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4885 [ 5 ] CVE-2012-0057 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0057 [ 6 ] CVE-2012-0788 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0788 [ 7 ] CVE-2012-0789 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0789 [ 8 ] CVE-2012-0830 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0830 [ 9 ] CVE-2012-0831 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0831 [ 10 ] CVE-2012-1172 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1172 [ 11 ] CVE-2012-1823 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1823 [ 12 ] CVE-2012-2143 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2143 [ 13 ] CVE-2012-2311 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2311 [ 14 ] CVE-2012-2335 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2335 [ 15 ] CVE-2012-2336 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2336 [ 16 ] CVE-2012-2386 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2386 [ 17 ] CVE-2012-2688 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2688 [ 18 ] CVE-2012-3365 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3365 [ 19 ] CVE-2012-3450 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3450
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201209-03.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2012 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5 . HP System Management Homepage (SMH) v7.2.0 and earlier running on Linux and Windows. ----------------------------------------------------------------------
Become a PSI 3.0 beta tester! Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. Download it here! http://secunia.com/psi_30_beta_launch
TITLE: Ubuntu update for php
SECUNIA ADVISORY ID: SA49097
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/49097/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=49097
RELEASE DATE: 2012-05-07
DISCUSS ADVISORY: http://secunia.com/advisories/49097/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/49097/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=49097
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Ubuntu has issued an update for php. This fixes a vulnerability, which can be exploited by malicious people to disclose certain sensitive information or compromise a vulnerable system.
For more information: SA49014
SOLUTION: Apply updated packages.
Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
ORIGINAL ADVISORY: USN-1437-1: http://www.ubuntu.com/usn/usn-1437-1/
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
.
Additionally, this update fixes insufficient validation of upload name which lead to corrupted $_FILES indices.
For the stable distribution (squeeze), this problem has been fixed in version 5.3.3-7+squeeze9.
The testing distribution (wheezy) will be fixed soon.
For the unstable distribution (sid), this problem has been fixed in version 5.4.3-1.
We recommend that you upgrade your php5 packages.
Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux)
iQEcBAEBAgAGBQJPqqf3AAoJEOxfUAG2iX57MqcIALyiggqZ6SR+lOtdAd7npKd3 lZ3nXZVUvyC5e4/gageT3s2BlmuipGIrBvyraWR2TvAlNYIu7Ia6EMVsjG0T3gHu iM2yB4+wCaV8CIHqzmyN9lDaotxVty9gQ8BdtJaZguwi9+Sw7KfaCw6CXTluqPkU Ocdb7Saz7eVnNnVwTORxOCBnlIZDn4PbiW9tMLZawGTwNgdT/2lMS8czJGVmf/Oj j4c631zN1K8vlnctHCYQAS269nr9jwmEx0JKcWl5khc7XMi/SmcUG9xG4p5JpGrA ZbBAySyLuxr9bdMA3I9Jqxmmq4uaGwpCH8DSfMJd5FHNXKfq7efnL1Hp5mOERHU= =snJW -----END PGP SIGNATURE-----
Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Note: the current version of the following document is available here: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c03368475
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c03368475 Version: 1
HPSBUX02791 SSRT100856 rev.1 - HP-UX Apache Web Server running PHP, Remote Execution of Arbitrary Code, Privilege Elevation, Denial of Service (DoS)
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2012-06-14 Last Updated: 2012-06-14
Potential Security Impact: Remote execution of arbitrary code, privilege elevation, or Denial of Service (DoS).
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY Potential security vulnerabilities have been identified with HP-UX Apache Web Server running PHP. These vulnerabilities could be exploited remotely to execute arbitrary code, elevate privileges, or create a Denial of Service (DoS).
References: CVE-2011-4153, CVE-2012-0830, CVE-2012-0883, CVE-2012-1172, CVE-2012-1823, CVE-2012-2311
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP-UX B.11.23, B.11.31 running HP-UX Apache Web Server Suite v3.24 or earlier
BACKGROUND For a PGP signed
CVSS 2.0 Base Metrics
Reference Base Vector Base Score CVE-2011-4153 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0 CVE-2012-0830 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5 CVE-2012-0883 (AV:L/AC:M/Au:N/C:C/I:C/A:C) 6.9 CVE-2012-1172 (AV:N/AC:M/Au:N/C:N/I:P/A:P) 5.8 CVE-2012-1823 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5 CVE-2012-2311 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002
RESOLUTION
HP has provided the following software updates to resolve the vulnerabilities. The updates are available for download from http://software.hp.com
HP-UX Web Server Suite v.3.24 containing Apache v2.2.15.13 and PHP v5.2.17 HP-UX 11i Release Apache Depot name
B.11.23 (32-bit) HPUXWS22ATW-B324-32
B.11.23 (64-bit) HPUXWS22ATW-B324-64
B.11.31 (32-bit) HPUXWS22ATW-B324-32
B.11.31 (64-bit) HPUXWS22ATW-B324-64
MANUAL ACTIONS: Yes - Update Install HP-UX Web Server Suite v3.24 or subsequent.
PRODUCT SPECIFIC INFORMATION
HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HP and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see https://www.hp.com/go/swa
The following text is for use by the HP-UX Software Assistant. HP-UX Web Server Suite v3.24 AFFECTED VERSIONS
HP-UX B.11.23
hpuxws22APCH32.APACHE hpuxws22APCH32.APACHE2 hpuxws22APCH32.AUTH_LDAP hpuxws22APCH32.AUTH_LDAP2 hpuxws22APCH32.MOD_JK hpuxws22APCH32.MOD_JK2 hpuxws22APCH32.MOD_PERL hpuxws22APCH32.MOD_PERL2 hpuxws22APCH32.PHP hpuxws22APCH32.PHP2 hpuxws22APCH32.WEBPROXY hpuxws22APCH32.WEBPROXY2 hpuxws22APACHE.APACHE hpuxws22APACHE.APACHE2 hpuxws22APACHE.AUTH_LDAP hpuxws22APACHE.AUTH_LDAP2 hpuxws22APACHE.MOD_JK hpuxws22APACHE.MOD_JK2 hpuxws22APACHE.MOD_PERL hpuxws22APACHE.MOD_PERL2 hpuxws22APACHE.PHP hpuxws22APACHE.PHP2 hpuxws22APACHE.WEBPROXY hpuxws22APACHE.WEBPROXY2 action: install revision B.2.2.15.13 or subsequent
HP-UX B.11.31
hpuxws22APCH32.APACHE hpuxws22APCH32.APACHE2 hpuxws22APCH32.AUTH_LDAP hpuxws22APCH32.AUTH_LDAP2 hpuxws22APCH32.MOD_JK hpuxws22APCH32.MOD_JK2 hpuxws22APCH32.MOD_PERL hpuxws22APCH32.MOD_PERL2 hpuxws22APCH32.PHP hpuxws22APCH32.PHP2 hpuxws22APCH32.WEBPROXY hpuxws22APCH32.WEBPROXY2 hpuxws22APACHE.APACHE hpuxws22APACHE.APACHE2 hpuxws22APACHE.AUTH_LDAP hpuxws22APACHE.AUTH_LDAP2 hpuxws22APACHE.MOD_JK hpuxws22APACHE.MOD_JK2 hpuxws22APACHE.MOD_PERL hpuxws22APACHE.MOD_PERL2 hpuxws22APACHE.PHP hpuxws22APACHE.PHP2 hpuxws22APACHE.WEBPROXY hpuxws22APACHE.WEBPROXY2
action: install revision B.2.2.15.13 or subsequent
END AFFECTED VERSIONS
HISTORY Version:1 (rev.1) - 14 June 2012 Initial release
Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com
Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins
Security Bulletin List: A list of HP Security Bulletins, updated periodically, is contained in HP Security Notice HPSN-2011-001: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c02964430
Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://h20566.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/
Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB.
3C = 3COM 3P = 3rd Party Software GN = HP General Software HF = HP Hardware and Firmware MP = MPE/iX MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PI = Printing and Imaging PV = ProCurve ST = Storage Software TU = Tru64 UNIX UX = HP-UX
Copyright 2012 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners.
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux)
iEYEARECAAYFAk/f0GcACgkQ4B86/C0qfVnCEwCfWX2UX+TvBNeJawjexLmPtwjt 1TEAnj7Q3fqZkor5ilSKlW2dNHa1f4aO =pEB+ -----END PGP SIGNATURE----- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
APPLE-SA-2012-09-19-2 OS X Mountain Lion v10.8.2, OS X Lion v10.7.5 and Security Update 2012-004
OS X Mountain Lion v10.8.2, OS X Lion v10.7.5 and Security Update 2012-004 are now available and address the following:
Apache Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Multiple vulnerabilities in Apache Description: Apache is updated to version 2.2.22 to address several vulnerabilities, the most serious of which may lead to a denial of service. Further information is available via the Apache web site at http://httpd.apache.org/. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2011-3368 CVE-2011-3607 CVE-2011-4317 CVE-2012-0021 CVE-2012-0031 CVE-2012-0053
BIND Available for: OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: A remote attacker may be able to cause a denial of service in systems configured to run BIND as a DNS nameserver Description: A reachable assertion issue existed in the handling of DNS records. This issue was addressed by updating to BIND 9.7.6-P1. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2011-4313
BIND Available for: OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4, OS X Mountain Lion v10.8 and v10.8.1 Impact: A remote attacker may be able to cause a denial of service, data corruption, or obtain sensitive information from process memory in systems configured to run BIND as a DNS nameserver Description: A memory management issue existed in the handling of DNS records. This issue was addressed by updating to BIND 9.7.6-P1 on OS X Lion systems, and BIND 9.8.3-P1 on OS X Mountain Lion systems. CVE-ID CVE-2012-1667
CoreText Available for: OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Applications that use CoreText may be vulnerable to an unexpected application termination or arbitrary code execution Description: A bounds checking issue existed in the handling of text glyphs, which may lead to out of bounds memory reads or writes. This issue was addressed through improved bounds checking. This issue does not affect Mac OS X v10.6 or OS X Mountain Lion systems. CVE-ID CVE-2012-3716 : Jesse Ruderman of Mozilla Corporation
Data Security Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4, OS X Mountain Lion v10.8 and v10.8.1 Impact: An attacker with a privileged network position may intercept user credentials or other sensitive information Description: TrustWave, a trusted root CA, has issued, and subsequently revoked, a sub-CA certificate from one of its trusted anchors. This sub-CA facilitated the interception of communications secured by Transport Layer Security (TLS). This update adds the involved sub-CA certificate to OS X's list of untrusted certificates.
DirectoryService Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8 Impact: If the DirectoryService Proxy is used, a remote attacker may cause a denial of service or arbitrary code execution Description: A buffer overflow existed in the DirectoryService Proxy. This issue was addressed through improved bounds checking. This issue does not affect OS X Lion and Mountain Lion systems. CVE-ID CVE-2012-0650 : aazubel working with HP's Zero Day Initiative
ImageIO Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Viewing a maliciously crafted PNG image may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in libpng's handling of PNG images. These issues were addressed through improved validation of PNG images. These issues do not affect OS X Mountain Lion systems. CVE-ID CVE-2011-3026 : Juri Aedla CVE-2011-3048
ImageIO Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution Description: An integer overflow issue existed in libTIFF's handling of TIFF images. This issue was addressed through improved validation of TIFF images. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2012-1173 : Alexander Gavrun working with HP's Zero Day Initiative
Installer Available for: OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Remote admins and persons with physical access to the system may obtain account information Description: The fix for CVE-2012-0652 in OS X Lion 10.7.4 prevented user passwords from being recorded in the system log, but did not remove the old log entries. This issue was addressed by deleting log files that contained passwords. This issue does not affect Mac OS X 10.6 or OS X Mountain Lion systems. CVE-ID CVE-2012-0652
International Components for Unicode Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Applications that use ICU may be vulnerable to an unexpected application termination or arbitrary code execution Description: A stack buffer overflow existed in the handling of ICU locale IDs. This issue was addressed through improved bounds checking. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2011-4599
Kernel Available for: OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: A malicious program could bypass sandbox restrictions Description: A logic issue existed in the handling of debug system calls. This may allow a malicious program to gain code execution in other programs with the same user privileges. This issue was addressed by disabling handling of addresses in PT_STEP and PT_CONTINUE. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2012-0643 : iOS Jailbreak Dream Team
LoginWindow Available for: OS X Mountain Lion v10.8 and v10.8.1 Impact: A local user may be able to obtain other user's login passwords Description: A user-installed input method could intercept password keystrokes from Login Window or Screen Saver Unlock. This issue was addressed by preventing user-installed methods from being used when the system is handling login information. CVE-ID CVE-2012-3718 : An anonymous researcher
Mail Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Viewing an e-mail message may lead to execution of web plugins Description: An input validation issue existed in Mail's handling of embedded web plugins. This issue was addressed by disabling third- party plug-ins in Mail. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2012-3719 : Will Dormann of the CERT/CC
Mobile Accounts Available for: OS X Mountain Lion v10.8 and v10.8.1 Impact: A user with access to the contents of a mobile account may obtain the account password Description: Creating a mobile account saved a hash of the password in the account, which was used to login when the mobile account was used as an external account. The password hash could be used to determine the user's password. This issue was addressed by creating the password hash only if external accounts are enabled on the system where the mobile account is created. CVE-ID CVE-2012-3720 : Harald Wagener of Google, Inc.
PHP Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4, OS X Mountain Lion v10.8 and v10.8.1 Impact: Multiple vulnerabilities in PHP Description: >PHP is updated to version 5.3.15 to address multiple vulnerabilities, the most serious of which may lead to arbitrary code execution. Further information is available via the PHP web site at http://www.php.net CVE-ID CVE-2012-0831 CVE-2012-1172 CVE-2012-1823 CVE-2012-2143 CVE-2012-2311 CVE-2012-2386 CVE-2012-2688
PHP Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: PHP scripts which use libpng may be vulnerable to an unexpected application termination or arbitrary code execution Description: A memory corruption issue existed in the handling of PNG files. This issue was addressed by updating PHP's copy of libpng to version 1.5.10. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2011-3048
Profile Manager Available for: OS X Lion Server v10.7 to v10.7.4 Impact: An unauthenticated user could enumerate managed devices Description: An authentication issue existed in the Device Management private interface. This issue was addressed by removing the interface. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2012-3721 : Derick Cassidy of XEquals Corporation
QuickLook Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Viewing a maliciously crafted .pict file may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue existed in the handling of .pict files. This issue was addressed through improved validation of .pict files. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2012-0671 : Rodrigo Rubira Branco (twitter.com/bsdaemon) from the Qualys Vulnerability & Malware Research Labs (VMRL)
QuickTime Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution Description: An integer overflow existed in QuickTime's handling of sean atoms. This issue was addressed through improved bounds checking. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2012-0670 : Tom Gallagher (Microsoft) and Paul Bates (Microsoft) working with HP's Zero Day Initiative
QuickTime Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution Description: An uninitialized memory access existed in the handling of Sorenson encoded movie files. This issue was addressed through improved memory initialization. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2012-3722 : Will Dormann of the CERT/CC
QuickTime Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow existed in the handling of RLE encoded movie files. This issue was addressed through improved bounds checking. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2012-0668 : Luigi Auriemma working with HP's Zero Day Initiative
Ruby Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: An attacker may be able to decrypt data protected by SSL Description: There are known attacks on the confidentiality of SSL 3.0 and TLS 1.0 when a cipher suite uses a block cipher in CBC mode. The Ruby OpenSSL module disabled the 'empty fragment' countermeasure which prevented these attacks. This issue was addressed by enabling empty fragments. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2011-3389
USB Available for: OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Attaching a USB device may lead to an unexpected system termination or arbitrary code execution Description: A memory corruption issue existed in the handling of USB hub descriptors. This issue was addressed through improved handling of the bNbrPorts descriptor field. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2012-3723 : Andy Davis of NGS Secure
Note: OS X Mountain Lion v10.8.2 includes the content of Safari 6.0.1. For further details see "About the security content of Safari 6.0.1" at http://http//support.apple.com/kb/HT5502
OS X Mountain Lion v10.8.2, OS X Lion v10.7.5 and Security Update 2012-004 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/
The Software Update utility will present the update that applies to your system configuration. Only one is needed, either OS X Mountain Lion v10.8.2, OS X Lion v10.7.5 or Security Update 2012-004.
For OS X Mountain Lion v10.8.1 The download file is named: OSXUpd10.8.2.dmg Its SHA-1 digest is: d6779e1cc748b78af0207499383b1859ffbebe33
For OS X Mountain Lion v10.8 The download file is named: OSXUpdCombo10.8.2.dmg Its SHA-1 digest is: b08f10233d362e39f20b69f91d1d73f5e7b68a2c
For OS X Lion v10.7.4 The download file is named: MacOSXUpd10.7.5.dmg Its SHA-1 digest is: e0a9582cce9896938a7a541bd431862d93893532
For OS X Lion v10.7 and v10.7.3 The download file is named: MacOSXUpdCombo10.7.5.dmg Its SHA-1 digest is: f7a26b164fa10dae4fe646e57b01c34a619c8d9b
For OS X Lion Server v10.7.4 The download file is named: MacOSXServerUpd10.7.5.dmg Its SHA-1 digest is: a891b03bfb4eecb745c0c39a32f39960fdb6796a
For OS X Lion Server v10.7 and v10.7.3 The download file is named: MacOSXServerUpdCombo10.7.5.dmg Its SHA-1 digest is: df6e1748ab0a3c9e05c890be49d514673efd965e
For Mac OS X v10.6.8 The download file is named: SecUpd2012-004.dmg Its SHA-1 digest is: 5b136e29a871d41012f0c6ea1362d6210c8b4fb7
For Mac OS X Server v10.6.8 The download file is named: SecUpdSrvr2012-004.dmg Its SHA-1 digest is: 9b24496be15078e58a88537700f2f39c112e3b28
Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJQWhlbAAoJEPefwLHPlZEwwjwQAKrpQlZh1B2mkSTLxR7QZg6e Qm7SmIZL9sjl5gQkTxoAvOGxJ8uRdYPlJ1IpyU/MbK0GqO53KmFSeKkwCnvLKMaW pc6tiFaQ4zV4LEAwBAFEuqCsMyPEJqKDhYXl2cHQmWfAlrLCyCKfzGLy2mY2UnkE DQC2+ys70DChFv2GzyXlibBXAGMKDygJ5dVKynsi1ceZLYWbUJoGwlUtXPylBpnO QyGWXmEloPbhK6HJbKMNacuDdVcb26pvIeFiivkTSxPVlZ3ns2tAwEyvHrzA9O4n 7rQ6jvfDbguOZmM5sPFvVKBw2GVDBNU+G3T8ouIXhk6Pjhr4in8VFCb8MIMLb8hm 7YYn2z1TzKTNmUuYbwe6ukQvf57cPuW0bAvslbl6PgrzqorlNPU4rDoSvPrJx/RO BOYkcxfirevHDGibfkeqXPjL3h+bVrb1USZpAv+ZOAy0M89SHFcvMtpAhxnoGiV5 w4EyKB+9Yi/CSAk2Ne3Y5kHH7/v3pWV68aJwhVirya7ex3vnJ+M+lRLKSm2BUjL3 +9fykrJBDujFDXoCmK5CN5Wx36DSVZ4VO1h635crotudtcvd+LQ2VHma/Chav5wK q5SSllf4KEownpx6o/qTxpg5tcC4lvgTcsDHlYcNq2s8KTTjmOden8ar4h7M7QD2 xyBfrQfG/dsif6jGHaot =8joH -----END PGP SIGNATURE----- . Content-Disposition: inline
==========================================================================Ubuntu Security Notice USN-1437-1 May 04, 2012
php5 vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS
- Ubuntu 8.04 LTS
Summary:
Standalone PHP CGI scripts could be made to execute arbitrary code with the privilege of the web server.
Software Description: - php5: HTML-embedded scripting language interpreter
Details:
It was discovered that PHP, when used as a stand alone CGI processor for the Apache Web Server, did not properly parse and filter query strings. Configurations using mod_php5 and FastCGI were not vulnerable.
This update addresses the issue when the PHP CGI interpreter is configured using mod_cgi and mod_actions as described in /usr/share/doc/php5-cgi/README.Debian.gz; however, if an alternate configuration is used to enable PHP CGI processing, it should be reviewed to ensure that command line arguments cannot be passed to the PHP interpreter. Please see http://people.canonical.com/~ubuntu-security/cve/2012/CVE-2012-2311.html for more details and potential mitigation approaches.
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 12.04 LTS: php5-cgi 5.3.10-1ubuntu3.1
Ubuntu 11.10: php5-cgi 5.3.6-13ubuntu3.7
Ubuntu 11.04: php5-cgi 5.3.5-1ubuntu7.8
Ubuntu 10.04 LTS: php5-cgi 5.3.2-1ubuntu4.15
Ubuntu 8.04 LTS: php5-cgi 5.2.4-2ubuntu5.24
In general, a standard system update will make all the necessary changes
Show details on source website{
"affected_products": {
"_id": null,
"data": [
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.3,
"vendor": "php",
"version": "5.3.1"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.3,
"vendor": "php",
"version": "5.3.8"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.3,
"vendor": "php",
"version": "5.3.10"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.3,
"vendor": "php",
"version": "5.3.9"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.3,
"vendor": "php",
"version": "5.3.3"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.3,
"vendor": "php",
"version": "5.3.6"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.3,
"vendor": "php",
"version": "5.3.5"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.3,
"vendor": "php",
"version": "5.3.4"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.3,
"vendor": "php",
"version": "5.3.7"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.3,
"vendor": "php",
"version": "5.4.1"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.3,
"vendor": "php",
"version": "5.3.2"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.0.2"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.14"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.3"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.4.9"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.3.3"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.6"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.13"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.4"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.0.1"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.4"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.9"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.4.2"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.4.4"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.1.2"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.2.1"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.1.0"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.3.8"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.4.1"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.17"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.13"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.1.6"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "2.0b10"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.4.7"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.16"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.2.3"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.18"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.5"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.3.11"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.9"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.10"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.0.0"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.2.2"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.0.6"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.1"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.16"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.4.3"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.3"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.3.4"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.3.2"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.0.4"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.8"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.4.0"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.1.1"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.12"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.2.0"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.3.0"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.15"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.3.5"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.4.6"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.12"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.17"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.11"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.6"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.1.0"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.3.9"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.1.2"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.8"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.0.5"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.3.6"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.5"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.0.3"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.3.7"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.1.4"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.0.0"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.7"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.11"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.0.4"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.2"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.0.5"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.0"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.1.3"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.4.5"
},
{
"_id": null,
"model": "php",
"scope": "lte",
"trust": 1.0,
"vendor": "php",
"version": "5.3.12"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.3.10"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.0.2"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.14"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.4.0"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.1.5"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.0"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.7"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "2.0"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "1.0"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.2"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.15"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.4.8"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.3.0"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.1"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.3.1"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.0.1"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.3.11"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.1.1"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.10"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.0.7"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.0.3"
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "the php group",
"version": null
},
{
"_id": null,
"model": "plesk panel",
"scope": "eq",
"trust": 0.3,
"vendor": "parallels",
"version": "9.5.4"
},
{
"_id": null,
"model": "linux i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.10"
},
{
"_id": null,
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.2"
},
{
"_id": null,
"model": "enterprise linux hpc node optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "7.2"
},
{
"_id": null,
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "linux ia-64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "ip office application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "8.1"
},
{
"_id": null,
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "6.2"
},
{
"_id": null,
"model": "voice portal sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0"
},
{
"_id": null,
"model": "enterprise linux server",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "linux enterprise sdk sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"_id": null,
"model": "voice portal",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.1"
},
{
"_id": null,
"model": "linux enterprise server sp3 ltss",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "10"
},
{
"_id": null,
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"_id": null,
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "5"
},
{
"_id": null,
"model": "enterprise linux server eus 6.1.z",
"scope": null,
"trust": 0.3,
"vendor": "redhat",
"version": null
},
{
"_id": null,
"model": "enterprise linux server optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "enterprise linux long life server",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "5.3"
},
{
"_id": null,
"model": "appliance server",
"scope": "eq",
"trust": 0.3,
"vendor": "turbolinux",
"version": "3.0"
},
{
"_id": null,
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2.3"
},
{
"_id": null,
"model": "enterprise server",
"scope": "eq",
"trust": 0.3,
"vendor": "mandrakesoft",
"version": "5"
},
{
"_id": null,
"model": "voice portal sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0"
},
{
"_id": null,
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7"
},
{
"_id": null,
"model": "ctpview",
"scope": "eq",
"trust": 0.3,
"vendor": "juniper",
"version": "4.6"
},
{
"_id": null,
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"_id": null,
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.10"
},
{
"_id": null,
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "7.0"
},
{
"_id": null,
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1.1"
},
{
"_id": null,
"model": "aura communication manager utility services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"_id": null,
"model": "linux lts amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"_id": null,
"model": "linux mandrake x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2011"
},
{
"_id": null,
"model": "enterprise linux workstation",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.8"
},
{
"_id": null,
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.5"
},
{
"_id": null,
"model": "linux lts powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"_id": null,
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"_id": null,
"model": "ctpview",
"scope": "eq",
"trust": 0.3,
"vendor": "juniper",
"version": "4.3"
},
{
"_id": null,
"model": "aura messaging",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0.1"
},
{
"_id": null,
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.3"
},
{
"_id": null,
"model": "linux enterprise sdk sp4",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "10"
},
{
"_id": null,
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.4"
},
{
"_id": null,
"model": "ctpview",
"scope": "eq",
"trust": 0.3,
"vendor": "juniper",
"version": "4.2"
},
{
"_id": null,
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.8"
},
{
"_id": null,
"model": "opensuse",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "11.4"
},
{
"_id": null,
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.04"
},
{
"_id": null,
"model": "enterprise linux workstation optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "voice portal",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.1.1"
},
{
"_id": null,
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.8.1"
},
{
"_id": null,
"model": "linux i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"_id": null,
"model": "aura communication manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"_id": null,
"model": "plesk panel",
"scope": "eq",
"trust": 0.3,
"vendor": "parallels",
"version": "9.3"
},
{
"_id": null,
"model": "linux lts sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"_id": null,
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "ctpview 7.0r1",
"scope": "ne",
"trust": 0.3,
"vendor": "juniper",
"version": null
},
{
"_id": null,
"model": "lotus foundations start 1.2.2b",
"scope": "ne",
"trust": 0.3,
"vendor": "ibm",
"version": null
},
{
"_id": null,
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.1"
},
{
"_id": null,
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.1"
},
{
"_id": null,
"model": "aura messaging",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"_id": null,
"model": "linux lts i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"_id": null,
"model": "linux i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.04"
},
{
"_id": null,
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2.2"
},
{
"_id": null,
"model": "enterprise linux eus 5.6.z server",
"scope": null,
"trust": 0.3,
"vendor": "redhat",
"version": null
},
{
"_id": null,
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.2"
},
{
"_id": null,
"model": "system management homepage",
"scope": "ne",
"trust": 0.3,
"vendor": "hp",
"version": "7.2.1"
},
{
"_id": null,
"model": "linux enterprise server sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"_id": null,
"model": "aura session manager sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 0.3,
"vendor": "php",
"version": "5.4.2"
},
{
"_id": null,
"model": "linux enterprise server sp4",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "10"
},
{
"_id": null,
"model": "ip office application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"_id": null,
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "6"
},
{
"_id": null,
"model": "lotus foundations start 1.2.2a",
"scope": null,
"trust": 0.3,
"vendor": "ibm",
"version": null
},
{
"_id": null,
"model": "mac os",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.5"
},
{
"_id": null,
"model": "ctpview",
"scope": "eq",
"trust": 0.3,
"vendor": "juniper",
"version": "4.5"
},
{
"_id": null,
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2.1"
},
{
"_id": null,
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"_id": null,
"model": "enterprise linux desktop optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "aura communication manager utility services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"_id": null,
"model": "linux mandrake x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2010.1"
},
{
"_id": null,
"model": "voice portal sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.1"
},
{
"_id": null,
"model": "linux enterprise server sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"_id": null,
"model": "voice portal",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.1.2"
},
{
"_id": null,
"model": "ip office application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.0"
},
{
"_id": null,
"model": "linux",
"scope": null,
"trust": 0.3,
"vendor": "gentoo",
"version": null
},
{
"_id": null,
"model": "linux enterprise sdk sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"_id": null,
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"_id": null,
"model": "enterprise linux server optional eus",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6.1"
},
{
"_id": null,
"model": "linux lts i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "12.04"
},
{
"_id": null,
"model": "enterprise linux hpc node",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "aura communication manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0.1"
},
{
"_id": null,
"model": "server",
"scope": "eq",
"trust": 0.3,
"vendor": "turbolinux",
"version": "110"
},
{
"_id": null,
"model": "voice portal",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0"
},
{
"_id": null,
"model": "aura session manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"_id": null,
"model": "ip office application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "8.0"
},
{
"_id": null,
"model": "linux mandrake",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2011"
},
{
"_id": null,
"model": "linux lts lpia",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"_id": null,
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"_id": null,
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.04"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 0.3,
"vendor": "php",
"version": "5.3.12"
},
{
"_id": null,
"model": "ctpview",
"scope": "eq",
"trust": 0.3,
"vendor": "juniper",
"version": "4.4"
},
{
"_id": null,
"model": "enterprise linux server",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "5"
},
{
"_id": null,
"model": "linux lts amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "12.04"
},
{
"_id": null,
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7"
},
{
"_id": null,
"model": "linux ia-32",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "linux mips",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.04"
},
{
"_id": null,
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.0"
},
{
"_id": null,
"model": "aura messaging",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"_id": null,
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.8"
},
{
"_id": null,
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.3"
},
{
"_id": null,
"model": "linux enterprise server for vmware sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"_id": null,
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "7.1.2"
},
{
"_id": null,
"model": "mac os",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "x10.8.2"
},
{
"_id": null,
"model": "linux enterprise server for vmware sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"_id": null,
"model": "hp-ux b.11.31",
"scope": null,
"trust": 0.3,
"vendor": "hp",
"version": null
},
{
"_id": null,
"model": "linux s/390",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "aura communication manager utility services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.2"
},
{
"_id": null,
"model": "appliance server",
"scope": "eq",
"trust": 0.3,
"vendor": "turbolinux",
"version": "3.0x64"
},
{
"_id": null,
"model": "enterprise linux desktop workstation client",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "5"
},
{
"_id": null,
"model": "plesk panel",
"scope": "eq",
"trust": 0.3,
"vendor": "parallels",
"version": "9.2"
},
{
"_id": null,
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.1"
},
{
"_id": null,
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "client",
"scope": "eq",
"trust": 0.3,
"vendor": "turbolinux",
"version": "2008"
},
{
"_id": null,
"model": "plesk panel",
"scope": "eq",
"trust": 0.3,
"vendor": "parallels",
"version": "8.6"
},
{
"_id": null,
"model": "plesk panel",
"scope": "eq",
"trust": 0.3,
"vendor": "parallels",
"version": "9.0"
},
{
"_id": null,
"model": "ip office application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"_id": null,
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.3"
},
{
"_id": null,
"model": "lotus foundations start",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "1.2"
},
{
"_id": null,
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "7.1.1"
},
{
"_id": null,
"model": "enterprise server x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "mandrakesoft",
"version": "5"
},
{
"_id": null,
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "7.1"
},
{
"_id": null,
"model": "enterprise linux server eus",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6.0"
},
{
"_id": null,
"model": "aura session manager sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"_id": null,
"model": "server",
"scope": "eq",
"trust": 0.3,
"vendor": "turbolinux",
"version": "11x64"
},
{
"_id": null,
"model": "system management homepage",
"scope": "ne",
"trust": 0.3,
"vendor": "hp",
"version": "7.1.1"
},
{
"_id": null,
"model": "enterprise linux server optional eus",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6.0"
},
{
"_id": null,
"model": "opensuse",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "12.1"
},
{
"_id": null,
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.2"
},
{
"_id": null,
"model": "linux mandrake",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2010.1"
},
{
"_id": null,
"model": "php",
"scope": "ne",
"trust": 0.3,
"vendor": "php",
"version": "5.3.13"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#520827"
},
{
"db": "BID",
"id": "53388"
},
{
"db": "NVD",
"id": "CVE-2012-2311"
}
]
},
"credits": {
"_id": null,
"data": "HP",
"sources": [
{
"db": "PACKETSTORM",
"id": "123310"
},
{
"db": "PACKETSTORM",
"id": "122468"
},
{
"db": "PACKETSTORM",
"id": "113905"
},
{
"db": "PACKETSTORM",
"id": "122482"
}
],
"trust": 0.4
},
"cve": "CVE-2012-2311",
"cvss": {
"_id": null,
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2012-2311",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 1.0,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2012-2311",
"trust": 1.0,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2012-2311"
}
]
},
"description": {
"_id": null,
"data": "sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that contain a %3D sequence but no = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the \u0027d\u0027 case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823. PHP-CGI-based setups contain a vulnerability when parsing query string parameters from php files. PHP is prone to an information-disclosure vulnerability. \nExploiting this issue allows remote attackers to view the source code of files in the context of the server process. This may allow the attacker to obtain sensitive information and to run arbitrary PHP code on the affected computer; other attacks are also possible. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory GLSA 201209-03\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n http://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: High\n Title: PHP: Multiple vulnerabilities\n Date: September 24, 2012\n Bugs: #384301, #396311, #396533, #399247, #399567, #399573,\n #401997, #410957, #414553, #421489, #427354, #429630\n ID: 201209-03\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities were found in PHP, the worst of which lead to\nremote execution of arbitrary code. \n\nBackground\n==========\n\nPHP is a widely-used general-purpose scripting language that is\nespecially suited for Web development and can be embedded into HTML. \n\nAffected packages\n=================\n\n -------------------------------------------------------------------\n Package / Vulnerable / Unaffected\n -------------------------------------------------------------------\n 1 dev-lang/php \u003c 5.3.15 \u003e= 5.3.15\n \u003c 5.4.5 \u003e= 5.4.5\n -------------------------------------------------------------------\n # Package 1 only applies to users of these architectures:\n arm\n\nDescription\n===========\n\nMultiple vulnerabilities have been discovered in PHP. Please review the\nCVE identifiers referenced below for details. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll PHP users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose \"\u003e=dev-lang/php-5.3.15\"\n\nAll PHP users on ARM should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose \"\u003e=dev-lang/php-5.4.5\"\n\nReferences\n==========\n\n[ 1 ] CVE-2011-1398\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1398\n[ 2 ] CVE-2011-3379\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3379\n[ 3 ] CVE-2011-4566\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4566\n[ 4 ] CVE-2011-4885\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4885\n[ 5 ] CVE-2012-0057\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0057\n[ 6 ] CVE-2012-0788\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0788\n[ 7 ] CVE-2012-0789\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0789\n[ 8 ] CVE-2012-0830\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0830\n[ 9 ] CVE-2012-0831\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0831\n[ 10 ] CVE-2012-1172\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1172\n[ 11 ] CVE-2012-1823\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1823\n[ 12 ] CVE-2012-2143\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2143\n[ 13 ] CVE-2012-2311\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2311\n[ 14 ] CVE-2012-2335\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2335\n[ 15 ] CVE-2012-2336\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2336\n[ 16 ] CVE-2012-2386\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2386\n[ 17 ] CVE-2012-2688\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2688\n[ 18 ] CVE-2012-3365\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3365\n[ 19 ] CVE-2012-3450\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3450\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n http://security.gentoo.org/glsa/glsa-201209-03.xml\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2012 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttp://creativecommons.org/licenses/by-sa/2.5\n. \nHP System Management Homepage (SMH) v7.2.0 and earlier running on Linux and\nWindows. ----------------------------------------------------------------------\n\nBecome a PSI 3.0 beta tester!\nTest-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. \nDownload it here!\nhttp://secunia.com/psi_30_beta_launch\n\n----------------------------------------------------------------------\n\nTITLE:\nUbuntu update for php\n\nSECUNIA ADVISORY ID:\nSA49097\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/49097/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=49097\n\nRELEASE DATE:\n2012-05-07\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/49097/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/49097/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=49097\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nUbuntu has issued an update for php. This fixes a vulnerability,\nwhich can be exploited by malicious people to disclose certain\nsensitive information or compromise a vulnerable system. \n\nFor more information:\nSA49014\n\nSOLUTION:\nApply updated packages. \n\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nORIGINAL ADVISORY:\nUSN-1437-1:\nhttp://www.ubuntu.com/usn/usn-1437-1/\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. \n\nAdditionally, this update fixes insufficient validation of upload\nname which lead to corrupted $_FILES indices. \n\nFor the stable distribution (squeeze), this problem has been fixed in\nversion 5.3.3-7+squeeze9. \n\nThe testing distribution (wheezy) will be fixed soon. \n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 5.4.3-1. \n\nWe recommend that you upgrade your php5 packages. \n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: http://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.12 (GNU/Linux)\n\niQEcBAEBAgAGBQJPqqf3AAoJEOxfUAG2iX57MqcIALyiggqZ6SR+lOtdAd7npKd3\nlZ3nXZVUvyC5e4/gageT3s2BlmuipGIrBvyraWR2TvAlNYIu7Ia6EMVsjG0T3gHu\niM2yB4+wCaV8CIHqzmyN9lDaotxVty9gQ8BdtJaZguwi9+Sw7KfaCw6CXTluqPkU\nOcdb7Saz7eVnNnVwTORxOCBnlIZDn4PbiW9tMLZawGTwNgdT/2lMS8czJGVmf/Oj\nj4c631zN1K8vlnctHCYQAS269nr9jwmEx0JKcWl5khc7XMi/SmcUG9xG4p5JpGrA\nZbBAySyLuxr9bdMA3I9Jqxmmq4uaGwpCH8DSfMJd5FHNXKfq7efnL1Hp5mOERHU=\n=snJW\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nFull-Disclosure - We believe in it. \nCharter: http://lists.grok.org.uk/full-disclosure-charter.html\nHosted and sponsored by Secunia - http://secunia.com/\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\nNote: the current version of the following document is available here:\nhttps://h20566.www2.hp.com/portal/site/hpsc/public/kb/\ndocDisplay?docId=emr_na-c03368475\n\nSUPPORT COMMUNICATION - SECURITY BULLETIN\n\nDocument ID: c03368475\nVersion: 1\n\nHPSBUX02791 SSRT100856 rev.1 - HP-UX Apache Web Server running PHP, Remote\nExecution of Arbitrary Code, Privilege Elevation, Denial of Service (DoS)\n\nNOTICE: The information in this Security Bulletin should be acted upon as\nsoon as possible. \n\nRelease Date: 2012-06-14\nLast Updated: 2012-06-14\n\nPotential Security Impact: Remote execution of arbitrary code, privilege\nelevation, or Denial of Service (DoS). \n\nSource: Hewlett-Packard Company, HP Software Security Response Team\n\nVULNERABILITY SUMMARY\nPotential security vulnerabilities have been identified with HP-UX Apache Web\nServer running PHP. These vulnerabilities could be exploited remotely to\nexecute arbitrary code, elevate privileges, or create a Denial of Service\n(DoS). \n\nReferences: CVE-2011-4153, CVE-2012-0830, CVE-2012-0883, CVE-2012-1172,\nCVE-2012-1823, CVE-2012-2311\n\nSUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. \nHP-UX B.11.23, B.11.31 running HP-UX Apache Web Server Suite v3.24 or earlier\n\nBACKGROUND\nFor a PGP signed\n\nCVSS 2.0 Base Metrics\n===========================================================\n Reference Base Vector Base Score\nCVE-2011-4153 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0\nCVE-2012-0830 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5\nCVE-2012-0883 (AV:L/AC:M/Au:N/C:C/I:C/A:C) 6.9\nCVE-2012-1172 (AV:N/AC:M/Au:N/C:N/I:P/A:P) 5.8\nCVE-2012-1823 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5\nCVE-2012-2311 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5\n===========================================================\n Information on CVSS is documented\n in HP Customer Notice: HPSN-2008-002\n\nRESOLUTION\n\nHP has provided the following software updates to resolve the\nvulnerabilities. \nThe updates are available for download from http://software.hp.com\n\nHP-UX Web Server Suite v.3.24 containing Apache v2.2.15.13 and PHP v5.2.17\nHP-UX 11i Release\n Apache Depot name\n\nB.11.23 (32-bit)\n HPUXWS22ATW-B324-32\n\nB.11.23 (64-bit)\n HPUXWS22ATW-B324-64\n\nB.11.31 (32-bit)\n HPUXWS22ATW-B324-32\n\nB.11.31 (64-bit)\n HPUXWS22ATW-B324-64\n\nMANUAL ACTIONS: Yes - Update\nInstall HP-UX Web Server Suite v3.24 or subsequent. \n\nPRODUCT SPECIFIC INFORMATION\n\nHP-UX Software Assistant: HP-UX Software Assistant is an enhanced application\nthat replaces HP-UX Security Patch Check. It analyzes all Security Bulletins\nissued by HP and lists recommended actions that may apply to a specific HP-UX\nsystem. It can also download patches and create a depot automatically. For\nmore information see https://www.hp.com/go/swa\n\nThe following text is for use by the HP-UX Software Assistant. \nHP-UX Web Server Suite v3.24\nAFFECTED VERSIONS\n\nHP-UX B.11.23\n==============\nhpuxws22APCH32.APACHE\nhpuxws22APCH32.APACHE2\nhpuxws22APCH32.AUTH_LDAP\nhpuxws22APCH32.AUTH_LDAP2\nhpuxws22APCH32.MOD_JK\nhpuxws22APCH32.MOD_JK2\nhpuxws22APCH32.MOD_PERL\nhpuxws22APCH32.MOD_PERL2\nhpuxws22APCH32.PHP\nhpuxws22APCH32.PHP2\nhpuxws22APCH32.WEBPROXY\nhpuxws22APCH32.WEBPROXY2\nhpuxws22APACHE.APACHE\nhpuxws22APACHE.APACHE2\nhpuxws22APACHE.AUTH_LDAP\nhpuxws22APACHE.AUTH_LDAP2\nhpuxws22APACHE.MOD_JK\nhpuxws22APACHE.MOD_JK2\nhpuxws22APACHE.MOD_PERL\nhpuxws22APACHE.MOD_PERL2\nhpuxws22APACHE.PHP\nhpuxws22APACHE.PHP2\nhpuxws22APACHE.WEBPROXY\nhpuxws22APACHE.WEBPROXY2\naction: install revision B.2.2.15.13 or subsequent\n\nHP-UX B.11.31\n==================\nhpuxws22APCH32.APACHE\nhpuxws22APCH32.APACHE2\nhpuxws22APCH32.AUTH_LDAP\nhpuxws22APCH32.AUTH_LDAP2\nhpuxws22APCH32.MOD_JK\nhpuxws22APCH32.MOD_JK2\nhpuxws22APCH32.MOD_PERL\nhpuxws22APCH32.MOD_PERL2\nhpuxws22APCH32.PHP\nhpuxws22APCH32.PHP2\nhpuxws22APCH32.WEBPROXY\nhpuxws22APCH32.WEBPROXY2\nhpuxws22APACHE.APACHE\nhpuxws22APACHE.APACHE2\nhpuxws22APACHE.AUTH_LDAP\nhpuxws22APACHE.AUTH_LDAP2\nhpuxws22APACHE.MOD_JK\nhpuxws22APACHE.MOD_JK2\nhpuxws22APACHE.MOD_PERL\nhpuxws22APACHE.MOD_PERL2\nhpuxws22APACHE.PHP\nhpuxws22APACHE.PHP2\nhpuxws22APACHE.WEBPROXY\nhpuxws22APACHE.WEBPROXY2\n\naction: install revision B.2.2.15.13 or subsequent\n\nEND AFFECTED VERSIONS\n\nHISTORY\nVersion:1 (rev.1) - 14 June 2012 Initial release\n\nThird Party Security Patches: Third party security patches that are to be\ninstalled on systems running HP software products should be applied in\naccordance with the customer\u0027s patch management policy. \n\nSupport: For issues about implementing the recommendations of this Security\nBulletin, contact normal HP Services support channel. For other issues about\nthe content of this Security Bulletin, send e-mail to security-alert@hp.com. \n\nReport: To report a potential security vulnerability with any HP supported\nproduct, send Email to: security-alert@hp.com\n\nSubscribe: To initiate a subscription to receive future HP Security Bulletin\nalerts via Email:\nhttp://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins\n\nSecurity Bulletin List: A list of HP Security Bulletins, updated\nperiodically, is contained in HP Security Notice HPSN-2011-001:\nhttps://h20566.www2.hp.com/portal/site/hpsc/public/kb/\ndocDisplay?docId=emr_na-c02964430\n\nSecurity Bulletin Archive: A list of recently released Security Bulletins is\navailable here:\nhttp://h20566.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/\n\nSoftware Product Category: The Software Product Category is represented in\nthe title by the two characters following HPSB. \n\n3C = 3COM\n3P = 3rd Party Software\nGN = HP General Software\nHF = HP Hardware and Firmware\nMP = MPE/iX\nMU = Multi-Platform Software\nNS = NonStop Servers\nOV = OpenVMS\nPI = Printing and Imaging\nPV = ProCurve\nST = Storage Software\nTU = Tru64 UNIX\nUX = HP-UX\n\nCopyright 2012 Hewlett-Packard Development Company, L.P. \nHewlett-Packard Company shall not be liable for technical or editorial errors\nor omissions contained herein. The information provided is provided \"as is\"\nwithout warranty of any kind. To the extent permitted by law, neither HP or\nits affiliates, subcontractors or suppliers will be liable for\nincidental,special or consequential damages including downtime cost; lost\nprofits;damages relating to the procurement of substitute products or\nservices; or damages for loss of data, or software restoration. The\ninformation in this document is subject to change without notice. \nHewlett-Packard Company and the names of Hewlett-Packard products referenced\nherein are trademarks of Hewlett-Packard Company in the United States and\nother countries. Other product and company names mentioned herein may be\ntrademarks of their respective owners. \n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.10 (GNU/Linux)\n\niEYEARECAAYFAk/f0GcACgkQ4B86/C0qfVnCEwCfWX2UX+TvBNeJawjexLmPtwjt\n1TEAnj7Q3fqZkor5ilSKlW2dNHa1f4aO\n=pEB+\n-----END PGP SIGNATURE-----\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\nAPPLE-SA-2012-09-19-2 OS X Mountain Lion v10.8.2, OS X Lion v10.7.5 and\nSecurity Update 2012-004\n\nOS X Mountain Lion v10.8.2, OS X Lion v10.7.5 and Security Update\n2012-004 are now available and address the following:\n\nApache\nAvailable for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,\nOS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4\nImpact: Multiple vulnerabilities in Apache\nDescription: Apache is updated to version 2.2.22 to address several\nvulnerabilities, the most serious of which may lead to a denial of\nservice. Further information is available via the Apache web site at\nhttp://httpd.apache.org/. This issue does not affect OS X Mountain\nLion systems. \nCVE-ID\nCVE-2011-3368\nCVE-2011-3607\nCVE-2011-4317\nCVE-2012-0021\nCVE-2012-0031\nCVE-2012-0053\n\nBIND\nAvailable for: OS X Lion v10.7 to v10.7.4,\nOS X Lion Server v10.7 to v10.7.4\nImpact: A remote attacker may be able to cause a denial of service\nin systems configured to run BIND as a DNS nameserver\nDescription: A reachable assertion issue existed in the handling of\nDNS records. This issue was addressed by updating to BIND 9.7.6-P1. \nThis issue does not affect OS X Mountain Lion systems. \nCVE-ID\nCVE-2011-4313\n\nBIND\nAvailable for: OS X Lion v10.7 to v10.7.4,\nOS X Lion Server v10.7 to v10.7.4,\nOS X Mountain Lion v10.8 and v10.8.1\nImpact: A remote attacker may be able to cause a denial of service,\ndata corruption, or obtain sensitive information from process memory\nin systems configured to run BIND as a DNS nameserver\nDescription: A memory management issue existed in the handling of\nDNS records. This issue was addressed by updating to BIND 9.7.6-P1 on\nOS X Lion systems, and BIND 9.8.3-P1 on OS X Mountain Lion systems. \nCVE-ID\nCVE-2012-1667\n\nCoreText\nAvailable for: OS X Lion v10.7 to v10.7.4,\nOS X Lion Server v10.7 to v10.7.4\nImpact: Applications that use CoreText may be vulnerable to an\nunexpected application termination or arbitrary code execution\nDescription: A bounds checking issue existed in the handling of text\nglyphs, which may lead to out of bounds memory reads or writes. This\nissue was addressed through improved bounds checking. This issue does\nnot affect Mac OS X v10.6 or OS X Mountain Lion systems. \nCVE-ID\nCVE-2012-3716 : Jesse Ruderman of Mozilla Corporation\n\nData Security\nAvailable for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,\nOS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4,\nOS X Mountain Lion v10.8 and v10.8.1\nImpact: An attacker with a privileged network position may intercept\nuser credentials or other sensitive information\nDescription: TrustWave, a trusted root CA, has issued, and\nsubsequently revoked, a sub-CA certificate from one of its trusted\nanchors. This sub-CA facilitated the interception of communications\nsecured by Transport Layer Security (TLS). This update adds the\ninvolved sub-CA certificate to OS X\u0027s list of untrusted certificates. \n\nDirectoryService\nAvailable for: Mac OS X 10.6.8, Mac OS X Server 10.6.8\nImpact: If the DirectoryService Proxy is used, a remote attacker may\ncause a denial of service or arbitrary code execution\nDescription: A buffer overflow existed in the DirectoryService\nProxy. This issue was addressed through improved bounds checking. \nThis issue does not affect OS X Lion and Mountain Lion systems. \nCVE-ID\nCVE-2012-0650 : aazubel working with HP\u0027s Zero Day Initiative\n\nImageIO\nAvailable for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,\nOS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4\nImpact: Viewing a maliciously crafted PNG image may lead to an\nunexpected application termination or arbitrary code execution\nDescription: Multiple memory corruption issues existed in libpng\u0027s\nhandling of PNG images. These issues were addressed through improved\nvalidation of PNG images. These issues do not affect OS X Mountain\nLion systems. \nCVE-ID\nCVE-2011-3026 : Juri Aedla\nCVE-2011-3048\n\nImageIO\nAvailable for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,\nOS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4\nImpact: Viewing a maliciously crafted TIFF image may lead to an\nunexpected application termination or arbitrary code execution\nDescription: An integer overflow issue existed in libTIFF\u0027s handling\nof TIFF images. This issue was addressed through improved validation\nof TIFF images. This issue does not affect OS X Mountain Lion\nsystems. \nCVE-ID\nCVE-2012-1173 : Alexander Gavrun working with HP\u0027s Zero Day\nInitiative\n\nInstaller\nAvailable for: OS X Lion v10.7 to v10.7.4,\nOS X Lion Server v10.7 to v10.7.4\nImpact: Remote admins and persons with physical access to the system\nmay obtain account information\nDescription: The fix for CVE-2012-0652 in OS X Lion 10.7.4 prevented\nuser passwords from being recorded in the system log, but did not\nremove the old log entries. This issue was addressed by deleting log\nfiles that contained passwords. This issue does not affect Mac OS X\n10.6 or OS X Mountain Lion systems. \nCVE-ID\nCVE-2012-0652\n\nInternational Components for Unicode\nAvailable for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,\nOS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4\nImpact: Applications that use ICU may be vulnerable to an unexpected\napplication termination or arbitrary code execution\nDescription: A stack buffer overflow existed in the handling of ICU\nlocale IDs. This issue was addressed through improved bounds\nchecking. This issue does not affect OS X Mountain Lion systems. \nCVE-ID\nCVE-2011-4599\n\nKernel\nAvailable for: OS X Lion v10.7 to v10.7.4,\nOS X Lion Server v10.7 to v10.7.4\nImpact: A malicious program could bypass sandbox restrictions\nDescription: A logic issue existed in the handling of debug system\ncalls. This may allow a malicious program to gain code execution in\nother programs with the same user privileges. This issue was\naddressed by disabling handling of addresses in PT_STEP and\nPT_CONTINUE. This issue does not affect OS X Mountain Lion systems. \nCVE-ID\nCVE-2012-0643 : iOS Jailbreak Dream Team\n\nLoginWindow\nAvailable for: OS X Mountain Lion v10.8 and v10.8.1\nImpact: A local user may be able to obtain other user\u0027s login\npasswords\nDescription: A user-installed input method could intercept password\nkeystrokes from Login Window or Screen Saver Unlock. This issue was\naddressed by preventing user-installed methods from being used when\nthe system is handling login information. \nCVE-ID\nCVE-2012-3718 : An anonymous researcher\n\nMail\nAvailable for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,\nOS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4\nImpact: Viewing an e-mail message may lead to execution of web\nplugins\nDescription: An input validation issue existed in Mail\u0027s handling of\nembedded web plugins. This issue was addressed by disabling third-\nparty plug-ins in Mail. This issue does not affect OS X Mountain Lion\nsystems. \nCVE-ID\nCVE-2012-3719 : Will Dormann of the CERT/CC\n\nMobile Accounts\nAvailable for: OS X Mountain Lion v10.8 and v10.8.1\nImpact: A user with access to the contents of a mobile account may\nobtain the account password\nDescription: Creating a mobile account saved a hash of the password\nin the account, which was used to login when the mobile account was\nused as an external account. The password hash could be used to\ndetermine the user\u0027s password. This issue was addressed by creating\nthe password hash only if external accounts are enabled on the system\nwhere the mobile account is created. \nCVE-ID\nCVE-2012-3720 : Harald Wagener of Google, Inc. \n\nPHP\nAvailable for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,\nOS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4,\nOS X Mountain Lion v10.8 and v10.8.1\nImpact: Multiple vulnerabilities in PHP\nDescription: \u003ePHP is updated to version 5.3.15 to address multiple\nvulnerabilities, the most serious of which may lead to arbitrary code\nexecution. Further information is available via the PHP web site at\nhttp://www.php.net\nCVE-ID\nCVE-2012-0831\nCVE-2012-1172\nCVE-2012-1823\nCVE-2012-2143\nCVE-2012-2311\nCVE-2012-2386\nCVE-2012-2688\n\nPHP\nAvailable for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,\nOS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4\nImpact: PHP scripts which use libpng may be vulnerable to an\nunexpected application termination or arbitrary code execution\nDescription: A memory corruption issue existed in the handling of\nPNG files. This issue was addressed by updating PHP\u0027s copy of libpng\nto version 1.5.10. This issue does not affect OS X Mountain Lion\nsystems. \nCVE-ID\nCVE-2011-3048\n\nProfile Manager\nAvailable for: OS X Lion Server v10.7 to v10.7.4\nImpact: An unauthenticated user could enumerate managed devices\nDescription: An authentication issue existed in the Device\nManagement private interface. This issue was addressed by removing\nthe interface. This issue does not affect OS X Mountain Lion\nsystems. \nCVE-ID\nCVE-2012-3721 : Derick Cassidy of XEquals Corporation\n\nQuickLook\nAvailable for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,\nOS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4\nImpact: Viewing a maliciously crafted .pict file may lead to an\nunexpected application termination or arbitrary code execution\nDescription: A memory corruption issue existed in the handling of\n.pict files. This issue was addressed through improved validation of\n.pict files. This issue does not affect OS X Mountain Lion systems. \nCVE-ID\nCVE-2012-0671 : Rodrigo Rubira Branco (twitter.com/bsdaemon) from the\nQualys Vulnerability \u0026 Malware Research Labs (VMRL)\n\nQuickTime\nAvailable for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,\nOS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4\nImpact: Viewing a maliciously crafted movie file may lead to an\nunexpected application termination or arbitrary code execution\nDescription: An integer overflow existed in QuickTime\u0027s handling of\nsean atoms. This issue was addressed through improved bounds\nchecking. This issue does not affect OS X Mountain Lion systems. \nCVE-ID\nCVE-2012-0670 : Tom Gallagher (Microsoft) and Paul Bates (Microsoft)\nworking with HP\u0027s Zero Day Initiative\n\nQuickTime\nAvailable for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,\nOS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4\nImpact: Viewing a maliciously crafted movie file may lead to an\nunexpected application termination or arbitrary code execution\nDescription: An uninitialized memory access existed in the handling\nof Sorenson encoded movie files. This issue was addressed through\nimproved memory initialization. This issue does not affect OS X\nMountain Lion systems. \nCVE-ID\nCVE-2012-3722 : Will Dormann of the CERT/CC\n\nQuickTime\nAvailable for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,\nOS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4\nImpact: Viewing a maliciously crafted movie file may lead to an\nunexpected application termination or arbitrary code execution\nDescription: A buffer overflow existed in the handling of RLE\nencoded movie files. This issue was addressed through improved bounds\nchecking. This issue does not affect OS X Mountain Lion systems. \nCVE-ID\nCVE-2012-0668 : Luigi Auriemma working with HP\u0027s Zero Day Initiative\n\nRuby\nAvailable for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,\nOS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4\nImpact: An attacker may be able to decrypt data protected by SSL\nDescription: There are known attacks on the confidentiality of SSL\n3.0 and TLS 1.0 when a cipher suite uses a block cipher in CBC mode. \nThe Ruby OpenSSL module disabled the \u0027empty fragment\u0027 countermeasure\nwhich prevented these attacks. This issue was addressed by enabling\nempty fragments. This issue does not affect OS X Mountain Lion\nsystems. \nCVE-ID\nCVE-2011-3389\n\nUSB\nAvailable for: OS X Lion v10.7 to v10.7.4,\nOS X Lion Server v10.7 to v10.7.4\nImpact: Attaching a USB device may lead to an unexpected system\ntermination or arbitrary code execution\nDescription: A memory corruption issue existed in the handling of\nUSB hub descriptors. This issue was addressed through improved\nhandling of the bNbrPorts descriptor field. This issue does not\naffect OS X Mountain Lion systems. \nCVE-ID\nCVE-2012-3723 : Andy Davis of NGS Secure\n\nNote: OS X Mountain Lion v10.8.2 includes the content of\nSafari 6.0.1. For further details see \"About the security content\nof Safari 6.0.1\" at http://http//support.apple.com/kb/HT5502\n\n\nOS X Mountain Lion v10.8.2, OS X Lion v10.7.5 and Security Update\n2012-004 may be obtained from the Software Update pane in System\nPreferences, or Apple\u0027s Software Downloads web site:\nhttp://www.apple.com/support/downloads/\n\nThe Software Update utility will present the update that applies\nto your system configuration. Only one is needed, either\nOS X Mountain Lion v10.8.2, OS X Lion v10.7.5 or Security Update\n2012-004. \n\nFor OS X Mountain Lion v10.8.1\nThe download file is named: OSXUpd10.8.2.dmg\nIts SHA-1 digest is: d6779e1cc748b78af0207499383b1859ffbebe33\n\nFor OS X Mountain Lion v10.8\nThe download file is named: OSXUpdCombo10.8.2.dmg\nIts SHA-1 digest is: b08f10233d362e39f20b69f91d1d73f5e7b68a2c\n\nFor OS X Lion v10.7.4\nThe download file is named: MacOSXUpd10.7.5.dmg\nIts SHA-1 digest is: e0a9582cce9896938a7a541bd431862d93893532\n\nFor OS X Lion v10.7 and v10.7.3\nThe download file is named: MacOSXUpdCombo10.7.5.dmg\nIts SHA-1 digest is: f7a26b164fa10dae4fe646e57b01c34a619c8d9b\n\nFor OS X Lion Server v10.7.4\nThe download file is named: MacOSXServerUpd10.7.5.dmg\nIts SHA-1 digest is: a891b03bfb4eecb745c0c39a32f39960fdb6796a\n\nFor OS X Lion Server v10.7 and v10.7.3\nThe download file is named: MacOSXServerUpdCombo10.7.5.dmg\nIts SHA-1 digest is: df6e1748ab0a3c9e05c890be49d514673efd965e\n\nFor Mac OS X v10.6.8\nThe download file is named: SecUpd2012-004.dmg\nIts SHA-1 digest is: 5b136e29a871d41012f0c6ea1362d6210c8b4fb7\n\nFor Mac OS X Server v10.6.8\nThe download file is named: SecUpdSrvr2012-004.dmg\nIts SHA-1 digest is: 9b24496be15078e58a88537700f2f39c112e3b28\n\nInformation will also be posted to the Apple Security Updates\nweb site: http://support.apple.com/kb/HT1222\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG/MacGPG2 v2.0.17 (Darwin)\nComment: GPGTools - http://gpgtools.org\n\niQIcBAEBAgAGBQJQWhlbAAoJEPefwLHPlZEwwjwQAKrpQlZh1B2mkSTLxR7QZg6e\nQm7SmIZL9sjl5gQkTxoAvOGxJ8uRdYPlJ1IpyU/MbK0GqO53KmFSeKkwCnvLKMaW\npc6tiFaQ4zV4LEAwBAFEuqCsMyPEJqKDhYXl2cHQmWfAlrLCyCKfzGLy2mY2UnkE\nDQC2+ys70DChFv2GzyXlibBXAGMKDygJ5dVKynsi1ceZLYWbUJoGwlUtXPylBpnO\nQyGWXmEloPbhK6HJbKMNacuDdVcb26pvIeFiivkTSxPVlZ3ns2tAwEyvHrzA9O4n\n7rQ6jvfDbguOZmM5sPFvVKBw2GVDBNU+G3T8ouIXhk6Pjhr4in8VFCb8MIMLb8hm\n7YYn2z1TzKTNmUuYbwe6ukQvf57cPuW0bAvslbl6PgrzqorlNPU4rDoSvPrJx/RO\nBOYkcxfirevHDGibfkeqXPjL3h+bVrb1USZpAv+ZOAy0M89SHFcvMtpAhxnoGiV5\nw4EyKB+9Yi/CSAk2Ne3Y5kHH7/v3pWV68aJwhVirya7ex3vnJ+M+lRLKSm2BUjL3\n+9fykrJBDujFDXoCmK5CN5Wx36DSVZ4VO1h635crotudtcvd+LQ2VHma/Chav5wK\nq5SSllf4KEownpx6o/qTxpg5tcC4lvgTcsDHlYcNq2s8KTTjmOden8ar4h7M7QD2\nxyBfrQfG/dsif6jGHaot\n=8joH\n-----END PGP SIGNATURE-----\n. Content-Disposition: inline\n\n==========================================================================Ubuntu Security Notice USN-1437-1\nMay 04, 2012\n\nphp5 vulnerability\n==========================================================================\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 12.04 LTS\n- Ubuntu 11.10\n- Ubuntu 11.04\n- Ubuntu 10.04 LTS\n- Ubuntu 8.04 LTS\n\nSummary:\n\nStandalone PHP CGI scripts could be made to execute arbitrary code with\nthe privilege of the web server. \n\nSoftware Description:\n- php5: HTML-embedded scripting language interpreter\n\nDetails:\n\nIt was discovered that PHP, when used as a stand alone CGI processor\nfor the Apache Web Server, did not properly parse and filter query\nstrings. Configurations using\nmod_php5 and FastCGI were not vulnerable. \n\nThis update addresses the issue when the PHP CGI interpreter\nis configured using mod_cgi and mod_actions as described\nin /usr/share/doc/php5-cgi/README.Debian.gz; however,\nif an alternate configuration is used to enable PHP CGI\nprocessing, it should be reviewed to ensure that command line\narguments cannot be passed to the PHP interpreter. Please see\nhttp://people.canonical.com/~ubuntu-security/cve/2012/CVE-2012-2311.html\nfor more details and potential mitigation approaches. \n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 12.04 LTS:\n php5-cgi 5.3.10-1ubuntu3.1\n\nUbuntu 11.10:\n php5-cgi 5.3.6-13ubuntu3.7\n\nUbuntu 11.04:\n php5-cgi 5.3.5-1ubuntu7.8\n\nUbuntu 10.04 LTS:\n php5-cgi 5.3.2-1ubuntu4.15\n\nUbuntu 8.04 LTS:\n php5-cgi 5.2.4-2ubuntu5.24\n\nIn general, a standard system update will make all the necessary changes",
"sources": [
{
"db": "NVD",
"id": "CVE-2012-2311"
},
{
"db": "CERT/CC",
"id": "VU#520827"
},
{
"db": "BID",
"id": "53388"
},
{
"db": "PACKETSTORM",
"id": "123310"
},
{
"db": "PACKETSTORM",
"id": "116800"
},
{
"db": "PACKETSTORM",
"id": "122468"
},
{
"db": "PACKETSTORM",
"id": "112515"
},
{
"db": "PACKETSTORM",
"id": "112580"
},
{
"db": "PACKETSTORM",
"id": "113905"
},
{
"db": "PACKETSTORM",
"id": "122482"
},
{
"db": "PACKETSTORM",
"id": "116792"
},
{
"db": "PACKETSTORM",
"id": "112474"
}
],
"trust": 2.7
},
"external_ids": {
"_id": null,
"data": [
{
"db": "NVD",
"id": "CVE-2012-2311",
"trust": 2.9
},
{
"db": "CERT/CC",
"id": "VU#520827",
"trust": 2.1
},
{
"db": "SECUNIA",
"id": "49014",
"trust": 1.0
},
{
"db": "SECUNIA",
"id": "49085",
"trust": 1.0
},
{
"db": "SECTRACK",
"id": "1027022",
"trust": 1.0
},
{
"db": "JUNIPER",
"id": "JSA10658",
"trust": 0.3
},
{
"db": "CERT/CC",
"id": "VU#673343",
"trust": 0.3
},
{
"db": "BID",
"id": "53388",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "123310",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "116800",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "122468",
"trust": 0.1
},
{
"db": "SECUNIA",
"id": "49097",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "112515",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "112580",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "113905",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "122482",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "116792",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "112474",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#520827"
},
{
"db": "BID",
"id": "53388"
},
{
"db": "PACKETSTORM",
"id": "123310"
},
{
"db": "PACKETSTORM",
"id": "116800"
},
{
"db": "PACKETSTORM",
"id": "122468"
},
{
"db": "PACKETSTORM",
"id": "112515"
},
{
"db": "PACKETSTORM",
"id": "112580"
},
{
"db": "PACKETSTORM",
"id": "113905"
},
{
"db": "PACKETSTORM",
"id": "122482"
},
{
"db": "PACKETSTORM",
"id": "116792"
},
{
"db": "PACKETSTORM",
"id": "112474"
},
{
"db": "NVD",
"id": "CVE-2012-2311"
}
]
},
"id": "VAR-201205-0246",
"iot": {
"_id": null,
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.47077376
},
"last_update_date": "2026-04-10T23:37:20.576000Z",
"problemtype_data": {
"_id": null,
"data": [
{
"problemtype": "CWE-89",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2012-2311"
}
]
},
"references": {
"_id": null,
"data": [
{
"trust": 2.1,
"url": "http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/"
},
{
"trust": 1.8,
"url": "http://www.php.net/archive/2012.php#id2012-05-08-1"
},
{
"trust": 1.6,
"url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c03839862"
},
{
"trust": 1.3,
"url": "http://www.kb.cert.org/vuls/id/520827"
},
{
"trust": 1.1,
"url": "http://www.php.net/"
},
{
"trust": 1.1,
"url": "http://www.php.net/archive/2012.php#id2012-05-03-1"
},
{
"trust": 1.0,
"url": "http://lists.apple.com/archives/security-announce/2012/sep/msg00004.html"
},
{
"trust": 1.0,
"url": "http://www.securitytracker.com/id?1027022"
},
{
"trust": 1.0,
"url": "http://secunia.com/advisories/49085"
},
{
"trust": 1.0,
"url": "http://www.debian.org/security/2012/dsa-2465"
},
{
"trust": 1.0,
"url": "http://support.apple.com/kb/ht5501"
},
{
"trust": 1.0,
"url": "https://bugs.php.net/patch-display.php?bug_id=61910\u0026patch=cgi.diff-fix-check.patch\u0026revision=1336093719\u0026display=1"
},
{
"trust": 1.0,
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00002.html"
},
{
"trust": 1.0,
"url": "http://marc.info/?l=bugtraq\u0026m=134012830914727\u0026w=2"
},
{
"trust": 1.0,
"url": "http://secunia.com/advisories/49014"
},
{
"trust": 1.0,
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00011.html"
},
{
"trust": 1.0,
"url": "https://bugs.php.net/bug.php?id=61910"
},
{
"trust": 1.0,
"url": "http://www.php.net/changelog-5.php#5.4.3"
},
{
"trust": 1.0,
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00007.html"
},
{
"trust": 0.8,
"url": "http://www.php.net/manual/en/security.cgi-bin.php"
},
{
"trust": 0.8,
"url": "http://www.symantec.com/connect/blogs/linux-worm-targeting-hidden-devices"
},
{
"trust": 0.8,
"url": "http://php.net/changelog-5.php"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2311"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-1823"
},
{
"trust": 0.4,
"url": "http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2335"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-3389"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2336"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0883"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-1172"
},
{
"trust": 0.3,
"url": "http://alerts.hp.com/r?2.1.3kt.2zr.xg7ek.hmj%2asm..t.a4jy.6o9k.bw89mq%5f%5fdmtsfto0"
},
{
"trust": 0.3,
"url": "http://www-01.ibm.com/software/lotus/products/foundations/start/"
},
{
"trust": 0.3,
"url": "http://kb.parallels.com/en/113818"
},
{
"trust": 0.3,
"url": "kb.parallels.com/en/116241"
},
{
"trust": 0.3,
"url": "https://community.rapid7.com/thread/5174"
},
{
"trust": 0.3,
"url": "http://seclists.org/fulldisclosure/2013/jun/21"
},
{
"trust": 0.3,
"url": "http://ompldr.org/vzgxxaq"
},
{
"trust": 0.3,
"url": "http://kb.juniper.net/infocenter/index?page=content\u0026id=jsa10658\u0026cat=sirt_1\u0026actp=list"
},
{
"trust": 0.3,
"url": "https://downloads.avaya.com/css/p8/documents/100162699"
},
{
"trust": 0.3,
"url": "https://downloads.avaya.com/css/p8/documents/100165255"
},
{
"trust": 0.3,
"url": "http://www.h-online.com/security/news/item/critical-open-hole-in-php-creates-risks-update-1567532.html"
},
{
"trust": 0.3,
"url": "http://h20000.www2.hp.com/bizsupport/techsupport/document.jsp?objectid=c03360041"
},
{
"trust": 0.3,
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21620314"
},
{
"trust": 0.3,
"url": "http://www.turbolinux.co.jp/security-e/2012/tlsa-2012-14.txt"
},
{
"trust": 0.3,
"url": "http://www.kb.cert.org/vuls/id/673343"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2358"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2357"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2362"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2361"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2364"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2363"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2359"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2329"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2356"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2110"
},
{
"trust": 0.3,
"url": "http://h18013.www1.hp.com/products/servers/management/agents/index.html"
},
{
"trust": 0.3,
"url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/"
},
{
"trust": 0.3,
"url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secbullarchive/"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2355"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2360"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-5217"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2688"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0831"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2143"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0830"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2386"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-4821"
},
{
"trust": 0.1,
"url": "http://security.gentoo.org/glsa/glsa-201209-03.xml"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0057"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-4566"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-2688"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1398"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-0789"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-1398"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0788"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-4885"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-0831"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-2336"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-2335"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-0057"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-3450"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-3450"
},
{
"trust": 0.1,
"url": "http://creativecommons.org/licenses/by-sa/2.5"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-0830"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-3379"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-3379"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-4566"
},
{
"trust": 0.1,
"url": "http://security.gentoo.org/"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-1172"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-4885"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-1823"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-0788"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-2311"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0789"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-3365"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-2143"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-3365"
},
{
"trust": 0.1,
"url": "https://bugs.gentoo.org."
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-2386"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-5217"
},
{
"trust": 0.1,
"url": "http://www.ubuntu.com/usn/usn-1437-1/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/49097/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/psi_30_beta_launch"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=49097"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/49097/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/"
},
{
"trust": 0.1,
"url": "http://www.debian.org/security/faq"
},
{
"trust": 0.1,
"url": "http://www.debian.org/security/"
},
{
"trust": 0.1,
"url": "http://lists.grok.org.uk/full-disclosure-charter.html"
},
{
"trust": 0.1,
"url": "http://software.hp.com"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-4153"
},
{
"trust": 0.1,
"url": "http://h20566.www2.hp.com/portal/site/hpsc/public/kb/secbullarchive/"
},
{
"trust": 0.1,
"url": "https://www.hp.com/go/swa"
},
{
"trust": 0.1,
"url": "https://h20566.www2.hp.com/portal/site/hpsc/public/kb/"
},
{
"trust": 0.1,
"url": "http://www.php.net"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-3718"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-4313"
},
{
"trust": 0.1,
"url": "http://http//support.apple.com/kb/ht5502"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-3048"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0031"
},
{
"trust": 0.1,
"url": "http://support.apple.com/kb/ht1222"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0668"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-3368"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-4317"
},
{
"trust": 0.1,
"url": "http://www.apple.com/support/downloads/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0670"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0671"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-1173"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0652"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-4599"
},
{
"trust": 0.1,
"url": "https://www.apple.com/support/security/pgp/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-1667"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-3607"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0021"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0650"
},
{
"trust": 0.1,
"url": "http://gpgtools.org"
},
{
"trust": 0.1,
"url": "http://httpd.apache.org/."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-3026"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0643"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0053"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-3716"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/php5/5.3.5-1ubuntu7.8"
},
{
"trust": 0.1,
"url": "http://people.canonical.com/~ubuntu-security/cve/2012/cve-2012-2311.html"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/php5/5.3.10-1ubuntu3.1"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/php5/5.2.4-2ubuntu5.24"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/php5/5.3.2-1ubuntu4.15"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/php5/5.3.6-13ubuntu3.7"
},
{
"trust": 0.1,
"url": "http://www.ubuntu.com/usn/usn-1437-1"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#520827"
},
{
"db": "BID",
"id": "53388"
},
{
"db": "PACKETSTORM",
"id": "123310"
},
{
"db": "PACKETSTORM",
"id": "116800"
},
{
"db": "PACKETSTORM",
"id": "122468"
},
{
"db": "PACKETSTORM",
"id": "112515"
},
{
"db": "PACKETSTORM",
"id": "112580"
},
{
"db": "PACKETSTORM",
"id": "113905"
},
{
"db": "PACKETSTORM",
"id": "122482"
},
{
"db": "PACKETSTORM",
"id": "116792"
},
{
"db": "PACKETSTORM",
"id": "112474"
},
{
"db": "NVD",
"id": "CVE-2012-2311"
}
]
},
"sources": {
"_id": null,
"data": [
{
"db": "CERT/CC",
"id": "VU#520827",
"ident": null
},
{
"db": "BID",
"id": "53388",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "123310",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "116800",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "122468",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "112515",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "112580",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "113905",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "122482",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "116792",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "112474",
"ident": null
},
{
"db": "NVD",
"id": "CVE-2012-2311",
"ident": null
}
]
},
"sources_release_date": {
"_id": null,
"data": [
{
"date": "2012-05-03T00:00:00",
"db": "CERT/CC",
"id": "VU#520827",
"ident": null
},
{
"date": "2012-05-04T00:00:00",
"db": "BID",
"id": "53388",
"ident": null
},
{
"date": "2013-09-19T22:22:00",
"db": "PACKETSTORM",
"id": "123310",
"ident": null
},
{
"date": "2012-09-24T15:02:14",
"db": "PACKETSTORM",
"id": "116800",
"ident": null
},
{
"date": "2013-07-18T18:51:07",
"db": "PACKETSTORM",
"id": "122468",
"ident": null
},
{
"date": "2012-05-08T04:16:46",
"db": "PACKETSTORM",
"id": "112515",
"ident": null
},
{
"date": "2012-05-10T03:59:25",
"db": "PACKETSTORM",
"id": "112580",
"ident": null
},
{
"date": "2012-06-19T18:22:00",
"db": "PACKETSTORM",
"id": "113905",
"ident": null
},
{
"date": "2013-07-19T19:33:00",
"db": "PACKETSTORM",
"id": "122482",
"ident": null
},
{
"date": "2012-09-22T06:30:43",
"db": "PACKETSTORM",
"id": "116792",
"ident": null
},
{
"date": "2012-05-06T01:28:45",
"db": "PACKETSTORM",
"id": "112474",
"ident": null
},
{
"date": "2012-05-11T10:15:48.107000",
"db": "NVD",
"id": "CVE-2012-2311",
"ident": null
}
]
},
"sources_update_date": {
"_id": null,
"data": [
{
"date": "2013-12-02T00:00:00",
"db": "CERT/CC",
"id": "VU#520827",
"ident": null
},
{
"date": "2015-04-13T22:15:00",
"db": "BID",
"id": "53388",
"ident": null
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2012-2311",
"ident": null
}
]
},
"threat_type": {
"_id": null,
"data": "network",
"sources": [
{
"db": "BID",
"id": "53388"
}
],
"trust": 0.3
},
"title": {
"_id": null,
"data": "PHP-CGI query string parameter vulnerability",
"sources": [
{
"db": "CERT/CC",
"id": "VU#520827"
}
],
"trust": 0.8
},
"type": {
"_id": null,
"data": "arbitrary",
"sources": [
{
"db": "PACKETSTORM",
"id": "123310"
},
{
"db": "PACKETSTORM",
"id": "116800"
},
{
"db": "PACKETSTORM",
"id": "122468"
},
{
"db": "PACKETSTORM",
"id": "112580"
},
{
"db": "PACKETSTORM",
"id": "113905"
},
{
"db": "PACKETSTORM",
"id": "122482"
},
{
"db": "PACKETSTORM",
"id": "112474"
}
],
"trust": 0.7
}
}
VAR-201205-0312
Vulnerability from variot - Updated: 2026-04-10 23:08sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to cause a denial of service (resource consumption) by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'T' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823. This vulnerability CVE-2012-1823 Vulnerability due to insufficient fix for.Service operation disruption by placing command line options in query strings by a third party ( Resource consumption ) There is a possibility of being put into a state. PHP is prone to an information-disclosure vulnerability. Exploiting this issue allows remote attackers to view the source code of files in the context of the server process. This may allow the attacker to obtain sensitive information and to run arbitrary PHP code on the affected computer; other attacks are also possible. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
===================================================================== Red Hat Security Advisory
Synopsis: Moderate: php security update Advisory ID: RHSA-2012:1046-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-1046.html Issue date: 2012-06-27 CVE Names: CVE-2010-2950 CVE-2011-4153 CVE-2012-0057 CVE-2012-0781 CVE-2012-0789 CVE-2012-1172 CVE-2012-2143 CVE-2012-2336 CVE-2012-2386 =====================================================================
- Summary:
Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
- Relevant releases/architectures:
Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64
- Description:
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.
It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057)
Note: This update disables file writing by default. A new PHP configuration directive, "xsl.security_prefs", can be used to enable file writing in XSLT.
A flaw was found in the way PHP validated file names in file upload requests. A remote attacker could possibly use this flaw to bypass the sanitization of the uploaded file names, and cause a PHP script to store the uploaded file in an unexpected directory, by using a directory traversal attack. (CVE-2012-1172)
Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way the PHP phar extension processed certain fields of tar archive files. A remote attacker could provide a specially-crafted tar archive file that, when processed by a PHP application using the phar extension, could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running PHP. (CVE-2012-2386)
A format string flaw was found in the way the PHP phar extension processed certain PHAR files. A remote attacker could provide a specially-crafted PHAR file, which once processed in a PHP application using the phar extension, could lead to information disclosure and possibly arbitrary code execution via a crafted phar:// URI. (CVE-2010-2950)
A flaw was found in the DES algorithm implementation in the crypt() password hashing function in PHP. If the password string to be hashed contained certain characters, the remainder of the string was ignored when calculating the hash, significantly reducing the password strength. (CVE-2012-2143)
Note: With this update, passwords are no longer truncated when performing DES hashing. Therefore, new hashes of the affected passwords will not match stored hashes generated using vulnerable PHP versions, and will need to be updated.
It was discovered that the fix for CVE-2012-1823, released via RHSA-2012:0546, did not properly filter all php-cgi command line arguments. A specially-crafted request to a PHP script could cause the PHP interpreter to execute the script in a loop, or output usage information that triggers an Internal Server Error. (CVE-2012-2336)
A memory leak flaw was found in the PHP strtotime() function call. A remote attacker could possibly use this flaw to cause excessive memory consumption by triggering many strtotime() function calls. (CVE-2012-0789)
A NULL pointer dereference flaw was found in the PHP tidy_diagnose() function. A remote attacker could use specially-crafted input to crash an application that uses tidy::diagnose. (CVE-2012-0781)
It was found that PHP did not check the zend_strndup() function's return value in certain cases. A remote attacker could possibly use this flaw to crash a PHP application. (CVE-2011-4153)
Upstream acknowledges Rubin Xu and Joseph Bonneau as the original reporters of CVE-2012-2143.
All php users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
- Solution:
Before applying this update, make sure all previously-released errata relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258
- Bugs fixed (http://bugzilla.redhat.com/):
782657 - CVE-2012-0057 php: XSLT file writing vulnerability 782943 - CVE-2011-4153 php: zend_strndup() NULL pointer dereference may cause DoS 782951 - CVE-2012-0781 php: tidy_diagnose() NULL pointer dereference may cause DoS 783609 - CVE-2012-0789 php: strtotime timezone memory leak 799187 - CVE-2012-1172 php: $_FILES array indexes corruption 816956 - CVE-2012-2143 BSD crypt(): DES encrypted password weakness 820708 - CVE-2012-2336 php: incomplete CVE-2012-1823 fix - missing filtering of -T and -h 823594 - CVE-2012-2386 php: Integer overflow leading to heap-buffer overflow in the Phar extension 835024 - CVE-2010-2950 php: Format string flaw in phar extension via phar_stream_flush() (MOPS-2010-024)
- Package List:
Red Hat Enterprise Linux Desktop Optional (v. 6):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/php-5.3.3-14.el6_3.src.rpm
i386: php-5.3.3-14.el6_3.i686.rpm php-bcmath-5.3.3-14.el6_3.i686.rpm php-cli-5.3.3-14.el6_3.i686.rpm php-common-5.3.3-14.el6_3.i686.rpm php-dba-5.3.3-14.el6_3.i686.rpm php-debuginfo-5.3.3-14.el6_3.i686.rpm php-devel-5.3.3-14.el6_3.i686.rpm php-embedded-5.3.3-14.el6_3.i686.rpm php-enchant-5.3.3-14.el6_3.i686.rpm php-gd-5.3.3-14.el6_3.i686.rpm php-imap-5.3.3-14.el6_3.i686.rpm php-intl-5.3.3-14.el6_3.i686.rpm php-ldap-5.3.3-14.el6_3.i686.rpm php-mbstring-5.3.3-14.el6_3.i686.rpm php-mysql-5.3.3-14.el6_3.i686.rpm php-odbc-5.3.3-14.el6_3.i686.rpm php-pdo-5.3.3-14.el6_3.i686.rpm php-pgsql-5.3.3-14.el6_3.i686.rpm php-process-5.3.3-14.el6_3.i686.rpm php-pspell-5.3.3-14.el6_3.i686.rpm php-recode-5.3.3-14.el6_3.i686.rpm php-snmp-5.3.3-14.el6_3.i686.rpm php-soap-5.3.3-14.el6_3.i686.rpm php-tidy-5.3.3-14.el6_3.i686.rpm php-xml-5.3.3-14.el6_3.i686.rpm php-xmlrpc-5.3.3-14.el6_3.i686.rpm php-zts-5.3.3-14.el6_3.i686.rpm
x86_64: php-5.3.3-14.el6_3.x86_64.rpm php-bcmath-5.3.3-14.el6_3.x86_64.rpm php-cli-5.3.3-14.el6_3.x86_64.rpm php-common-5.3.3-14.el6_3.x86_64.rpm php-dba-5.3.3-14.el6_3.x86_64.rpm php-debuginfo-5.3.3-14.el6_3.x86_64.rpm php-devel-5.3.3-14.el6_3.x86_64.rpm php-embedded-5.3.3-14.el6_3.x86_64.rpm php-enchant-5.3.3-14.el6_3.x86_64.rpm php-gd-5.3.3-14.el6_3.x86_64.rpm php-imap-5.3.3-14.el6_3.x86_64.rpm php-intl-5.3.3-14.el6_3.x86_64.rpm php-ldap-5.3.3-14.el6_3.x86_64.rpm php-mbstring-5.3.3-14.el6_3.x86_64.rpm php-mysql-5.3.3-14.el6_3.x86_64.rpm php-odbc-5.3.3-14.el6_3.x86_64.rpm php-pdo-5.3.3-14.el6_3.x86_64.rpm php-pgsql-5.3.3-14.el6_3.x86_64.rpm php-process-5.3.3-14.el6_3.x86_64.rpm php-pspell-5.3.3-14.el6_3.x86_64.rpm php-recode-5.3.3-14.el6_3.x86_64.rpm php-snmp-5.3.3-14.el6_3.x86_64.rpm php-soap-5.3.3-14.el6_3.x86_64.rpm php-tidy-5.3.3-14.el6_3.x86_64.rpm php-xml-5.3.3-14.el6_3.x86_64.rpm php-xmlrpc-5.3.3-14.el6_3.x86_64.rpm php-zts-5.3.3-14.el6_3.x86_64.rpm
Red Hat Enterprise Linux HPC Node (v. 6):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/php-5.3.3-14.el6_3.src.rpm
x86_64: php-cli-5.3.3-14.el6_3.x86_64.rpm php-common-5.3.3-14.el6_3.x86_64.rpm php-debuginfo-5.3.3-14.el6_3.x86_64.rpm
Red Hat Enterprise Linux HPC Node Optional (v. 6):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/php-5.3.3-14.el6_3.src.rpm
x86_64: php-5.3.3-14.el6_3.x86_64.rpm php-bcmath-5.3.3-14.el6_3.x86_64.rpm php-dba-5.3.3-14.el6_3.x86_64.rpm php-debuginfo-5.3.3-14.el6_3.x86_64.rpm php-devel-5.3.3-14.el6_3.x86_64.rpm php-embedded-5.3.3-14.el6_3.x86_64.rpm php-enchant-5.3.3-14.el6_3.x86_64.rpm php-gd-5.3.3-14.el6_3.x86_64.rpm php-imap-5.3.3-14.el6_3.x86_64.rpm php-intl-5.3.3-14.el6_3.x86_64.rpm php-ldap-5.3.3-14.el6_3.x86_64.rpm php-mbstring-5.3.3-14.el6_3.x86_64.rpm php-mysql-5.3.3-14.el6_3.x86_64.rpm php-odbc-5.3.3-14.el6_3.x86_64.rpm php-pdo-5.3.3-14.el6_3.x86_64.rpm php-pgsql-5.3.3-14.el6_3.x86_64.rpm php-process-5.3.3-14.el6_3.x86_64.rpm php-pspell-5.3.3-14.el6_3.x86_64.rpm php-recode-5.3.3-14.el6_3.x86_64.rpm php-snmp-5.3.3-14.el6_3.x86_64.rpm php-soap-5.3.3-14.el6_3.x86_64.rpm php-tidy-5.3.3-14.el6_3.x86_64.rpm php-xml-5.3.3-14.el6_3.x86_64.rpm php-xmlrpc-5.3.3-14.el6_3.x86_64.rpm php-zts-5.3.3-14.el6_3.x86_64.rpm
Red Hat Enterprise Linux Server (v. 6):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/php-5.3.3-14.el6_3.src.rpm
i386: php-5.3.3-14.el6_3.i686.rpm php-cli-5.3.3-14.el6_3.i686.rpm php-common-5.3.3-14.el6_3.i686.rpm php-debuginfo-5.3.3-14.el6_3.i686.rpm php-gd-5.3.3-14.el6_3.i686.rpm php-ldap-5.3.3-14.el6_3.i686.rpm php-mysql-5.3.3-14.el6_3.i686.rpm php-odbc-5.3.3-14.el6_3.i686.rpm php-pdo-5.3.3-14.el6_3.i686.rpm php-pgsql-5.3.3-14.el6_3.i686.rpm php-soap-5.3.3-14.el6_3.i686.rpm php-xml-5.3.3-14.el6_3.i686.rpm php-xmlrpc-5.3.3-14.el6_3.i686.rpm
ppc64: php-5.3.3-14.el6_3.ppc64.rpm php-cli-5.3.3-14.el6_3.ppc64.rpm php-common-5.3.3-14.el6_3.ppc64.rpm php-debuginfo-5.3.3-14.el6_3.ppc64.rpm php-gd-5.3.3-14.el6_3.ppc64.rpm php-ldap-5.3.3-14.el6_3.ppc64.rpm php-mysql-5.3.3-14.el6_3.ppc64.rpm php-odbc-5.3.3-14.el6_3.ppc64.rpm php-pdo-5.3.3-14.el6_3.ppc64.rpm php-pgsql-5.3.3-14.el6_3.ppc64.rpm php-soap-5.3.3-14.el6_3.ppc64.rpm php-xml-5.3.3-14.el6_3.ppc64.rpm php-xmlrpc-5.3.3-14.el6_3.ppc64.rpm
s390x: php-5.3.3-14.el6_3.s390x.rpm php-cli-5.3.3-14.el6_3.s390x.rpm php-common-5.3.3-14.el6_3.s390x.rpm php-debuginfo-5.3.3-14.el6_3.s390x.rpm php-gd-5.3.3-14.el6_3.s390x.rpm php-ldap-5.3.3-14.el6_3.s390x.rpm php-mysql-5.3.3-14.el6_3.s390x.rpm php-odbc-5.3.3-14.el6_3.s390x.rpm php-pdo-5.3.3-14.el6_3.s390x.rpm php-pgsql-5.3.3-14.el6_3.s390x.rpm php-soap-5.3.3-14.el6_3.s390x.rpm php-xml-5.3.3-14.el6_3.s390x.rpm php-xmlrpc-5.3.3-14.el6_3.s390x.rpm
x86_64: php-5.3.3-14.el6_3.x86_64.rpm php-cli-5.3.3-14.el6_3.x86_64.rpm php-common-5.3.3-14.el6_3.x86_64.rpm php-debuginfo-5.3.3-14.el6_3.x86_64.rpm php-gd-5.3.3-14.el6_3.x86_64.rpm php-ldap-5.3.3-14.el6_3.x86_64.rpm php-mysql-5.3.3-14.el6_3.x86_64.rpm php-odbc-5.3.3-14.el6_3.x86_64.rpm php-pdo-5.3.3-14.el6_3.x86_64.rpm php-pgsql-5.3.3-14.el6_3.x86_64.rpm php-soap-5.3.3-14.el6_3.x86_64.rpm php-xml-5.3.3-14.el6_3.x86_64.rpm php-xmlrpc-5.3.3-14.el6_3.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 6):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/php-5.3.3-14.el6_3.src.rpm
i386: php-bcmath-5.3.3-14.el6_3.i686.rpm php-dba-5.3.3-14.el6_3.i686.rpm php-debuginfo-5.3.3-14.el6_3.i686.rpm php-devel-5.3.3-14.el6_3.i686.rpm php-embedded-5.3.3-14.el6_3.i686.rpm php-enchant-5.3.3-14.el6_3.i686.rpm php-imap-5.3.3-14.el6_3.i686.rpm php-intl-5.3.3-14.el6_3.i686.rpm php-mbstring-5.3.3-14.el6_3.i686.rpm php-process-5.3.3-14.el6_3.i686.rpm php-pspell-5.3.3-14.el6_3.i686.rpm php-recode-5.3.3-14.el6_3.i686.rpm php-snmp-5.3.3-14.el6_3.i686.rpm php-tidy-5.3.3-14.el6_3.i686.rpm php-zts-5.3.3-14.el6_3.i686.rpm
ppc64: php-bcmath-5.3.3-14.el6_3.ppc64.rpm php-dba-5.3.3-14.el6_3.ppc64.rpm php-debuginfo-5.3.3-14.el6_3.ppc64.rpm php-devel-5.3.3-14.el6_3.ppc64.rpm php-embedded-5.3.3-14.el6_3.ppc64.rpm php-enchant-5.3.3-14.el6_3.ppc64.rpm php-imap-5.3.3-14.el6_3.ppc64.rpm php-intl-5.3.3-14.el6_3.ppc64.rpm php-mbstring-5.3.3-14.el6_3.ppc64.rpm php-process-5.3.3-14.el6_3.ppc64.rpm php-pspell-5.3.3-14.el6_3.ppc64.rpm php-recode-5.3.3-14.el6_3.ppc64.rpm php-snmp-5.3.3-14.el6_3.ppc64.rpm php-tidy-5.3.3-14.el6_3.ppc64.rpm php-zts-5.3.3-14.el6_3.ppc64.rpm
s390x: php-bcmath-5.3.3-14.el6_3.s390x.rpm php-dba-5.3.3-14.el6_3.s390x.rpm php-debuginfo-5.3.3-14.el6_3.s390x.rpm php-devel-5.3.3-14.el6_3.s390x.rpm php-embedded-5.3.3-14.el6_3.s390x.rpm php-enchant-5.3.3-14.el6_3.s390x.rpm php-imap-5.3.3-14.el6_3.s390x.rpm php-intl-5.3.3-14.el6_3.s390x.rpm php-mbstring-5.3.3-14.el6_3.s390x.rpm php-process-5.3.3-14.el6_3.s390x.rpm php-pspell-5.3.3-14.el6_3.s390x.rpm php-recode-5.3.3-14.el6_3.s390x.rpm php-snmp-5.3.3-14.el6_3.s390x.rpm php-tidy-5.3.3-14.el6_3.s390x.rpm php-zts-5.3.3-14.el6_3.s390x.rpm
x86_64: php-bcmath-5.3.3-14.el6_3.x86_64.rpm php-dba-5.3.3-14.el6_3.x86_64.rpm php-debuginfo-5.3.3-14.el6_3.x86_64.rpm php-devel-5.3.3-14.el6_3.x86_64.rpm php-embedded-5.3.3-14.el6_3.x86_64.rpm php-enchant-5.3.3-14.el6_3.x86_64.rpm php-imap-5.3.3-14.el6_3.x86_64.rpm php-intl-5.3.3-14.el6_3.x86_64.rpm php-mbstring-5.3.3-14.el6_3.x86_64.rpm php-process-5.3.3-14.el6_3.x86_64.rpm php-pspell-5.3.3-14.el6_3.x86_64.rpm php-recode-5.3.3-14.el6_3.x86_64.rpm php-snmp-5.3.3-14.el6_3.x86_64.rpm php-tidy-5.3.3-14.el6_3.x86_64.rpm php-zts-5.3.3-14.el6_3.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 6):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/php-5.3.3-14.el6_3.src.rpm
i386: php-5.3.3-14.el6_3.i686.rpm php-cli-5.3.3-14.el6_3.i686.rpm php-common-5.3.3-14.el6_3.i686.rpm php-debuginfo-5.3.3-14.el6_3.i686.rpm php-gd-5.3.3-14.el6_3.i686.rpm php-ldap-5.3.3-14.el6_3.i686.rpm php-mysql-5.3.3-14.el6_3.i686.rpm php-odbc-5.3.3-14.el6_3.i686.rpm php-pdo-5.3.3-14.el6_3.i686.rpm php-pgsql-5.3.3-14.el6_3.i686.rpm php-soap-5.3.3-14.el6_3.i686.rpm php-xml-5.3.3-14.el6_3.i686.rpm php-xmlrpc-5.3.3-14.el6_3.i686.rpm
x86_64: php-5.3.3-14.el6_3.x86_64.rpm php-cli-5.3.3-14.el6_3.x86_64.rpm php-common-5.3.3-14.el6_3.x86_64.rpm php-debuginfo-5.3.3-14.el6_3.x86_64.rpm php-gd-5.3.3-14.el6_3.x86_64.rpm php-ldap-5.3.3-14.el6_3.x86_64.rpm php-mysql-5.3.3-14.el6_3.x86_64.rpm php-odbc-5.3.3-14.el6_3.x86_64.rpm php-pdo-5.3.3-14.el6_3.x86_64.rpm php-pgsql-5.3.3-14.el6_3.x86_64.rpm php-soap-5.3.3-14.el6_3.x86_64.rpm php-xml-5.3.3-14.el6_3.x86_64.rpm php-xmlrpc-5.3.3-14.el6_3.x86_64.rpm
Red Hat Enterprise Linux Workstation Optional (v. 6):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/php-5.3.3-14.el6_3.src.rpm
i386: php-bcmath-5.3.3-14.el6_3.i686.rpm php-dba-5.3.3-14.el6_3.i686.rpm php-debuginfo-5.3.3-14.el6_3.i686.rpm php-devel-5.3.3-14.el6_3.i686.rpm php-embedded-5.3.3-14.el6_3.i686.rpm php-enchant-5.3.3-14.el6_3.i686.rpm php-imap-5.3.3-14.el6_3.i686.rpm php-intl-5.3.3-14.el6_3.i686.rpm php-mbstring-5.3.3-14.el6_3.i686.rpm php-process-5.3.3-14.el6_3.i686.rpm php-pspell-5.3.3-14.el6_3.i686.rpm php-recode-5.3.3-14.el6_3.i686.rpm php-snmp-5.3.3-14.el6_3.i686.rpm php-tidy-5.3.3-14.el6_3.i686.rpm php-zts-5.3.3-14.el6_3.i686.rpm
x86_64: php-bcmath-5.3.3-14.el6_3.x86_64.rpm php-dba-5.3.3-14.el6_3.x86_64.rpm php-debuginfo-5.3.3-14.el6_3.x86_64.rpm php-devel-5.3.3-14.el6_3.x86_64.rpm php-embedded-5.3.3-14.el6_3.x86_64.rpm php-enchant-5.3.3-14.el6_3.x86_64.rpm php-imap-5.3.3-14.el6_3.x86_64.rpm php-intl-5.3.3-14.el6_3.x86_64.rpm php-mbstring-5.3.3-14.el6_3.x86_64.rpm php-process-5.3.3-14.el6_3.x86_64.rpm php-pspell-5.3.3-14.el6_3.x86_64.rpm php-recode-5.3.3-14.el6_3.x86_64.rpm php-snmp-5.3.3-14.el6_3.x86_64.rpm php-tidy-5.3.3-14.el6_3.x86_64.rpm php-zts-5.3.3-14.el6_3.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package
- References:
https://www.redhat.com/security/data/cve/CVE-2010-2950.html https://www.redhat.com/security/data/cve/CVE-2011-4153.html https://www.redhat.com/security/data/cve/CVE-2012-0057.html https://www.redhat.com/security/data/cve/CVE-2012-0781.html https://www.redhat.com/security/data/cve/CVE-2012-0789.html https://www.redhat.com/security/data/cve/CVE-2012-1172.html https://www.redhat.com/security/data/cve/CVE-2012-2143.html https://www.redhat.com/security/data/cve/CVE-2012-2336.html https://www.redhat.com/security/data/cve/CVE-2012-2386.html https://access.redhat.com/security/updates/classification/#moderate https://rhn.redhat.com/errata/RHSA-2012-0546.html
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2012 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFP6yxRXlSAg2UNWIIRAqlmAKCLhNreR9eJ9DMLQgGynQ1AR57OhwCeNCjP 5dEIaw64iUF1AYJgb6tOHK0= =KioB -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce .
Problem Description:
A vulnerability has been found and corrected in php(-cgi):
PHP-CGI-based setups contain a vulnerability when parsing query string parameters from php files. The updated packages provides the latest version (5.3.13) which provides a solution to this flaw. The verification of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux)
iD8DBQFPq4WAmqjQ0CJFipgRAihWAKCc3667vbSD/ihxb7LB9g9x2C+bnQCg89XH JTVUFGYH3hR84ZM7EV65I9g= =hQaF -----END PGP SIGNATURE-----
Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . ============================================================================ Ubuntu Security Notice USN-1481-1 June 19, 2012
php5 vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS
- Ubuntu 8.04 LTS
Summary:
Several security issues were fixed in PHP.
Software Description: - php5: HTML-embedded scripting language interpreter
Details:
It was discovered that PHP incorrectly handled certain Tidy::diagnose operations on invalid objects. (CVE-2012-1172)
Rubin Xu and Joseph Bonneau discovered that PHP incorrectly handled certain Unicode characters in passwords passed to the crypt() function. (CVE-2012-2143)
It was discovered that a Debian/Ubuntu specific patch caused PHP to incorrectly handle empty salt strings. This issue only affected Ubuntu 10.04 LTS and Ubuntu 11.04. (CVE-2012-2317)
It was discovered that PHP, when used as a stand alone CGI processor for the Apache Web Server, did not properly parse and filter query strings. Configurations using mod_php5 and FastCGI were not vulnerable. (CVE-2012-2386)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 12.04 LTS: php5 5.3.10-1ubuntu3.2
Ubuntu 11.10: php5 5.3.6-13ubuntu3.8
Ubuntu 11.04: php5 5.3.5-1ubuntu7.10
Ubuntu 10.04 LTS: php5 5.3.2-1ubuntu4.17
Ubuntu 8.04 LTS: php5 5.2.4-2ubuntu5.25
In general, a standard system update will make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c03839862
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c03839862 Version: 2
HPSBMU02900 rev.2 - HP System Management Homepage (SMH) running on Linux and Windows, Multiple Remote and Local Vulnerabilities
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2013-07-18 Last Updated: 2013-07-19
Potential Security Impact: Local Denial of Service (DoS), remote Denial of Service (DoS), execution of arbitrary code, gain extended privileges, disclosure of information, unauthorized access, XSS
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY Potential security vulnerabilities have been identified with HP System Management Homepage (SMH) running on Linux and Windows. The vulnerabilities could be exploited remotely resulting in Local Denial of Service (DoS), remote Denial of Service (DoS), execution of arbitrary code, gain privileges, disclosure of information, unauthorized access, or XSS.
References: CVE-2011-3389 (SSRT100740) Remote disclosure of information CVE-2012-0883 (SSRT101209) Remote gain extended privileges CVE-2012-2110 (SSRT101210) Remote Denial of Service (DoS) CVE-2012-2311 (SSRT100992) Remote execution of arbitrary code CVE-2012-2329 (SSRT100992) Remote Denial of Service (DoS) CVE-2012-2335 (SSRT100992) Remote execution of arbitrary code CVE-2012-2336 (SSRT100992) Remote Denial of Service (DoS) CVE-2012-5217 (SSRT101137) Remote unauthorized access CVE-2013-2355 (SSRT100696) Remote unauthorized Access CVE-2013-2356 (SSRT100835) Remote disclosure of information CVE-2013-2357 (SSRT100907) Remote Denial of Service (DoS) CVE-2013-2358 (SSRT100907) Remote Denial of Service (DoS) CVE-2013-2359 (SSRT100907) Remote Denial of Service (DoS) CVE-2013-2360 (SSRT100907) Remote Denial of Service (DoS) CVE-2013-2361 (SSRT101007) XSS CVE-2013-2362 (SSRT101076, ZDI-CAN-1676) Local Denial of Service (DoS) CVE-2013-2363 (SSRT101150) Remote disclosure of information CVE-2013-2364 (SSRT101151) XSS
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP System Management Homepage (SMH) v7.2.0 and earlier running on Linux and Windows.
BACKGROUND
CVSS 2.0 Base Metrics
Reference Base Vector Base Score CVE-2011-3389 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3 CVE-2012-0883 (AV:L/AC:M/Au:N/C:C/I:C/A:C) 6.9 CVE-2012-2110 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5 CVE-2012-2311 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5 CVE-2012-2329 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0 CVE-2012-2335 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5 CVE-2012-2336 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0 CVE-2012-5217 (AV:N/AC:H/Au:N/C:P/I:N/A:N) 2.6 CVE-2013-2355 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3 CVE-2013-2356 (AV:N/AC:L/Au:N/C:C/I:N/A:N) 7.8 CVE-2013-2357 (AV:N/AC:M/Au:S/C:N/I:N/A:C) 6.3 CVE-2013-2358 (AV:N/AC:M/Au:S/C:N/I:N/A:C) 6.3 CVE-2013-2359 (AV:N/AC:M/Au:S/C:N/I:N/A:P) 3.5 CVE-2013-2360 (AV:N/AC:M/Au:S/C:N/I:N/A:P) 3.5 CVE-2013-2361 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 4.3 CVE-2013-2362 (AV:L/AC:H/Au:S/C:N/I:N/A:P) 1.0 CVE-2013-2363 (AV:N/AC:H/Au:N/C:C/I:N/A:P) 6.1 CVE-2013-2364 (AV:N/AC:L/Au:S/C:N/I:N/A:P) 4.0 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002
The Hewlett-Packard Company thanks agix for working with the TippingPoint Zero Day Initiative to report vulnerability CVE-2013-2362 to security-alert@hp.com
RESOLUTION
HP has made System Management Homepage (SMH) v7.2.1 or subsequent available for Windows and Linux to resolve the vulnerabilities.
Information and updates for SMH can be found at the following location:
http://h18013.www1.hp.com/products/servers/management/agents/index.html
HISTORY Version:1 (rev.1) - 18 July 2013 Initial release Version:2 (rev.2) - 19 July 2013 Corrected CVE-2012-5217 assignment
Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com
Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins
Security Bulletin Archive: A list of recently released Security Bulletins is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/
Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB.
3C = 3COM 3P = 3rd Party Software GN = HP General Software HF = HP Hardware and Firmware MP = MPE/iX MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PI = Printing and Imaging PV = ProCurve ST = Storage Software TU = Tru64 UNIX UX = HP-UX
Copyright 2013 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners
Show details on source website{
"affected_products": {
"_id": null,
"data": [
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.9,
"vendor": "php",
"version": "5.3.8"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.9,
"vendor": "php",
"version": "5.3.10"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.9,
"vendor": "php",
"version": "5.3.9"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.9,
"vendor": "php",
"version": "5.4.2"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.9,
"vendor": "php",
"version": "5.3.7"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.9,
"vendor": "php",
"version": "5.4.1"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.6,
"vendor": "php",
"version": "5.3.11"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.6,
"vendor": "php",
"version": "5.4.0"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.3,
"vendor": "php",
"version": "5.3.1"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.3,
"vendor": "php",
"version": "5.3.3"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.3,
"vendor": "php",
"version": "5.3.6"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.3,
"vendor": "php",
"version": "5.3.5"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.3,
"vendor": "php",
"version": "5.3.4"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.3,
"vendor": "php",
"version": "5.3.2"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.0.2"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.14"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.3"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.4.9"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.3.3"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.6"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.13"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.4"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.0.1"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.4"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.9"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.4.2"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.4.4"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.1.2"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.2.1"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.1.0"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.3.8"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.4.1"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.17"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.13"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.1.6"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "2.0b10"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.4.7"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.16"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.2.3"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.18"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.5"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.9"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.10"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.0.0"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.2.2"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.0.6"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.1"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.16"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.4.3"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.3"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.3.4"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.3.2"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.0.4"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.8"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.1.1"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.12"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.2.0"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.3.0"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.15"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.3.5"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.4.6"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.12"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.17"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.11"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.6"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.1.0"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.3.9"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.1.2"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.8"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.0.5"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.3.6"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.5"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.0.3"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.3.7"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.1.4"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.0.0"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.7"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.11"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.0.4"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.2"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.0.5"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.0"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.1.3"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.4.5"
},
{
"_id": null,
"model": "php",
"scope": "lte",
"trust": 1.0,
"vendor": "php",
"version": "5.3.12"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.3.10"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.0.2"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.14"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.4.0"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.1.5"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.0"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.7"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "2.0"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "1.0"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.2"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "3.0.15"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.4.8"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.3.0"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.1"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.3.1"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.0.1"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.3.11"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.1.1"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.2.10"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "4.0.7"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 1.0,
"vendor": "php",
"version": "5.0.3"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 0.9,
"vendor": "php",
"version": "5.3.12"
},
{
"_id": null,
"model": "php",
"scope": "lt",
"trust": 0.8,
"vendor": "the php group",
"version": "5.4.x"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 0.8,
"vendor": "the php group",
"version": "5.4.3"
},
{
"_id": null,
"model": "plesk panel",
"scope": "eq",
"trust": 0.3,
"vendor": "parallels",
"version": "9.5.4"
},
{
"_id": null,
"model": "linux i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.10"
},
{
"_id": null,
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.2"
},
{
"_id": null,
"model": "enterprise linux hpc node optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "7.2"
},
{
"_id": null,
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "linux ia-64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "ip office application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "8.1"
},
{
"_id": null,
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "6.2"
},
{
"_id": null,
"model": "voice portal sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0"
},
{
"_id": null,
"model": "enterprise linux server",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "linux enterprise sdk sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"_id": null,
"model": "voice portal",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.1"
},
{
"_id": null,
"model": "linux enterprise server sp3 ltss",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "10"
},
{
"_id": null,
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"_id": null,
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "5"
},
{
"_id": null,
"model": "enterprise linux server eus 6.1.z",
"scope": null,
"trust": 0.3,
"vendor": "redhat",
"version": null
},
{
"_id": null,
"model": "enterprise linux server optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "enterprise linux long life server",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "5.3"
},
{
"_id": null,
"model": "appliance server",
"scope": "eq",
"trust": 0.3,
"vendor": "turbolinux",
"version": "3.0"
},
{
"_id": null,
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2.3"
},
{
"_id": null,
"model": "enterprise server",
"scope": "eq",
"trust": 0.3,
"vendor": "mandrakesoft",
"version": "5"
},
{
"_id": null,
"model": "voice portal sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0"
},
{
"_id": null,
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7"
},
{
"_id": null,
"model": "ctpview",
"scope": "eq",
"trust": 0.3,
"vendor": "juniper",
"version": "4.6"
},
{
"_id": null,
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"_id": null,
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.10"
},
{
"_id": null,
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "7.0"
},
{
"_id": null,
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1.1"
},
{
"_id": null,
"model": "aura communication manager utility services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"_id": null,
"model": "linux lts amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"_id": null,
"model": "linux mandrake x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2011"
},
{
"_id": null,
"model": "enterprise linux workstation",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.8"
},
{
"_id": null,
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.5"
},
{
"_id": null,
"model": "linux lts powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"_id": null,
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"_id": null,
"model": "ctpview",
"scope": "eq",
"trust": 0.3,
"vendor": "juniper",
"version": "4.3"
},
{
"_id": null,
"model": "aura messaging",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0.1"
},
{
"_id": null,
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.3"
},
{
"_id": null,
"model": "linux enterprise sdk sp4",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "10"
},
{
"_id": null,
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.4"
},
{
"_id": null,
"model": "ctpview",
"scope": "eq",
"trust": 0.3,
"vendor": "juniper",
"version": "4.2"
},
{
"_id": null,
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.8"
},
{
"_id": null,
"model": "opensuse",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "11.4"
},
{
"_id": null,
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.04"
},
{
"_id": null,
"model": "enterprise linux workstation optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "voice portal",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.1.1"
},
{
"_id": null,
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.8.1"
},
{
"_id": null,
"model": "linux i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"_id": null,
"model": "aura communication manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"_id": null,
"model": "plesk panel",
"scope": "eq",
"trust": 0.3,
"vendor": "parallels",
"version": "9.3"
},
{
"_id": null,
"model": "linux lts sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"_id": null,
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "ctpview 7.0r1",
"scope": "ne",
"trust": 0.3,
"vendor": "juniper",
"version": null
},
{
"_id": null,
"model": "lotus foundations start 1.2.2b",
"scope": "ne",
"trust": 0.3,
"vendor": "ibm",
"version": null
},
{
"_id": null,
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.1"
},
{
"_id": null,
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.1"
},
{
"_id": null,
"model": "aura messaging",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"_id": null,
"model": "linux lts i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"_id": null,
"model": "linux i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.04"
},
{
"_id": null,
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2.2"
},
{
"_id": null,
"model": "enterprise linux eus 5.6.z server",
"scope": null,
"trust": 0.3,
"vendor": "redhat",
"version": null
},
{
"_id": null,
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.2"
},
{
"_id": null,
"model": "system management homepage",
"scope": "ne",
"trust": 0.3,
"vendor": "hp",
"version": "7.2.1"
},
{
"_id": null,
"model": "linux enterprise server sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"_id": null,
"model": "aura session manager sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"_id": null,
"model": "linux enterprise server sp4",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "10"
},
{
"_id": null,
"model": "ip office application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"_id": null,
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "6"
},
{
"_id": null,
"model": "lotus foundations start 1.2.2a",
"scope": null,
"trust": 0.3,
"vendor": "ibm",
"version": null
},
{
"_id": null,
"model": "mac os",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.5"
},
{
"_id": null,
"model": "ctpview",
"scope": "eq",
"trust": 0.3,
"vendor": "juniper",
"version": "4.5"
},
{
"_id": null,
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2.1"
},
{
"_id": null,
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"_id": null,
"model": "enterprise linux desktop optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "aura communication manager utility services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"_id": null,
"model": "linux mandrake x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2010.1"
},
{
"_id": null,
"model": "voice portal sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.1"
},
{
"_id": null,
"model": "linux enterprise server sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"_id": null,
"model": "voice portal",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.1.2"
},
{
"_id": null,
"model": "ip office application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.0"
},
{
"_id": null,
"model": "linux",
"scope": null,
"trust": 0.3,
"vendor": "gentoo",
"version": null
},
{
"_id": null,
"model": "linux enterprise sdk sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"_id": null,
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"_id": null,
"model": "enterprise linux server optional eus",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6.1"
},
{
"_id": null,
"model": "linux lts i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "12.04"
},
{
"_id": null,
"model": "enterprise linux hpc node",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "aura communication manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0.1"
},
{
"_id": null,
"model": "server",
"scope": "eq",
"trust": 0.3,
"vendor": "turbolinux",
"version": "110"
},
{
"_id": null,
"model": "voice portal",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0"
},
{
"_id": null,
"model": "aura session manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"_id": null,
"model": "ip office application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "8.0"
},
{
"_id": null,
"model": "linux mandrake",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2011"
},
{
"_id": null,
"model": "linux lts lpia",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"_id": null,
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"_id": null,
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.04"
},
{
"_id": null,
"model": "ctpview",
"scope": "eq",
"trust": 0.3,
"vendor": "juniper",
"version": "4.4"
},
{
"_id": null,
"model": "enterprise linux server",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "5"
},
{
"_id": null,
"model": "linux lts amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "12.04"
},
{
"_id": null,
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7"
},
{
"_id": null,
"model": "linux ia-32",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "linux mips",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.04"
},
{
"_id": null,
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.0"
},
{
"_id": null,
"model": "aura messaging",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"_id": null,
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.8"
},
{
"_id": null,
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.3"
},
{
"_id": null,
"model": "linux enterprise server for vmware sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"_id": null,
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "7.1.2"
},
{
"_id": null,
"model": "mac os",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "x10.8.2"
},
{
"_id": null,
"model": "linux enterprise server for vmware sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"_id": null,
"model": "hp-ux b.11.31",
"scope": null,
"trust": 0.3,
"vendor": "hp",
"version": null
},
{
"_id": null,
"model": "linux s/390",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "aura communication manager utility services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.2"
},
{
"_id": null,
"model": "appliance server",
"scope": "eq",
"trust": 0.3,
"vendor": "turbolinux",
"version": "3.0x64"
},
{
"_id": null,
"model": "enterprise linux desktop workstation client",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "5"
},
{
"_id": null,
"model": "plesk panel",
"scope": "eq",
"trust": 0.3,
"vendor": "parallels",
"version": "9.2"
},
{
"_id": null,
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.1"
},
{
"_id": null,
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "client",
"scope": "eq",
"trust": 0.3,
"vendor": "turbolinux",
"version": "2008"
},
{
"_id": null,
"model": "plesk panel",
"scope": "eq",
"trust": 0.3,
"vendor": "parallels",
"version": "8.6"
},
{
"_id": null,
"model": "plesk panel",
"scope": "eq",
"trust": 0.3,
"vendor": "parallels",
"version": "9.0"
},
{
"_id": null,
"model": "ip office application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"_id": null,
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.3"
},
{
"_id": null,
"model": "lotus foundations start",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "1.2"
},
{
"_id": null,
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "7.1.1"
},
{
"_id": null,
"model": "enterprise server x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "mandrakesoft",
"version": "5"
},
{
"_id": null,
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "7.1"
},
{
"_id": null,
"model": "enterprise linux server eus",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6.0"
},
{
"_id": null,
"model": "aura session manager sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"_id": null,
"model": "server",
"scope": "eq",
"trust": 0.3,
"vendor": "turbolinux",
"version": "11x64"
},
{
"_id": null,
"model": "system management homepage",
"scope": "ne",
"trust": 0.3,
"vendor": "hp",
"version": "7.1.1"
},
{
"_id": null,
"model": "enterprise linux server optional eus",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6.0"
},
{
"_id": null,
"model": "opensuse",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "12.1"
},
{
"_id": null,
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.2"
},
{
"_id": null,
"model": "linux mandrake",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2010.1"
},
{
"_id": null,
"model": "php",
"scope": "ne",
"trust": 0.3,
"vendor": "php",
"version": "5.3.13"
}
],
"sources": [
{
"db": "BID",
"id": "53388"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-209"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002395"
},
{
"db": "NVD",
"id": "CVE-2012-2336"
}
]
},
"configurations": {
"_id": null,
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:php:php",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-002395"
}
]
},
"credits": {
"_id": null,
"data": "De Eindbazen",
"sources": [
{
"db": "BID",
"id": "53388"
}
],
"trust": 0.3
},
"cve": "CVE-2012-2336",
"cvss": {
"_id": null,
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CVE-2012-2336",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2012-2336",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2012-2336",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-201205-209",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201205-209"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002395"
},
{
"db": "NVD",
"id": "CVE-2012-2336"
}
]
},
"description": {
"_id": null,
"data": "sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to cause a denial of service (resource consumption) by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the \u0027T\u0027 case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823. This vulnerability CVE-2012-1823 Vulnerability due to insufficient fix for.Service operation disruption by placing command line options in query strings by a third party ( Resource consumption ) There is a possibility of being put into a state. PHP is prone to an information-disclosure vulnerability. \nExploiting this issue allows remote attackers to view the source code of files in the context of the server process. This may allow the attacker to obtain sensitive information and to run arbitrary PHP code on the affected computer; other attacks are also possible. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n=====================================================================\n Red Hat Security Advisory\n\nSynopsis: Moderate: php security update\nAdvisory ID: RHSA-2012:1046-01\nProduct: Red Hat Enterprise Linux\nAdvisory URL: https://rhn.redhat.com/errata/RHSA-2012-1046.html\nIssue date: 2012-06-27\nCVE Names: CVE-2010-2950 CVE-2011-4153 CVE-2012-0057 \n CVE-2012-0781 CVE-2012-0789 CVE-2012-1172 \n CVE-2012-2143 CVE-2012-2336 CVE-2012-2386 \n=====================================================================\n\n1. Summary:\n\nUpdated php packages that fix multiple security issues are now available\nfor Red Hat Enterprise Linux 6. \n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64\nRed Hat Enterprise Linux HPC Node (v. 6) - x86_64\nRed Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64\nRed Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64\nRed Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64\nRed Hat Enterprise Linux Workstation (v. 6) - i386, x86_64\nRed Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64\n\n3. Description:\n\nPHP is an HTML-embedded scripting language commonly used with the Apache\nHTTP Server. \n\nIt was discovered that the PHP XSL extension did not restrict the file\nwriting capability of libxslt. A remote attacker could use this flaw to\ncreate or overwrite an arbitrary file that is writable by the user running\nPHP, if a PHP script processed untrusted eXtensible Style Sheet Language\nTransformations (XSLT) content. (CVE-2012-0057)\n\nNote: This update disables file writing by default. A new PHP configuration\ndirective, \"xsl.security_prefs\", can be used to enable file writing in\nXSLT. \n\nA flaw was found in the way PHP validated file names in file upload\nrequests. A remote attacker could possibly use this flaw to bypass the\nsanitization of the uploaded file names, and cause a PHP script to store\nthe uploaded file in an unexpected directory, by using a directory\ntraversal attack. (CVE-2012-1172)\n\nMultiple integer overflow flaws, leading to heap-based buffer overflows,\nwere found in the way the PHP phar extension processed certain fields of\ntar archive files. A remote attacker could provide a specially-crafted tar\narchive file that, when processed by a PHP application using the phar\nextension, could cause the application to crash or, potentially, execute\narbitrary code with the privileges of the user running PHP. (CVE-2012-2386)\n\nA format string flaw was found in the way the PHP phar extension processed\ncertain PHAR files. A remote attacker could provide a specially-crafted\nPHAR file, which once processed in a PHP application using the phar\nextension, could lead to information disclosure and possibly arbitrary code\nexecution via a crafted phar:// URI. (CVE-2010-2950)\n\nA flaw was found in the DES algorithm implementation in the crypt()\npassword hashing function in PHP. If the password string to be hashed\ncontained certain characters, the remainder of the string was ignored when\ncalculating the hash, significantly reducing the password strength. \n(CVE-2012-2143)\n\nNote: With this update, passwords are no longer truncated when performing\nDES hashing. Therefore, new hashes of the affected passwords will not match\nstored hashes generated using vulnerable PHP versions, and will need to be\nupdated. \n\nIt was discovered that the fix for CVE-2012-1823, released via\nRHSA-2012:0546, did not properly filter all php-cgi command line arguments. \nA specially-crafted request to a PHP script could cause the PHP interpreter\nto execute the script in a loop, or output usage information that triggers\nan Internal Server Error. (CVE-2012-2336)\n\nA memory leak flaw was found in the PHP strtotime() function call. A remote\nattacker could possibly use this flaw to cause excessive memory consumption\nby triggering many strtotime() function calls. (CVE-2012-0789)\n\nA NULL pointer dereference flaw was found in the PHP tidy_diagnose()\nfunction. A remote attacker could use specially-crafted input to crash an\napplication that uses tidy::diagnose. (CVE-2012-0781)\n\nIt was found that PHP did not check the zend_strndup() function\u0027s return\nvalue in certain cases. A remote attacker could possibly use this flaw to\ncrash a PHP application. (CVE-2011-4153)\n\nUpstream acknowledges Rubin Xu and Joseph Bonneau as the original reporters\nof CVE-2012-2143. \n\nAll php users should upgrade to these updated packages, which contain\nbackported patches to resolve these issues. After installing the updated\npackages, the httpd daemon must be restarted for the update to take effect. \n\n4. Solution:\n\nBefore applying this update, make sure all previously-released errata\nrelevant to your system have been applied. \n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258\n\n5. Bugs fixed (http://bugzilla.redhat.com/):\n\n782657 - CVE-2012-0057 php: XSLT file writing vulnerability\n782943 - CVE-2011-4153 php: zend_strndup() NULL pointer dereference may cause DoS\n782951 - CVE-2012-0781 php: tidy_diagnose() NULL pointer dereference may cause DoS\n783609 - CVE-2012-0789 php: strtotime timezone memory leak\n799187 - CVE-2012-1172 php: $_FILES array indexes corruption\n816956 - CVE-2012-2143 BSD crypt(): DES encrypted password weakness\n820708 - CVE-2012-2336 php: incomplete CVE-2012-1823 fix - missing filtering of -T and -h\n823594 - CVE-2012-2386 php: Integer overflow leading to heap-buffer overflow in the Phar extension\n835024 - CVE-2010-2950 php: Format string flaw in phar extension via phar_stream_flush() (MOPS-2010-024)\n\n6. Package List:\n\nRed Hat Enterprise Linux Desktop Optional (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/php-5.3.3-14.el6_3.src.rpm\n\ni386:\nphp-5.3.3-14.el6_3.i686.rpm\nphp-bcmath-5.3.3-14.el6_3.i686.rpm\nphp-cli-5.3.3-14.el6_3.i686.rpm\nphp-common-5.3.3-14.el6_3.i686.rpm\nphp-dba-5.3.3-14.el6_3.i686.rpm\nphp-debuginfo-5.3.3-14.el6_3.i686.rpm\nphp-devel-5.3.3-14.el6_3.i686.rpm\nphp-embedded-5.3.3-14.el6_3.i686.rpm\nphp-enchant-5.3.3-14.el6_3.i686.rpm\nphp-gd-5.3.3-14.el6_3.i686.rpm\nphp-imap-5.3.3-14.el6_3.i686.rpm\nphp-intl-5.3.3-14.el6_3.i686.rpm\nphp-ldap-5.3.3-14.el6_3.i686.rpm\nphp-mbstring-5.3.3-14.el6_3.i686.rpm\nphp-mysql-5.3.3-14.el6_3.i686.rpm\nphp-odbc-5.3.3-14.el6_3.i686.rpm\nphp-pdo-5.3.3-14.el6_3.i686.rpm\nphp-pgsql-5.3.3-14.el6_3.i686.rpm\nphp-process-5.3.3-14.el6_3.i686.rpm\nphp-pspell-5.3.3-14.el6_3.i686.rpm\nphp-recode-5.3.3-14.el6_3.i686.rpm\nphp-snmp-5.3.3-14.el6_3.i686.rpm\nphp-soap-5.3.3-14.el6_3.i686.rpm\nphp-tidy-5.3.3-14.el6_3.i686.rpm\nphp-xml-5.3.3-14.el6_3.i686.rpm\nphp-xmlrpc-5.3.3-14.el6_3.i686.rpm\nphp-zts-5.3.3-14.el6_3.i686.rpm\n\nx86_64:\nphp-5.3.3-14.el6_3.x86_64.rpm\nphp-bcmath-5.3.3-14.el6_3.x86_64.rpm\nphp-cli-5.3.3-14.el6_3.x86_64.rpm\nphp-common-5.3.3-14.el6_3.x86_64.rpm\nphp-dba-5.3.3-14.el6_3.x86_64.rpm\nphp-debuginfo-5.3.3-14.el6_3.x86_64.rpm\nphp-devel-5.3.3-14.el6_3.x86_64.rpm\nphp-embedded-5.3.3-14.el6_3.x86_64.rpm\nphp-enchant-5.3.3-14.el6_3.x86_64.rpm\nphp-gd-5.3.3-14.el6_3.x86_64.rpm\nphp-imap-5.3.3-14.el6_3.x86_64.rpm\nphp-intl-5.3.3-14.el6_3.x86_64.rpm\nphp-ldap-5.3.3-14.el6_3.x86_64.rpm\nphp-mbstring-5.3.3-14.el6_3.x86_64.rpm\nphp-mysql-5.3.3-14.el6_3.x86_64.rpm\nphp-odbc-5.3.3-14.el6_3.x86_64.rpm\nphp-pdo-5.3.3-14.el6_3.x86_64.rpm\nphp-pgsql-5.3.3-14.el6_3.x86_64.rpm\nphp-process-5.3.3-14.el6_3.x86_64.rpm\nphp-pspell-5.3.3-14.el6_3.x86_64.rpm\nphp-recode-5.3.3-14.el6_3.x86_64.rpm\nphp-snmp-5.3.3-14.el6_3.x86_64.rpm\nphp-soap-5.3.3-14.el6_3.x86_64.rpm\nphp-tidy-5.3.3-14.el6_3.x86_64.rpm\nphp-xml-5.3.3-14.el6_3.x86_64.rpm\nphp-xmlrpc-5.3.3-14.el6_3.x86_64.rpm\nphp-zts-5.3.3-14.el6_3.x86_64.rpm\n\nRed Hat Enterprise Linux HPC Node (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/php-5.3.3-14.el6_3.src.rpm\n\nx86_64:\nphp-cli-5.3.3-14.el6_3.x86_64.rpm\nphp-common-5.3.3-14.el6_3.x86_64.rpm\nphp-debuginfo-5.3.3-14.el6_3.x86_64.rpm\n\nRed Hat Enterprise Linux HPC Node Optional (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/php-5.3.3-14.el6_3.src.rpm\n\nx86_64:\nphp-5.3.3-14.el6_3.x86_64.rpm\nphp-bcmath-5.3.3-14.el6_3.x86_64.rpm\nphp-dba-5.3.3-14.el6_3.x86_64.rpm\nphp-debuginfo-5.3.3-14.el6_3.x86_64.rpm\nphp-devel-5.3.3-14.el6_3.x86_64.rpm\nphp-embedded-5.3.3-14.el6_3.x86_64.rpm\nphp-enchant-5.3.3-14.el6_3.x86_64.rpm\nphp-gd-5.3.3-14.el6_3.x86_64.rpm\nphp-imap-5.3.3-14.el6_3.x86_64.rpm\nphp-intl-5.3.3-14.el6_3.x86_64.rpm\nphp-ldap-5.3.3-14.el6_3.x86_64.rpm\nphp-mbstring-5.3.3-14.el6_3.x86_64.rpm\nphp-mysql-5.3.3-14.el6_3.x86_64.rpm\nphp-odbc-5.3.3-14.el6_3.x86_64.rpm\nphp-pdo-5.3.3-14.el6_3.x86_64.rpm\nphp-pgsql-5.3.3-14.el6_3.x86_64.rpm\nphp-process-5.3.3-14.el6_3.x86_64.rpm\nphp-pspell-5.3.3-14.el6_3.x86_64.rpm\nphp-recode-5.3.3-14.el6_3.x86_64.rpm\nphp-snmp-5.3.3-14.el6_3.x86_64.rpm\nphp-soap-5.3.3-14.el6_3.x86_64.rpm\nphp-tidy-5.3.3-14.el6_3.x86_64.rpm\nphp-xml-5.3.3-14.el6_3.x86_64.rpm\nphp-xmlrpc-5.3.3-14.el6_3.x86_64.rpm\nphp-zts-5.3.3-14.el6_3.x86_64.rpm\n\nRed Hat Enterprise Linux Server (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/php-5.3.3-14.el6_3.src.rpm\n\ni386:\nphp-5.3.3-14.el6_3.i686.rpm\nphp-cli-5.3.3-14.el6_3.i686.rpm\nphp-common-5.3.3-14.el6_3.i686.rpm\nphp-debuginfo-5.3.3-14.el6_3.i686.rpm\nphp-gd-5.3.3-14.el6_3.i686.rpm\nphp-ldap-5.3.3-14.el6_3.i686.rpm\nphp-mysql-5.3.3-14.el6_3.i686.rpm\nphp-odbc-5.3.3-14.el6_3.i686.rpm\nphp-pdo-5.3.3-14.el6_3.i686.rpm\nphp-pgsql-5.3.3-14.el6_3.i686.rpm\nphp-soap-5.3.3-14.el6_3.i686.rpm\nphp-xml-5.3.3-14.el6_3.i686.rpm\nphp-xmlrpc-5.3.3-14.el6_3.i686.rpm\n\nppc64:\nphp-5.3.3-14.el6_3.ppc64.rpm\nphp-cli-5.3.3-14.el6_3.ppc64.rpm\nphp-common-5.3.3-14.el6_3.ppc64.rpm\nphp-debuginfo-5.3.3-14.el6_3.ppc64.rpm\nphp-gd-5.3.3-14.el6_3.ppc64.rpm\nphp-ldap-5.3.3-14.el6_3.ppc64.rpm\nphp-mysql-5.3.3-14.el6_3.ppc64.rpm\nphp-odbc-5.3.3-14.el6_3.ppc64.rpm\nphp-pdo-5.3.3-14.el6_3.ppc64.rpm\nphp-pgsql-5.3.3-14.el6_3.ppc64.rpm\nphp-soap-5.3.3-14.el6_3.ppc64.rpm\nphp-xml-5.3.3-14.el6_3.ppc64.rpm\nphp-xmlrpc-5.3.3-14.el6_3.ppc64.rpm\n\ns390x:\nphp-5.3.3-14.el6_3.s390x.rpm\nphp-cli-5.3.3-14.el6_3.s390x.rpm\nphp-common-5.3.3-14.el6_3.s390x.rpm\nphp-debuginfo-5.3.3-14.el6_3.s390x.rpm\nphp-gd-5.3.3-14.el6_3.s390x.rpm\nphp-ldap-5.3.3-14.el6_3.s390x.rpm\nphp-mysql-5.3.3-14.el6_3.s390x.rpm\nphp-odbc-5.3.3-14.el6_3.s390x.rpm\nphp-pdo-5.3.3-14.el6_3.s390x.rpm\nphp-pgsql-5.3.3-14.el6_3.s390x.rpm\nphp-soap-5.3.3-14.el6_3.s390x.rpm\nphp-xml-5.3.3-14.el6_3.s390x.rpm\nphp-xmlrpc-5.3.3-14.el6_3.s390x.rpm\n\nx86_64:\nphp-5.3.3-14.el6_3.x86_64.rpm\nphp-cli-5.3.3-14.el6_3.x86_64.rpm\nphp-common-5.3.3-14.el6_3.x86_64.rpm\nphp-debuginfo-5.3.3-14.el6_3.x86_64.rpm\nphp-gd-5.3.3-14.el6_3.x86_64.rpm\nphp-ldap-5.3.3-14.el6_3.x86_64.rpm\nphp-mysql-5.3.3-14.el6_3.x86_64.rpm\nphp-odbc-5.3.3-14.el6_3.x86_64.rpm\nphp-pdo-5.3.3-14.el6_3.x86_64.rpm\nphp-pgsql-5.3.3-14.el6_3.x86_64.rpm\nphp-soap-5.3.3-14.el6_3.x86_64.rpm\nphp-xml-5.3.3-14.el6_3.x86_64.rpm\nphp-xmlrpc-5.3.3-14.el6_3.x86_64.rpm\n\nRed Hat Enterprise Linux Server Optional (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/php-5.3.3-14.el6_3.src.rpm\n\ni386:\nphp-bcmath-5.3.3-14.el6_3.i686.rpm\nphp-dba-5.3.3-14.el6_3.i686.rpm\nphp-debuginfo-5.3.3-14.el6_3.i686.rpm\nphp-devel-5.3.3-14.el6_3.i686.rpm\nphp-embedded-5.3.3-14.el6_3.i686.rpm\nphp-enchant-5.3.3-14.el6_3.i686.rpm\nphp-imap-5.3.3-14.el6_3.i686.rpm\nphp-intl-5.3.3-14.el6_3.i686.rpm\nphp-mbstring-5.3.3-14.el6_3.i686.rpm\nphp-process-5.3.3-14.el6_3.i686.rpm\nphp-pspell-5.3.3-14.el6_3.i686.rpm\nphp-recode-5.3.3-14.el6_3.i686.rpm\nphp-snmp-5.3.3-14.el6_3.i686.rpm\nphp-tidy-5.3.3-14.el6_3.i686.rpm\nphp-zts-5.3.3-14.el6_3.i686.rpm\n\nppc64:\nphp-bcmath-5.3.3-14.el6_3.ppc64.rpm\nphp-dba-5.3.3-14.el6_3.ppc64.rpm\nphp-debuginfo-5.3.3-14.el6_3.ppc64.rpm\nphp-devel-5.3.3-14.el6_3.ppc64.rpm\nphp-embedded-5.3.3-14.el6_3.ppc64.rpm\nphp-enchant-5.3.3-14.el6_3.ppc64.rpm\nphp-imap-5.3.3-14.el6_3.ppc64.rpm\nphp-intl-5.3.3-14.el6_3.ppc64.rpm\nphp-mbstring-5.3.3-14.el6_3.ppc64.rpm\nphp-process-5.3.3-14.el6_3.ppc64.rpm\nphp-pspell-5.3.3-14.el6_3.ppc64.rpm\nphp-recode-5.3.3-14.el6_3.ppc64.rpm\nphp-snmp-5.3.3-14.el6_3.ppc64.rpm\nphp-tidy-5.3.3-14.el6_3.ppc64.rpm\nphp-zts-5.3.3-14.el6_3.ppc64.rpm\n\ns390x:\nphp-bcmath-5.3.3-14.el6_3.s390x.rpm\nphp-dba-5.3.3-14.el6_3.s390x.rpm\nphp-debuginfo-5.3.3-14.el6_3.s390x.rpm\nphp-devel-5.3.3-14.el6_3.s390x.rpm\nphp-embedded-5.3.3-14.el6_3.s390x.rpm\nphp-enchant-5.3.3-14.el6_3.s390x.rpm\nphp-imap-5.3.3-14.el6_3.s390x.rpm\nphp-intl-5.3.3-14.el6_3.s390x.rpm\nphp-mbstring-5.3.3-14.el6_3.s390x.rpm\nphp-process-5.3.3-14.el6_3.s390x.rpm\nphp-pspell-5.3.3-14.el6_3.s390x.rpm\nphp-recode-5.3.3-14.el6_3.s390x.rpm\nphp-snmp-5.3.3-14.el6_3.s390x.rpm\nphp-tidy-5.3.3-14.el6_3.s390x.rpm\nphp-zts-5.3.3-14.el6_3.s390x.rpm\n\nx86_64:\nphp-bcmath-5.3.3-14.el6_3.x86_64.rpm\nphp-dba-5.3.3-14.el6_3.x86_64.rpm\nphp-debuginfo-5.3.3-14.el6_3.x86_64.rpm\nphp-devel-5.3.3-14.el6_3.x86_64.rpm\nphp-embedded-5.3.3-14.el6_3.x86_64.rpm\nphp-enchant-5.3.3-14.el6_3.x86_64.rpm\nphp-imap-5.3.3-14.el6_3.x86_64.rpm\nphp-intl-5.3.3-14.el6_3.x86_64.rpm\nphp-mbstring-5.3.3-14.el6_3.x86_64.rpm\nphp-process-5.3.3-14.el6_3.x86_64.rpm\nphp-pspell-5.3.3-14.el6_3.x86_64.rpm\nphp-recode-5.3.3-14.el6_3.x86_64.rpm\nphp-snmp-5.3.3-14.el6_3.x86_64.rpm\nphp-tidy-5.3.3-14.el6_3.x86_64.rpm\nphp-zts-5.3.3-14.el6_3.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/php-5.3.3-14.el6_3.src.rpm\n\ni386:\nphp-5.3.3-14.el6_3.i686.rpm\nphp-cli-5.3.3-14.el6_3.i686.rpm\nphp-common-5.3.3-14.el6_3.i686.rpm\nphp-debuginfo-5.3.3-14.el6_3.i686.rpm\nphp-gd-5.3.3-14.el6_3.i686.rpm\nphp-ldap-5.3.3-14.el6_3.i686.rpm\nphp-mysql-5.3.3-14.el6_3.i686.rpm\nphp-odbc-5.3.3-14.el6_3.i686.rpm\nphp-pdo-5.3.3-14.el6_3.i686.rpm\nphp-pgsql-5.3.3-14.el6_3.i686.rpm\nphp-soap-5.3.3-14.el6_3.i686.rpm\nphp-xml-5.3.3-14.el6_3.i686.rpm\nphp-xmlrpc-5.3.3-14.el6_3.i686.rpm\n\nx86_64:\nphp-5.3.3-14.el6_3.x86_64.rpm\nphp-cli-5.3.3-14.el6_3.x86_64.rpm\nphp-common-5.3.3-14.el6_3.x86_64.rpm\nphp-debuginfo-5.3.3-14.el6_3.x86_64.rpm\nphp-gd-5.3.3-14.el6_3.x86_64.rpm\nphp-ldap-5.3.3-14.el6_3.x86_64.rpm\nphp-mysql-5.3.3-14.el6_3.x86_64.rpm\nphp-odbc-5.3.3-14.el6_3.x86_64.rpm\nphp-pdo-5.3.3-14.el6_3.x86_64.rpm\nphp-pgsql-5.3.3-14.el6_3.x86_64.rpm\nphp-soap-5.3.3-14.el6_3.x86_64.rpm\nphp-xml-5.3.3-14.el6_3.x86_64.rpm\nphp-xmlrpc-5.3.3-14.el6_3.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation Optional (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/php-5.3.3-14.el6_3.src.rpm\n\ni386:\nphp-bcmath-5.3.3-14.el6_3.i686.rpm\nphp-dba-5.3.3-14.el6_3.i686.rpm\nphp-debuginfo-5.3.3-14.el6_3.i686.rpm\nphp-devel-5.3.3-14.el6_3.i686.rpm\nphp-embedded-5.3.3-14.el6_3.i686.rpm\nphp-enchant-5.3.3-14.el6_3.i686.rpm\nphp-imap-5.3.3-14.el6_3.i686.rpm\nphp-intl-5.3.3-14.el6_3.i686.rpm\nphp-mbstring-5.3.3-14.el6_3.i686.rpm\nphp-process-5.3.3-14.el6_3.i686.rpm\nphp-pspell-5.3.3-14.el6_3.i686.rpm\nphp-recode-5.3.3-14.el6_3.i686.rpm\nphp-snmp-5.3.3-14.el6_3.i686.rpm\nphp-tidy-5.3.3-14.el6_3.i686.rpm\nphp-zts-5.3.3-14.el6_3.i686.rpm\n\nx86_64:\nphp-bcmath-5.3.3-14.el6_3.x86_64.rpm\nphp-dba-5.3.3-14.el6_3.x86_64.rpm\nphp-debuginfo-5.3.3-14.el6_3.x86_64.rpm\nphp-devel-5.3.3-14.el6_3.x86_64.rpm\nphp-embedded-5.3.3-14.el6_3.x86_64.rpm\nphp-enchant-5.3.3-14.el6_3.x86_64.rpm\nphp-imap-5.3.3-14.el6_3.x86_64.rpm\nphp-intl-5.3.3-14.el6_3.x86_64.rpm\nphp-mbstring-5.3.3-14.el6_3.x86_64.rpm\nphp-process-5.3.3-14.el6_3.x86_64.rpm\nphp-pspell-5.3.3-14.el6_3.x86_64.rpm\nphp-recode-5.3.3-14.el6_3.x86_64.rpm\nphp-snmp-5.3.3-14.el6_3.x86_64.rpm\nphp-tidy-5.3.3-14.el6_3.x86_64.rpm\nphp-zts-5.3.3-14.el6_3.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/#package\n\n7. References:\n\nhttps://www.redhat.com/security/data/cve/CVE-2010-2950.html\nhttps://www.redhat.com/security/data/cve/CVE-2011-4153.html\nhttps://www.redhat.com/security/data/cve/CVE-2012-0057.html\nhttps://www.redhat.com/security/data/cve/CVE-2012-0781.html\nhttps://www.redhat.com/security/data/cve/CVE-2012-0789.html\nhttps://www.redhat.com/security/data/cve/CVE-2012-1172.html\nhttps://www.redhat.com/security/data/cve/CVE-2012-2143.html\nhttps://www.redhat.com/security/data/cve/CVE-2012-2336.html\nhttps://www.redhat.com/security/data/cve/CVE-2012-2386.html\nhttps://access.redhat.com/security/updates/classification/#moderate\nhttps://rhn.redhat.com/errata/RHSA-2012-0546.html\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2012 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.4 (GNU/Linux)\n\niD8DBQFP6yxRXlSAg2UNWIIRAqlmAKCLhNreR9eJ9DMLQgGynQ1AR57OhwCeNCjP\n5dEIaw64iUF1AYJgb6tOHK0=\n=KioB\n-----END PGP SIGNATURE-----\n\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. \n _______________________________________________________________________\n\n Problem Description:\n\n A vulnerability has been found and corrected in php(-cgi):\n \n PHP-CGI-based setups contain a vulnerability when parsing query string\n parameters from php files. The\n updated packages provides the latest version (5.3.13) which provides\n a solution to this flaw. The verification\n of md5 checksums and GPG signatures is performed automatically for you. \n\n All packages are signed by Mandriva for security. You can obtain the\n GPG public key of the Mandriva Security Team by executing:\n\n gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98\n\n You can view other update advisories for Mandriva Linux at:\n\n http://www.mandriva.com/security/advisories\n\n If you want to report vulnerabilities, please contact\n\n security_(at)_mandriva.com\n _______________________________________________________________________\n\n Type Bits/KeyID Date User ID\n pub 1024D/22458A98 2000-07-10 Mandriva Security Team\n \u003csecurity*mandriva.com\u003e\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.11 (GNU/Linux)\n\niD8DBQFPq4WAmqjQ0CJFipgRAihWAKCc3667vbSD/ihxb7LB9g9x2C+bnQCg89XH\nJTVUFGYH3hR84ZM7EV65I9g=\n=hQaF\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nFull-Disclosure - We believe in it. \nCharter: http://lists.grok.org.uk/full-disclosure-charter.html\nHosted and sponsored by Secunia - http://secunia.com/\n. ============================================================================\nUbuntu Security Notice USN-1481-1\nJune 19, 2012\n\nphp5 vulnerabilities\n============================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 12.04 LTS\n- Ubuntu 11.10\n- Ubuntu 11.04\n- Ubuntu 10.04 LTS\n- Ubuntu 8.04 LTS\n\nSummary:\n\nSeveral security issues were fixed in PHP. \n\nSoftware Description:\n- php5: HTML-embedded scripting language interpreter\n\nDetails:\n\nIt was discovered that PHP incorrectly handled certain Tidy::diagnose\noperations on invalid objects. (CVE-2012-1172)\n\nRubin Xu and Joseph Bonneau discovered that PHP incorrectly handled certain\nUnicode characters in passwords passed to the crypt() function. \n(CVE-2012-2143)\n\nIt was discovered that a Debian/Ubuntu specific patch caused PHP to\nincorrectly handle empty salt strings. This issue only affected Ubuntu 10.04\nLTS and Ubuntu 11.04. (CVE-2012-2317)\n\nIt was discovered that PHP, when used as a stand alone CGI processor\nfor the Apache Web Server, did not properly parse and filter query\nstrings. Configurations using mod_php5 and FastCGI were not vulnerable. \n(CVE-2012-2386)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 12.04 LTS:\n php5 5.3.10-1ubuntu3.2\n\nUbuntu 11.10:\n php5 5.3.6-13ubuntu3.8\n\nUbuntu 11.04:\n php5 5.3.5-1ubuntu7.10\n\nUbuntu 10.04 LTS:\n php5 5.3.2-1ubuntu4.17\n\nUbuntu 8.04 LTS:\n php5 5.2.4-2ubuntu5.25\n\nIn general, a standard system update will make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\nNote: the current version of the following document is available here:\nhttps://h20564.www2.hp.com/portal/site/hpsc/public/kb/\ndocDisplay?docId=emr_na-c03839862\n\nSUPPORT COMMUNICATION - SECURITY BULLETIN\n\nDocument ID: c03839862\nVersion: 2\n\nHPSBMU02900 rev.2 - HP System Management Homepage (SMH) running on Linux and\nWindows, Multiple Remote and Local Vulnerabilities\n\nNOTICE: The information in this Security Bulletin should be acted upon as\nsoon as possible. \n\nRelease Date: 2013-07-18\nLast Updated: 2013-07-19\n\nPotential Security Impact: Local Denial of Service (DoS), remote Denial of\nService (DoS), execution of arbitrary code, gain extended privileges,\ndisclosure of information, unauthorized access, XSS\n\nSource: Hewlett-Packard Company, HP Software Security Response Team\n\nVULNERABILITY SUMMARY\nPotential security vulnerabilities have been identified with HP System\nManagement Homepage (SMH) running on Linux and Windows. The vulnerabilities\ncould be exploited remotely resulting in Local Denial of Service (DoS),\nremote Denial of Service (DoS), execution of arbitrary code, gain privileges,\ndisclosure of information, unauthorized access, or XSS. \n\nReferences:\nCVE-2011-3389 (SSRT100740) Remote disclosure of information\nCVE-2012-0883 (SSRT101209) Remote gain extended privileges\nCVE-2012-2110 (SSRT101210) Remote Denial of Service (DoS)\nCVE-2012-2311 (SSRT100992) Remote execution of arbitrary code\nCVE-2012-2329 (SSRT100992) Remote Denial of Service (DoS)\nCVE-2012-2335 (SSRT100992) Remote execution of arbitrary code\nCVE-2012-2336 (SSRT100992) Remote Denial of Service (DoS)\nCVE-2012-5217 (SSRT101137) Remote unauthorized access\nCVE-2013-2355 (SSRT100696) Remote unauthorized Access\nCVE-2013-2356 (SSRT100835) Remote disclosure of information\nCVE-2013-2357 (SSRT100907) Remote Denial of Service (DoS)\nCVE-2013-2358 (SSRT100907) Remote Denial of Service (DoS)\nCVE-2013-2359 (SSRT100907) Remote Denial of Service (DoS)\nCVE-2013-2360 (SSRT100907) Remote Denial of Service (DoS)\nCVE-2013-2361 (SSRT101007) XSS\nCVE-2013-2362 (SSRT101076, ZDI-CAN-1676) Local Denial of Service (DoS)\nCVE-2013-2363 (SSRT101150) Remote disclosure of information\nCVE-2013-2364 (SSRT101151) XSS\n\nSUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. \nHP System Management Homepage (SMH) v7.2.0 and earlier running on Linux and\nWindows. \n\nBACKGROUND\n\nCVSS 2.0 Base Metrics\n===========================================================\n Reference Base Vector Base Score\nCVE-2011-3389 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3\nCVE-2012-0883 (AV:L/AC:M/Au:N/C:C/I:C/A:C) 6.9\nCVE-2012-2110 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5\nCVE-2012-2311 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5\nCVE-2012-2329 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0\nCVE-2012-2335 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5\nCVE-2012-2336 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0\nCVE-2012-5217 (AV:N/AC:H/Au:N/C:P/I:N/A:N) 2.6\nCVE-2013-2355 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3\nCVE-2013-2356 (AV:N/AC:L/Au:N/C:C/I:N/A:N) 7.8\nCVE-2013-2357 (AV:N/AC:M/Au:S/C:N/I:N/A:C) 6.3\nCVE-2013-2358 (AV:N/AC:M/Au:S/C:N/I:N/A:C) 6.3\nCVE-2013-2359 (AV:N/AC:M/Au:S/C:N/I:N/A:P) 3.5\nCVE-2013-2360 (AV:N/AC:M/Au:S/C:N/I:N/A:P) 3.5\nCVE-2013-2361 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 4.3\nCVE-2013-2362 (AV:L/AC:H/Au:S/C:N/I:N/A:P) 1.0\nCVE-2013-2363 (AV:N/AC:H/Au:N/C:C/I:N/A:P) 6.1\nCVE-2013-2364 (AV:N/AC:L/Au:S/C:N/I:N/A:P) 4.0\n===========================================================\n Information on CVSS is documented\n in HP Customer Notice: HPSN-2008-002\n\nThe Hewlett-Packard Company thanks agix for working with the TippingPoint\nZero Day Initiative to report vulnerability CVE-2013-2362 to\nsecurity-alert@hp.com\n\nRESOLUTION\n\nHP has made System Management Homepage (SMH) v7.2.1 or subsequent available\nfor Windows and Linux to resolve the vulnerabilities. \n\nInformation and updates for SMH can be found at the following location:\n\nhttp://h18013.www1.hp.com/products/servers/management/agents/index.html\n\nHISTORY\nVersion:1 (rev.1) - 18 July 2013 Initial release\nVersion:2 (rev.2) - 19 July 2013 Corrected CVE-2012-5217 assignment\n\nThird Party Security Patches: Third party security patches that are to be\ninstalled on systems running HP software products should be applied in\naccordance with the customer\u0027s patch management policy. \n\nSupport: For issues about implementing the recommendations of this Security\nBulletin, contact normal HP Services support channel. For other issues about\nthe content of this Security Bulletin, send e-mail to security-alert@hp.com. \n\nReport: To report a potential security vulnerability with any HP supported\nproduct, send Email to: security-alert@hp.com\n\nSubscribe: To initiate a subscription to receive future HP Security Bulletin\nalerts via Email:\nhttp://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins\n\nSecurity Bulletin Archive: A list of recently released Security Bulletins is\navailable here:\nhttps://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/\n\nSoftware Product Category: The Software Product Category is represented in\nthe title by the two characters following HPSB. \n\n3C = 3COM\n3P = 3rd Party Software\nGN = HP General Software\nHF = HP Hardware and Firmware\nMP = MPE/iX\nMU = Multi-Platform Software\nNS = NonStop Servers\nOV = OpenVMS\nPI = Printing and Imaging\nPV = ProCurve\nST = Storage Software\nTU = Tru64 UNIX\nUX = HP-UX\n\nCopyright 2013 Hewlett-Packard Development Company, L.P. \nHewlett-Packard Company shall not be liable for technical or editorial errors\nor omissions contained herein. The information provided is provided \"as is\"\nwithout warranty of any kind. To the extent permitted by law, neither HP or\nits affiliates, subcontractors or suppliers will be liable for\nincidental,special or consequential damages including downtime cost; lost\nprofits;damages relating to the procurement of substitute products or\nservices; or damages for loss of data, or software restoration. The\ninformation in this document is subject to change without notice. \nHewlett-Packard Company and the names of Hewlett-Packard products referenced\nherein are trademarks of Hewlett-Packard Company in the United States and\nother countries. Other product and company names mentioned herein may be\ntrademarks of their respective owners",
"sources": [
{
"db": "NVD",
"id": "CVE-2012-2336"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002395"
},
{
"db": "BID",
"id": "53388"
},
{
"db": "PACKETSTORM",
"id": "123310"
},
{
"db": "PACKETSTORM",
"id": "114261"
},
{
"db": "PACKETSTORM",
"id": "114259"
},
{
"db": "PACKETSTORM",
"id": "114260"
},
{
"db": "PACKETSTORM",
"id": "112597"
},
{
"db": "PACKETSTORM",
"id": "113885"
},
{
"db": "PACKETSTORM",
"id": "122482"
}
],
"trust": 2.52
},
"external_ids": {
"_id": null,
"data": [
{
"db": "NVD",
"id": "CVE-2012-2336",
"trust": 3.4
},
{
"db": "SECUNIA",
"id": "49014",
"trust": 1.6
},
{
"db": "CERT/CC",
"id": "VU#520827",
"trust": 1.1
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002395",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201205-209",
"trust": 0.6
},
{
"db": "JUNIPER",
"id": "JSA10658",
"trust": 0.3
},
{
"db": "CERT/CC",
"id": "VU#673343",
"trust": 0.3
},
{
"db": "BID",
"id": "53388",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "123310",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "114261",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "114259",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "114260",
"trust": 0.1
},
{
"db": "OPENWALL",
"id": "OSS-SECURITY/2012/05/09/9",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "112597",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "113885",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "122482",
"trust": 0.1
}
],
"sources": [
{
"db": "BID",
"id": "53388"
},
{
"db": "PACKETSTORM",
"id": "123310"
},
{
"db": "PACKETSTORM",
"id": "114261"
},
{
"db": "PACKETSTORM",
"id": "114259"
},
{
"db": "PACKETSTORM",
"id": "114260"
},
{
"db": "PACKETSTORM",
"id": "112597"
},
{
"db": "PACKETSTORM",
"id": "113885"
},
{
"db": "PACKETSTORM",
"id": "122482"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-209"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002395"
},
{
"db": "NVD",
"id": "CVE-2012-2336"
}
]
},
"id": "VAR-201205-0312",
"iot": {
"_id": null,
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.47077376
},
"last_update_date": "2026-04-10T23:08:50.423000Z",
"patch": {
"_id": null,
"data": [
{
"title": "SUSE-SU-2012:0840",
"trust": 0.8,
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00003.html"
},
{
"title": "PHP 5.4.3 and PHP 5.3.13 Released!",
"trust": 0.8,
"url": "http://www.php.net/archive/2012.php#id2012-05-08-1"
},
{
"title": "PHP 5 ChangeLog - Version 5.4.3",
"trust": 0.8,
"url": "http://www.php.net/ChangeLog-5.php#5.4.3"
},
{
"title": "PHP 5.4.3",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=43186"
},
{
"title": "PHP 5.4.3",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=43185"
}
],
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201205-209"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002395"
}
]
},
"problemtype_data": {
"_id": null,
"data": [
{
"problemtype": "CWE-20",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-002395"
},
{
"db": "NVD",
"id": "CVE-2012-2336"
}
]
},
"references": {
"_id": null,
"data": [
{
"trust": 2.2,
"url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c03839862"
},
{
"trust": 1.7,
"url": "https://bugs.php.net/bug.php?id=61910"
},
{
"trust": 1.6,
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00004.html"
},
{
"trust": 1.6,
"url": "http://www.php.net/archive/2012.php#id2012-05-08-1"
},
{
"trust": 1.6,
"url": "https://bugs.php.net/patch-display.php?bug_id=61910\u0026patch=cve-2012-1823.patch\u0026revision=1336251592\u0026display=1"
},
{
"trust": 1.6,
"url": "http://www.php.net/changelog-5.php#5.4.3"
},
{
"trust": 1.6,
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00003.html"
},
{
"trust": 1.6,
"url": "http://secunia.com/advisories/49014"
},
{
"trust": 1.1,
"url": "http://www.kb.cert.org/vuls/id/520827"
},
{
"trust": 0.9,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-2336"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnvu520827/index.html"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-2336"
},
{
"trust": 0.7,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2336"
},
{
"trust": 0.6,
"url": "https://access.redhat.com/errata/rhsa-2012:1047"
},
{
"trust": 0.6,
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=820708"
},
{
"trust": 0.6,
"url": "https://access.redhat.com/errata/rhsa-2012:1045"
},
{
"trust": 0.6,
"url": "https://access.redhat.com/errata/rhsa-2012:1046"
},
{
"trust": 0.6,
"url": "https://access.redhat.com/security/cve/cve-2012-2336"
},
{
"trust": 0.4,
"url": "http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2335"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-1172"
},
{
"trust": 0.3,
"url": "http://alerts.hp.com/r?2.1.3kt.2zr.xg7ek.hmj%2asm..t.a4jy.6o9k.bw89mq%5f%5fdmtsfto0"
},
{
"trust": 0.3,
"url": "http://www-01.ibm.com/software/lotus/products/foundations/start/"
},
{
"trust": 0.3,
"url": "http://kb.parallels.com/en/113818"
},
{
"trust": 0.3,
"url": "kb.parallels.com/en/116241"
},
{
"trust": 0.3,
"url": "https://community.rapid7.com/thread/5174"
},
{
"trust": 0.3,
"url": "http://www.php.net/"
},
{
"trust": 0.3,
"url": "http://seclists.org/fulldisclosure/2013/jun/21"
},
{
"trust": 0.3,
"url": "http://ompldr.org/vzgxxaq"
},
{
"trust": 0.3,
"url": "http://kb.juniper.net/infocenter/index?page=content\u0026id=jsa10658\u0026cat=sirt_1\u0026actp=list"
},
{
"trust": 0.3,
"url": "https://downloads.avaya.com/css/p8/documents/100162699"
},
{
"trust": 0.3,
"url": "https://downloads.avaya.com/css/p8/documents/100165255"
},
{
"trust": 0.3,
"url": "http://www.h-online.com/security/news/item/critical-open-hole-in-php-creates-risks-update-1567532.html"
},
{
"trust": 0.3,
"url": "http://h20000.www2.hp.com/bizsupport/techsupport/document.jsp?objectid=c03360041"
},
{
"trust": 0.3,
"url": "http://www.php.net/archive/2012.php#id2012-05-03-1"
},
{
"trust": 0.3,
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21620314"
},
{
"trust": 0.3,
"url": "http://www.turbolinux.co.jp/security-e/2012/tlsa-2012-14.txt"
},
{
"trust": 0.3,
"url": "http://www.kb.cert.org/vuls/id/673343"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0057"
},
{
"trust": 0.3,
"url": "https://www.redhat.com/security/data/cve/cve-2012-0057.html"
},
{
"trust": 0.3,
"url": "https://www.redhat.com/security/data/cve/cve-2012-2336.html"
},
{
"trust": 0.3,
"url": "https://www.redhat.com/security/data/cve/cve-2011-4153.html"
},
{
"trust": 0.3,
"url": "https://www.redhat.com/security/data/cve/cve-2012-1172.html"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2143"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/security/team/contact/"
},
{
"trust": 0.3,
"url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-4153"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2386"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/knowledge/articles/11258"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0789"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/security/team/key/#package"
},
{
"trust": 0.3,
"url": "https://www.redhat.com/security/data/cve/cve-2012-0789.html"
},
{
"trust": 0.3,
"url": "http://bugzilla.redhat.com/):"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2358"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2357"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2362"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2361"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2364"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2363"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2359"
},
{
"trust": 0.2,
"url": "http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2329"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-5217"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-3389"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2311"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2356"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2110"
},
{
"trust": 0.2,
"url": "http://h18013.www1.hp.com/products/servers/management/agents/index.html"
},
{
"trust": 0.2,
"url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/"
},
{
"trust": 0.2,
"url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secbullarchive/"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0883"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2355"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2360"
},
{
"trust": 0.2,
"url": "https://www.redhat.com/security/data/cve/cve-2012-2143.html"
},
{
"trust": 0.2,
"url": "https://www.redhat.com/security/data/cve/cve-2010-2950.html"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0781"
},
{
"trust": 0.2,
"url": "https://rhn.redhat.com/errata/rhsa-2012-0546.html"
},
{
"trust": 0.2,
"url": "https://www.redhat.com/security/data/cve/cve-2012-2386.html"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-2950"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-4821"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2012-0781.html"
},
{
"trust": 0.1,
"url": "https://rhn.redhat.com/errata/rhsa-2012-1046.html"
},
{
"trust": 0.1,
"url": "https://rhn.redhat.com/errata/rhsa-2012-0547.html"
},
{
"trust": 0.1,
"url": "https://rhn.redhat.com/errata/rhsa-2012-1047.html"
},
{
"trust": 0.1,
"url": "https://rhn.redhat.com/errata/rhsa-2012-1045.html"
},
{
"trust": 0.1,
"url": "http://www.mandriva.com/security/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-1823"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-1823"
},
{
"trust": 0.1,
"url": "http://www.openwall.com/lists/oss-security/2012/05/09/9"
},
{
"trust": 0.1,
"url": "http://secunia.com/"
},
{
"trust": 0.1,
"url": "http://www.mandriva.com/security/advisories"
},
{
"trust": 0.1,
"url": "http://lists.grok.org.uk/full-disclosure-charter.html"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-2335"
},
{
"trust": 0.1,
"url": "http://www.ubuntu.com/usn/usn-1481-1"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/php5/5.3.5-1ubuntu7.10"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/php5/5.3.10-1ubuntu3.2"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/php5/5.3.6-13ubuntu3.8"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/php5/5.3.2-1ubuntu4.17"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/php5/5.2.4-2ubuntu5.25"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2317"
}
],
"sources": [
{
"db": "BID",
"id": "53388"
},
{
"db": "PACKETSTORM",
"id": "123310"
},
{
"db": "PACKETSTORM",
"id": "114261"
},
{
"db": "PACKETSTORM",
"id": "114259"
},
{
"db": "PACKETSTORM",
"id": "114260"
},
{
"db": "PACKETSTORM",
"id": "112597"
},
{
"db": "PACKETSTORM",
"id": "113885"
},
{
"db": "PACKETSTORM",
"id": "122482"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-209"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002395"
},
{
"db": "NVD",
"id": "CVE-2012-2336"
}
]
},
"sources": {
"_id": null,
"data": [
{
"db": "BID",
"id": "53388",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "123310",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "114261",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "114259",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "114260",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "112597",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "113885",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "122482",
"ident": null
},
{
"db": "CNNVD",
"id": "CNNVD-201205-209",
"ident": null
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002395",
"ident": null
},
{
"db": "NVD",
"id": "CVE-2012-2336",
"ident": null
}
]
},
"sources_release_date": {
"_id": null,
"data": [
{
"date": "2012-05-04T00:00:00",
"db": "BID",
"id": "53388",
"ident": null
},
{
"date": "2013-09-19T22:22:00",
"db": "PACKETSTORM",
"id": "123310",
"ident": null
},
{
"date": "2012-06-28T03:31:36",
"db": "PACKETSTORM",
"id": "114261",
"ident": null
},
{
"date": "2012-06-28T03:31:01",
"db": "PACKETSTORM",
"id": "114259",
"ident": null
},
{
"date": "2012-06-28T03:31:24",
"db": "PACKETSTORM",
"id": "114260",
"ident": null
},
{
"date": "2012-05-10T15:26:54",
"db": "PACKETSTORM",
"id": "112597",
"ident": null
},
{
"date": "2012-06-20T02:58:04",
"db": "PACKETSTORM",
"id": "113885",
"ident": null
},
{
"date": "2013-07-19T19:33:00",
"db": "PACKETSTORM",
"id": "122482",
"ident": null
},
{
"date": "2012-05-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201205-209",
"ident": null
},
{
"date": "2012-05-14T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-002395",
"ident": null
},
{
"date": "2012-05-11T10:15:48.527000",
"db": "NVD",
"id": "CVE-2012-2336",
"ident": null
}
]
},
"sources_update_date": {
"_id": null,
"data": [
{
"date": "2015-04-13T22:15:00",
"db": "BID",
"id": "53388",
"ident": null
},
{
"date": "2023-04-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201205-209",
"ident": null
},
{
"date": "2012-07-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-002395",
"ident": null
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2012-2336",
"ident": null
}
]
},
"threat_type": {
"_id": null,
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "114261"
},
{
"db": "PACKETSTORM",
"id": "114259"
},
{
"db": "PACKETSTORM",
"id": "114260"
},
{
"db": "PACKETSTORM",
"id": "112597"
},
{
"db": "PACKETSTORM",
"id": "113885"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-209"
}
],
"trust": 1.1
},
"title": {
"_id": null,
"data": "PHP of sapi/cgi/cgi_main.c Service disruption in ( Resource consumption ) Vulnerabilities",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-002395"
}
],
"trust": 0.8
},
"type": {
"_id": null,
"data": "arbitrary",
"sources": [
{
"db": "PACKETSTORM",
"id": "123310"
},
{
"db": "PACKETSTORM",
"id": "114261"
},
{
"db": "PACKETSTORM",
"id": "114259"
},
{
"db": "PACKETSTORM",
"id": "114260"
},
{
"db": "PACKETSTORM",
"id": "112597"
},
{
"db": "PACKETSTORM",
"id": "122482"
}
],
"trust": 0.6
}
}
VAR-201205-0305
Vulnerability from variot - Updated: 2026-03-09 21:23sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case. Parallels Plesk Panel versions 9.0 - 9.2.3 on Linux platforms are vulnerable to remote code execution. PHP is prone to an information-disclosure vulnerability. Exploiting this issue allows remote attackers to view the source code of files in the context of the server process. This may allow the attacker to obtain sensitive information and to run arbitrary PHP code on the affected computer; other attacks are also possible. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201209-03
http://security.gentoo.org/
Severity: High Title: PHP: Multiple vulnerabilities Date: September 24, 2012 Bugs: #384301, #396311, #396533, #399247, #399567, #399573, #401997, #410957, #414553, #421489, #427354, #429630 ID: 201209-03
Synopsis
Multiple vulnerabilities were found in PHP, the worst of which lead to remote execution of arbitrary code.
Background
PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML.
Affected packages
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 dev-lang/php < 5.3.15 >= 5.3.15 < 5.4.5 >= 5.4.5 ------------------------------------------------------------------- # Package 1 only applies to users of these architectures: arm
Description
Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details.
Workaround
There is no known workaround at this time.
Resolution
All PHP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-5.3.15"
All PHP users on ARM should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-5.4.5"
References
[ 1 ] CVE-2011-1398 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1398 [ 2 ] CVE-2011-3379 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3379 [ 3 ] CVE-2011-4566 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4566 [ 4 ] CVE-2011-4885 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4885 [ 5 ] CVE-2012-0057 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0057 [ 6 ] CVE-2012-0788 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0788 [ 7 ] CVE-2012-0789 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0789 [ 8 ] CVE-2012-0830 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0830 [ 9 ] CVE-2012-0831 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0831 [ 10 ] CVE-2012-1172 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1172 [ 11 ] CVE-2012-1823 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1823 [ 12 ] CVE-2012-2143 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2143 [ 13 ] CVE-2012-2311 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2311 [ 14 ] CVE-2012-2335 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2335 [ 15 ] CVE-2012-2336 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2336 [ 16 ] CVE-2012-2386 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2386 [ 17 ] CVE-2012-2688 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2688 [ 18 ] CVE-2012-3365 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3365 [ 19 ] CVE-2012-3450 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3450
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201209-03.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2012 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5 . HP System Management Homepage (SMH) before v7.1.1 running on Linux, Windows and VMware ESX.
Additionally, this update fixes insufficient validation of upload name which lead to corrupted $_FILES indices.
For the stable distribution (squeeze), this problem has been fixed in version 5.3.3-7+squeeze9.
The testing distribution (wheezy) will be fixed soon.
For the unstable distribution (sid), this problem has been fixed in version 5.4.3-1.
We recommend that you upgrade your php5 packages. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . ----------------------------------------------------------------------
Become a PSI 3.0 beta tester! Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. Download it here! http://secunia.com/psi_30_beta_launch
TITLE: Debian update for php5
SECUNIA ADVISORY ID: SA49053
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/49053/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=49053
RELEASE DATE: 2012-05-10
DISCUSS ADVISORY: http://secunia.com/advisories/49053/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/49053/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=49053
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Debian has issued an update for php5. This fixes a vulnerability, which can be exploited by malicious people to disclose certain sensitive information or compromise a vulnerable system.
For more information see vulnerability #1 in: SA49014
SOLUTION: Apply updated packages via the apt-get package manager.
ORIGINAL ADVISORY: DSA-2465-1: http://www.debian.org/security/2012/dsa-2465
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Note: the current version of the following document is available here: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c03368475
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c03368475 Version: 2
HPSBUX02791 SSRT100856 rev.2 - HP-UX Apache Web Server running PHP, Remote Execution of Arbitrary Code, Privilege Elevation, Denial of Service (DoS)
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2012-06-14 Last Updated: 2012-08-22
Potential Security Impact: Remote execution of arbitrary code, privilege elevation, or Denial of Service (DoS).
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY Potential security vulnerabilities have been identified with HP-UX Apache Web Server running PHP. These vulnerabilities could be exploited remotely to execute arbitrary code, elevate privileges, or create a Denial of Service (DoS).
References: CVE-2011-4153, CVE-2012-0830, CVE-2012-0883, CVE-2012-1172, CVE-2012-1823, CVE-2012-2311
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP-UX B.11.23, B.11.31 running HP-UX Apache Web Server Suite v3.24 or earlier
HP-UX B.11.11 running HP-UX Apache Web Server Suite v2.35 or earlier
BACKGROUND
CVSS 2.0 Base Metrics
Reference Base Vector Base Score CVE-2011-4153 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0 CVE-2012-0830 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5 CVE-2012-0883 (AV:L/AC:M/Au:N/C:C/I:C/A:C) 6.9 CVE-2012-1172 (AV:N/AC:M/Au:N/C:N/I:P/A:P) 5.8 CVE-2012-1823 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5 CVE-2012-2311 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002
RESOLUTION
HP has provided the following software updates to resolve the vulnerabilities. The updates are available for download from http://software.hp.com
HP-UX Web Server Suite v3.24 containing Apache v2.2.15.13 and PHP v5.2.17 HP-UX 11i Release / Apache Depot name B.11.23 (32-bit) / HPUXWS22ATW-B324-32 B.11.23 (64-bit) / HPUXWS22ATW-B324-64 B.11.31 (32-bit) / HPUXWS22ATW-B324-32 B.11.31 (64-bit) / HPUXWS22ATW-B324-64
HP-UX Web Server Suite v2.36 containing Apache v2.0.64.04 and PHP v5.2.17 HP-UX 11i Release / Apache Depot Name B.11.11 (32-bit) / HPUXWSATW-B236-1111
MANUAL ACTIONS: Yes - Update Install HP-UX Web Server Suite v3.24 or subsequent
Install HP-UX Web Server Suite v2.36 or subsequent
PRODUCT SPECIFIC INFORMATION
HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HP and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see https://www.hp.com/go/swa
The following text is for use by the HP-UX Software Assistant.
AFFECTED VERSIONS HP-UX B.11.11
============== hpuxwsAPACHE.APACHE hpuxwsAPACHE.APACHE2 hpuxwsAPACHE.AUTH_LDAP hpuxwsAPACHE.AUTH_LDAP2 hpuxwsAPACHE.MOD_JK hpuxwsAPACHE.MOD_JK2 hpuxwsAPACHE.MOD_PERL hpuxwsAPACHE.MOD_PERL2 hpuxwsAPACHE.PHP hpuxwsAPACHE.PHP2 hpuxwsAPACHE.WEBPROXY action: install revision B.2.0.64.04 or subsequent
HP-UX B.11.23
hpuxws22APCH32.APACHE hpuxws22APCH32.APACHE2 hpuxws22APCH32.AUTH_LDAP hpuxws22APCH32.AUTH_LDAP2 hpuxws22APCH32.MOD_JK hpuxws22APCH32.MOD_JK2 hpuxws22APCH32.MOD_PERL hpuxws22APCH32.MOD_PERL2 hpuxws22APCH32.PHP hpuxws22APCH32.PHP2 hpuxws22APCH32.WEBPROXY hpuxws22APCH32.WEBPROXY2 hpuxws22APACHE.APACHE hpuxws22APACHE.APACHE2 hpuxws22APACHE.AUTH_LDAP hpuxws22APACHE.AUTH_LDAP2 hpuxws22APACHE.MOD_JK hpuxws22APACHE.MOD_JK2 hpuxws22APACHE.MOD_PERL hpuxws22APACHE.MOD_PERL2 hpuxws22APACHE.PHP hpuxws22APACHE.PHP2 hpuxws22APACHE.WEBPROXY hpuxws22APACHE.WEBPROXY2 action: install revision B.2.2.15.13 or subsequent
HP-UX B.11.31
hpuxws22APCH32.APACHE hpuxws22APCH32.APACHE2 hpuxws22APCH32.AUTH_LDAP hpuxws22APCH32.AUTH_LDAP2 hpuxws22APCH32.MOD_JK hpuxws22APCH32.MOD_JK2 hpuxws22APCH32.MOD_PERL hpuxws22APCH32.MOD_PERL2 hpuxws22APCH32.PHP hpuxws22APCH32.PHP2 hpuxws22APCH32.WEBPROXY hpuxws22APCH32.WEBPROXY2 hpuxws22APACHE.APACHE hpuxws22APACHE.APACHE2 hpuxws22APACHE.AUTH_LDAP hpuxws22APACHE.AUTH_LDAP2 hpuxws22APACHE.MOD_JK hpuxws22APACHE.MOD_JK2 hpuxws22APACHE.MOD_PERL hpuxws22APACHE.MOD_PERL2 hpuxws22APACHE.PHP hpuxws22APACHE.PHP2 hpuxws22APACHE.WEBPROXY hpuxws22APACHE.WEBPROXY2
action: install revision B.2.2.15.13 or subsequent
END AFFECTED VERSIONS
HISTORY Version:1 (rev.1) - 14 June 2012 Initial release Version:2 (rev.2) - 22 August 2012 B.11.11 content added for B.2.0.64.04
Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com
Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins
Security Bulletin List: A list of HP Security Bulletins, updated periodically, is contained in HP Security Notice HPSN-2011-001: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c02964430
Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://h20566.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/
Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB.
3C = 3COM 3P = 3rd Party Software GN = HP General Software HF = HP Hardware and Firmware MP = MPE/iX MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PI = Printing and Imaging PV = ProCurve ST = Storage Software TU = Tru64 UNIX UX = HP-UX
Copyright 2012 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
===================================================================== Red Hat Security Advisory
Synopsis: Critical: php53 security update Advisory ID: RHSA-2012:0547-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-0547.html Issue date: 2012-05-07 CVE Names: CVE-2012-1823 =====================================================================
- Summary:
Updated php53 packages that fix one security issue are now available for Red Hat Enterprise Linux 5.
The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
- Relevant releases/architectures:
RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64
- Description:
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.
A flaw was found in the way the php-cgi executable processed command line arguments when running in CGI mode. A remote attacker could send a specially-crafted request to a PHP script that would result in the query string being parsed by php-cgi as command line options and arguments. (CVE-2012-1823)
Red Hat is aware that a public exploit for this issue is available that allows remote code execution in affected PHP CGI configurations. This flaw does not affect the default configuration using the PHP module for Apache httpd to handle PHP scripts.
All php53 users should upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
- Solution:
Before applying this update, make sure all previously-released errata relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258
- Bugs fixed (http://bugzilla.redhat.com/):
818607 - CVE-2012-1823 php: command line arguments injection when run in CGI mode (VU#520827)
- Package List:
RHEL Desktop Workstation (v. 5 client):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/php53-5.3.3-7.el5_8.src.rpm
i386: php53-5.3.3-7.el5_8.i386.rpm php53-bcmath-5.3.3-7.el5_8.i386.rpm php53-cli-5.3.3-7.el5_8.i386.rpm php53-common-5.3.3-7.el5_8.i386.rpm php53-dba-5.3.3-7.el5_8.i386.rpm php53-debuginfo-5.3.3-7.el5_8.i386.rpm php53-devel-5.3.3-7.el5_8.i386.rpm php53-gd-5.3.3-7.el5_8.i386.rpm php53-imap-5.3.3-7.el5_8.i386.rpm php53-intl-5.3.3-7.el5_8.i386.rpm php53-ldap-5.3.3-7.el5_8.i386.rpm php53-mbstring-5.3.3-7.el5_8.i386.rpm php53-mysql-5.3.3-7.el5_8.i386.rpm php53-odbc-5.3.3-7.el5_8.i386.rpm php53-pdo-5.3.3-7.el5_8.i386.rpm php53-pgsql-5.3.3-7.el5_8.i386.rpm php53-process-5.3.3-7.el5_8.i386.rpm php53-pspell-5.3.3-7.el5_8.i386.rpm php53-snmp-5.3.3-7.el5_8.i386.rpm php53-soap-5.3.3-7.el5_8.i386.rpm php53-xml-5.3.3-7.el5_8.i386.rpm php53-xmlrpc-5.3.3-7.el5_8.i386.rpm
x86_64: php53-5.3.3-7.el5_8.x86_64.rpm php53-bcmath-5.3.3-7.el5_8.x86_64.rpm php53-cli-5.3.3-7.el5_8.x86_64.rpm php53-common-5.3.3-7.el5_8.x86_64.rpm php53-dba-5.3.3-7.el5_8.x86_64.rpm php53-debuginfo-5.3.3-7.el5_8.x86_64.rpm php53-devel-5.3.3-7.el5_8.x86_64.rpm php53-gd-5.3.3-7.el5_8.x86_64.rpm php53-imap-5.3.3-7.el5_8.x86_64.rpm php53-intl-5.3.3-7.el5_8.x86_64.rpm php53-ldap-5.3.3-7.el5_8.x86_64.rpm php53-mbstring-5.3.3-7.el5_8.x86_64.rpm php53-mysql-5.3.3-7.el5_8.x86_64.rpm php53-odbc-5.3.3-7.el5_8.x86_64.rpm php53-pdo-5.3.3-7.el5_8.x86_64.rpm php53-pgsql-5.3.3-7.el5_8.x86_64.rpm php53-process-5.3.3-7.el5_8.x86_64.rpm php53-pspell-5.3.3-7.el5_8.x86_64.rpm php53-snmp-5.3.3-7.el5_8.x86_64.rpm php53-soap-5.3.3-7.el5_8.x86_64.rpm php53-xml-5.3.3-7.el5_8.x86_64.rpm php53-xmlrpc-5.3.3-7.el5_8.x86_64.rpm
Red Hat Enterprise Linux (v. 5 server):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/php53-5.3.3-7.el5_8.src.rpm
i386: php53-5.3.3-7.el5_8.i386.rpm php53-bcmath-5.3.3-7.el5_8.i386.rpm php53-cli-5.3.3-7.el5_8.i386.rpm php53-common-5.3.3-7.el5_8.i386.rpm php53-dba-5.3.3-7.el5_8.i386.rpm php53-debuginfo-5.3.3-7.el5_8.i386.rpm php53-devel-5.3.3-7.el5_8.i386.rpm php53-gd-5.3.3-7.el5_8.i386.rpm php53-imap-5.3.3-7.el5_8.i386.rpm php53-intl-5.3.3-7.el5_8.i386.rpm php53-ldap-5.3.3-7.el5_8.i386.rpm php53-mbstring-5.3.3-7.el5_8.i386.rpm php53-mysql-5.3.3-7.el5_8.i386.rpm php53-odbc-5.3.3-7.el5_8.i386.rpm php53-pdo-5.3.3-7.el5_8.i386.rpm php53-pgsql-5.3.3-7.el5_8.i386.rpm php53-process-5.3.3-7.el5_8.i386.rpm php53-pspell-5.3.3-7.el5_8.i386.rpm php53-snmp-5.3.3-7.el5_8.i386.rpm php53-soap-5.3.3-7.el5_8.i386.rpm php53-xml-5.3.3-7.el5_8.i386.rpm php53-xmlrpc-5.3.3-7.el5_8.i386.rpm
ia64: php53-5.3.3-7.el5_8.ia64.rpm php53-bcmath-5.3.3-7.el5_8.ia64.rpm php53-cli-5.3.3-7.el5_8.ia64.rpm php53-common-5.3.3-7.el5_8.ia64.rpm php53-dba-5.3.3-7.el5_8.ia64.rpm php53-debuginfo-5.3.3-7.el5_8.ia64.rpm php53-devel-5.3.3-7.el5_8.ia64.rpm php53-gd-5.3.3-7.el5_8.ia64.rpm php53-imap-5.3.3-7.el5_8.ia64.rpm php53-intl-5.3.3-7.el5_8.ia64.rpm php53-ldap-5.3.3-7.el5_8.ia64.rpm php53-mbstring-5.3.3-7.el5_8.ia64.rpm php53-mysql-5.3.3-7.el5_8.ia64.rpm php53-odbc-5.3.3-7.el5_8.ia64.rpm php53-pdo-5.3.3-7.el5_8.ia64.rpm php53-pgsql-5.3.3-7.el5_8.ia64.rpm php53-process-5.3.3-7.el5_8.ia64.rpm php53-pspell-5.3.3-7.el5_8.ia64.rpm php53-snmp-5.3.3-7.el5_8.ia64.rpm php53-soap-5.3.3-7.el5_8.ia64.rpm php53-xml-5.3.3-7.el5_8.ia64.rpm php53-xmlrpc-5.3.3-7.el5_8.ia64.rpm
ppc: php53-5.3.3-7.el5_8.ppc.rpm php53-bcmath-5.3.3-7.el5_8.ppc.rpm php53-cli-5.3.3-7.el5_8.ppc.rpm php53-common-5.3.3-7.el5_8.ppc.rpm php53-dba-5.3.3-7.el5_8.ppc.rpm php53-debuginfo-5.3.3-7.el5_8.ppc.rpm php53-devel-5.3.3-7.el5_8.ppc.rpm php53-gd-5.3.3-7.el5_8.ppc.rpm php53-imap-5.3.3-7.el5_8.ppc.rpm php53-intl-5.3.3-7.el5_8.ppc.rpm php53-ldap-5.3.3-7.el5_8.ppc.rpm php53-mbstring-5.3.3-7.el5_8.ppc.rpm php53-mysql-5.3.3-7.el5_8.ppc.rpm php53-odbc-5.3.3-7.el5_8.ppc.rpm php53-pdo-5.3.3-7.el5_8.ppc.rpm php53-pgsql-5.3.3-7.el5_8.ppc.rpm php53-process-5.3.3-7.el5_8.ppc.rpm php53-pspell-5.3.3-7.el5_8.ppc.rpm php53-snmp-5.3.3-7.el5_8.ppc.rpm php53-soap-5.3.3-7.el5_8.ppc.rpm php53-xml-5.3.3-7.el5_8.ppc.rpm php53-xmlrpc-5.3.3-7.el5_8.ppc.rpm
s390x: php53-5.3.3-7.el5_8.s390x.rpm php53-bcmath-5.3.3-7.el5_8.s390x.rpm php53-cli-5.3.3-7.el5_8.s390x.rpm php53-common-5.3.3-7.el5_8.s390x.rpm php53-dba-5.3.3-7.el5_8.s390x.rpm php53-debuginfo-5.3.3-7.el5_8.s390x.rpm php53-devel-5.3.3-7.el5_8.s390x.rpm php53-gd-5.3.3-7.el5_8.s390x.rpm php53-imap-5.3.3-7.el5_8.s390x.rpm php53-intl-5.3.3-7.el5_8.s390x.rpm php53-ldap-5.3.3-7.el5_8.s390x.rpm php53-mbstring-5.3.3-7.el5_8.s390x.rpm php53-mysql-5.3.3-7.el5_8.s390x.rpm php53-odbc-5.3.3-7.el5_8.s390x.rpm php53-pdo-5.3.3-7.el5_8.s390x.rpm php53-pgsql-5.3.3-7.el5_8.s390x.rpm php53-process-5.3.3-7.el5_8.s390x.rpm php53-pspell-5.3.3-7.el5_8.s390x.rpm php53-snmp-5.3.3-7.el5_8.s390x.rpm php53-soap-5.3.3-7.el5_8.s390x.rpm php53-xml-5.3.3-7.el5_8.s390x.rpm php53-xmlrpc-5.3.3-7.el5_8.s390x.rpm
x86_64: php53-5.3.3-7.el5_8.x86_64.rpm php53-bcmath-5.3.3-7.el5_8.x86_64.rpm php53-cli-5.3.3-7.el5_8.x86_64.rpm php53-common-5.3.3-7.el5_8.x86_64.rpm php53-dba-5.3.3-7.el5_8.x86_64.rpm php53-debuginfo-5.3.3-7.el5_8.x86_64.rpm php53-devel-5.3.3-7.el5_8.x86_64.rpm php53-gd-5.3.3-7.el5_8.x86_64.rpm php53-imap-5.3.3-7.el5_8.x86_64.rpm php53-intl-5.3.3-7.el5_8.x86_64.rpm php53-ldap-5.3.3-7.el5_8.x86_64.rpm php53-mbstring-5.3.3-7.el5_8.x86_64.rpm php53-mysql-5.3.3-7.el5_8.x86_64.rpm php53-odbc-5.3.3-7.el5_8.x86_64.rpm php53-pdo-5.3.3-7.el5_8.x86_64.rpm php53-pgsql-5.3.3-7.el5_8.x86_64.rpm php53-process-5.3.3-7.el5_8.x86_64.rpm php53-pspell-5.3.3-7.el5_8.x86_64.rpm php53-snmp-5.3.3-7.el5_8.x86_64.rpm php53-soap-5.3.3-7.el5_8.x86_64.rpm php53-xml-5.3.3-7.el5_8.x86_64.rpm php53-xmlrpc-5.3.3-7.el5_8.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package
- References:
https://www.redhat.com/security/data/cve/CVE-2012-1823.html https://access.redhat.com/security/updates/classification/#critical
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2012 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux)
iD4DBQFPqBjQXlSAg2UNWIIRAsGqAJjy9MAGgtGKsuasY7QYQjdFM5yiAJ4xwgNF 6mLuYoKOaLGGEiAy1FU0OQ== =G9Kt -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
APPLE-SA-2012-09-19-2 OS X Mountain Lion v10.8.2, OS X Lion v10.7.5 and Security Update 2012-004
OS X Mountain Lion v10.8.2, OS X Lion v10.7.5 and Security Update 2012-004 are now available and address the following:
Apache Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Multiple vulnerabilities in Apache Description: Apache is updated to version 2.2.22 to address several vulnerabilities, the most serious of which may lead to a denial of service. Further information is available via the Apache web site at http://httpd.apache.org/. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2011-3368 CVE-2011-3607 CVE-2011-4317 CVE-2012-0021 CVE-2012-0031 CVE-2012-0053
BIND Available for: OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: A remote attacker may be able to cause a denial of service in systems configured to run BIND as a DNS nameserver Description: A reachable assertion issue existed in the handling of DNS records. This issue was addressed by updating to BIND 9.7.6-P1. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2011-4313
BIND Available for: OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4, OS X Mountain Lion v10.8 and v10.8.1 Impact: A remote attacker may be able to cause a denial of service, data corruption, or obtain sensitive information from process memory in systems configured to run BIND as a DNS nameserver Description: A memory management issue existed in the handling of DNS records. This issue was addressed by updating to BIND 9.7.6-P1 on OS X Lion systems, and BIND 9.8.3-P1 on OS X Mountain Lion systems. CVE-ID CVE-2012-1667
CoreText Available for: OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Applications that use CoreText may be vulnerable to an unexpected application termination or arbitrary code execution Description: A bounds checking issue existed in the handling of text glyphs, which may lead to out of bounds memory reads or writes. This issue was addressed through improved bounds checking. This issue does not affect Mac OS X v10.6 or OS X Mountain Lion systems. CVE-ID CVE-2012-3716 : Jesse Ruderman of Mozilla Corporation
Data Security Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4, OS X Mountain Lion v10.8 and v10.8.1 Impact: An attacker with a privileged network position may intercept user credentials or other sensitive information Description: TrustWave, a trusted root CA, has issued, and subsequently revoked, a sub-CA certificate from one of its trusted anchors. This sub-CA facilitated the interception of communications secured by Transport Layer Security (TLS). This update adds the involved sub-CA certificate to OS X's list of untrusted certificates.
DirectoryService Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8 Impact: If the DirectoryService Proxy is used, a remote attacker may cause a denial of service or arbitrary code execution Description: A buffer overflow existed in the DirectoryService Proxy. This issue was addressed through improved bounds checking. This issue does not affect OS X Lion and Mountain Lion systems. CVE-ID CVE-2012-0650 : aazubel working with HP's Zero Day Initiative
ImageIO Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Viewing a maliciously crafted PNG image may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in libpng's handling of PNG images. These issues were addressed through improved validation of PNG images. These issues do not affect OS X Mountain Lion systems. CVE-ID CVE-2011-3026 : Juri Aedla CVE-2011-3048
ImageIO Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution Description: An integer overflow issue existed in libTIFF's handling of TIFF images. This issue was addressed through improved validation of TIFF images. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2012-1173 : Alexander Gavrun working with HP's Zero Day Initiative
Installer Available for: OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Remote admins and persons with physical access to the system may obtain account information Description: The fix for CVE-2012-0652 in OS X Lion 10.7.4 prevented user passwords from being recorded in the system log, but did not remove the old log entries. This issue was addressed by deleting log files that contained passwords. This issue does not affect Mac OS X 10.6 or OS X Mountain Lion systems. CVE-ID CVE-2012-0652
International Components for Unicode Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Applications that use ICU may be vulnerable to an unexpected application termination or arbitrary code execution Description: A stack buffer overflow existed in the handling of ICU locale IDs. This issue was addressed through improved bounds checking. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2011-4599
Kernel Available for: OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: A malicious program could bypass sandbox restrictions Description: A logic issue existed in the handling of debug system calls. This may allow a malicious program to gain code execution in other programs with the same user privileges. This issue was addressed by disabling handling of addresses in PT_STEP and PT_CONTINUE. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2012-0643 : iOS Jailbreak Dream Team
LoginWindow Available for: OS X Mountain Lion v10.8 and v10.8.1 Impact: A local user may be able to obtain other user's login passwords Description: A user-installed input method could intercept password keystrokes from Login Window or Screen Saver Unlock. This issue was addressed by preventing user-installed methods from being used when the system is handling login information. CVE-ID CVE-2012-3718 : An anonymous researcher
Mail Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Viewing an e-mail message may lead to execution of web plugins Description: An input validation issue existed in Mail's handling of embedded web plugins. This issue was addressed by disabling third- party plug-ins in Mail. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2012-3719 : Will Dormann of the CERT/CC
Mobile Accounts Available for: OS X Mountain Lion v10.8 and v10.8.1 Impact: A user with access to the contents of a mobile account may obtain the account password Description: Creating a mobile account saved a hash of the password in the account, which was used to login when the mobile account was used as an external account. The password hash could be used to determine the user's password. This issue was addressed by creating the password hash only if external accounts are enabled on the system where the mobile account is created. CVE-ID CVE-2012-3720 : Harald Wagener of Google, Inc.
PHP Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4, OS X Mountain Lion v10.8 and v10.8.1 Impact: Multiple vulnerabilities in PHP Description: >PHP is updated to version 5.3.15 to address multiple vulnerabilities, the most serious of which may lead to arbitrary code execution. Further information is available via the PHP web site at http://www.php.net CVE-ID CVE-2012-0831 CVE-2012-1172 CVE-2012-1823 CVE-2012-2143 CVE-2012-2311 CVE-2012-2386 CVE-2012-2688
PHP Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: PHP scripts which use libpng may be vulnerable to an unexpected application termination or arbitrary code execution Description: A memory corruption issue existed in the handling of PNG files. This issue was addressed by updating PHP's copy of libpng to version 1.5.10. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2011-3048
Profile Manager Available for: OS X Lion Server v10.7 to v10.7.4 Impact: An unauthenticated user could enumerate managed devices Description: An authentication issue existed in the Device Management private interface. This issue was addressed by removing the interface. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2012-3721 : Derick Cassidy of XEquals Corporation
QuickLook Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Viewing a maliciously crafted .pict file may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue existed in the handling of .pict files. This issue was addressed through improved validation of .pict files. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2012-0671 : Rodrigo Rubira Branco (twitter.com/bsdaemon) from the Qualys Vulnerability & Malware Research Labs (VMRL)
QuickTime Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution Description: An integer overflow existed in QuickTime's handling of sean atoms. This issue was addressed through improved bounds checking. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2012-0670 : Tom Gallagher (Microsoft) and Paul Bates (Microsoft) working with HP's Zero Day Initiative
QuickTime Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution Description: An uninitialized memory access existed in the handling of Sorenson encoded movie files. This issue was addressed through improved memory initialization. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2012-3722 : Will Dormann of the CERT/CC
QuickTime Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow existed in the handling of RLE encoded movie files. This issue was addressed through improved bounds checking. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2012-0668 : Luigi Auriemma working with HP's Zero Day Initiative
Ruby Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: An attacker may be able to decrypt data protected by SSL Description: There are known attacks on the confidentiality of SSL 3.0 and TLS 1.0 when a cipher suite uses a block cipher in CBC mode. The Ruby OpenSSL module disabled the 'empty fragment' countermeasure which prevented these attacks. This issue was addressed by enabling empty fragments. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2011-3389
USB Available for: OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Attaching a USB device may lead to an unexpected system termination or arbitrary code execution Description: A memory corruption issue existed in the handling of USB hub descriptors. This issue was addressed through improved handling of the bNbrPorts descriptor field. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2012-3723 : Andy Davis of NGS Secure
Note: OS X Mountain Lion v10.8.2 includes the content of Safari 6.0.1. For further details see "About the security content of Safari 6.0.1" at http://http//support.apple.com/kb/HT5502
OS X Mountain Lion v10.8.2, OS X Lion v10.7.5 and Security Update 2012-004 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/
The Software Update utility will present the update that applies to your system configuration. Only one is needed, either OS X Mountain Lion v10.8.2, OS X Lion v10.7.5 or Security Update 2012-004.
For OS X Mountain Lion v10.8.1 The download file is named: OSXUpd10.8.2.dmg Its SHA-1 digest is: d6779e1cc748b78af0207499383b1859ffbebe33
For OS X Mountain Lion v10.8 The download file is named: OSXUpdCombo10.8.2.dmg Its SHA-1 digest is: b08f10233d362e39f20b69f91d1d73f5e7b68a2c
For OS X Lion v10.7.4 The download file is named: MacOSXUpd10.7.5.dmg Its SHA-1 digest is: e0a9582cce9896938a7a541bd431862d93893532
For OS X Lion v10.7 and v10.7.3 The download file is named: MacOSXUpdCombo10.7.5.dmg Its SHA-1 digest is: f7a26b164fa10dae4fe646e57b01c34a619c8d9b
For OS X Lion Server v10.7.4 The download file is named: MacOSXServerUpd10.7.5.dmg Its SHA-1 digest is: a891b03bfb4eecb745c0c39a32f39960fdb6796a
For OS X Lion Server v10.7 and v10.7.3 The download file is named: MacOSXServerUpdCombo10.7.5.dmg Its SHA-1 digest is: df6e1748ab0a3c9e05c890be49d514673efd965e
For Mac OS X v10.6.8 The download file is named: SecUpd2012-004.dmg Its SHA-1 digest is: 5b136e29a871d41012f0c6ea1362d6210c8b4fb7
For Mac OS X Server v10.6.8 The download file is named: SecUpdSrvr2012-004.dmg Its SHA-1 digest is: 9b24496be15078e58a88537700f2f39c112e3b28
Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJQWhlbAAoJEPefwLHPlZEwwjwQAKrpQlZh1B2mkSTLxR7QZg6e Qm7SmIZL9sjl5gQkTxoAvOGxJ8uRdYPlJ1IpyU/MbK0GqO53KmFSeKkwCnvLKMaW pc6tiFaQ4zV4LEAwBAFEuqCsMyPEJqKDhYXl2cHQmWfAlrLCyCKfzGLy2mY2UnkE DQC2+ys70DChFv2GzyXlibBXAGMKDygJ5dVKynsi1ceZLYWbUJoGwlUtXPylBpnO QyGWXmEloPbhK6HJbKMNacuDdVcb26pvIeFiivkTSxPVlZ3ns2tAwEyvHrzA9O4n 7rQ6jvfDbguOZmM5sPFvVKBw2GVDBNU+G3T8ouIXhk6Pjhr4in8VFCb8MIMLb8hm 7YYn2z1TzKTNmUuYbwe6ukQvf57cPuW0bAvslbl6PgrzqorlNPU4rDoSvPrJx/RO BOYkcxfirevHDGibfkeqXPjL3h+bVrb1USZpAv+ZOAy0M89SHFcvMtpAhxnoGiV5 w4EyKB+9Yi/CSAk2Ne3Y5kHH7/v3pWV68aJwhVirya7ex3vnJ+M+lRLKSm2BUjL3 +9fykrJBDujFDXoCmK5CN5Wx36DSVZ4VO1h635crotudtcvd+LQ2VHma/Chav5wK q5SSllf4KEownpx6o/qTxpg5tcC4lvgTcsDHlYcNq2s8KTTjmOden8ar4h7M7QD2 xyBfrQfG/dsif6jGHaot =8joH -----END PGP SIGNATURE----- . Content-Disposition: inline
==========================================================================Ubuntu Security Notice USN-1437-1 May 04, 2012
php5 vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS
- Ubuntu 8.04 LTS
Summary:
Standalone PHP CGI scripts could be made to execute arbitrary code with the privilege of the web server. Configurations using mod_php5 and FastCGI were not vulnerable. Please see http://people.canonical.com/~ubuntu-security/cve/2012/CVE-2012-2311.html for more details and potential mitigation approaches.
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 12.04 LTS: php5-cgi 5.3.10-1ubuntu3.1
Ubuntu 11.10: php5-cgi 5.3.6-13ubuntu3.7
Ubuntu 11.04: php5-cgi 5.3.5-1ubuntu7.8
Ubuntu 10.04 LTS: php5-cgi 5.3.2-1ubuntu4.15
Ubuntu 8.04 LTS: php5-cgi 5.2.4-2ubuntu5.24
In general, a standard system update will make all the necessary changes
Show details on source website{
"affected_products": {
"_id": null,
"data": [
{
"_id": null,
"model": "enterprise linux eus",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "6.2"
},
{
"_id": null,
"model": "enterprise linux server",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "5.0"
},
{
"_id": null,
"model": "hp-ux",
"scope": "eq",
"trust": 1.0,
"vendor": "hp",
"version": "b.11.23"
},
{
"_id": null,
"model": "application stack",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "2.0"
},
{
"_id": null,
"model": "mac os x",
"scope": "gte",
"trust": 1.0,
"vendor": "apple",
"version": "10.8.0"
},
{
"_id": null,
"model": "enterprise linux workstation",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "5.0"
},
{
"_id": null,
"model": "php",
"scope": "lt",
"trust": 1.0,
"vendor": "php",
"version": "5.3.12"
},
{
"_id": null,
"model": "opensuse",
"scope": "eq",
"trust": 1.0,
"vendor": "opensuse",
"version": "12.1"
},
{
"_id": null,
"model": "enterprise linux server",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "6.0"
},
{
"_id": null,
"model": "enterprise linux desktop",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "6.0"
},
{
"_id": null,
"model": "mac os x",
"scope": "gte",
"trust": 1.0,
"vendor": "apple",
"version": "10.6.8"
},
{
"_id": null,
"model": "enterprise linux server aus",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "5.3"
},
{
"_id": null,
"model": "linux enterprise software development kit",
"scope": "eq",
"trust": 1.0,
"vendor": "suse",
"version": "10"
},
{
"_id": null,
"model": "opensuse",
"scope": "eq",
"trust": 1.0,
"vendor": "opensuse",
"version": "11.4"
},
{
"_id": null,
"model": "hp-ux",
"scope": "eq",
"trust": 1.0,
"vendor": "hp",
"version": "b.11.31"
},
{
"_id": null,
"model": "enterprise linux workstation",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "6.0"
},
{
"_id": null,
"model": "enterprise linux server aus",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "5.6"
},
{
"_id": null,
"model": "storage for public cloud",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "2.0"
},
{
"_id": null,
"model": "linux enterprise software development kit",
"scope": "eq",
"trust": 1.0,
"vendor": "suse",
"version": "11"
},
{
"_id": null,
"model": "php",
"scope": "lt",
"trust": 1.0,
"vendor": "php",
"version": "5.4.2"
},
{
"_id": null,
"model": "linux enterprise server",
"scope": "eq",
"trust": 1.0,
"vendor": "suse",
"version": "10"
},
{
"_id": null,
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "mac os x",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "10.8.2"
},
{
"_id": null,
"model": "fedora",
"scope": "eq",
"trust": 1.0,
"vendor": "fedoraproject",
"version": "39"
},
{
"_id": null,
"model": "enterprise linux eus",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "5.6"
},
{
"_id": null,
"model": "fedora",
"scope": "eq",
"trust": 1.0,
"vendor": "fedoraproject",
"version": "40"
},
{
"_id": null,
"model": "enterprise linux eus",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "6.1"
},
{
"_id": null,
"model": "storage",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "2.0"
},
{
"_id": null,
"model": "php",
"scope": "gte",
"trust": 1.0,
"vendor": "php",
"version": "5.4.0"
},
{
"_id": null,
"model": "mac os x",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "10.7.5"
},
{
"_id": null,
"model": "linux enterprise server",
"scope": "eq",
"trust": 1.0,
"vendor": "suse",
"version": "11"
},
{
"_id": null,
"model": "gluster storage server for on-premise",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "2.0"
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "parallels holdings",
"version": null
},
{
"_id": null,
"model": "plesk panel",
"scope": "eq",
"trust": 0.3,
"vendor": "parallels",
"version": "9.5.4"
},
{
"_id": null,
"model": "linux i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.10"
},
{
"_id": null,
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.2"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 0.3,
"vendor": "php",
"version": "5.3.1"
},
{
"_id": null,
"model": "enterprise linux hpc node optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "7.2"
},
{
"_id": null,
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "linux ia-64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "ip office application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "8.1"
},
{
"_id": null,
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "6.2"
},
{
"_id": null,
"model": "voice portal sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0"
},
{
"_id": null,
"model": "enterprise linux server",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 0.3,
"vendor": "php",
"version": "5.3.8"
},
{
"_id": null,
"model": "linux enterprise sdk sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"_id": null,
"model": "voice portal",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.1"
},
{
"_id": null,
"model": "linux enterprise server sp3 ltss",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "10"
},
{
"_id": null,
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"_id": null,
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "5"
},
{
"_id": null,
"model": "enterprise linux server eus 6.1.z",
"scope": null,
"trust": 0.3,
"vendor": "redhat",
"version": null
},
{
"_id": null,
"model": "enterprise linux server optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "enterprise linux long life server",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "5.3"
},
{
"_id": null,
"model": "appliance server",
"scope": "eq",
"trust": 0.3,
"vendor": "turbolinux",
"version": "3.0"
},
{
"_id": null,
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2.3"
},
{
"_id": null,
"model": "enterprise server",
"scope": "eq",
"trust": 0.3,
"vendor": "mandrakesoft",
"version": "5"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 0.3,
"vendor": "php",
"version": "5.3.10"
},
{
"_id": null,
"model": "voice portal sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0"
},
{
"_id": null,
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7"
},
{
"_id": null,
"model": "ctpview",
"scope": "eq",
"trust": 0.3,
"vendor": "juniper",
"version": "4.6"
},
{
"_id": null,
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"_id": null,
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.10"
},
{
"_id": null,
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "7.0"
},
{
"_id": null,
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1.1"
},
{
"_id": null,
"model": "aura communication manager utility services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"_id": null,
"model": "linux lts amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"_id": null,
"model": "linux mandrake x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2011"
},
{
"_id": null,
"model": "enterprise linux workstation",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.8"
},
{
"_id": null,
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.5"
},
{
"_id": null,
"model": "linux lts powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"_id": null,
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"_id": null,
"model": "ctpview",
"scope": "eq",
"trust": 0.3,
"vendor": "juniper",
"version": "4.3"
},
{
"_id": null,
"model": "aura messaging",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0.1"
},
{
"_id": null,
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.3"
},
{
"_id": null,
"model": "linux enterprise sdk sp4",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "10"
},
{
"_id": null,
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.4"
},
{
"_id": null,
"model": "ctpview",
"scope": "eq",
"trust": 0.3,
"vendor": "juniper",
"version": "4.2"
},
{
"_id": null,
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.8"
},
{
"_id": null,
"model": "opensuse",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "11.4"
},
{
"_id": null,
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.04"
},
{
"_id": null,
"model": "enterprise linux workstation optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "voice portal",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.1.1"
},
{
"_id": null,
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.8.1"
},
{
"_id": null,
"model": "linux i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"_id": null,
"model": "aura communication manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"_id": null,
"model": "plesk panel",
"scope": "eq",
"trust": 0.3,
"vendor": "parallels",
"version": "9.3"
},
{
"_id": null,
"model": "linux lts sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"_id": null,
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "ctpview 7.0r1",
"scope": "ne",
"trust": 0.3,
"vendor": "juniper",
"version": null
},
{
"_id": null,
"model": "lotus foundations start 1.2.2b",
"scope": "ne",
"trust": 0.3,
"vendor": "ibm",
"version": null
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 0.3,
"vendor": "php",
"version": "5.3.9"
},
{
"_id": null,
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.1"
},
{
"_id": null,
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.1"
},
{
"_id": null,
"model": "aura messaging",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"_id": null,
"model": "linux lts i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"_id": null,
"model": "linux i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.04"
},
{
"_id": null,
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2.2"
},
{
"_id": null,
"model": "enterprise linux eus 5.6.z server",
"scope": null,
"trust": 0.3,
"vendor": "redhat",
"version": null
},
{
"_id": null,
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.2"
},
{
"_id": null,
"model": "system management homepage",
"scope": "ne",
"trust": 0.3,
"vendor": "hp",
"version": "7.2.1"
},
{
"_id": null,
"model": "linux enterprise server sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"_id": null,
"model": "aura session manager sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 0.3,
"vendor": "php",
"version": "5.4.2"
},
{
"_id": null,
"model": "linux enterprise server sp4",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "10"
},
{
"_id": null,
"model": "ip office application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"_id": null,
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "6"
},
{
"_id": null,
"model": "lotus foundations start 1.2.2a",
"scope": null,
"trust": 0.3,
"vendor": "ibm",
"version": null
},
{
"_id": null,
"model": "mac os",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.5"
},
{
"_id": null,
"model": "ctpview",
"scope": "eq",
"trust": 0.3,
"vendor": "juniper",
"version": "4.5"
},
{
"_id": null,
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2.1"
},
{
"_id": null,
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"_id": null,
"model": "enterprise linux desktop optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "aura communication manager utility services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"_id": null,
"model": "linux mandrake x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2010.1"
},
{
"_id": null,
"model": "voice portal sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.1"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 0.3,
"vendor": "php",
"version": "5.3.3"
},
{
"_id": null,
"model": "linux enterprise server sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"_id": null,
"model": "voice portal",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.1.2"
},
{
"_id": null,
"model": "ip office application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.0"
},
{
"_id": null,
"model": "linux",
"scope": null,
"trust": 0.3,
"vendor": "gentoo",
"version": null
},
{
"_id": null,
"model": "linux enterprise sdk sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"_id": null,
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"_id": null,
"model": "enterprise linux server optional eus",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6.1"
},
{
"_id": null,
"model": "linux lts i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "12.04"
},
{
"_id": null,
"model": "enterprise linux hpc node",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 0.3,
"vendor": "php",
"version": "5.3.6"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 0.3,
"vendor": "php",
"version": "5.3.5"
},
{
"_id": null,
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "aura communication manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0.1"
},
{
"_id": null,
"model": "server",
"scope": "eq",
"trust": 0.3,
"vendor": "turbolinux",
"version": "110"
},
{
"_id": null,
"model": "voice portal",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0"
},
{
"_id": null,
"model": "aura session manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"_id": null,
"model": "ip office application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "8.0"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 0.3,
"vendor": "php",
"version": "5.3.4"
},
{
"_id": null,
"model": "linux mandrake",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2011"
},
{
"_id": null,
"model": "linux lts lpia",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"_id": null,
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"_id": null,
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.04"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 0.3,
"vendor": "php",
"version": "5.3.12"
},
{
"_id": null,
"model": "ctpview",
"scope": "eq",
"trust": 0.3,
"vendor": "juniper",
"version": "4.4"
},
{
"_id": null,
"model": "enterprise linux server",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "5"
},
{
"_id": null,
"model": "linux lts amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "12.04"
},
{
"_id": null,
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7"
},
{
"_id": null,
"model": "linux ia-32",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 0.3,
"vendor": "php",
"version": "5.3.7"
},
{
"_id": null,
"model": "linux mips",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.04"
},
{
"_id": null,
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.0"
},
{
"_id": null,
"model": "aura messaging",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"_id": null,
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.8"
},
{
"_id": null,
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.3"
},
{
"_id": null,
"model": "linux enterprise server for vmware sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"_id": null,
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "7.1.2"
},
{
"_id": null,
"model": "mac os",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "x10.8.2"
},
{
"_id": null,
"model": "linux enterprise server for vmware sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"_id": null,
"model": "hp-ux b.11.31",
"scope": null,
"trust": 0.3,
"vendor": "hp",
"version": null
},
{
"_id": null,
"model": "linux s/390",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "aura communication manager utility services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.2"
},
{
"_id": null,
"model": "appliance server",
"scope": "eq",
"trust": 0.3,
"vendor": "turbolinux",
"version": "3.0x64"
},
{
"_id": null,
"model": "enterprise linux desktop workstation client",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "5"
},
{
"_id": null,
"model": "plesk panel",
"scope": "eq",
"trust": 0.3,
"vendor": "parallels",
"version": "9.2"
},
{
"_id": null,
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.1"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 0.3,
"vendor": "php",
"version": "5.4.1"
},
{
"_id": null,
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "client",
"scope": "eq",
"trust": 0.3,
"vendor": "turbolinux",
"version": "2008"
},
{
"_id": null,
"model": "plesk panel",
"scope": "eq",
"trust": 0.3,
"vendor": "parallels",
"version": "8.6"
},
{
"_id": null,
"model": "plesk panel",
"scope": "eq",
"trust": 0.3,
"vendor": "parallels",
"version": "9.0"
},
{
"_id": null,
"model": "ip office application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"_id": null,
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.3"
},
{
"_id": null,
"model": "lotus foundations start",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "1.2"
},
{
"_id": null,
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "7.1.1"
},
{
"_id": null,
"model": "enterprise server x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "mandrakesoft",
"version": "5"
},
{
"_id": null,
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "7.1"
},
{
"_id": null,
"model": "enterprise linux server eus",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6.0"
},
{
"_id": null,
"model": "aura session manager sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"_id": null,
"model": "server",
"scope": "eq",
"trust": 0.3,
"vendor": "turbolinux",
"version": "11x64"
},
{
"_id": null,
"model": "system management homepage",
"scope": "ne",
"trust": 0.3,
"vendor": "hp",
"version": "7.1.1"
},
{
"_id": null,
"model": "enterprise linux server optional eus",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6.0"
},
{
"_id": null,
"model": "opensuse",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "12.1"
},
{
"_id": null,
"model": "php",
"scope": "eq",
"trust": 0.3,
"vendor": "php",
"version": "5.3.2"
},
{
"_id": null,
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.2"
},
{
"_id": null,
"model": "linux mandrake",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2010.1"
},
{
"_id": null,
"model": "php",
"scope": "ne",
"trust": 0.3,
"vendor": "php",
"version": "5.3.13"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#673343"
},
{
"db": "BID",
"id": "53388"
},
{
"db": "NVD",
"id": "CVE-2012-1823"
}
]
},
"credits": {
"_id": null,
"data": "De Eindbazen",
"sources": [
{
"db": "BID",
"id": "53388"
}
],
"trust": 0.3
},
"cve": "CVE-2012-1823",
"cvss": {
"_id": null,
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2012-1823",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 1.1,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"availabilityRequirement": "NOT DEFINED",
"baseScore": 7.5,
"collateralDamagePotential": "NOT DEFINED",
"confidentialityImpact": "PARTIAL",
"confidentialityRequirement": "NOT DEFINED",
"enviromentalScore": 4.9,
"exploitability": "HIGH",
"exploitabilityScore": 10.0,
"id": "CVE-2012-1823",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"integrityRequirement": "NOT DEFINED",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"remediationLevel": "OFFICIAL FIX",
"reportConfidence": "CONFIRMED",
"severity": "HIGH",
"targetDistribution": "MEDIUM",
"trust": 0.8,
"userInteractionRequired": null,
"vector_string": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2012-1823",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 2.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2012-1823",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"id": "CVE-2012-1823",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2012-1823",
"trust": 0.8,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2012-1823",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#673343"
},
{
"db": "VULMON",
"id": "CVE-2012-1823"
},
{
"db": "NVD",
"id": "CVE-2012-1823"
},
{
"db": "NVD",
"id": "CVE-2012-1823"
}
]
},
"description": {
"_id": null,
"data": "sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the \u0027d\u0027 case. Parallels Plesk Panel versions 9.0 - 9.2.3 on Linux platforms are vulnerable to remote code execution. PHP is prone to an information-disclosure vulnerability. \nExploiting this issue allows remote attackers to view the source code of files in the context of the server process. This may allow the attacker to obtain sensitive information and to run arbitrary PHP code on the affected computer; other attacks are also possible. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory GLSA 201209-03\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n http://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: High\n Title: PHP: Multiple vulnerabilities\n Date: September 24, 2012\n Bugs: #384301, #396311, #396533, #399247, #399567, #399573,\n #401997, #410957, #414553, #421489, #427354, #429630\n ID: 201209-03\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities were found in PHP, the worst of which lead to\nremote execution of arbitrary code. \n\nBackground\n==========\n\nPHP is a widely-used general-purpose scripting language that is\nespecially suited for Web development and can be embedded into HTML. \n\nAffected packages\n=================\n\n -------------------------------------------------------------------\n Package / Vulnerable / Unaffected\n -------------------------------------------------------------------\n 1 dev-lang/php \u003c 5.3.15 \u003e= 5.3.15\n \u003c 5.4.5 \u003e= 5.4.5\n -------------------------------------------------------------------\n # Package 1 only applies to users of these architectures:\n arm\n\nDescription\n===========\n\nMultiple vulnerabilities have been discovered in PHP. Please review the\nCVE identifiers referenced below for details. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll PHP users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose \"\u003e=dev-lang/php-5.3.15\"\n\nAll PHP users on ARM should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose \"\u003e=dev-lang/php-5.4.5\"\n\nReferences\n==========\n\n[ 1 ] CVE-2011-1398\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1398\n[ 2 ] CVE-2011-3379\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3379\n[ 3 ] CVE-2011-4566\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4566\n[ 4 ] CVE-2011-4885\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4885\n[ 5 ] CVE-2012-0057\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0057\n[ 6 ] CVE-2012-0788\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0788\n[ 7 ] CVE-2012-0789\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0789\n[ 8 ] CVE-2012-0830\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0830\n[ 9 ] CVE-2012-0831\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0831\n[ 10 ] CVE-2012-1172\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1172\n[ 11 ] CVE-2012-1823\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1823\n[ 12 ] CVE-2012-2143\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2143\n[ 13 ] CVE-2012-2311\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2311\n[ 14 ] CVE-2012-2335\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2335\n[ 15 ] CVE-2012-2336\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2336\n[ 16 ] CVE-2012-2386\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2386\n[ 17 ] CVE-2012-2688\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2688\n[ 18 ] CVE-2012-3365\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3365\n[ 19 ] CVE-2012-3450\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3450\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n http://security.gentoo.org/glsa/glsa-201209-03.xml\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2012 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttp://creativecommons.org/licenses/by-sa/2.5\n. \nHP System Management Homepage (SMH) before v7.1.1 running on Linux, Windows\nand VMware ESX. \n\nAdditionally, this update fixes insufficient validation of upload\nname which lead to corrupted $_FILES indices. \n\nFor the stable distribution (squeeze), this problem has been fixed in\nversion 5.3.3-7+squeeze9. \n\nThe testing distribution (wheezy) will be fixed soon. \n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 5.4.3-1. \n\nWe recommend that you upgrade your php5 packages. \nCharter: http://lists.grok.org.uk/full-disclosure-charter.html\nHosted and sponsored by Secunia - http://secunia.com/\n. ----------------------------------------------------------------------\n\nBecome a PSI 3.0 beta tester!\nTest-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. \nDownload it here!\nhttp://secunia.com/psi_30_beta_launch\n\n----------------------------------------------------------------------\n\nTITLE:\nDebian update for php5\n\nSECUNIA ADVISORY ID:\nSA49053\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/49053/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=49053\n\nRELEASE DATE:\n2012-05-10\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/49053/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/49053/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=49053\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nDebian has issued an update for php5. This fixes a vulnerability,\nwhich can be exploited by malicious people to disclose certain\nsensitive information or compromise a vulnerable system. \n\nFor more information see vulnerability #1 in:\nSA49014\n\nSOLUTION:\nApply updated packages via the apt-get package manager. \n\nORIGINAL ADVISORY:\nDSA-2465-1:\nhttp://www.debian.org/security/2012/dsa-2465\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\nNote: the current version of the following document is available here:\nhttps://h20566.www2.hp.com/portal/site/hpsc/public/kb/\ndocDisplay?docId=emr_na-c03368475\n\nSUPPORT COMMUNICATION - SECURITY BULLETIN\n\nDocument ID: c03368475\nVersion: 2\n\nHPSBUX02791 SSRT100856 rev.2 - HP-UX Apache Web Server running PHP, Remote\nExecution of Arbitrary Code, Privilege Elevation, Denial of Service (DoS)\n\nNOTICE: The information in this Security Bulletin should be acted upon as\nsoon as possible. \n\nRelease Date: 2012-06-14\nLast Updated: 2012-08-22\n\n- -----------------------------------------------------------------------------\n\nPotential Security Impact: Remote execution of arbitrary code, privilege\nelevation, or Denial of Service (DoS). \n\nSource: Hewlett-Packard Company, HP Software Security Response Team\n\nVULNERABILITY SUMMARY\nPotential security vulnerabilities have been identified with HP-UX Apache Web\nServer running PHP. These vulnerabilities could be exploited remotely to\nexecute arbitrary code, elevate privileges, or create a Denial of Service\n(DoS). \n\nReferences: CVE-2011-4153, CVE-2012-0830, CVE-2012-0883, CVE-2012-1172,\nCVE-2012-1823, CVE-2012-2311\n\nSUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. \nHP-UX B.11.23, B.11.31 running HP-UX Apache Web Server Suite v3.24 or earlier\n\nHP-UX B.11.11 running HP-UX Apache Web Server Suite v2.35 or earlier\n\nBACKGROUND\n\nCVSS 2.0 Base Metrics\n===========================================================\n Reference Base Vector Base Score\nCVE-2011-4153 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0\nCVE-2012-0830 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5\nCVE-2012-0883 (AV:L/AC:M/Au:N/C:C/I:C/A:C) 6.9\nCVE-2012-1172 (AV:N/AC:M/Au:N/C:N/I:P/A:P) 5.8\nCVE-2012-1823 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5\nCVE-2012-2311 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5\n===========================================================\n Information on CVSS is documented\n in HP Customer Notice: HPSN-2008-002\n\nRESOLUTION\n\nHP has provided the following software updates to resolve the\nvulnerabilities. \nThe updates are available for download from http://software.hp.com\n\nHP-UX Web Server Suite v3.24 containing Apache v2.2.15.13 and PHP v5.2.17\nHP-UX 11i Release / Apache Depot name\nB.11.23 (32-bit) / HPUXWS22ATW-B324-32\nB.11.23 (64-bit) / HPUXWS22ATW-B324-64\nB.11.31 (32-bit) / HPUXWS22ATW-B324-32\nB.11.31 (64-bit) / HPUXWS22ATW-B324-64\n\nHP-UX Web Server Suite v2.36 containing Apache v2.0.64.04 and PHP v5.2.17\nHP-UX 11i Release / Apache Depot Name\nB.11.11 (32-bit) / HPUXWSATW-B236-1111\n\nMANUAL ACTIONS: Yes - Update\nInstall HP-UX Web Server Suite v3.24 or subsequent\n\nInstall HP-UX Web Server Suite v2.36 or subsequent\n\nPRODUCT SPECIFIC INFORMATION\n\nHP-UX Software Assistant: HP-UX Software Assistant is an enhanced application\nthat replaces HP-UX Security Patch Check. It analyzes all Security Bulletins\nissued by HP and lists recommended actions that may apply to a specific HP-UX\nsystem. It can also download patches and create a depot automatically. For\nmore information see https://www.hp.com/go/swa\n\nThe following text is for use by the HP-UX Software Assistant. \n\nAFFECTED VERSIONS\nHP-UX B.11.11\n\n==============\nhpuxwsAPACHE.APACHE\nhpuxwsAPACHE.APACHE2\nhpuxwsAPACHE.AUTH_LDAP\nhpuxwsAPACHE.AUTH_LDAP2\nhpuxwsAPACHE.MOD_JK\nhpuxwsAPACHE.MOD_JK2\nhpuxwsAPACHE.MOD_PERL\nhpuxwsAPACHE.MOD_PERL2\nhpuxwsAPACHE.PHP\nhpuxwsAPACHE.PHP2\nhpuxwsAPACHE.WEBPROXY\naction: install revision B.2.0.64.04 or subsequent\n\nHP-UX B.11.23\n==============\nhpuxws22APCH32.APACHE\nhpuxws22APCH32.APACHE2\nhpuxws22APCH32.AUTH_LDAP\nhpuxws22APCH32.AUTH_LDAP2\nhpuxws22APCH32.MOD_JK\nhpuxws22APCH32.MOD_JK2\nhpuxws22APCH32.MOD_PERL\nhpuxws22APCH32.MOD_PERL2\nhpuxws22APCH32.PHP\nhpuxws22APCH32.PHP2\nhpuxws22APCH32.WEBPROXY\nhpuxws22APCH32.WEBPROXY2\nhpuxws22APACHE.APACHE\nhpuxws22APACHE.APACHE2\nhpuxws22APACHE.AUTH_LDAP\nhpuxws22APACHE.AUTH_LDAP2\nhpuxws22APACHE.MOD_JK\nhpuxws22APACHE.MOD_JK2\nhpuxws22APACHE.MOD_PERL\nhpuxws22APACHE.MOD_PERL2\nhpuxws22APACHE.PHP\nhpuxws22APACHE.PHP2\nhpuxws22APACHE.WEBPROXY\nhpuxws22APACHE.WEBPROXY2\naction: install revision B.2.2.15.13 or subsequent\n\nHP-UX B.11.31\n==================\nhpuxws22APCH32.APACHE\nhpuxws22APCH32.APACHE2\nhpuxws22APCH32.AUTH_LDAP\nhpuxws22APCH32.AUTH_LDAP2\nhpuxws22APCH32.MOD_JK\nhpuxws22APCH32.MOD_JK2\nhpuxws22APCH32.MOD_PERL\nhpuxws22APCH32.MOD_PERL2\nhpuxws22APCH32.PHP\nhpuxws22APCH32.PHP2\nhpuxws22APCH32.WEBPROXY\nhpuxws22APCH32.WEBPROXY2\nhpuxws22APACHE.APACHE\nhpuxws22APACHE.APACHE2\nhpuxws22APACHE.AUTH_LDAP\nhpuxws22APACHE.AUTH_LDAP2\nhpuxws22APACHE.MOD_JK\nhpuxws22APACHE.MOD_JK2\nhpuxws22APACHE.MOD_PERL\nhpuxws22APACHE.MOD_PERL2\nhpuxws22APACHE.PHP\nhpuxws22APACHE.PHP2\nhpuxws22APACHE.WEBPROXY\nhpuxws22APACHE.WEBPROXY2\n\naction: install revision B.2.2.15.13 or subsequent\n\nEND AFFECTED VERSIONS\n\nHISTORY\nVersion:1 (rev.1) - 14 June 2012 Initial release\nVersion:2 (rev.2) - 22 August 2012 B.11.11 content added for B.2.0.64.04\n\nThird Party Security Patches: Third party security patches that are to be\ninstalled on systems running HP software products should be applied in\naccordance with the customer\u0027s patch management policy. \n\nSupport: For issues about implementing the recommendations of this Security\nBulletin, contact normal HP Services support channel. For other issues about\nthe content of this Security Bulletin, send e-mail to security-alert@hp.com. \n\nReport: To report a potential security vulnerability with any HP supported\nproduct, send Email to: security-alert@hp.com\n\nSubscribe: To initiate a subscription to receive future HP Security Bulletin\nalerts via Email:\nhttp://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins\n\nSecurity Bulletin List: A list of HP Security Bulletins, updated\nperiodically, is contained in HP Security Notice HPSN-2011-001:\nhttps://h20566.www2.hp.com/portal/site/hpsc/public/kb/\ndocDisplay?docId=emr_na-c02964430\n\nSecurity Bulletin Archive: A list of recently released Security Bulletins is\navailable here:\nhttp://h20566.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/\n\nSoftware Product Category: The Software Product Category is represented in\nthe title by the two characters following HPSB. \n\n3C = 3COM\n3P = 3rd Party Software\nGN = HP General Software\nHF = HP Hardware and Firmware\nMP = MPE/iX\nMU = Multi-Platform Software\nNS = NonStop Servers\nOV = OpenVMS\nPI = Printing and Imaging\nPV = ProCurve\nST = Storage Software\nTU = Tru64 UNIX\nUX = HP-UX\n\nCopyright 2012 Hewlett-Packard Development Company, L.P. \nHewlett-Packard Company shall not be liable for technical or editorial errors\nor omissions contained herein. The information provided is provided \"as is\"\nwithout warranty of any kind. To the extent permitted by law, neither HP or\nits affiliates, subcontractors or suppliers will be liable for\nincidental,special or consequential damages including downtime cost; lost\nprofits;damages relating to the procurement of substitute products or\nservices; or damages for loss of data, or software restoration. The\ninformation in this document is subject to change without notice. \nHewlett-Packard Company and the names of Hewlett-Packard products referenced\nherein are trademarks of Hewlett-Packard Company in the United States and\nother countries. Other product and company names mentioned herein may be\ntrademarks of their respective owners. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n=====================================================================\n Red Hat Security Advisory\n\nSynopsis: Critical: php53 security update\nAdvisory ID: RHSA-2012:0547-01\nProduct: Red Hat Enterprise Linux\nAdvisory URL: https://rhn.redhat.com/errata/RHSA-2012-0547.html\nIssue date: 2012-05-07\nCVE Names: CVE-2012-1823 \n=====================================================================\n\n1. Summary:\n\nUpdated php53 packages that fix one security issue are now available for\nRed Hat Enterprise Linux 5. \n\nThe Red Hat Security Response Team has rated this update as having critical\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section. \n\n2. Relevant releases/architectures:\n\nRHEL Desktop Workstation (v. 5 client) - i386, x86_64\nRed Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64\n\n3. Description:\n\nPHP is an HTML-embedded scripting language commonly used with the Apache\nHTTP Server. \n\nA flaw was found in the way the php-cgi executable processed command line\narguments when running in CGI mode. A remote attacker could send a \nspecially-crafted request to a PHP script that would result in the query\nstring being parsed by php-cgi as command line options and arguments. (CVE-2012-1823) \n\nRed Hat is aware that a public exploit for this issue is available that \nallows remote code execution in affected PHP CGI configurations. This flaw \ndoes not affect the default configuration using the PHP module for Apache \nhttpd to handle PHP scripts. \n\nAll php53 users should upgrade to these updated packages, which contain a\nbackported patch to resolve this issue. After installing the updated\npackages, the httpd daemon must be restarted for the update to take effect. \n\n4. Solution:\n\nBefore applying this update, make sure all previously-released errata\nrelevant to your system have been applied. \n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258\n\n5. Bugs fixed (http://bugzilla.redhat.com/):\n\n818607 - CVE-2012-1823 php: command line arguments injection when run in CGI mode (VU#520827)\n\n6. Package List:\n\nRHEL Desktop Workstation (v. 5 client):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/php53-5.3.3-7.el5_8.src.rpm\n\ni386:\nphp53-5.3.3-7.el5_8.i386.rpm\nphp53-bcmath-5.3.3-7.el5_8.i386.rpm\nphp53-cli-5.3.3-7.el5_8.i386.rpm\nphp53-common-5.3.3-7.el5_8.i386.rpm\nphp53-dba-5.3.3-7.el5_8.i386.rpm\nphp53-debuginfo-5.3.3-7.el5_8.i386.rpm\nphp53-devel-5.3.3-7.el5_8.i386.rpm\nphp53-gd-5.3.3-7.el5_8.i386.rpm\nphp53-imap-5.3.3-7.el5_8.i386.rpm\nphp53-intl-5.3.3-7.el5_8.i386.rpm\nphp53-ldap-5.3.3-7.el5_8.i386.rpm\nphp53-mbstring-5.3.3-7.el5_8.i386.rpm\nphp53-mysql-5.3.3-7.el5_8.i386.rpm\nphp53-odbc-5.3.3-7.el5_8.i386.rpm\nphp53-pdo-5.3.3-7.el5_8.i386.rpm\nphp53-pgsql-5.3.3-7.el5_8.i386.rpm\nphp53-process-5.3.3-7.el5_8.i386.rpm\nphp53-pspell-5.3.3-7.el5_8.i386.rpm\nphp53-snmp-5.3.3-7.el5_8.i386.rpm\nphp53-soap-5.3.3-7.el5_8.i386.rpm\nphp53-xml-5.3.3-7.el5_8.i386.rpm\nphp53-xmlrpc-5.3.3-7.el5_8.i386.rpm\n\nx86_64:\nphp53-5.3.3-7.el5_8.x86_64.rpm\nphp53-bcmath-5.3.3-7.el5_8.x86_64.rpm\nphp53-cli-5.3.3-7.el5_8.x86_64.rpm\nphp53-common-5.3.3-7.el5_8.x86_64.rpm\nphp53-dba-5.3.3-7.el5_8.x86_64.rpm\nphp53-debuginfo-5.3.3-7.el5_8.x86_64.rpm\nphp53-devel-5.3.3-7.el5_8.x86_64.rpm\nphp53-gd-5.3.3-7.el5_8.x86_64.rpm\nphp53-imap-5.3.3-7.el5_8.x86_64.rpm\nphp53-intl-5.3.3-7.el5_8.x86_64.rpm\nphp53-ldap-5.3.3-7.el5_8.x86_64.rpm\nphp53-mbstring-5.3.3-7.el5_8.x86_64.rpm\nphp53-mysql-5.3.3-7.el5_8.x86_64.rpm\nphp53-odbc-5.3.3-7.el5_8.x86_64.rpm\nphp53-pdo-5.3.3-7.el5_8.x86_64.rpm\nphp53-pgsql-5.3.3-7.el5_8.x86_64.rpm\nphp53-process-5.3.3-7.el5_8.x86_64.rpm\nphp53-pspell-5.3.3-7.el5_8.x86_64.rpm\nphp53-snmp-5.3.3-7.el5_8.x86_64.rpm\nphp53-soap-5.3.3-7.el5_8.x86_64.rpm\nphp53-xml-5.3.3-7.el5_8.x86_64.rpm\nphp53-xmlrpc-5.3.3-7.el5_8.x86_64.rpm\n\nRed Hat Enterprise Linux (v. 5 server):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/php53-5.3.3-7.el5_8.src.rpm\n\ni386:\nphp53-5.3.3-7.el5_8.i386.rpm\nphp53-bcmath-5.3.3-7.el5_8.i386.rpm\nphp53-cli-5.3.3-7.el5_8.i386.rpm\nphp53-common-5.3.3-7.el5_8.i386.rpm\nphp53-dba-5.3.3-7.el5_8.i386.rpm\nphp53-debuginfo-5.3.3-7.el5_8.i386.rpm\nphp53-devel-5.3.3-7.el5_8.i386.rpm\nphp53-gd-5.3.3-7.el5_8.i386.rpm\nphp53-imap-5.3.3-7.el5_8.i386.rpm\nphp53-intl-5.3.3-7.el5_8.i386.rpm\nphp53-ldap-5.3.3-7.el5_8.i386.rpm\nphp53-mbstring-5.3.3-7.el5_8.i386.rpm\nphp53-mysql-5.3.3-7.el5_8.i386.rpm\nphp53-odbc-5.3.3-7.el5_8.i386.rpm\nphp53-pdo-5.3.3-7.el5_8.i386.rpm\nphp53-pgsql-5.3.3-7.el5_8.i386.rpm\nphp53-process-5.3.3-7.el5_8.i386.rpm\nphp53-pspell-5.3.3-7.el5_8.i386.rpm\nphp53-snmp-5.3.3-7.el5_8.i386.rpm\nphp53-soap-5.3.3-7.el5_8.i386.rpm\nphp53-xml-5.3.3-7.el5_8.i386.rpm\nphp53-xmlrpc-5.3.3-7.el5_8.i386.rpm\n\nia64:\nphp53-5.3.3-7.el5_8.ia64.rpm\nphp53-bcmath-5.3.3-7.el5_8.ia64.rpm\nphp53-cli-5.3.3-7.el5_8.ia64.rpm\nphp53-common-5.3.3-7.el5_8.ia64.rpm\nphp53-dba-5.3.3-7.el5_8.ia64.rpm\nphp53-debuginfo-5.3.3-7.el5_8.ia64.rpm\nphp53-devel-5.3.3-7.el5_8.ia64.rpm\nphp53-gd-5.3.3-7.el5_8.ia64.rpm\nphp53-imap-5.3.3-7.el5_8.ia64.rpm\nphp53-intl-5.3.3-7.el5_8.ia64.rpm\nphp53-ldap-5.3.3-7.el5_8.ia64.rpm\nphp53-mbstring-5.3.3-7.el5_8.ia64.rpm\nphp53-mysql-5.3.3-7.el5_8.ia64.rpm\nphp53-odbc-5.3.3-7.el5_8.ia64.rpm\nphp53-pdo-5.3.3-7.el5_8.ia64.rpm\nphp53-pgsql-5.3.3-7.el5_8.ia64.rpm\nphp53-process-5.3.3-7.el5_8.ia64.rpm\nphp53-pspell-5.3.3-7.el5_8.ia64.rpm\nphp53-snmp-5.3.3-7.el5_8.ia64.rpm\nphp53-soap-5.3.3-7.el5_8.ia64.rpm\nphp53-xml-5.3.3-7.el5_8.ia64.rpm\nphp53-xmlrpc-5.3.3-7.el5_8.ia64.rpm\n\nppc:\nphp53-5.3.3-7.el5_8.ppc.rpm\nphp53-bcmath-5.3.3-7.el5_8.ppc.rpm\nphp53-cli-5.3.3-7.el5_8.ppc.rpm\nphp53-common-5.3.3-7.el5_8.ppc.rpm\nphp53-dba-5.3.3-7.el5_8.ppc.rpm\nphp53-debuginfo-5.3.3-7.el5_8.ppc.rpm\nphp53-devel-5.3.3-7.el5_8.ppc.rpm\nphp53-gd-5.3.3-7.el5_8.ppc.rpm\nphp53-imap-5.3.3-7.el5_8.ppc.rpm\nphp53-intl-5.3.3-7.el5_8.ppc.rpm\nphp53-ldap-5.3.3-7.el5_8.ppc.rpm\nphp53-mbstring-5.3.3-7.el5_8.ppc.rpm\nphp53-mysql-5.3.3-7.el5_8.ppc.rpm\nphp53-odbc-5.3.3-7.el5_8.ppc.rpm\nphp53-pdo-5.3.3-7.el5_8.ppc.rpm\nphp53-pgsql-5.3.3-7.el5_8.ppc.rpm\nphp53-process-5.3.3-7.el5_8.ppc.rpm\nphp53-pspell-5.3.3-7.el5_8.ppc.rpm\nphp53-snmp-5.3.3-7.el5_8.ppc.rpm\nphp53-soap-5.3.3-7.el5_8.ppc.rpm\nphp53-xml-5.3.3-7.el5_8.ppc.rpm\nphp53-xmlrpc-5.3.3-7.el5_8.ppc.rpm\n\ns390x:\nphp53-5.3.3-7.el5_8.s390x.rpm\nphp53-bcmath-5.3.3-7.el5_8.s390x.rpm\nphp53-cli-5.3.3-7.el5_8.s390x.rpm\nphp53-common-5.3.3-7.el5_8.s390x.rpm\nphp53-dba-5.3.3-7.el5_8.s390x.rpm\nphp53-debuginfo-5.3.3-7.el5_8.s390x.rpm\nphp53-devel-5.3.3-7.el5_8.s390x.rpm\nphp53-gd-5.3.3-7.el5_8.s390x.rpm\nphp53-imap-5.3.3-7.el5_8.s390x.rpm\nphp53-intl-5.3.3-7.el5_8.s390x.rpm\nphp53-ldap-5.3.3-7.el5_8.s390x.rpm\nphp53-mbstring-5.3.3-7.el5_8.s390x.rpm\nphp53-mysql-5.3.3-7.el5_8.s390x.rpm\nphp53-odbc-5.3.3-7.el5_8.s390x.rpm\nphp53-pdo-5.3.3-7.el5_8.s390x.rpm\nphp53-pgsql-5.3.3-7.el5_8.s390x.rpm\nphp53-process-5.3.3-7.el5_8.s390x.rpm\nphp53-pspell-5.3.3-7.el5_8.s390x.rpm\nphp53-snmp-5.3.3-7.el5_8.s390x.rpm\nphp53-soap-5.3.3-7.el5_8.s390x.rpm\nphp53-xml-5.3.3-7.el5_8.s390x.rpm\nphp53-xmlrpc-5.3.3-7.el5_8.s390x.rpm\n\nx86_64:\nphp53-5.3.3-7.el5_8.x86_64.rpm\nphp53-bcmath-5.3.3-7.el5_8.x86_64.rpm\nphp53-cli-5.3.3-7.el5_8.x86_64.rpm\nphp53-common-5.3.3-7.el5_8.x86_64.rpm\nphp53-dba-5.3.3-7.el5_8.x86_64.rpm\nphp53-debuginfo-5.3.3-7.el5_8.x86_64.rpm\nphp53-devel-5.3.3-7.el5_8.x86_64.rpm\nphp53-gd-5.3.3-7.el5_8.x86_64.rpm\nphp53-imap-5.3.3-7.el5_8.x86_64.rpm\nphp53-intl-5.3.3-7.el5_8.x86_64.rpm\nphp53-ldap-5.3.3-7.el5_8.x86_64.rpm\nphp53-mbstring-5.3.3-7.el5_8.x86_64.rpm\nphp53-mysql-5.3.3-7.el5_8.x86_64.rpm\nphp53-odbc-5.3.3-7.el5_8.x86_64.rpm\nphp53-pdo-5.3.3-7.el5_8.x86_64.rpm\nphp53-pgsql-5.3.3-7.el5_8.x86_64.rpm\nphp53-process-5.3.3-7.el5_8.x86_64.rpm\nphp53-pspell-5.3.3-7.el5_8.x86_64.rpm\nphp53-snmp-5.3.3-7.el5_8.x86_64.rpm\nphp53-soap-5.3.3-7.el5_8.x86_64.rpm\nphp53-xml-5.3.3-7.el5_8.x86_64.rpm\nphp53-xmlrpc-5.3.3-7.el5_8.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/#package\n\n7. References:\n\nhttps://www.redhat.com/security/data/cve/CVE-2012-1823.html\nhttps://access.redhat.com/security/updates/classification/#critical\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2012 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.4 (GNU/Linux)\n\niD4DBQFPqBjQXlSAg2UNWIIRAsGqAJjy9MAGgtGKsuasY7QYQjdFM5yiAJ4xwgNF\n6mLuYoKOaLGGEiAy1FU0OQ==\n=G9Kt\n-----END PGP SIGNATURE-----\n\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\nAPPLE-SA-2012-09-19-2 OS X Mountain Lion v10.8.2, OS X Lion v10.7.5 and\nSecurity Update 2012-004\n\nOS X Mountain Lion v10.8.2, OS X Lion v10.7.5 and Security Update\n2012-004 are now available and address the following:\n\nApache\nAvailable for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,\nOS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4\nImpact: Multiple vulnerabilities in Apache\nDescription: Apache is updated to version 2.2.22 to address several\nvulnerabilities, the most serious of which may lead to a denial of\nservice. Further information is available via the Apache web site at\nhttp://httpd.apache.org/. This issue does not affect OS X Mountain\nLion systems. \nCVE-ID\nCVE-2011-3368\nCVE-2011-3607\nCVE-2011-4317\nCVE-2012-0021\nCVE-2012-0031\nCVE-2012-0053\n\nBIND\nAvailable for: OS X Lion v10.7 to v10.7.4,\nOS X Lion Server v10.7 to v10.7.4\nImpact: A remote attacker may be able to cause a denial of service\nin systems configured to run BIND as a DNS nameserver\nDescription: A reachable assertion issue existed in the handling of\nDNS records. This issue was addressed by updating to BIND 9.7.6-P1. \nThis issue does not affect OS X Mountain Lion systems. \nCVE-ID\nCVE-2011-4313\n\nBIND\nAvailable for: OS X Lion v10.7 to v10.7.4,\nOS X Lion Server v10.7 to v10.7.4,\nOS X Mountain Lion v10.8 and v10.8.1\nImpact: A remote attacker may be able to cause a denial of service,\ndata corruption, or obtain sensitive information from process memory\nin systems configured to run BIND as a DNS nameserver\nDescription: A memory management issue existed in the handling of\nDNS records. This issue was addressed by updating to BIND 9.7.6-P1 on\nOS X Lion systems, and BIND 9.8.3-P1 on OS X Mountain Lion systems. \nCVE-ID\nCVE-2012-1667\n\nCoreText\nAvailable for: OS X Lion v10.7 to v10.7.4,\nOS X Lion Server v10.7 to v10.7.4\nImpact: Applications that use CoreText may be vulnerable to an\nunexpected application termination or arbitrary code execution\nDescription: A bounds checking issue existed in the handling of text\nglyphs, which may lead to out of bounds memory reads or writes. This\nissue was addressed through improved bounds checking. This issue does\nnot affect Mac OS X v10.6 or OS X Mountain Lion systems. \nCVE-ID\nCVE-2012-3716 : Jesse Ruderman of Mozilla Corporation\n\nData Security\nAvailable for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,\nOS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4,\nOS X Mountain Lion v10.8 and v10.8.1\nImpact: An attacker with a privileged network position may intercept\nuser credentials or other sensitive information\nDescription: TrustWave, a trusted root CA, has issued, and\nsubsequently revoked, a sub-CA certificate from one of its trusted\nanchors. This sub-CA facilitated the interception of communications\nsecured by Transport Layer Security (TLS). This update adds the\ninvolved sub-CA certificate to OS X\u0027s list of untrusted certificates. \n\nDirectoryService\nAvailable for: Mac OS X 10.6.8, Mac OS X Server 10.6.8\nImpact: If the DirectoryService Proxy is used, a remote attacker may\ncause a denial of service or arbitrary code execution\nDescription: A buffer overflow existed in the DirectoryService\nProxy. This issue was addressed through improved bounds checking. \nThis issue does not affect OS X Lion and Mountain Lion systems. \nCVE-ID\nCVE-2012-0650 : aazubel working with HP\u0027s Zero Day Initiative\n\nImageIO\nAvailable for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,\nOS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4\nImpact: Viewing a maliciously crafted PNG image may lead to an\nunexpected application termination or arbitrary code execution\nDescription: Multiple memory corruption issues existed in libpng\u0027s\nhandling of PNG images. These issues were addressed through improved\nvalidation of PNG images. These issues do not affect OS X Mountain\nLion systems. \nCVE-ID\nCVE-2011-3026 : Juri Aedla\nCVE-2011-3048\n\nImageIO\nAvailable for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,\nOS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4\nImpact: Viewing a maliciously crafted TIFF image may lead to an\nunexpected application termination or arbitrary code execution\nDescription: An integer overflow issue existed in libTIFF\u0027s handling\nof TIFF images. This issue was addressed through improved validation\nof TIFF images. This issue does not affect OS X Mountain Lion\nsystems. \nCVE-ID\nCVE-2012-1173 : Alexander Gavrun working with HP\u0027s Zero Day\nInitiative\n\nInstaller\nAvailable for: OS X Lion v10.7 to v10.7.4,\nOS X Lion Server v10.7 to v10.7.4\nImpact: Remote admins and persons with physical access to the system\nmay obtain account information\nDescription: The fix for CVE-2012-0652 in OS X Lion 10.7.4 prevented\nuser passwords from being recorded in the system log, but did not\nremove the old log entries. This issue was addressed by deleting log\nfiles that contained passwords. This issue does not affect Mac OS X\n10.6 or OS X Mountain Lion systems. \nCVE-ID\nCVE-2012-0652\n\nInternational Components for Unicode\nAvailable for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,\nOS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4\nImpact: Applications that use ICU may be vulnerable to an unexpected\napplication termination or arbitrary code execution\nDescription: A stack buffer overflow existed in the handling of ICU\nlocale IDs. This issue was addressed through improved bounds\nchecking. This issue does not affect OS X Mountain Lion systems. \nCVE-ID\nCVE-2011-4599\n\nKernel\nAvailable for: OS X Lion v10.7 to v10.7.4,\nOS X Lion Server v10.7 to v10.7.4\nImpact: A malicious program could bypass sandbox restrictions\nDescription: A logic issue existed in the handling of debug system\ncalls. This may allow a malicious program to gain code execution in\nother programs with the same user privileges. This issue was\naddressed by disabling handling of addresses in PT_STEP and\nPT_CONTINUE. This issue does not affect OS X Mountain Lion systems. \nCVE-ID\nCVE-2012-0643 : iOS Jailbreak Dream Team\n\nLoginWindow\nAvailable for: OS X Mountain Lion v10.8 and v10.8.1\nImpact: A local user may be able to obtain other user\u0027s login\npasswords\nDescription: A user-installed input method could intercept password\nkeystrokes from Login Window or Screen Saver Unlock. This issue was\naddressed by preventing user-installed methods from being used when\nthe system is handling login information. \nCVE-ID\nCVE-2012-3718 : An anonymous researcher\n\nMail\nAvailable for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,\nOS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4\nImpact: Viewing an e-mail message may lead to execution of web\nplugins\nDescription: An input validation issue existed in Mail\u0027s handling of\nembedded web plugins. This issue was addressed by disabling third-\nparty plug-ins in Mail. This issue does not affect OS X Mountain Lion\nsystems. \nCVE-ID\nCVE-2012-3719 : Will Dormann of the CERT/CC\n\nMobile Accounts\nAvailable for: OS X Mountain Lion v10.8 and v10.8.1\nImpact: A user with access to the contents of a mobile account may\nobtain the account password\nDescription: Creating a mobile account saved a hash of the password\nin the account, which was used to login when the mobile account was\nused as an external account. The password hash could be used to\ndetermine the user\u0027s password. This issue was addressed by creating\nthe password hash only if external accounts are enabled on the system\nwhere the mobile account is created. \nCVE-ID\nCVE-2012-3720 : Harald Wagener of Google, Inc. \n\nPHP\nAvailable for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,\nOS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4,\nOS X Mountain Lion v10.8 and v10.8.1\nImpact: Multiple vulnerabilities in PHP\nDescription: \u003ePHP is updated to version 5.3.15 to address multiple\nvulnerabilities, the most serious of which may lead to arbitrary code\nexecution. Further information is available via the PHP web site at\nhttp://www.php.net\nCVE-ID\nCVE-2012-0831\nCVE-2012-1172\nCVE-2012-1823\nCVE-2012-2143\nCVE-2012-2311\nCVE-2012-2386\nCVE-2012-2688\n\nPHP\nAvailable for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,\nOS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4\nImpact: PHP scripts which use libpng may be vulnerable to an\nunexpected application termination or arbitrary code execution\nDescription: A memory corruption issue existed in the handling of\nPNG files. This issue was addressed by updating PHP\u0027s copy of libpng\nto version 1.5.10. This issue does not affect OS X Mountain Lion\nsystems. \nCVE-ID\nCVE-2011-3048\n\nProfile Manager\nAvailable for: OS X Lion Server v10.7 to v10.7.4\nImpact: An unauthenticated user could enumerate managed devices\nDescription: An authentication issue existed in the Device\nManagement private interface. This issue was addressed by removing\nthe interface. This issue does not affect OS X Mountain Lion\nsystems. \nCVE-ID\nCVE-2012-3721 : Derick Cassidy of XEquals Corporation\n\nQuickLook\nAvailable for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,\nOS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4\nImpact: Viewing a maliciously crafted .pict file may lead to an\nunexpected application termination or arbitrary code execution\nDescription: A memory corruption issue existed in the handling of\n.pict files. This issue was addressed through improved validation of\n.pict files. This issue does not affect OS X Mountain Lion systems. \nCVE-ID\nCVE-2012-0671 : Rodrigo Rubira Branco (twitter.com/bsdaemon) from the\nQualys Vulnerability \u0026 Malware Research Labs (VMRL)\n\nQuickTime\nAvailable for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,\nOS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4\nImpact: Viewing a maliciously crafted movie file may lead to an\nunexpected application termination or arbitrary code execution\nDescription: An integer overflow existed in QuickTime\u0027s handling of\nsean atoms. This issue was addressed through improved bounds\nchecking. This issue does not affect OS X Mountain Lion systems. \nCVE-ID\nCVE-2012-0670 : Tom Gallagher (Microsoft) and Paul Bates (Microsoft)\nworking with HP\u0027s Zero Day Initiative\n\nQuickTime\nAvailable for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,\nOS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4\nImpact: Viewing a maliciously crafted movie file may lead to an\nunexpected application termination or arbitrary code execution\nDescription: An uninitialized memory access existed in the handling\nof Sorenson encoded movie files. This issue was addressed through\nimproved memory initialization. This issue does not affect OS X\nMountain Lion systems. \nCVE-ID\nCVE-2012-3722 : Will Dormann of the CERT/CC\n\nQuickTime\nAvailable for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,\nOS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4\nImpact: Viewing a maliciously crafted movie file may lead to an\nunexpected application termination or arbitrary code execution\nDescription: A buffer overflow existed in the handling of RLE\nencoded movie files. This issue was addressed through improved bounds\nchecking. This issue does not affect OS X Mountain Lion systems. \nCVE-ID\nCVE-2012-0668 : Luigi Auriemma working with HP\u0027s Zero Day Initiative\n\nRuby\nAvailable for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,\nOS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4\nImpact: An attacker may be able to decrypt data protected by SSL\nDescription: There are known attacks on the confidentiality of SSL\n3.0 and TLS 1.0 when a cipher suite uses a block cipher in CBC mode. \nThe Ruby OpenSSL module disabled the \u0027empty fragment\u0027 countermeasure\nwhich prevented these attacks. This issue was addressed by enabling\nempty fragments. This issue does not affect OS X Mountain Lion\nsystems. \nCVE-ID\nCVE-2011-3389\n\nUSB\nAvailable for: OS X Lion v10.7 to v10.7.4,\nOS X Lion Server v10.7 to v10.7.4\nImpact: Attaching a USB device may lead to an unexpected system\ntermination or arbitrary code execution\nDescription: A memory corruption issue existed in the handling of\nUSB hub descriptors. This issue was addressed through improved\nhandling of the bNbrPorts descriptor field. This issue does not\naffect OS X Mountain Lion systems. \nCVE-ID\nCVE-2012-3723 : Andy Davis of NGS Secure\n\nNote: OS X Mountain Lion v10.8.2 includes the content of\nSafari 6.0.1. For further details see \"About the security content\nof Safari 6.0.1\" at http://http//support.apple.com/kb/HT5502\n\n\nOS X Mountain Lion v10.8.2, OS X Lion v10.7.5 and Security Update\n2012-004 may be obtained from the Software Update pane in System\nPreferences, or Apple\u0027s Software Downloads web site:\nhttp://www.apple.com/support/downloads/\n\nThe Software Update utility will present the update that applies\nto your system configuration. Only one is needed, either\nOS X Mountain Lion v10.8.2, OS X Lion v10.7.5 or Security Update\n2012-004. \n\nFor OS X Mountain Lion v10.8.1\nThe download file is named: OSXUpd10.8.2.dmg\nIts SHA-1 digest is: d6779e1cc748b78af0207499383b1859ffbebe33\n\nFor OS X Mountain Lion v10.8\nThe download file is named: OSXUpdCombo10.8.2.dmg\nIts SHA-1 digest is: b08f10233d362e39f20b69f91d1d73f5e7b68a2c\n\nFor OS X Lion v10.7.4\nThe download file is named: MacOSXUpd10.7.5.dmg\nIts SHA-1 digest is: e0a9582cce9896938a7a541bd431862d93893532\n\nFor OS X Lion v10.7 and v10.7.3\nThe download file is named: MacOSXUpdCombo10.7.5.dmg\nIts SHA-1 digest is: f7a26b164fa10dae4fe646e57b01c34a619c8d9b\n\nFor OS X Lion Server v10.7.4\nThe download file is named: MacOSXServerUpd10.7.5.dmg\nIts SHA-1 digest is: a891b03bfb4eecb745c0c39a32f39960fdb6796a\n\nFor OS X Lion Server v10.7 and v10.7.3\nThe download file is named: MacOSXServerUpdCombo10.7.5.dmg\nIts SHA-1 digest is: df6e1748ab0a3c9e05c890be49d514673efd965e\n\nFor Mac OS X v10.6.8\nThe download file is named: SecUpd2012-004.dmg\nIts SHA-1 digest is: 5b136e29a871d41012f0c6ea1362d6210c8b4fb7\n\nFor Mac OS X Server v10.6.8\nThe download file is named: SecUpdSrvr2012-004.dmg\nIts SHA-1 digest is: 9b24496be15078e58a88537700f2f39c112e3b28\n\nInformation will also be posted to the Apple Security Updates\nweb site: http://support.apple.com/kb/HT1222\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG/MacGPG2 v2.0.17 (Darwin)\nComment: GPGTools - http://gpgtools.org\n\niQIcBAEBAgAGBQJQWhlbAAoJEPefwLHPlZEwwjwQAKrpQlZh1B2mkSTLxR7QZg6e\nQm7SmIZL9sjl5gQkTxoAvOGxJ8uRdYPlJ1IpyU/MbK0GqO53KmFSeKkwCnvLKMaW\npc6tiFaQ4zV4LEAwBAFEuqCsMyPEJqKDhYXl2cHQmWfAlrLCyCKfzGLy2mY2UnkE\nDQC2+ys70DChFv2GzyXlibBXAGMKDygJ5dVKynsi1ceZLYWbUJoGwlUtXPylBpnO\nQyGWXmEloPbhK6HJbKMNacuDdVcb26pvIeFiivkTSxPVlZ3ns2tAwEyvHrzA9O4n\n7rQ6jvfDbguOZmM5sPFvVKBw2GVDBNU+G3T8ouIXhk6Pjhr4in8VFCb8MIMLb8hm\n7YYn2z1TzKTNmUuYbwe6ukQvf57cPuW0bAvslbl6PgrzqorlNPU4rDoSvPrJx/RO\nBOYkcxfirevHDGibfkeqXPjL3h+bVrb1USZpAv+ZOAy0M89SHFcvMtpAhxnoGiV5\nw4EyKB+9Yi/CSAk2Ne3Y5kHH7/v3pWV68aJwhVirya7ex3vnJ+M+lRLKSm2BUjL3\n+9fykrJBDujFDXoCmK5CN5Wx36DSVZ4VO1h635crotudtcvd+LQ2VHma/Chav5wK\nq5SSllf4KEownpx6o/qTxpg5tcC4lvgTcsDHlYcNq2s8KTTjmOden8ar4h7M7QD2\nxyBfrQfG/dsif6jGHaot\n=8joH\n-----END PGP SIGNATURE-----\n. Content-Disposition: inline\n\n==========================================================================Ubuntu Security Notice USN-1437-1\nMay 04, 2012\n\nphp5 vulnerability\n==========================================================================\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 12.04 LTS\n- Ubuntu 11.10\n- Ubuntu 11.04\n- Ubuntu 10.04 LTS\n- Ubuntu 8.04 LTS\n\nSummary:\n\nStandalone PHP CGI scripts could be made to execute arbitrary code with\nthe privilege of the web server. Configurations using\nmod_php5 and FastCGI were not vulnerable. Please see\nhttp://people.canonical.com/~ubuntu-security/cve/2012/CVE-2012-2311.html\nfor more details and potential mitigation approaches. \n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 12.04 LTS:\n php5-cgi 5.3.10-1ubuntu3.1\n\nUbuntu 11.10:\n php5-cgi 5.3.6-13ubuntu3.7\n\nUbuntu 11.04:\n php5-cgi 5.3.5-1ubuntu7.8\n\nUbuntu 10.04 LTS:\n php5-cgi 5.3.2-1ubuntu4.15\n\nUbuntu 8.04 LTS:\n php5-cgi 5.2.4-2ubuntu5.24\n\nIn general, a standard system update will make all the necessary changes",
"sources": [
{
"db": "NVD",
"id": "CVE-2012-1823"
},
{
"db": "CERT/CC",
"id": "VU#673343"
},
{
"db": "BID",
"id": "53388"
},
{
"db": "VULMON",
"id": "CVE-2012-1823"
},
{
"db": "PACKETSTORM",
"id": "116800"
},
{
"db": "PACKETSTORM",
"id": "121573"
},
{
"db": "PACKETSTORM",
"id": "112580"
},
{
"db": "PACKETSTORM",
"id": "112612"
},
{
"db": "PACKETSTORM",
"id": "115853"
},
{
"db": "PACKETSTORM",
"id": "112508"
},
{
"db": "PACKETSTORM",
"id": "116792"
},
{
"db": "PACKETSTORM",
"id": "112474"
}
],
"trust": 2.7
},
"exploit_availability": {
"_id": null,
"data": [
{
"reference": "https://www.kb.cert.org/vuls/id/673343",
"trust": 0.8,
"type": "unknown"
},
{
"reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=18836",
"trust": 0.4,
"type": "exploit"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#673343"
},
{
"db": "VULMON",
"id": "CVE-2012-1823"
}
]
},
"external_ids": {
"_id": null,
"data": [
{
"db": "NVD",
"id": "CVE-2012-1823",
"trust": 2.9
},
{
"db": "CERT/CC",
"id": "VU#673343",
"trust": 2.2
},
{
"db": "CERT/CC",
"id": "VU#520827",
"trust": 1.4
},
{
"db": "SECUNIA",
"id": "49014",
"trust": 1.1
},
{
"db": "SECUNIA",
"id": "49065",
"trust": 1.1
},
{
"db": "SECUNIA",
"id": "49085",
"trust": 1.1
},
{
"db": "SECUNIA",
"id": "49087",
"trust": 1.1
},
{
"db": "SECTRACK",
"id": "1027022",
"trust": 1.1
},
{
"db": "OPENWALL",
"id": "OSS-SECURITY/2024/06/07/1",
"trust": 1.0
},
{
"db": "JUNIPER",
"id": "JSA10658",
"trust": 0.3
},
{
"db": "BID",
"id": "53388",
"trust": 0.3
},
{
"db": "EXPLOIT-DB",
"id": "18836",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2012-1823",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "116800",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "121573",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "112580",
"trust": 0.1
},
{
"db": "SECUNIA",
"id": "49053",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "112612",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "115853",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "112508",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "116792",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "112474",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#673343"
},
{
"db": "VULMON",
"id": "CVE-2012-1823"
},
{
"db": "BID",
"id": "53388"
},
{
"db": "PACKETSTORM",
"id": "116800"
},
{
"db": "PACKETSTORM",
"id": "121573"
},
{
"db": "PACKETSTORM",
"id": "112580"
},
{
"db": "PACKETSTORM",
"id": "112612"
},
{
"db": "PACKETSTORM",
"id": "115853"
},
{
"db": "PACKETSTORM",
"id": "112508"
},
{
"db": "PACKETSTORM",
"id": "116792"
},
{
"db": "PACKETSTORM",
"id": "112474"
},
{
"db": "NVD",
"id": "CVE-2012-1823"
}
]
},
"id": "VAR-201205-0305",
"iot": {
"_id": null,
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.47077376
},
"last_update_date": "2026-03-09T21:23:07.534000Z",
"patch": {
"_id": null,
"data": [
{
"title": "Red Hat: Critical: php53 security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20120569 - Security Advisory"
},
{
"title": "Red Hat: Critical: php security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20120568 - Security Advisory"
},
{
"title": "Red Hat: Critical: php security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20120546 - Security Advisory"
},
{
"title": "Red Hat: Critical: php53 security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20120547 - Security Advisory"
},
{
"title": "Debian CVElist Bug Report Logs: php5: PHP-CGI query string parameter vulnerability (CVE-2012-1823 / CVE-2012-2311, CERT VU#520827)",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=369fec60ba7ae134a5d768faf3cb2f6b"
},
{
"title": "Ubuntu Security Notice: php5 vulnerability",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-1437-1"
},
{
"title": "Amazon Linux AMI: ALAS-2012-077",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami\u0026qid=ALAS-2012-077"
},
{
"title": "Debian Security Advisories: DSA-2465-1 php5 -- several vulnerabilities",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories\u0026qid=db88513c75df4c41339c6c90dcb69831"
},
{
"title": "Red Hat: Moderate: php security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20121045 - Security Advisory"
},
{
"title": "Red Hat: Moderate: php53 security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20121047 - Security Advisory"
},
{
"title": "Red Hat: Moderate: php security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20121046 - Security Advisory"
},
{
"title": "HacktivityCon_CTF_2020",
"trust": 0.1,
"url": "https://github.com/W3rni0/HacktivityCon_CTF_2020 "
},
{
"title": "exploits",
"trust": 0.1,
"url": "https://github.com/infodox/exploits "
},
{
"title": "webappurls",
"trust": 0.1,
"url": "https://github.com/pwnwiki/webappurls "
},
{
"title": "CVE-2012-1823",
"trust": 0.1,
"url": "https://github.com/drone789/CVE-2012-1823 "
},
{
"title": "Covid-v2-Botnet",
"trust": 0.1,
"url": "https://github.com/SniperX-D/Covid-v2-Botnet "
},
{
"title": "covid",
"trust": 0.1,
"url": "https://github.com/MrScytheLULZ/covid "
},
{
"title": "python-pySecurity",
"trust": 0.1,
"url": "https://github.com/CyberSavvy/python-pySecurity "
},
{
"title": "pySecurity",
"trust": 0.1,
"url": "https://github.com/smartFlash/pySecurity "
},
{
"title": "AutoSploit",
"trust": 0.1,
"url": "https://github.com/RootUp/AutoSploit "
},
{
"title": "Python",
"trust": 0.1,
"url": "https://github.com/BCyberSavvy/Python "
},
{
"title": "awesome-infosec",
"trust": 0.1,
"url": "https://github.com/onlurking/awesome-infosec "
},
{
"title": "awesome-infosec",
"trust": 0.1,
"url": "https://github.com/eric-erki/awesome-infosec "
},
{
"title": "Intrusion_Detection_System-Python",
"trust": 0.1,
"url": "https://github.com/marcocastro100/Intrusion_Detection_System-Python "
},
{
"title": "deepdig",
"trust": 0.1,
"url": "https://github.com/cyberdeception/deepdig "
},
{
"title": "Boot2root-CTFs-Writeups",
"trust": 0.1,
"url": "https://github.com/Jean-Francois-C/Boot2root-CTFs "
},
{
"title": "Boot2root-CTFs-Writeups",
"trust": 0.1,
"url": "https://github.com/Jean-Francois-C/Boot2root-CTFs-Writeups "
},
{
"title": "CDL",
"trust": 0.1,
"url": "https://github.com/NCSU-DANCE-Research-Group/CDL "
},
{
"title": "Classified-Distributed-Learning-for-Detecting-Security-Attacks-in-Containerized-Applications",
"trust": 0.1,
"url": "https://github.com/yuhang-lin/Classified-Distributed-Learning-for-Detecting-Security-Attacks-in-Containerized-Applications "
},
{
"title": "Threatpost",
"trust": 0.1,
"url": "https://threatpost.com/new-exploits-arrive-for-old-php-vulnerability/104881/"
},
{
"title": "Securelist",
"trust": 0.1,
"url": "https://securelist.com/it-threat-evolution-q2-2013/37163/"
},
{
"title": "Threatpost",
"trust": 0.1,
"url": "https://threatpost.com/php-group-set-release-another-patch-cve-2012-1823-flaw-050812/76537/"
},
{
"title": "Threatpost",
"trust": 0.1,
"url": "https://threatpost.com/php-group-releases-new-versions-patch-doesnt-fix-cve-2012-1823-bug-050412/76524/"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2012-1823"
}
]
},
"problemtype_data": {
"_id": null,
"data": [
{
"problemtype": "CWE-77",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2012-1823"
}
]
},
"references": {
"_id": null,
"data": [
{
"trust": 2.2,
"url": "http://www.php.net/archive/2012.php#id2012-05-03-1"
},
{
"trust": 1.5,
"url": "http://www.kb.cert.org/vuls/id/673343"
},
{
"trust": 1.4,
"url": "http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/"
},
{
"trust": 1.4,
"url": "http://www.kb.cert.org/vuls/id/520827"
},
{
"trust": 1.4,
"url": "http://h20000.www2.hp.com/bizsupport/techsupport/document.jsp?objectid=c03360041"
},
{
"trust": 1.2,
"url": "http://rhn.redhat.com/errata/rhsa-2012-0547.html"
},
{
"trust": 1.2,
"url": "http://www.debian.org/security/2012/dsa-2465"
},
{
"trust": 1.1,
"url": "http://kb.parallels.com/en/113818"
},
{
"trust": 1.1,
"url": "http://seclists.org/fulldisclosure/2013/jun/21"
},
{
"trust": 1.1,
"url": "https://bugs.php.net/bug.php?id=61910"
},
{
"trust": 1.1,
"url": "http://www.php.net/changelog-5.php#5.4.2"
},
{
"trust": 1.1,
"url": "https://bugs.php.net/patch-display.php?bug_id=61910\u0026patch=cgi.diff\u0026revision=1335984315\u0026display=1"
},
{
"trust": 1.1,
"url": "http://rhn.redhat.com/errata/rhsa-2012-0568.html"
},
{
"trust": 1.1,
"url": "http://rhn.redhat.com/errata/rhsa-2012-0546.html"
},
{
"trust": 1.1,
"url": "http://secunia.com/advisories/49014"
},
{
"trust": 1.1,
"url": "http://secunia.com/advisories/49087"
},
{
"trust": 1.1,
"url": "http://secunia.com/advisories/49065"
},
{
"trust": 1.1,
"url": "http://marc.info/?l=bugtraq\u0026m=134012830914727\u0026w=2"
},
{
"trust": 1.1,
"url": "http://lists.apple.com/archives/security-announce/2012/sep/msg00004.html"
},
{
"trust": 1.1,
"url": "http://support.apple.com/kb/ht5501"
},
{
"trust": 1.1,
"url": "http://www.securitytracker.com/id?1027022"
},
{
"trust": 1.1,
"url": "http://secunia.com/advisories/49085"
},
{
"trust": 1.1,
"url": "http://www.mandriva.com/security/advisories?name=mdvsa-2012:068"
},
{
"trust": 1.1,
"url": "http://rhn.redhat.com/errata/rhsa-2012-0570.html"
},
{
"trust": 1.1,
"url": "http://rhn.redhat.com/errata/rhsa-2012-0569.html"
},
{
"trust": 1.1,
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00002.html"
},
{
"trust": 1.1,
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00011.html"
},
{
"trust": 1.1,
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00007.html"
},
{
"trust": 1.0,
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=cve-2012-1823"
},
{
"trust": 1.0,
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/pkgtquoa2ntz3rxn22csaujpiruyrb4b/"
},
{
"trust": 1.0,
"url": "http://www.openwall.com/lists/oss-security/2024/06/07/1"
},
{
"trust": 1.0,
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/pkgtquoa2ntz3rxn22csaujpiruyrb4b/"
},
{
"trust": 1.0,
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/w45dboh56nqdrtom2dn2lna2fzimc3pk/"
},
{
"trust": 0.8,
"url": "http://kb.parallels.com/116241"
},
{
"trust": 0.8,
"url": "http://www.parallels.com/products/plesk/lifecycle"
},
{
"trust": 0.8,
"url": "http://blogs.cisco.com/security/plesk-0-day-targets-web-servers/"
},
{
"trust": 0.8,
"url": "http://kb.parallels.com/en/113814"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-1823"
},
{
"trust": 0.7,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-1823"
},
{
"trust": 0.6,
"url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c03839862"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2311"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-1172"
},
{
"trust": 0.3,
"url": "http://alerts.hp.com/r?2.1.3kt.2zr.xg7ek.hmj%2asm..t.a4jy.6o9k.bw89mq%5f%5fdmtsfto0"
},
{
"trust": 0.3,
"url": "http://www-01.ibm.com/software/lotus/products/foundations/start/"
},
{
"trust": 0.3,
"url": "kb.parallels.com/en/116241"
},
{
"trust": 0.3,
"url": "https://community.rapid7.com/thread/5174"
},
{
"trust": 0.3,
"url": "http://www.php.net/"
},
{
"trust": 0.3,
"url": "http://ompldr.org/vzgxxaq"
},
{
"trust": 0.3,
"url": "http://kb.juniper.net/infocenter/index?page=content\u0026id=jsa10658\u0026cat=sirt_1\u0026actp=list"
},
{
"trust": 0.3,
"url": "https://downloads.avaya.com/css/p8/documents/100162699"
},
{
"trust": 0.3,
"url": "https://downloads.avaya.com/css/p8/documents/100165255"
},
{
"trust": 0.3,
"url": "http://www.h-online.com/security/news/item/critical-open-hole-in-php-creates-risks-update-1567532.html"
},
{
"trust": 0.3,
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21620314"
},
{
"trust": 0.3,
"url": "http://www.turbolinux.co.jp/security-e/2012/tlsa-2012-14.txt"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0830"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2688"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0057"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-4885"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0831"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2143"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-3379"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2386"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0031"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-4317"
},
{
"trust": 0.2,
"url": "http://h20566.www2.hp.com/portal/site/hpsc/public/kb/secbullarchive/"
},
{
"trust": 0.2,
"url": "http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-4153"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-3607"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0021"
},
{
"trust": 0.2,
"url": "https://h20566.www2.hp.com/portal/site/hpsc/public/kb/"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0053"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/errata/rhsa-2012:0569"
},
{
"trust": 0.1,
"url": "https://github.com/infodox/exploits"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://www.exploit-db.com/exploits/18836/"
},
{
"trust": 0.1,
"url": "http://security.gentoo.org/glsa/glsa-201209-03.xml"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-4566"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-2688"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1398"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-0789"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-1398"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0788"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-0831"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-2336"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-2335"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-0057"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-3450"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2335"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-3450"
},
{
"trust": 0.1,
"url": "http://creativecommons.org/licenses/by-sa/2.5"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-0830"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-3379"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-4566"
},
{
"trust": 0.1,
"url": "http://security.gentoo.org/"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-1172"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-4885"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-1823"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2336"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-0788"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-2311"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0789"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-3365"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-2143"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-3365"
},
{
"trust": 0.1,
"url": "https://bugs.gentoo.org."
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-2386"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0036"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2016"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-4078"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-1165"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-2834"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1944"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2014"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-4108"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2013"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-4415"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-4577"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-4619"
},
{
"trust": 0.1,
"url": "http://www.hp.com/swpublishing/mtx-ac3d1f80b8dd48b792bfc01a08"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0027"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2012"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2015"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-4576"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-2821"
},
{
"trust": 0.1,
"url": "http://secunia.com/"
},
{
"trust": 0.1,
"url": "http://www.debian.org/security/faq"
},
{
"trust": 0.1,
"url": "http://www.debian.org/security/"
},
{
"trust": 0.1,
"url": "http://lists.grok.org.uk/full-disclosure-charter.html"
},
{
"trust": 0.1,
"url": "http://secunia.com/psi_30_beta_launch"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/49053/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=49053"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/49053/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://software.hp.com"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0883"
},
{
"trust": 0.1,
"url": "https://www.hp.com/go/swa"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2012-1823.html"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/team/contact/"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/team/key/#package"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/updates/classification/#critical"
},
{
"trust": 0.1,
"url": "http://bugzilla.redhat.com/):"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/knowledge/articles/11258"
},
{
"trust": 0.1,
"url": "http://www.php.net"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-3718"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-4313"
},
{
"trust": 0.1,
"url": "http://http//support.apple.com/kb/ht5502"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-3048"
},
{
"trust": 0.1,
"url": "http://support.apple.com/kb/ht1222"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0668"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-3368"
},
{
"trust": 0.1,
"url": "http://www.apple.com/support/downloads/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0670"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0671"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-1173"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0652"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-4599"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-3389"
},
{
"trust": 0.1,
"url": "https://www.apple.com/support/security/pgp/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-1667"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0650"
},
{
"trust": 0.1,
"url": "http://gpgtools.org"
},
{
"trust": 0.1,
"url": "http://httpd.apache.org/."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-3026"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0643"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-3716"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/php5/5.3.5-1ubuntu7.8"
},
{
"trust": 0.1,
"url": "http://people.canonical.com/~ubuntu-security/cve/2012/cve-2012-2311.html"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/php5/5.3.10-1ubuntu3.1"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/php5/5.2.4-2ubuntu5.24"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/php5/5.3.2-1ubuntu4.15"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/php5/5.3.6-13ubuntu3.7"
},
{
"trust": 0.1,
"url": "http://www.ubuntu.com/usn/usn-1437-1"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#673343"
},
{
"db": "VULMON",
"id": "CVE-2012-1823"
},
{
"db": "BID",
"id": "53388"
},
{
"db": "PACKETSTORM",
"id": "116800"
},
{
"db": "PACKETSTORM",
"id": "121573"
},
{
"db": "PACKETSTORM",
"id": "112580"
},
{
"db": "PACKETSTORM",
"id": "112612"
},
{
"db": "PACKETSTORM",
"id": "115853"
},
{
"db": "PACKETSTORM",
"id": "112508"
},
{
"db": "PACKETSTORM",
"id": "116792"
},
{
"db": "PACKETSTORM",
"id": "112474"
},
{
"db": "NVD",
"id": "CVE-2012-1823"
}
]
},
"sources": {
"_id": null,
"data": [
{
"db": "CERT/CC",
"id": "VU#673343",
"ident": null
},
{
"db": "VULMON",
"id": "CVE-2012-1823",
"ident": null
},
{
"db": "BID",
"id": "53388",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "116800",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "121573",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "112580",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "112612",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "115853",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "112508",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "116792",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "112474",
"ident": null
},
{
"db": "NVD",
"id": "CVE-2012-1823",
"ident": null
}
]
},
"sources_release_date": {
"_id": null,
"data": [
{
"date": "2013-06-07T00:00:00",
"db": "CERT/CC",
"id": "VU#673343",
"ident": null
},
{
"date": "2012-05-11T00:00:00",
"db": "VULMON",
"id": "CVE-2012-1823",
"ident": null
},
{
"date": "2012-05-04T00:00:00",
"db": "BID",
"id": "53388",
"ident": null
},
{
"date": "2012-09-24T15:02:14",
"db": "PACKETSTORM",
"id": "116800",
"ident": null
},
{
"date": "2013-05-09T14:44:00",
"db": "PACKETSTORM",
"id": "121573",
"ident": null
},
{
"date": "2012-05-10T03:59:25",
"db": "PACKETSTORM",
"id": "112580",
"ident": null
},
{
"date": "2012-05-10T06:23:20",
"db": "PACKETSTORM",
"id": "112612",
"ident": null
},
{
"date": "2012-08-24T01:40:32",
"db": "PACKETSTORM",
"id": "115853",
"ident": null
},
{
"date": "2012-05-07T20:04:50",
"db": "PACKETSTORM",
"id": "112508",
"ident": null
},
{
"date": "2012-09-22T06:30:43",
"db": "PACKETSTORM",
"id": "116792",
"ident": null
},
{
"date": "2012-05-06T01:28:45",
"db": "PACKETSTORM",
"id": "112474",
"ident": null
},
{
"date": "2012-05-11T10:15:48.043000",
"db": "NVD",
"id": "CVE-2012-1823",
"ident": null
}
]
},
"sources_update_date": {
"_id": null,
"data": [
{
"date": "2013-06-07T00:00:00",
"db": "CERT/CC",
"id": "VU#673343",
"ident": null
},
{
"date": "2018-01-18T00:00:00",
"db": "VULMON",
"id": "CVE-2012-1823",
"ident": null
},
{
"date": "2015-04-13T22:15:00",
"db": "BID",
"id": "53388",
"ident": null
},
{
"date": "2025-11-04T18:15:34.990000",
"db": "NVD",
"id": "CVE-2012-1823",
"ident": null
}
]
},
"threat_type": {
"_id": null,
"data": "network",
"sources": [
{
"db": "BID",
"id": "53388"
}
],
"trust": 0.3
},
"title": {
"_id": null,
"data": "Parallels Plesk Panel phppath/php vulnerability",
"sources": [
{
"db": "CERT/CC",
"id": "VU#673343"
}
],
"trust": 0.8
},
"type": {
"_id": null,
"data": "arbitrary",
"sources": [
{
"db": "PACKETSTORM",
"id": "116800"
},
{
"db": "PACKETSTORM",
"id": "121573"
},
{
"db": "PACKETSTORM",
"id": "112580"
},
{
"db": "PACKETSTORM",
"id": "115853"
},
{
"db": "PACKETSTORM",
"id": "112474"
}
],
"trust": 0.5
}
}
VAR-201205-0311
Vulnerability from variot - Updated: 2025-04-14 20:09php-wrapper.fcgi does not properly handle command-line arguments, which allows remote attackers to bypass a protection mechanism in PHP 5.3.12 and 5.4.2 and execute arbitrary code by leveraging improper interaction between the PHP sapi/cgi/cgi_main.c component and a query string beginning with a +- sequence. PHP is prone to an information-disclosure vulnerability. Exploiting this issue allows remote attackers to view the source code of files in the context of the server process. This may allow the attacker to obtain sensitive information and to run arbitrary PHP code on the affected computer; other attacks are also possible. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201209-03
http://security.gentoo.org/
Severity: High Title: PHP: Multiple vulnerabilities Date: September 24, 2012 Bugs: #384301, #396311, #396533, #399247, #399567, #399573, #401997, #410957, #414553, #421489, #427354, #429630 ID: 201209-03
Synopsis
Multiple vulnerabilities were found in PHP, the worst of which lead to remote execution of arbitrary code.
Background
PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML.
Affected packages
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 dev-lang/php < 5.3.15 >= 5.3.15 < 5.4.5 >= 5.4.5 ------------------------------------------------------------------- # Package 1 only applies to users of these architectures: arm
Description
Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details.
Workaround
There is no known workaround at this time.
Resolution
All PHP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-5.3.15"
All PHP users on ARM should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-5.4.5"
References
[ 1 ] CVE-2011-1398 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1398 [ 2 ] CVE-2011-3379 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3379 [ 3 ] CVE-2011-4566 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4566 [ 4 ] CVE-2011-4885 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4885 [ 5 ] CVE-2012-0057 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0057 [ 6 ] CVE-2012-0788 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0788 [ 7 ] CVE-2012-0789 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0789 [ 8 ] CVE-2012-0830 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0830 [ 9 ] CVE-2012-0831 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0831 [ 10 ] CVE-2012-1172 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1172 [ 11 ] CVE-2012-1823 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1823 [ 12 ] CVE-2012-2143 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2143 [ 13 ] CVE-2012-2311 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2311 [ 14 ] CVE-2012-2335 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2335 [ 15 ] CVE-2012-2336 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2336 [ 16 ] CVE-2012-2386 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2386 [ 17 ] CVE-2012-2688 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2688 [ 18 ] CVE-2012-3365 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3365 [ 19 ] CVE-2012-3450 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3450
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201209-03.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2012 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5 . Please refer to the following Mandriva advisories for further information: MDVA-2012:004, MDVSA-2011:165, MDVSA-2011:166, MDVSA-2011:180, MDVSA-2011:197, MDVSA-2012:065, MDVSA-2012:068, MDVSA-2012:068-1. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c03839862
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c03839862 Version: 1
HPSBMU02900 rev.1 - HP System Management Homepage (SMH) running on Linux and Windows, Multiple Remote and Local Vulnerabilities
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2013-07-18 Last Updated: 2013-07-18
Potential Security Impact: Local Denial of Service (DoS), remote Denial of Service (DoS), execution of arbitrary code, gain extended privileges, disclosure of information, unauthorized access, XSS
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY Potential security vulnerabilities have been identified with HP System Management Homepage (SMH) running on Linux and Windows. The vulnerabilities could be exploited remotely resulting in Local Denial of Service (DoS), remote Denial of Service (DoS), execution of arbitrary code, gain privileges, disclosure of information, unauthorized access, or XSS.
References: CVE-2011-3389 (SSRT100740) Remote disclosure of information CVE-2012-0883 (SSRT101209) Remote gain extended privileges CVE-2012-2110 (SSRT101210) Remote Denial of Service (DoS) CVE-2012-2311 (SSRT100992) Remote execution of arbitrary code CVE-2012-2329 (SSRT100992) Remote Denial of Service (DoS) CVE-2012-2335 (SSRT100992) Remote execution of arbitrary code CVE-2012-2336 (SSRT100992) Remote Denial of Service (DoS) CVE-2013-2355 (SSRT100696) Remote unauthorized Access CVE-2013-2356 (SSRT100835) Remote disclosure of information CVE-2013-2357 (SSRT100907) Remote Denial of Service (DoS) CVE-2013-2358 (SSRT100907) Remote Denial of Service (DoS) CVE-2013-2359 (SSRT100907) Remote Denial of Service (DoS) CVE-2013-2360 (SSRT100907) Remote Denial of Service (DoS) CVE-2013-2361 (SSRT101007) XSS CVE-2013-2362 (SSRT101076, ZDI-CAN-1676) Local Denial of Service (DoS) CVE-2013-2363 (SSRT101150) Remote disclosure of information CVE-2013-2364 (SSRT101151) XSS CVE-2013-5217 (SSRT101137) Remote unauthorized access
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP System Management Homepage (SMH) v7.2.0 and earlier running on Linux and Windows.
BACKGROUND
CVSS 2.0 Base Metrics
Reference Base Vector Base Score CVE-2011-3389 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3 CVE-2012-0883 (AV:L/AC:M/Au:N/C:C/I:C/A:C) 6.9 CVE-2012-2110 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5 CVE-2012-2311 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5 CVE-2012-2329 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0 CVE-2012-2335 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5 CVE-2012-2336 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0 CVE-2013-2355 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3 CVE-2013-2356 (AV:N/AC:L/Au:N/C:C/I:N/A:N) 7.8 CVE-2013-2357 (AV:N/AC:M/Au:S/C:N/I:N/A:C) 6.3 CVE-2013-2358 (AV:N/AC:M/Au:S/C:N/I:N/A:C) 6.3 CVE-2013-2359 (AV:N/AC:M/Au:S/C:N/I:N/A:P) 3.5 CVE-2013-2360 (AV:N/AC:M/Au:S/C:N/I:N/A:P) 3.5 CVE-2013-2361 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 4.3 CVE-2013-2362 (AV:L/AC:H/Au:S/C:N/I:N/A:P) 1.0 CVE-2013-2363 (AV:N/AC:H/Au:N/C:C/I:N/A:P) 6.1 CVE-2013-2364 (AV:N/AC:L/Au:S/C:N/I:N/A:P) 4.0 CVE-2013-5217 (AV:N/AC:H/Au:N/C:P/I:N/A:N) 2.6 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002
The Hewlett-Packard Company thanks agix for working with the TippingPoint Zero Day Initiative to report vulnerability CVE-2013-2362 to security-alert@hp.com
RESOLUTION
HP has made System Management Homepage (SMH) v7.2.1 or subsequent available for Windows and Linux to resolve the vulnerabilities.
Information and updates for SMH can be found at the following location:
http://h18013.www1.hp.com/products/servers/management/agents/index.html
HISTORY Version:1 (rev.1) - 18 July 2013 Initial release
Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com
Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins
Security Bulletin Archive: A list of recently released Security Bulletins is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/
Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB.
3C = 3COM 3P = 3rd Party Software GN = HP General Software HF = HP Hardware and Firmware MP = MPE/iX MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PI = Printing and Imaging PV = ProCurve ST = Storage Software TU = Tru64 UNIX UX = HP-UX
Copyright 2013 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners.
-----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (GNU/Linux)
iEYEARECAAYFAlHoGuMACgkQ4B86/C0qfVmlbwCg5muoKwOcRb0N/+BZa47f7lC9 CCoAoJo1hIDxLxljNZM2GDOcYGgJi1hH =kSG1 -----END PGP SIGNATURE----- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Mandriva Linux Security Advisory MDVSA-2012:068-1 http://www.mandriva.com/security/
Package : php Date : May 10, 2012 Affected: 2010.1, 2011.
Problem Description:
A vulnerability has been found and corrected in php(-cgi):
PHP-CGI-based setups contain a vulnerability when parsing query string parameters from php files.
The updated packages have been patched to correct this issue.
Update:
It was discovered that the previous fix for the CVE-2012-1823 vulnerability was incomplete (CVE-2012-2335, CVE-2012-2336). The updated packages provides the latest version (5.3.13) which provides a solution to this flaw.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1823 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2335 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2336 https://bugs.php.net/bug.php?id=61910 http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/ http://www.openwall.com/lists/oss-security/2012/05/09/9
Updated Packages:
Mandriva Linux 2010.1: 140d36ed5578274826846a0ff7ca05a9 2010.1/i586/apache-mod_php-5.3.13-0.1mdv2010.2.i586.rpm 24775050f82b736c2133fc30f93e809e 2010.1/i586/libphp5_common5-5.3.13-0.1mdv2010.2.i586.rpm f3fb19456fe4b8fd41f4306c007e85fb 2010.1/i586/php-bcmath-5.3.13-0.1mdv2010.2.i586.rpm 99a812ad5970bc37414909de5ef578fa 2010.1/i586/php-bz2-5.3.13-0.1mdv2010.2.i586.rpm 634f717747ee4db7cdd19a93ffd2d5ef 2010.1/i586/php-calendar-5.3.13-0.1mdv2010.2.i586.rpm 3429fa2b956f67b8602489e4b7d3757a 2010.1/i586/php-cgi-5.3.13-0.1mdv2010.2.i586.rpm 51a1d975e31b445ef71901cd04d8fd3a 2010.1/i586/php-cli-5.3.13-0.1mdv2010.2.i586.rpm ba763fffd3798434cb0cde5c8f7a8891 2010.1/i586/php-ctype-5.3.13-0.1mdv2010.2.i586.rpm ebf996e845619b26515e6f3e828c8fbf 2010.1/i586/php-curl-5.3.13-0.1mdv2010.2.i586.rpm ec57b30c43f5678b8cd822fd85df5e34 2010.1/i586/php-dba-5.3.13-0.1mdv2010.2.i586.rpm 85799e72a9511c0f54ff2435fba0aaab 2010.1/i586/php-devel-5.3.13-0.1mdv2010.2.i586.rpm 823c9544385c894e4c5edd1b52bf4e92 2010.1/i586/php-doc-5.3.13-0.1mdv2010.2.i586.rpm 5d753655d5615e92db188468903b8d16 2010.1/i586/php-dom-5.3.13-0.1mdv2010.2.i586.rpm 705fbff48501d08bae719a2d7841d8c2 2010.1/i586/php-enchant-5.3.13-0.1mdv2010.2.i586.rpm 4f78075bddc8fa173a7384e545e3cd5c 2010.1/i586/php-exif-5.3.13-0.1mdv2010.2.i586.rpm e8fefd604fd5006361419135c9059076 2010.1/i586/php-fileinfo-5.3.13-0.1mdv2010.2.i586.rpm bc65e927149d5277ad634b0bad8a868a 2010.1/i586/php-filter-5.3.13-0.1mdv2010.2.i586.rpm ea6a6fd721db888225dfea83a0ad99d9 2010.1/i586/php-fpm-5.3.13-0.1mdv2010.2.i586.rpm 7fb6a2914e72a63ec9401c9662f9bc2b 2010.1/i586/php-ftp-5.3.13-0.1mdv2010.2.i586.rpm 0df19020817d838aba51f052c29f6532 2010.1/i586/php-gd-5.3.13-0.1mdv2010.2.i586.rpm 5ce28c873da3fc5e0feda8e3cad2247a 2010.1/i586/php-gettext-5.3.13-0.1mdv2010.2.i586.rpm acbe524bfc8e156906c70124496a3161 2010.1/i586/php-gmp-5.3.13-0.1mdv2010.2.i586.rpm d03bc0f91411297408ac3dbbd5c426b3 2010.1/i586/php-hash-5.3.13-0.1mdv2010.2.i586.rpm 19bc92bd8b1a4ea4b86b497f5f48933c 2010.1/i586/php-iconv-5.3.13-0.1mdv2010.2.i586.rpm a891fe8d9bcbbfc4458fb31a23720338 2010.1/i586/php-imap-5.3.13-0.1mdv2010.2.i586.rpm edec73af34ecb6b42ed0a14dadb8949d 2010.1/i586/php-ini-5.3.13-0.1mdv2010.2.i586.rpm 529135563f982966be228d0e7055a97d 2010.1/i586/php-intl-5.3.13-0.1mdv2010.2.i586.rpm 2de32f3e7d7da5e06a83f9bf8eac6318 2010.1/i586/php-json-5.3.13-0.1mdv2010.2.i586.rpm 2b4f232c6bd026de886d8199dba4c2f2 2010.1/i586/php-ldap-5.3.13-0.1mdv2010.2.i586.rpm c14fe2ed7cfeb5320fed29676af9e682 2010.1/i586/php-mbstring-5.3.13-0.1mdv2010.2.i586.rpm 606e65e002f946dcf9fa8f7f3950f81d 2010.1/i586/php-mcrypt-5.3.13-0.1mdv2010.2.i586.rpm 84e35a42b7861251869a439b0031f225 2010.1/i586/php-mssql-5.3.13-0.1mdv2010.2.i586.rpm 95caf9f4d272fdeae006851e482a2461 2010.1/i586/php-mysql-5.3.13-0.1mdv2010.2.i586.rpm 5bb6f61f906e8572f66cbbcb0a3a667b 2010.1/i586/php-mysqli-5.3.13-0.1mdv2010.2.i586.rpm 28e5bdd198862a80dfea2ab9e86b9678 2010.1/i586/php-mysqlnd-5.3.13-0.1mdv2010.2.i586.rpm 802e12a27b7256dbba5b9029e7bbb00b 2010.1/i586/php-odbc-5.3.13-0.1mdv2010.2.i586.rpm f3f2b22190a0180e4adddd36ac43b808 2010.1/i586/php-openssl-5.3.13-0.1mdv2010.2.i586.rpm 850ed2a02899e7ef950368f1e6936e7b 2010.1/i586/php-pcntl-5.3.13-0.1mdv2010.2.i586.rpm 128bc6c67ee8960e29c893a0a210f967 2010.1/i586/php-pdo-5.3.13-0.1mdv2010.2.i586.rpm 31d3d8d11a8ec860ff748b4491ed637d 2010.1/i586/php-pdo_dblib-5.3.13-0.1mdv2010.2.i586.rpm 840fd711e567a690f46a5aa686a47019 2010.1/i586/php-pdo_mysql-5.3.13-0.1mdv2010.2.i586.rpm 6b979eef99f357fc4e283c98c5ef96ea 2010.1/i586/php-pdo_odbc-5.3.13-0.1mdv2010.2.i586.rpm 9b5d0ca325bbfcf6b87f74748caceb76 2010.1/i586/php-pdo_pgsql-5.3.13-0.1mdv2010.2.i586.rpm 70c688be75e34b79a9a35462570a2ada 2010.1/i586/php-pdo_sqlite-5.3.13-0.1mdv2010.2.i586.rpm e67f4f8ded56378452b8a548b126266b 2010.1/i586/php-pgsql-5.3.13-0.1mdv2010.2.i586.rpm 4d26258bb774b1d9aff74d3fdc1e3c2c 2010.1/i586/php-phar-5.3.13-0.1mdv2010.2.i586.rpm 74bc08429969529762425997772f8a5d 2010.1/i586/php-posix-5.3.13-0.1mdv2010.2.i586.rpm e697d56093f50bbde693541d67b7566c 2010.1/i586/php-pspell-5.3.13-0.1mdv2010.2.i586.rpm 0fc94be46e664a52fbc9111958cd4146 2010.1/i586/php-readline-5.3.13-0.1mdv2010.2.i586.rpm af7e1bb5a2722063cc52af223dc90787 2010.1/i586/php-recode-5.3.13-0.1mdv2010.2.i586.rpm fee14325fb3a764988c4e2a69c7938b4 2010.1/i586/php-session-5.3.13-0.1mdv2010.2.i586.rpm e89aba4b7dec345be125261046d31b92 2010.1/i586/php-shmop-5.3.13-0.1mdv2010.2.i586.rpm 69f2a66fef9892c0405d3a03c72096b2 2010.1/i586/php-snmp-5.3.13-0.1mdv2010.2.i586.rpm 4db2b4b3d7670603b5922a122dc975aa 2010.1/i586/php-soap-5.3.13-0.1mdv2010.2.i586.rpm e02779584cc1c588d75346f6995ad5a6 2010.1/i586/php-sockets-5.3.13-0.1mdv2010.2.i586.rpm aae3b1c32441f481c49f7f38c1c96294 2010.1/i586/php-sqlite3-5.3.13-0.1mdv2010.2.i586.rpm b4255e1825f289410b71b6a210229b8e 2010.1/i586/php-sqlite-5.3.13-0.1mdv2010.2.i586.rpm dd54ede221fd579f1ebd81be6930010b 2010.1/i586/php-sybase_ct-5.3.13-0.1mdv2010.2.i586.rpm 4bdebc41d1b654e904d39c8f89be51a2 2010.1/i586/php-sysvmsg-5.3.13-0.1mdv2010.2.i586.rpm 3d485895eca51f5f801323baf1f0f8bf 2010.1/i586/php-sysvsem-5.3.13-0.1mdv2010.2.i586.rpm a5c65e02a46da5f9a1be3235565926a3 2010.1/i586/php-sysvshm-5.3.13-0.1mdv2010.2.i586.rpm 1a1e6a0a91388e7113f2774bb0f16c01 2010.1/i586/php-tidy-5.3.13-0.1mdv2010.2.i586.rpm cf565e35c341273ed2b4378c9f0980c8 2010.1/i586/php-tokenizer-5.3.13-0.1mdv2010.2.i586.rpm b1fd12591b6500464a97eb2ae47b2f60 2010.1/i586/php-wddx-5.3.13-0.1mdv2010.2.i586.rpm f0f801ce893ad8eb55bb21d010af641a 2010.1/i586/php-xml-5.3.13-0.1mdv2010.2.i586.rpm 055873d10551544750bd05555cc63155 2010.1/i586/php-xmlreader-5.3.13-0.1mdv2010.2.i586.rpm 69a6e3930ed1b2d1ddac5df5719bc6d6 2010.1/i586/php-xmlrpc-5.3.13-0.1mdv2010.2.i586.rpm de7f360c56f74b036ea924d9f7c76b59 2010.1/i586/php-xmlwriter-5.3.13-0.1mdv2010.2.i586.rpm 4cbd130cf269dd2769dd084322eaf77a 2010.1/i586/php-xsl-5.3.13-0.1mdv2010.2.i586.rpm 1d32b52e968a2bd7c4ff6b640f38ae36 2010.1/i586/php-zip-5.3.13-0.1mdv2010.2.i586.rpm 9508241b048c6acc033c16494f797289 2010.1/i586/php-zlib-5.3.13-0.1mdv2010.2.i586.rpm cd0e0682df60061148366ab6b10394d2 2010.1/SRPMS/apache-mod_php-5.3.13-0.1mdv2010.2.src.rpm f454d177e9bd631df2a4eeca3d33fe38 2010.1/SRPMS/php-5.3.13-0.1mdv2010.2.src.rpm 281be8fe2bb8cd404ade445f64c616da 2010.1/SRPMS/php-ini-5.3.13-0.1mdv2010.2.src.rpm
Mandriva Linux 2010.1/X86_64: 5c32f90215090901240e661f8e2224a9 2010.1/x86_64/apache-mod_php-5.3.13-0.1mdv2010.2.x86_64.rpm c21032781b826fe3a8202eff5b7ef8b5 2010.1/x86_64/lib64php5_common5-5.3.13-0.1mdv2010.2.x86_64.rpm a2d0b2b43aa856d5872679d455e56a1e 2010.1/x86_64/php-bcmath-5.3.13-0.1mdv2010.2.x86_64.rpm 5421084c1b946cb2c5eeebfed07ac829 2010.1/x86_64/php-bz2-5.3.13-0.1mdv2010.2.x86_64.rpm 48aa03dcba36a09689dc6c7f2497741c 2010.1/x86_64/php-calendar-5.3.13-0.1mdv2010.2.x86_64.rpm c503b930c9d60cbd4d4ea58d8a6deda7 2010.1/x86_64/php-cgi-5.3.13-0.1mdv2010.2.x86_64.rpm 228b72cbf197c817d866d1fe3c7ed6b2 2010.1/x86_64/php-cli-5.3.13-0.1mdv2010.2.x86_64.rpm c9435be90a6e5fae1a980109c9bc9aca 2010.1/x86_64/php-ctype-5.3.13-0.1mdv2010.2.x86_64.rpm 0eb2e95722b4af3006f560c8441d687f 2010.1/x86_64/php-curl-5.3.13-0.1mdv2010.2.x86_64.rpm ccebc661c63d1028540c1212de90bbae 2010.1/x86_64/php-dba-5.3.13-0.1mdv2010.2.x86_64.rpm 2edc5f5c47a0ee2bbf001fae9024849f 2010.1/x86_64/php-devel-5.3.13-0.1mdv2010.2.x86_64.rpm 3b3eeb211bf45ede0abaae347d8bc745 2010.1/x86_64/php-doc-5.3.13-0.1mdv2010.2.x86_64.rpm 29f9a4fcee784caeaa54d88ae6f1fda9 2010.1/x86_64/php-dom-5.3.13-0.1mdv2010.2.x86_64.rpm eda0d150731e178912024b0ff6665835 2010.1/x86_64/php-enchant-5.3.13-0.1mdv2010.2.x86_64.rpm cf52bd1d68b75ba6841fe6258b9a1f69 2010.1/x86_64/php-exif-5.3.13-0.1mdv2010.2.x86_64.rpm 0243226aa4bf036a4054b48966f80cf3 2010.1/x86_64/php-fileinfo-5.3.13-0.1mdv2010.2.x86_64.rpm a5bca21277b5c72133340ea059cf0df0 2010.1/x86_64/php-filter-5.3.13-0.1mdv2010.2.x86_64.rpm 3c7007006b1d93d8c96e86dcf27ea38b 2010.1/x86_64/php-fpm-5.3.13-0.1mdv2010.2.x86_64.rpm f9549d4ed2973e5c1519546e971fd81a 2010.1/x86_64/php-ftp-5.3.13-0.1mdv2010.2.x86_64.rpm c7231a7117abab68e8c4d1a3f6a80ccb 2010.1/x86_64/php-gd-5.3.13-0.1mdv2010.2.x86_64.rpm 0ca2c9679c082508a4c2b007ec5a8c46 2010.1/x86_64/php-gettext-5.3.13-0.1mdv2010.2.x86_64.rpm 7d0de98a757251e874aff11ab76db12b 2010.1/x86_64/php-gmp-5.3.13-0.1mdv2010.2.x86_64.rpm 8757a89019988ab9b689c282ae06cf01 2010.1/x86_64/php-hash-5.3.13-0.1mdv2010.2.x86_64.rpm 996f5bcb88fc855db3cc4c779897a9ad 2010.1/x86_64/php-iconv-5.3.13-0.1mdv2010.2.x86_64.rpm 1580fd0ebb4ff0bd0e3c2a6e8925fc8a 2010.1/x86_64/php-imap-5.3.13-0.1mdv2010.2.x86_64.rpm 89a3915683d63a757fa29e53fadf0e1d 2010.1/x86_64/php-ini-5.3.13-0.1mdv2010.2.x86_64.rpm 38115fadfb51fdfd10ea14def4d9143d 2010.1/x86_64/php-intl-5.3.13-0.1mdv2010.2.x86_64.rpm 06aaaa6c43d85283ba31e079f9e1e0e0 2010.1/x86_64/php-json-5.3.13-0.1mdv2010.2.x86_64.rpm b9f6e00a0ac3916b91442ed6c62ad440 2010.1/x86_64/php-ldap-5.3.13-0.1mdv2010.2.x86_64.rpm 9b634f67d80ba028247dafe559276859 2010.1/x86_64/php-mbstring-5.3.13-0.1mdv2010.2.x86_64.rpm bd39ac4808035578dec2e24a98457b03 2010.1/x86_64/php-mcrypt-5.3.13-0.1mdv2010.2.x86_64.rpm 4acc008044469403769de09af155f0d5 2010.1/x86_64/php-mssql-5.3.13-0.1mdv2010.2.x86_64.rpm 8d5826fa6ba3dcaf214839a654e74659 2010.1/x86_64/php-mysql-5.3.13-0.1mdv2010.2.x86_64.rpm ea0e352e2900b493b9d355257ec99a4e 2010.1/x86_64/php-mysqli-5.3.13-0.1mdv2010.2.x86_64.rpm 40b23996dd377b3699ca230f30451e09 2010.1/x86_64/php-mysqlnd-5.3.13-0.1mdv2010.2.x86_64.rpm 4a49bad04937598951093dbf1e57eb19 2010.1/x86_64/php-odbc-5.3.13-0.1mdv2010.2.x86_64.rpm ef337452c999c609f38511b30424aa95 2010.1/x86_64/php-openssl-5.3.13-0.1mdv2010.2.x86_64.rpm 8adda9b3ac67749c4cbbca498fe97042 2010.1/x86_64/php-pcntl-5.3.13-0.1mdv2010.2.x86_64.rpm aab08edd87702937cc87e3eea9683e04 2010.1/x86_64/php-pdo-5.3.13-0.1mdv2010.2.x86_64.rpm b769d4729112be42057acbecc42784fd 2010.1/x86_64/php-pdo_dblib-5.3.13-0.1mdv2010.2.x86_64.rpm 51f45520e81ae006da36c27e9ff23d29 2010.1/x86_64/php-pdo_mysql-5.3.13-0.1mdv2010.2.x86_64.rpm 337fef4ac991f694fbc52f1b51292f0e 2010.1/x86_64/php-pdo_odbc-5.3.13-0.1mdv2010.2.x86_64.rpm ee046601f134c275c1c5394156868176 2010.1/x86_64/php-pdo_pgsql-5.3.13-0.1mdv2010.2.x86_64.rpm f1b25be0d7a2e6948dd6d95776da6f27 2010.1/x86_64/php-pdo_sqlite-5.3.13-0.1mdv2010.2.x86_64.rpm c61a1bc81075ebfc94e820984597774b 2010.1/x86_64/php-pgsql-5.3.13-0.1mdv2010.2.x86_64.rpm 11bed7992443f01305ad4ce8304e9f07 2010.1/x86_64/php-phar-5.3.13-0.1mdv2010.2.x86_64.rpm dd6008750a431325112944e3a5783d0c 2010.1/x86_64/php-posix-5.3.13-0.1mdv2010.2.x86_64.rpm f5531db71580b0c17c5796cfd79f4020 2010.1/x86_64/php-pspell-5.3.13-0.1mdv2010.2.x86_64.rpm 80c9841836ea5246babb676ce79adb9d 2010.1/x86_64/php-readline-5.3.13-0.1mdv2010.2.x86_64.rpm 6271ebd8132c7d94513646d0bbfedf15 2010.1/x86_64/php-recode-5.3.13-0.1mdv2010.2.x86_64.rpm 77e395b19c6068c941cc1ee1c89e15c6 2010.1/x86_64/php-session-5.3.13-0.1mdv2010.2.x86_64.rpm b310511e16b059f753cef3fbe39a35b0 2010.1/x86_64/php-shmop-5.3.13-0.1mdv2010.2.x86_64.rpm 70b99d0120ea8c6018a327996314ab49 2010.1/x86_64/php-snmp-5.3.13-0.1mdv2010.2.x86_64.rpm 33f829a30afaeab74203389d8a48a2d9 2010.1/x86_64/php-soap-5.3.13-0.1mdv2010.2.x86_64.rpm 64295e56e1c81c3322aa49bd1bf2d838 2010.1/x86_64/php-sockets-5.3.13-0.1mdv2010.2.x86_64.rpm 9afd6ba7da1e9ffa58a33c822eeb6a9d 2010.1/x86_64/php-sqlite3-5.3.13-0.1mdv2010.2.x86_64.rpm 8f8e7ee68199f5fdb8867b10d8cede5a 2010.1/x86_64/php-sqlite-5.3.13-0.1mdv2010.2.x86_64.rpm 84d824d25bcd058301b8a8cac4eece97 2010.1/x86_64/php-sybase_ct-5.3.13-0.1mdv2010.2.x86_64.rpm cdd27855aa2b685fba70fea949d0f8f5 2010.1/x86_64/php-sysvmsg-5.3.13-0.1mdv2010.2.x86_64.rpm 47714ed1a09513b0fa4016fed1faf374 2010.1/x86_64/php-sysvsem-5.3.13-0.1mdv2010.2.x86_64.rpm 878cc21a21bcb9120f0c60d0dc3c848d 2010.1/x86_64/php-sysvshm-5.3.13-0.1mdv2010.2.x86_64.rpm ed7017d81df4e68da01f9d790c5e9e75 2010.1/x86_64/php-tidy-5.3.13-0.1mdv2010.2.x86_64.rpm e2dbcbefd496f408e56c5072938f62d6 2010.1/x86_64/php-tokenizer-5.3.13-0.1mdv2010.2.x86_64.rpm c629479463912ae1d91c4399e5b05f67 2010.1/x86_64/php-wddx-5.3.13-0.1mdv2010.2.x86_64.rpm 5a71b4a2a66aa994585f3372f13ad969 2010.1/x86_64/php-xml-5.3.13-0.1mdv2010.2.x86_64.rpm 9e99f81386d263bf395a4462ce3333f8 2010.1/x86_64/php-xmlreader-5.3.13-0.1mdv2010.2.x86_64.rpm 76c565d3fdcba0133b6c25a914a4fed3 2010.1/x86_64/php-xmlrpc-5.3.13-0.1mdv2010.2.x86_64.rpm af3b32c6d60342fb5c7a7c455f647f34 2010.1/x86_64/php-xmlwriter-5.3.13-0.1mdv2010.2.x86_64.rpm 31a1efcba8488b85ec31054bea181262 2010.1/x86_64/php-xsl-5.3.13-0.1mdv2010.2.x86_64.rpm d3b08c3d48baefa3ee14632b876100fb 2010.1/x86_64/php-zip-5.3.13-0.1mdv2010.2.x86_64.rpm a6a3b117484b1bb2e7d449c08fa49b46 2010.1/x86_64/php-zlib-5.3.13-0.1mdv2010.2.x86_64.rpm cd0e0682df60061148366ab6b10394d2 2010.1/SRPMS/apache-mod_php-5.3.13-0.1mdv2010.2.src.rpm f454d177e9bd631df2a4eeca3d33fe38 2010.1/SRPMS/php-5.3.13-0.1mdv2010.2.src.rpm 281be8fe2bb8cd404ade445f64c616da 2010.1/SRPMS/php-ini-5.3.13-0.1mdv2010.2.src.rpm
Mandriva Linux 2011: 35cdd956ce62db7548d2626d8a8f7ae8 2011/i586/apache-mod_php-5.3.13-0.1-mdv2011.0.i586.rpm dd02a276ddca3ae7ad754e19a41e8ff8 2011/i586/libphp5_common5-5.3.13-0.1-mdv2011.0.i586.rpm 7a8feff11aa910f94074c57b54a124d6 2011/i586/php-bcmath-5.3.13-0.1-mdv2011.0.i586.rpm 3c70edc391c1c8fb7845f81f3b3f5bac 2011/i586/php-bz2-5.3.13-0.1-mdv2011.0.i586.rpm d8020203023aaf02a30b22559d5a67c7 2011/i586/php-calendar-5.3.13-0.1-mdv2011.0.i586.rpm e0f010a7d61cf27e13a486ff6e5d6ce4 2011/i586/php-cgi-5.3.13-0.1-mdv2011.0.i586.rpm 345ee6e60bc1973f0049ab25f7dc3557 2011/i586/php-cli-5.3.13-0.1-mdv2011.0.i586.rpm c4e851c0260ad96797ca56deb2b6f3c7 2011/i586/php-ctype-5.3.13-0.1-mdv2011.0.i586.rpm 073d81d6531862861015cf7f53173045 2011/i586/php-curl-5.3.13-0.1-mdv2011.0.i586.rpm 1330fd10a3bdd3787913db7795054819 2011/i586/php-dba-5.3.13-0.1-mdv2011.0.i586.rpm b6d0fefa9206b7cd3f4c73744c324906 2011/i586/php-devel-5.3.13-0.1-mdv2011.0.i586.rpm 32a9567d7a61d6f35654e8d33baec58a 2011/i586/php-doc-5.3.13-0.1-mdv2011.0.i586.rpm 149566d373265e732f1ec3140d11cac2 2011/i586/php-dom-5.3.13-0.1-mdv2011.0.i586.rpm 6f4b1fe24a35809c93e9489347c448bb 2011/i586/php-enchant-5.3.13-0.1-mdv2011.0.i586.rpm 44f27021f7ff8202f5f34a8b0720be5b 2011/i586/php-exif-5.3.13-0.1-mdv2011.0.i586.rpm 5d32e3e7dc217fd69b6dc99dffb747f7 2011/i586/php-fileinfo-5.3.13-0.1-mdv2011.0.i586.rpm 043c17fad24c3113600799c63c5dde18 2011/i586/php-filter-5.3.13-0.1-mdv2011.0.i586.rpm 08c16e8ec2f1c821df8090c38c43809b 2011/i586/php-fpm-5.3.13-0.1-mdv2011.0.i586.rpm 209b4baf966b45cb48790e7a020b1aa9 2011/i586/php-ftp-5.3.13-0.1-mdv2011.0.i586.rpm eac85767ff89fcf822b2c2cf408b2aca 2011/i586/php-gd-5.3.13-0.1-mdv2011.0.i586.rpm 7c7c5ab6370c934b727dac2ad1c9bd33 2011/i586/php-gettext-5.3.13-0.1-mdv2011.0.i586.rpm babb1410dd897504ec526243789fd749 2011/i586/php-gmp-5.3.13-0.1-mdv2011.0.i586.rpm 63feb83eda18663f3ae28fee522a79c8 2011/i586/php-hash-5.3.13-0.1-mdv2011.0.i586.rpm a8aad04e3c20f9223832632f412c4c69 2011/i586/php-iconv-5.3.13-0.1-mdv2011.0.i586.rpm 22f5f2b807af8ea7445e8682f6718ab2 2011/i586/php-imap-5.3.13-0.1-mdv2011.0.i586.rpm ff780d80135cc18647edecdde6b77e16 2011/i586/php-ini-5.3.13-0.1-mdv2011.0.i586.rpm 10475ddafeeb384ae3afb7f5d2d1afa8 2011/i586/php-intl-5.3.13-0.1-mdv2011.0.i586.rpm e3261da452695aed46718ec06a1f17ed 2011/i586/php-json-5.3.13-0.1-mdv2011.0.i586.rpm f6238f4f4566582418666333eb797994 2011/i586/php-ldap-5.3.13-0.1-mdv2011.0.i586.rpm 9ae1d9fc8320fa272fa56484f425e7d8 2011/i586/php-mbstring-5.3.13-0.1-mdv2011.0.i586.rpm 86710277f0bca955ced6610b199fcf16 2011/i586/php-mcrypt-5.3.13-0.1-mdv2011.0.i586.rpm a9dad85e7658b897bcd9a3c088a71168 2011/i586/php-mssql-5.3.13-0.1-mdv2011.0.i586.rpm 66063a764c3a2b90143c5653c0f1dd2c 2011/i586/php-mysql-5.3.13-0.1-mdv2011.0.i586.rpm c7993bdf0b9ceaf4f2fa86dbc558ddfb 2011/i586/php-mysqli-5.3.13-0.1-mdv2011.0.i586.rpm afcd3e1e62498bffaa9432c5d5c505f5 2011/i586/php-mysqlnd-5.3.13-0.1-mdv2011.0.i586.rpm 21a837c5413d3e89b7747b70b343ff39 2011/i586/php-odbc-5.3.13-0.1-mdv2011.0.i586.rpm 9653980157e82a7cc1fcb428e6a11831 2011/i586/php-openssl-5.3.13-0.1-mdv2011.0.i586.rpm 2a7283323df15b449a0911147e4e120a 2011/i586/php-pcntl-5.3.13-0.1-mdv2011.0.i586.rpm 5943398e22f4b3aab9fb741e7b6a8014 2011/i586/php-pdo-5.3.13-0.1-mdv2011.0.i586.rpm 4a8632f0605a849c61148479c3dce11c 2011/i586/php-pdo_dblib-5.3.13-0.1-mdv2011.0.i586.rpm 90bfc85fce2cf88d5cc7e9d383bac674 2011/i586/php-pdo_mysql-5.3.13-0.1-mdv2011.0.i586.rpm 13a2e35fe9389ceff1bd86915d4fbb45 2011/i586/php-pdo_odbc-5.3.13-0.1-mdv2011.0.i586.rpm bd5ac6d3de510f5648e0796262ee0284 2011/i586/php-pdo_pgsql-5.3.13-0.1-mdv2011.0.i586.rpm c8a144f194b2e263d30d42549ef72df7 2011/i586/php-pdo_sqlite-5.3.13-0.1-mdv2011.0.i586.rpm 9fc72c845adc2c8b526ccda1045e95cb 2011/i586/php-pgsql-5.3.13-0.1-mdv2011.0.i586.rpm ceed9de56ba7babbb1103c0505360ae8 2011/i586/php-phar-5.3.13-0.1-mdv2011.0.i586.rpm 99df22a88e7ec65277c5f1d67946b674 2011/i586/php-posix-5.3.13-0.1-mdv2011.0.i586.rpm 2a7c90e39eaed912fd8ef49d5edcf3b0 2011/i586/php-pspell-5.3.13-0.1-mdv2011.0.i586.rpm b4f54f67b9372e1bef78b6a40a756d31 2011/i586/php-readline-5.3.13-0.1-mdv2011.0.i586.rpm c3ab166b9fc83521a75c13dff80f3a56 2011/i586/php-recode-5.3.13-0.1-mdv2011.0.i586.rpm a6c67fe24586ad45656a0e11906e7bb3 2011/i586/php-session-5.3.13-0.1-mdv2011.0.i586.rpm 39dd1f3c8218f0537aad8f03aa96b833 2011/i586/php-shmop-5.3.13-0.1-mdv2011.0.i586.rpm 7d516b28e8f45f06883657d93d152c31 2011/i586/php-snmp-5.3.13-0.1-mdv2011.0.i586.rpm 511c2eadd6584227584704adf97150e9 2011/i586/php-soap-5.3.13-0.1-mdv2011.0.i586.rpm d2bb4858eb41257b9e3c72b385b55fed 2011/i586/php-sockets-5.3.13-0.1-mdv2011.0.i586.rpm ef20af5ac9def94fc4db18e4e9ef80f3 2011/i586/php-sqlite3-5.3.13-0.1-mdv2011.0.i586.rpm d87d2f151f37050dd9f3d1fb66cc5be6 2011/i586/php-sqlite-5.3.13-0.1-mdv2011.0.i586.rpm 1214cb4bc37c7fb285dd6c2f00411904 2011/i586/php-sybase_ct-5.3.13-0.1-mdv2011.0.i586.rpm 1bd2a3a7f3408e7e304190e4145cec7f 2011/i586/php-sysvmsg-5.3.13-0.1-mdv2011.0.i586.rpm 602e9fbc2dd26d526709da1fbb5f43a3 2011/i586/php-sysvsem-5.3.13-0.1-mdv2011.0.i586.rpm 1f4d61a55c51175890bf3fe8da58178b 2011/i586/php-sysvshm-5.3.13-0.1-mdv2011.0.i586.rpm 7f81e3126928fd1e48e61a04e978e549 2011/i586/php-tidy-5.3.13-0.1-mdv2011.0.i586.rpm a2ea94863a07932b8cc8adfaf9984801 2011/i586/php-tokenizer-5.3.13-0.1-mdv2011.0.i586.rpm 7ca9553c6d0280546bc198cf7e349fd0 2011/i586/php-wddx-5.3.13-0.1-mdv2011.0.i586.rpm 2657cd50ab3d1ed89c40dd022b18a78a 2011/i586/php-xml-5.3.13-0.1-mdv2011.0.i586.rpm 4484a28aa070a5507ca51b7b6ccd9c4f 2011/i586/php-xmlreader-5.3.13-0.1-mdv2011.0.i586.rpm fb655f70ba8fd02cb283c685fb32198d 2011/i586/php-xmlrpc-5.3.13-0.1-mdv2011.0.i586.rpm 595eb1d07062b9ea1cbfa4db0c858b24 2011/i586/php-xmlwriter-5.3.13-0.1-mdv2011.0.i586.rpm 13c04bf3f0134e29372d595589f59193 2011/i586/php-xsl-5.3.13-0.1-mdv2011.0.i586.rpm 0a98ea3d088772271f96eeb7a5f23ba2 2011/i586/php-zip-5.3.13-0.1-mdv2011.0.i586.rpm e5242f7e29696cf3f9a80eb65ac97184 2011/i586/php-zlib-5.3.13-0.1-mdv2011.0.i586.rpm 43577b68968398f3e83bbb150c2ba4dd 2011/SRPMS/apache-mod_php-5.3.13-0.1.src.rpm 75c0847b9bfff7a4ecf5f5097e39b5e0 2011/SRPMS/php-5.3.13-0.1.src.rpm daa6819e438adce22445ffb6f25c10f0 2011/SRPMS/php-ini-5.3.13-0.1.src.rpm
Mandriva Linux 2011/X86_64: 6f1b882d07cd219f673c90396542719e 2011/x86_64/apache-mod_php-5.3.13-0.1-mdv2011.0.x86_64.rpm 11c80f46a5669769a85ef8f391d07a70 2011/x86_64/lib64php5_common5-5.3.13-0.1-mdv2011.0.x86_64.rpm 7e4e71c5b17031412c13ea2d9b2477c5 2011/x86_64/php-bcmath-5.3.13-0.1-mdv2011.0.x86_64.rpm 528be2af28cf1a4843850e1b565c3898 2011/x86_64/php-bz2-5.3.13-0.1-mdv2011.0.x86_64.rpm 39b482e7037283b454056f4882d5917b 2011/x86_64/php-calendar-5.3.13-0.1-mdv2011.0.x86_64.rpm 9829b1d862405439321b3ecbfb4c7ea1 2011/x86_64/php-cgi-5.3.13-0.1-mdv2011.0.x86_64.rpm 5e705973df7b6c201fabeb2c75d3a74a 2011/x86_64/php-cli-5.3.13-0.1-mdv2011.0.x86_64.rpm eb3b69da40fb3992024aa0a9fea15a8d 2011/x86_64/php-ctype-5.3.13-0.1-mdv2011.0.x86_64.rpm a7fd1763425d19677b6adc88a835770f 2011/x86_64/php-curl-5.3.13-0.1-mdv2011.0.x86_64.rpm 0a4712efbe6fd4e1d2590842f620982c 2011/x86_64/php-dba-5.3.13-0.1-mdv2011.0.x86_64.rpm ca749d3257f0bb0595a6495816d17c29 2011/x86_64/php-devel-5.3.13-0.1-mdv2011.0.x86_64.rpm 56a0d712c402bcddcaba739f35ea07a6 2011/x86_64/php-doc-5.3.13-0.1-mdv2011.0.x86_64.rpm 2a6cf45b3a94ae3e571e3dbcbbc08804 2011/x86_64/php-dom-5.3.13-0.1-mdv2011.0.x86_64.rpm 0f109c681babe75db077f8d9af926f85 2011/x86_64/php-enchant-5.3.13-0.1-mdv2011.0.x86_64.rpm 7d419c4fd0f8180bb777b4b198dbf192 2011/x86_64/php-exif-5.3.13-0.1-mdv2011.0.x86_64.rpm befa5de9e5e4a3a2ab04a4899a0c654e 2011/x86_64/php-fileinfo-5.3.13-0.1-mdv2011.0.x86_64.rpm ef19b2adb8544747b6dbc673d5b758cd 2011/x86_64/php-filter-5.3.13-0.1-mdv2011.0.x86_64.rpm 42952a220d307fab9e88012a0db43ecd 2011/x86_64/php-fpm-5.3.13-0.1-mdv2011.0.x86_64.rpm 40c04426bafdec1b7ac6efd7e80112e3 2011/x86_64/php-ftp-5.3.13-0.1-mdv2011.0.x86_64.rpm 4fb018ed2383c082d45e4b75a346d588 2011/x86_64/php-gd-5.3.13-0.1-mdv2011.0.x86_64.rpm 7237c26a2db73c6a115fc4e035ecb0f2 2011/x86_64/php-gettext-5.3.13-0.1-mdv2011.0.x86_64.rpm 1a474b43b899509ba9516fa042fe1ddd 2011/x86_64/php-gmp-5.3.13-0.1-mdv2011.0.x86_64.rpm 28e8e4748273a5ccaeb65b54d666402f 2011/x86_64/php-hash-5.3.13-0.1-mdv2011.0.x86_64.rpm d3f5e9dfc04ce0ad319884c2501529c4 2011/x86_64/php-iconv-5.3.13-0.1-mdv2011.0.x86_64.rpm c166f30d0bab63ab66c91fdc7f23109e 2011/x86_64/php-imap-5.3.13-0.1-mdv2011.0.x86_64.rpm c2a6c0df9bdb831fa633b00afe1656ca 2011/x86_64/php-ini-5.3.13-0.1-mdv2011.0.x86_64.rpm 8ef06e0d3bc50c6af030273db341f33f 2011/x86_64/php-intl-5.3.13-0.1-mdv2011.0.x86_64.rpm 5e59fb195dd577622ba638e6f61301ce 2011/x86_64/php-json-5.3.13-0.1-mdv2011.0.x86_64.rpm 51d4d134118097c396fd9ae22658fd95 2011/x86_64/php-ldap-5.3.13-0.1-mdv2011.0.x86_64.rpm 43089444e735a7fb955f4b2073a89b8e 2011/x86_64/php-mbstring-5.3.13-0.1-mdv2011.0.x86_64.rpm 67cb0bb2abf2ac499616a9f6b67e42a4 2011/x86_64/php-mcrypt-5.3.13-0.1-mdv2011.0.x86_64.rpm 6167541236c972e1b3ca07ab4e3aa435 2011/x86_64/php-mssql-5.3.13-0.1-mdv2011.0.x86_64.rpm 8169e0c8a9121ed5b088e50f729a08f2 2011/x86_64/php-mysql-5.3.13-0.1-mdv2011.0.x86_64.rpm a9f88ce7ae03e6c9614bbbe77badd211 2011/x86_64/php-mysqli-5.3.13-0.1-mdv2011.0.x86_64.rpm 09ffa27ee341ea0f316c001302dc6b4f 2011/x86_64/php-mysqlnd-5.3.13-0.1-mdv2011.0.x86_64.rpm 52eca2dca4ad432fdb9ca2a42f8af637 2011/x86_64/php-odbc-5.3.13-0.1-mdv2011.0.x86_64.rpm f6e46b6f5ad8a961cbfde8b8e767054a 2011/x86_64/php-openssl-5.3.13-0.1-mdv2011.0.x86_64.rpm 3dd5efd7a83830669edf081f84a6ddd0 2011/x86_64/php-pcntl-5.3.13-0.1-mdv2011.0.x86_64.rpm f000fb58640165fa93eb8939c88f51b9 2011/x86_64/php-pdo-5.3.13-0.1-mdv2011.0.x86_64.rpm e91e95bb78ee4ccc6edc8a676cf83331 2011/x86_64/php-pdo_dblib-5.3.13-0.1-mdv2011.0.x86_64.rpm 82ca0b0fa4daa2d13d351f57cac4b1ad 2011/x86_64/php-pdo_mysql-5.3.13-0.1-mdv2011.0.x86_64.rpm 2a2e4cf2e7b3d6c718072e34bbf1f4d5 2011/x86_64/php-pdo_odbc-5.3.13-0.1-mdv2011.0.x86_64.rpm bae3bd360ca8da31e3444555b1ba5984 2011/x86_64/php-pdo_pgsql-5.3.13-0.1-mdv2011.0.x86_64.rpm 265ffe4fec20f1a276a4ae598f897097 2011/x86_64/php-pdo_sqlite-5.3.13-0.1-mdv2011.0.x86_64.rpm de5791ef4c4f09caf289efcc2946bd40 2011/x86_64/php-pgsql-5.3.13-0.1-mdv2011.0.x86_64.rpm 3e5a5c8d71d73d792f6a9c5d1d1ff0e0 2011/x86_64/php-phar-5.3.13-0.1-mdv2011.0.x86_64.rpm 1b106b0000d8cf09217a8c6066a08abe 2011/x86_64/php-posix-5.3.13-0.1-mdv2011.0.x86_64.rpm 4142e252a6e80033b49966678333d4fc 2011/x86_64/php-pspell-5.3.13-0.1-mdv2011.0.x86_64.rpm 2eaa627598b484e870a745dfce89561c 2011/x86_64/php-readline-5.3.13-0.1-mdv2011.0.x86_64.rpm 16aa5e0d0038dad164fd251584267b25 2011/x86_64/php-recode-5.3.13-0.1-mdv2011.0.x86_64.rpm 1f2221028312e63a8fe0153b0f37268d 2011/x86_64/php-session-5.3.13-0.1-mdv2011.0.x86_64.rpm 08339bda25dfc15853d8f4f3093906b5 2011/x86_64/php-shmop-5.3.13-0.1-mdv2011.0.x86_64.rpm af74d89511d56956fd18f47588c8134a 2011/x86_64/php-snmp-5.3.13-0.1-mdv2011.0.x86_64.rpm a60760ee2c728bcd933f7f129918e20f 2011/x86_64/php-soap-5.3.13-0.1-mdv2011.0.x86_64.rpm 23edc8e373f493137a741d3f5b8a776f 2011/x86_64/php-sockets-5.3.13-0.1-mdv2011.0.x86_64.rpm 0ee3559a3748ba690ee5c4f99a324b1e 2011/x86_64/php-sqlite3-5.3.13-0.1-mdv2011.0.x86_64.rpm a4b3e977bffee9f122cb6e9582edb3f1 2011/x86_64/php-sqlite-5.3.13-0.1-mdv2011.0.x86_64.rpm edcf9dd12733f50cc808a336b26e0fe2 2011/x86_64/php-sybase_ct-5.3.13-0.1-mdv2011.0.x86_64.rpm d6cd75e157f0b6b026444a1407cf90a7 2011/x86_64/php-sysvmsg-5.3.13-0.1-mdv2011.0.x86_64.rpm 0c283bd1ae67f256a6e776f35e36b30c 2011/x86_64/php-sysvsem-5.3.13-0.1-mdv2011.0.x86_64.rpm 85f7cb718011e2ff913ce142a12a6343 2011/x86_64/php-sysvshm-5.3.13-0.1-mdv2011.0.x86_64.rpm 63b205689a9cb3929379ce8c6415fecc 2011/x86_64/php-tidy-5.3.13-0.1-mdv2011.0.x86_64.rpm addd08fffff1581bfa703aeba53c5566 2011/x86_64/php-tokenizer-5.3.13-0.1-mdv2011.0.x86_64.rpm 138500dc24f46346ae847fc2f56ca7a7 2011/x86_64/php-wddx-5.3.13-0.1-mdv2011.0.x86_64.rpm 27801c8421becc9030eb1e2e06342efe 2011/x86_64/php-xml-5.3.13-0.1-mdv2011.0.x86_64.rpm 1fefd162d7a627212ccca1ecda6ccdf2 2011/x86_64/php-xmlreader-5.3.13-0.1-mdv2011.0.x86_64.rpm 2e6d1bbc2319425bfe20b189f4fe4b79 2011/x86_64/php-xmlrpc-5.3.13-0.1-mdv2011.0.x86_64.rpm 421888369bc51fcfcb7a0fcedb23e3e4 2011/x86_64/php-xmlwriter-5.3.13-0.1-mdv2011.0.x86_64.rpm f5d79e3adf80fadf2f185db98ec3b142 2011/x86_64/php-xsl-5.3.13-0.1-mdv2011.0.x86_64.rpm e126fa1b8d8f0a7c18bae56a00345299 2011/x86_64/php-zip-5.3.13-0.1-mdv2011.0.x86_64.rpm a8492adb1cc9cd92d2771d151161ac2e 2011/x86_64/php-zlib-5.3.13-0.1-mdv2011.0.x86_64.rpm 43577b68968398f3e83bbb150c2ba4dd 2011/SRPMS/apache-mod_php-5.3.13-0.1.src.rpm 75c0847b9bfff7a4ecf5f5097e39b5e0 2011/SRPMS/php-5.3.13-0.1.src.rpm daa6819e438adce22445ffb6f25c10f0 2011/SRPMS/php-ini-5.3.13-0.1.src.rpm
To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux)
iD8DBQFPq4WAmqjQ0CJFipgRAihWAKCc3667vbSD/ihxb7LB9g9x2C+bnQCg89XH JTVUFGYH3hR84ZM7EV65I9g= =hQaF -----END PGP SIGNATURE-----
Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . ============================================================================ Ubuntu Security Notice USN-1481-1 June 19, 2012
php5 vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS
- Ubuntu 8.04 LTS
Summary:
Several security issues were fixed in PHP.
Software Description: - php5: HTML-embedded scripting language interpreter
Details:
It was discovered that PHP incorrectly handled certain Tidy::diagnose operations on invalid objects. A remote attacker could use this flaw to cause PHP to crash, leading to a denial of service. (CVE-2012-0781)
It was discovered that PHP incorrectly handled certain multi-file upload filenames. A remote attacker could use this flaw to cause a denial of service, or to perform a directory traversal attack. (CVE-2012-1172)
Rubin Xu and Joseph Bonneau discovered that PHP incorrectly handled certain Unicode characters in passwords passed to the crypt() function. A remote attacker could possibly use this flaw to bypass authentication. (CVE-2012-2143)
It was discovered that a Debian/Ubuntu specific patch caused PHP to incorrectly handle empty salt strings. A remote attacker could possibly use this flaw to bypass authentication. This issue only affected Ubuntu 10.04 LTS and Ubuntu 11.04. (CVE-2012-2317)
It was discovered that PHP, when used as a stand alone CGI processor for the Apache Web Server, did not properly parse and filter query strings. Configurations using mod_php5 and FastCGI were not vulnerable. (CVE-2012-2335, CVE-2012-2336)
Alexander Gavrun discovered that the PHP Phar extension incorrectly handled certain malformed TAR files. (CVE-2012-2386)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 12.04 LTS: php5 5.3.10-1ubuntu3.2
Ubuntu 11.10: php5 5.3.6-13ubuntu3.8
Ubuntu 11.04: php5 5.3.5-1ubuntu7.10
Ubuntu 10.04 LTS: php5 5.3.2-1ubuntu4.17
Ubuntu 8.04 LTS: php5 5.2.4-2ubuntu5.25
In general, a standard system update will make all the necessary changes.
References: http://www.ubuntu.com/usn/usn-1481-1 CVE-2012-0781, CVE-2012-1172, CVE-2012-2143, CVE-2012-2317, CVE-2012-2335, CVE-2012-2336, CVE-2012-2386
Package Information: https://launchpad.net/ubuntu/+source/php5/5.3.10-1ubuntu3.2 https://launchpad.net/ubuntu/+source/php5/5.3.6-13ubuntu3.8 https://launchpad.net/ubuntu/+source/php5/5.3.5-1ubuntu7.10 https://launchpad.net/ubuntu/+source/php5/5.3.2-1ubuntu4.17 https://launchpad.net/ubuntu/+source/php5/5.2.4-2ubuntu5.25
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201205-0311",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "php",
"scope": "eq",
"trust": 1.9,
"vendor": "php",
"version": "5.4.2"
},
{
"model": "php",
"scope": "eq",
"trust": 1.9,
"vendor": "php",
"version": "5.3.12"
},
{
"model": "php",
"scope": "eq",
"trust": 0.8,
"vendor": "the php group",
"version": "5.3.12"
},
{
"model": "php",
"scope": "eq",
"trust": 0.8,
"vendor": "the php group",
"version": "5.4.2"
},
{
"model": "plesk panel",
"scope": "eq",
"trust": 0.3,
"vendor": "parallels",
"version": "9.5.4"
},
{
"model": "linux i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.10"
},
{
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.2"
},
{
"model": "php",
"scope": "eq",
"trust": 0.3,
"vendor": "php",
"version": "5.3.1"
},
{
"model": "enterprise linux hpc node optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "7.2"
},
{
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux ia-64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "ip office application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "8.1"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "6.2"
},
{
"model": "voice portal sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0"
},
{
"model": "enterprise linux server",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "php",
"scope": "eq",
"trust": 0.3,
"vendor": "php",
"version": "5.3.8"
},
{
"model": "linux enterprise sdk sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"model": "voice portal",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.1"
},
{
"model": "linux enterprise server sp3 ltss",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "10"
},
{
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "5"
},
{
"model": "enterprise linux server eus 6.1.z",
"scope": null,
"trust": 0.3,
"vendor": "redhat",
"version": null
},
{
"model": "enterprise linux server optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "enterprise linux long life server",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "5.3"
},
{
"model": "appliance server",
"scope": "eq",
"trust": 0.3,
"vendor": "turbolinux",
"version": "3.0"
},
{
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2.3"
},
{
"model": "enterprise server",
"scope": "eq",
"trust": 0.3,
"vendor": "mandrakesoft",
"version": "5"
},
{
"model": "php",
"scope": "eq",
"trust": 0.3,
"vendor": "php",
"version": "5.3.10"
},
{
"model": "voice portal sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7"
},
{
"model": "ctpview",
"scope": "eq",
"trust": 0.3,
"vendor": "juniper",
"version": "4.6"
},
{
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.10"
},
{
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "7.0"
},
{
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1.1"
},
{
"model": "aura communication manager utility services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"model": "linux lts amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"model": "linux mandrake x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2011"
},
{
"model": "enterprise linux workstation",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.8"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.5"
},
{
"model": "linux lts powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"model": "ctpview",
"scope": "eq",
"trust": 0.3,
"vendor": "juniper",
"version": "4.3"
},
{
"model": "aura messaging",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.3"
},
{
"model": "linux enterprise sdk sp4",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "10"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.4"
},
{
"model": "ctpview",
"scope": "eq",
"trust": 0.3,
"vendor": "juniper",
"version": "4.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.8"
},
{
"model": "opensuse",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "11.4"
},
{
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.04"
},
{
"model": "enterprise linux workstation optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "voice portal",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.1.1"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.8.1"
},
{
"model": "linux i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"model": "aura communication manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "plesk panel",
"scope": "eq",
"trust": 0.3,
"vendor": "parallels",
"version": "9.3"
},
{
"model": "linux lts sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "ctpview 7.0r1",
"scope": "ne",
"trust": 0.3,
"vendor": "juniper",
"version": null
},
{
"model": "lotus foundations start 1.2.2b",
"scope": "ne",
"trust": 0.3,
"vendor": "ibm",
"version": null
},
{
"model": "php",
"scope": "eq",
"trust": 0.3,
"vendor": "php",
"version": "5.3.9"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.1"
},
{
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.1"
},
{
"model": "aura messaging",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"model": "linux lts i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"model": "linux i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.04"
},
{
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2.2"
},
{
"model": "enterprise linux eus 5.6.z server",
"scope": null,
"trust": 0.3,
"vendor": "redhat",
"version": null
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.2"
},
{
"model": "system management homepage",
"scope": "ne",
"trust": 0.3,
"vendor": "hp",
"version": "7.2.1"
},
{
"model": "linux enterprise server sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"model": "aura session manager sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"model": "linux enterprise server sp4",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "10"
},
{
"model": "ip office application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "6"
},
{
"model": "lotus foundations start 1.2.2a",
"scope": null,
"trust": 0.3,
"vendor": "ibm",
"version": null
},
{
"model": "mac os",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.5"
},
{
"model": "ctpview",
"scope": "eq",
"trust": 0.3,
"vendor": "juniper",
"version": "4.5"
},
{
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2.1"
},
{
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"model": "enterprise linux desktop optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "aura communication manager utility services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "linux mandrake x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2010.1"
},
{
"model": "voice portal sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.1"
},
{
"model": "php",
"scope": "eq",
"trust": 0.3,
"vendor": "php",
"version": "5.3.3"
},
{
"model": "linux enterprise server sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"model": "voice portal",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.1.2"
},
{
"model": "ip office application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.0"
},
{
"model": "linux",
"scope": null,
"trust": 0.3,
"vendor": "gentoo",
"version": null
},
{
"model": "linux enterprise sdk sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"model": "enterprise linux server optional eus",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6.1"
},
{
"model": "linux lts i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "12.04"
},
{
"model": "enterprise linux hpc node",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "php",
"scope": "eq",
"trust": 0.3,
"vendor": "php",
"version": "5.3.6"
},
{
"model": "php",
"scope": "eq",
"trust": 0.3,
"vendor": "php",
"version": "5.3.5"
},
{
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "aura communication manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0.1"
},
{
"model": "server",
"scope": "eq",
"trust": 0.3,
"vendor": "turbolinux",
"version": "110"
},
{
"model": "voice portal",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0"
},
{
"model": "aura session manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"model": "ip office application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "8.0"
},
{
"model": "php",
"scope": "eq",
"trust": 0.3,
"vendor": "php",
"version": "5.3.4"
},
{
"model": "linux mandrake",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2011"
},
{
"model": "linux lts lpia",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.04"
},
{
"model": "ctpview",
"scope": "eq",
"trust": 0.3,
"vendor": "juniper",
"version": "4.4"
},
{
"model": "enterprise linux server",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "5"
},
{
"model": "linux lts amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "12.04"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7"
},
{
"model": "linux ia-32",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "php",
"scope": "eq",
"trust": 0.3,
"vendor": "php",
"version": "5.3.7"
},
{
"model": "linux mips",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.04"
},
{
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.0"
},
{
"model": "aura messaging",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.8"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.3"
},
{
"model": "linux enterprise server for vmware sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "7.1.2"
},
{
"model": "mac os",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "x10.8.2"
},
{
"model": "linux enterprise server for vmware sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"model": "hp-ux b.11.31",
"scope": null,
"trust": 0.3,
"vendor": "hp",
"version": null
},
{
"model": "linux s/390",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "aura communication manager utility services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.2"
},
{
"model": "appliance server",
"scope": "eq",
"trust": 0.3,
"vendor": "turbolinux",
"version": "3.0x64"
},
{
"model": "enterprise linux desktop workstation client",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "5"
},
{
"model": "plesk panel",
"scope": "eq",
"trust": 0.3,
"vendor": "parallels",
"version": "9.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.1"
},
{
"model": "php",
"scope": "eq",
"trust": 0.3,
"vendor": "php",
"version": "5.4.1"
},
{
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "client",
"scope": "eq",
"trust": 0.3,
"vendor": "turbolinux",
"version": "2008"
},
{
"model": "plesk panel",
"scope": "eq",
"trust": 0.3,
"vendor": "parallels",
"version": "8.6"
},
{
"model": "plesk panel",
"scope": "eq",
"trust": 0.3,
"vendor": "parallels",
"version": "9.0"
},
{
"model": "ip office application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.3"
},
{
"model": "lotus foundations start",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "1.2"
},
{
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "7.1.1"
},
{
"model": "enterprise server x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "mandrakesoft",
"version": "5"
},
{
"model": "system management homepage",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "7.1"
},
{
"model": "enterprise linux server eus",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6.0"
},
{
"model": "aura session manager sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"model": "server",
"scope": "eq",
"trust": 0.3,
"vendor": "turbolinux",
"version": "11x64"
},
{
"model": "system management homepage",
"scope": "ne",
"trust": 0.3,
"vendor": "hp",
"version": "7.1.1"
},
{
"model": "enterprise linux server optional eus",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6.0"
},
{
"model": "opensuse",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "12.1"
},
{
"model": "php",
"scope": "eq",
"trust": 0.3,
"vendor": "php",
"version": "5.3.2"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.2"
},
{
"model": "linux mandrake",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2010.1"
},
{
"model": "php",
"scope": "ne",
"trust": 0.3,
"vendor": "php",
"version": "5.3.13"
}
],
"sources": [
{
"db": "BID",
"id": "53388"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002394"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-208"
},
{
"db": "NVD",
"id": "CVE-2012-2335"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:php:php",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-002394"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "De Eindbazen",
"sources": [
{
"db": "BID",
"id": "53388"
}
],
"trust": 0.3
},
"cve": "CVE-2012-2335",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2012-2335",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2012-2335",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2012-2335",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201205-208",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-002394"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-208"
},
{
"db": "NVD",
"id": "CVE-2012-2335"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "php-wrapper.fcgi does not properly handle command-line arguments, which allows remote attackers to bypass a protection mechanism in PHP 5.3.12 and 5.4.2 and execute arbitrary code by leveraging improper interaction between the PHP sapi/cgi/cgi_main.c component and a query string beginning with a +- sequence. PHP is prone to an information-disclosure vulnerability. \nExploiting this issue allows remote attackers to view the source code of files in the context of the server process. This may allow the attacker to obtain sensitive information and to run arbitrary PHP code on the affected computer; other attacks are also possible. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory GLSA 201209-03\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n http://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: High\n Title: PHP: Multiple vulnerabilities\n Date: September 24, 2012\n Bugs: #384301, #396311, #396533, #399247, #399567, #399573,\n #401997, #410957, #414553, #421489, #427354, #429630\n ID: 201209-03\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities were found in PHP, the worst of which lead to\nremote execution of arbitrary code. \n\nBackground\n==========\n\nPHP is a widely-used general-purpose scripting language that is\nespecially suited for Web development and can be embedded into HTML. \n\nAffected packages\n=================\n\n -------------------------------------------------------------------\n Package / Vulnerable / Unaffected\n -------------------------------------------------------------------\n 1 dev-lang/php \u003c 5.3.15 \u003e= 5.3.15\n \u003c 5.4.5 \u003e= 5.4.5\n -------------------------------------------------------------------\n # Package 1 only applies to users of these architectures:\n arm\n\nDescription\n===========\n\nMultiple vulnerabilities have been discovered in PHP. Please review the\nCVE identifiers referenced below for details. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll PHP users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose \"\u003e=dev-lang/php-5.3.15\"\n\nAll PHP users on ARM should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose \"\u003e=dev-lang/php-5.4.5\"\n\nReferences\n==========\n\n[ 1 ] CVE-2011-1398\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1398\n[ 2 ] CVE-2011-3379\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3379\n[ 3 ] CVE-2011-4566\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4566\n[ 4 ] CVE-2011-4885\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4885\n[ 5 ] CVE-2012-0057\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0057\n[ 6 ] CVE-2012-0788\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0788\n[ 7 ] CVE-2012-0789\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0789\n[ 8 ] CVE-2012-0830\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0830\n[ 9 ] CVE-2012-0831\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0831\n[ 10 ] CVE-2012-1172\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1172\n[ 11 ] CVE-2012-1823\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1823\n[ 12 ] CVE-2012-2143\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2143\n[ 13 ] CVE-2012-2311\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2311\n[ 14 ] CVE-2012-2335\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2335\n[ 15 ] CVE-2012-2336\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2336\n[ 16 ] CVE-2012-2386\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2386\n[ 17 ] CVE-2012-2688\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2688\n[ 18 ] CVE-2012-3365\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3365\n[ 19 ] CVE-2012-3450\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3450\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n http://security.gentoo.org/glsa/glsa-201209-03.xml\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2012 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttp://creativecommons.org/licenses/by-sa/2.5\n. Please refer to the following Mandriva\n advisories for further information:\n MDVA-2012:004, MDVSA-2011:165, MDVSA-2011:166, MDVSA-2011:180,\n MDVSA-2011:197, MDVSA-2012:065, MDVSA-2012:068, MDVSA-2012:068-1. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\nNote: the current version of the following document is available here:\nhttps://h20564.www2.hp.com/portal/site/hpsc/public/kb/\ndocDisplay?docId=emr_na-c03839862\n\nSUPPORT COMMUNICATION - SECURITY BULLETIN\n\nDocument ID: c03839862\nVersion: 1\n\nHPSBMU02900 rev.1 - HP System Management Homepage (SMH) running on Linux and\nWindows, Multiple Remote and Local Vulnerabilities\n\nNOTICE: The information in this Security Bulletin should be acted upon as\nsoon as possible. \n\nRelease Date: 2013-07-18\nLast Updated: 2013-07-18\n\nPotential Security Impact: Local Denial of Service (DoS), remote Denial of\nService (DoS), execution of arbitrary code, gain extended privileges,\ndisclosure of information, unauthorized access, XSS\n\nSource: Hewlett-Packard Company, HP Software Security Response Team\n\nVULNERABILITY SUMMARY\nPotential security vulnerabilities have been identified with HP System\nManagement Homepage (SMH) running on Linux and Windows. The vulnerabilities\ncould be exploited remotely resulting in Local Denial of Service (DoS),\nremote Denial of Service (DoS), execution of arbitrary code, gain privileges,\ndisclosure of information, unauthorized access, or XSS. \n\nReferences:\nCVE-2011-3389 (SSRT100740) Remote disclosure of information\nCVE-2012-0883 (SSRT101209) Remote gain extended privileges\nCVE-2012-2110 (SSRT101210) Remote Denial of Service (DoS)\nCVE-2012-2311 (SSRT100992) Remote execution of arbitrary code\nCVE-2012-2329 (SSRT100992) Remote Denial of Service (DoS)\nCVE-2012-2335 (SSRT100992) Remote execution of arbitrary code\nCVE-2012-2336 (SSRT100992) Remote Denial of Service (DoS)\nCVE-2013-2355 (SSRT100696) Remote unauthorized Access\nCVE-2013-2356 (SSRT100835) Remote disclosure of information\nCVE-2013-2357 (SSRT100907) Remote Denial of Service (DoS)\nCVE-2013-2358 (SSRT100907) Remote Denial of Service (DoS)\nCVE-2013-2359 (SSRT100907) Remote Denial of Service (DoS)\nCVE-2013-2360 (SSRT100907) Remote Denial of Service (DoS)\nCVE-2013-2361 (SSRT101007) XSS\nCVE-2013-2362 (SSRT101076, ZDI-CAN-1676) Local Denial of Service (DoS)\nCVE-2013-2363 (SSRT101150) Remote disclosure of information\nCVE-2013-2364 (SSRT101151) XSS\nCVE-2013-5217 (SSRT101137) Remote unauthorized access\n\nSUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. \nHP System Management Homepage (SMH) v7.2.0 and earlier running on Linux and\nWindows. \n\nBACKGROUND\n\nCVSS 2.0 Base Metrics\n===========================================================\n Reference Base Vector Base Score\nCVE-2011-3389 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3\nCVE-2012-0883 (AV:L/AC:M/Au:N/C:C/I:C/A:C) 6.9\nCVE-2012-2110 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5\nCVE-2012-2311 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5\nCVE-2012-2329 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0\nCVE-2012-2335 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5\nCVE-2012-2336 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0\nCVE-2013-2355 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3\nCVE-2013-2356 (AV:N/AC:L/Au:N/C:C/I:N/A:N) 7.8\nCVE-2013-2357 (AV:N/AC:M/Au:S/C:N/I:N/A:C) 6.3\nCVE-2013-2358 (AV:N/AC:M/Au:S/C:N/I:N/A:C) 6.3\nCVE-2013-2359 (AV:N/AC:M/Au:S/C:N/I:N/A:P) 3.5\nCVE-2013-2360 (AV:N/AC:M/Au:S/C:N/I:N/A:P) 3.5\nCVE-2013-2361 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 4.3\nCVE-2013-2362 (AV:L/AC:H/Au:S/C:N/I:N/A:P) 1.0\nCVE-2013-2363 (AV:N/AC:H/Au:N/C:C/I:N/A:P) 6.1\nCVE-2013-2364 (AV:N/AC:L/Au:S/C:N/I:N/A:P) 4.0\nCVE-2013-5217 (AV:N/AC:H/Au:N/C:P/I:N/A:N) 2.6\n===========================================================\n Information on CVSS is documented\n in HP Customer Notice: HPSN-2008-002\n\nThe Hewlett-Packard Company thanks agix for working with the TippingPoint\nZero Day Initiative to report vulnerability CVE-2013-2362 to\nsecurity-alert@hp.com\n\nRESOLUTION\n\nHP has made System Management Homepage (SMH) v7.2.1 or subsequent available\nfor Windows and Linux to resolve the vulnerabilities. \n\nInformation and updates for SMH can be found at the following location:\n\nhttp://h18013.www1.hp.com/products/servers/management/agents/index.html\n\nHISTORY\nVersion:1 (rev.1) - 18 July 2013 Initial release\n\nThird Party Security Patches: Third party security patches that are to be\ninstalled on systems running HP software products should be applied in\naccordance with the customer\u0027s patch management policy. \n\nSupport: For issues about implementing the recommendations of this Security\nBulletin, contact normal HP Services support channel. For other issues about\nthe content of this Security Bulletin, send e-mail to security-alert@hp.com. \n\nReport: To report a potential security vulnerability with any HP supported\nproduct, send Email to: security-alert@hp.com\n\nSubscribe: To initiate a subscription to receive future HP Security Bulletin\nalerts via Email:\nhttp://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins\n\nSecurity Bulletin Archive: A list of recently released Security Bulletins is\navailable here:\nhttps://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/\n\nSoftware Product Category: The Software Product Category is represented in\nthe title by the two characters following HPSB. \n\n3C = 3COM\n3P = 3rd Party Software\nGN = HP General Software\nHF = HP Hardware and Firmware\nMP = MPE/iX\nMU = Multi-Platform Software\nNS = NonStop Servers\nOV = OpenVMS\nPI = Printing and Imaging\nPV = ProCurve\nST = Storage Software\nTU = Tru64 UNIX\nUX = HP-UX\n\nCopyright 2013 Hewlett-Packard Development Company, L.P. \nHewlett-Packard Company shall not be liable for technical or editorial errors\nor omissions contained herein. The information provided is provided \"as is\"\nwithout warranty of any kind. To the extent permitted by law, neither HP or\nits affiliates, subcontractors or suppliers will be liable for\nincidental,special or consequential damages including downtime cost; lost\nprofits;damages relating to the procurement of substitute products or\nservices; or damages for loss of data, or software restoration. The\ninformation in this document is subject to change without notice. \nHewlett-Packard Company and the names of Hewlett-Packard products referenced\nherein are trademarks of Hewlett-Packard Company in the United States and\nother countries. Other product and company names mentioned herein may be\ntrademarks of their respective owners. \n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v2.0.19 (GNU/Linux)\n\niEYEARECAAYFAlHoGuMACgkQ4B86/C0qfVmlbwCg5muoKwOcRb0N/+BZa47f7lC9\nCCoAoJo1hIDxLxljNZM2GDOcYGgJi1hH\n=kSG1\n-----END PGP SIGNATURE-----\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n _______________________________________________________________________\n\n Mandriva Linux Security Advisory MDVSA-2012:068-1\n http://www.mandriva.com/security/\n _______________________________________________________________________\n\n Package : php\n Date : May 10, 2012\n Affected: 2010.1, 2011. \n _______________________________________________________________________\n\n Problem Description:\n\n A vulnerability has been found and corrected in php(-cgi):\n \n PHP-CGI-based setups contain a vulnerability when parsing query string\n parameters from php files. \n \n The updated packages have been patched to correct this issue. \n\n Update:\n\n It was discovered that the previous fix for the CVE-2012-1823\n vulnerability was incomplete (CVE-2012-2335, CVE-2012-2336). The\n updated packages provides the latest version (5.3.13) which provides\n a solution to this flaw. \n _______________________________________________________________________\n\n References:\n\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1823\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2335\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2336\n https://bugs.php.net/bug.php?id=61910\n http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/\n http://www.openwall.com/lists/oss-security/2012/05/09/9\n _______________________________________________________________________\n\n Updated Packages:\n\n Mandriva Linux 2010.1:\n 140d36ed5578274826846a0ff7ca05a9 2010.1/i586/apache-mod_php-5.3.13-0.1mdv2010.2.i586.rpm\n 24775050f82b736c2133fc30f93e809e 2010.1/i586/libphp5_common5-5.3.13-0.1mdv2010.2.i586.rpm\n f3fb19456fe4b8fd41f4306c007e85fb 2010.1/i586/php-bcmath-5.3.13-0.1mdv2010.2.i586.rpm\n 99a812ad5970bc37414909de5ef578fa 2010.1/i586/php-bz2-5.3.13-0.1mdv2010.2.i586.rpm\n 634f717747ee4db7cdd19a93ffd2d5ef 2010.1/i586/php-calendar-5.3.13-0.1mdv2010.2.i586.rpm\n 3429fa2b956f67b8602489e4b7d3757a 2010.1/i586/php-cgi-5.3.13-0.1mdv2010.2.i586.rpm\n 51a1d975e31b445ef71901cd04d8fd3a 2010.1/i586/php-cli-5.3.13-0.1mdv2010.2.i586.rpm\n ba763fffd3798434cb0cde5c8f7a8891 2010.1/i586/php-ctype-5.3.13-0.1mdv2010.2.i586.rpm\n ebf996e845619b26515e6f3e828c8fbf 2010.1/i586/php-curl-5.3.13-0.1mdv2010.2.i586.rpm\n ec57b30c43f5678b8cd822fd85df5e34 2010.1/i586/php-dba-5.3.13-0.1mdv2010.2.i586.rpm\n 85799e72a9511c0f54ff2435fba0aaab 2010.1/i586/php-devel-5.3.13-0.1mdv2010.2.i586.rpm\n 823c9544385c894e4c5edd1b52bf4e92 2010.1/i586/php-doc-5.3.13-0.1mdv2010.2.i586.rpm\n 5d753655d5615e92db188468903b8d16 2010.1/i586/php-dom-5.3.13-0.1mdv2010.2.i586.rpm\n 705fbff48501d08bae719a2d7841d8c2 2010.1/i586/php-enchant-5.3.13-0.1mdv2010.2.i586.rpm\n 4f78075bddc8fa173a7384e545e3cd5c 2010.1/i586/php-exif-5.3.13-0.1mdv2010.2.i586.rpm\n e8fefd604fd5006361419135c9059076 2010.1/i586/php-fileinfo-5.3.13-0.1mdv2010.2.i586.rpm\n bc65e927149d5277ad634b0bad8a868a 2010.1/i586/php-filter-5.3.13-0.1mdv2010.2.i586.rpm\n ea6a6fd721db888225dfea83a0ad99d9 2010.1/i586/php-fpm-5.3.13-0.1mdv2010.2.i586.rpm\n 7fb6a2914e72a63ec9401c9662f9bc2b 2010.1/i586/php-ftp-5.3.13-0.1mdv2010.2.i586.rpm\n 0df19020817d838aba51f052c29f6532 2010.1/i586/php-gd-5.3.13-0.1mdv2010.2.i586.rpm\n 5ce28c873da3fc5e0feda8e3cad2247a 2010.1/i586/php-gettext-5.3.13-0.1mdv2010.2.i586.rpm\n acbe524bfc8e156906c70124496a3161 2010.1/i586/php-gmp-5.3.13-0.1mdv2010.2.i586.rpm\n d03bc0f91411297408ac3dbbd5c426b3 2010.1/i586/php-hash-5.3.13-0.1mdv2010.2.i586.rpm\n 19bc92bd8b1a4ea4b86b497f5f48933c 2010.1/i586/php-iconv-5.3.13-0.1mdv2010.2.i586.rpm\n a891fe8d9bcbbfc4458fb31a23720338 2010.1/i586/php-imap-5.3.13-0.1mdv2010.2.i586.rpm\n edec73af34ecb6b42ed0a14dadb8949d 2010.1/i586/php-ini-5.3.13-0.1mdv2010.2.i586.rpm\n 529135563f982966be228d0e7055a97d 2010.1/i586/php-intl-5.3.13-0.1mdv2010.2.i586.rpm\n 2de32f3e7d7da5e06a83f9bf8eac6318 2010.1/i586/php-json-5.3.13-0.1mdv2010.2.i586.rpm\n 2b4f232c6bd026de886d8199dba4c2f2 2010.1/i586/php-ldap-5.3.13-0.1mdv2010.2.i586.rpm\n c14fe2ed7cfeb5320fed29676af9e682 2010.1/i586/php-mbstring-5.3.13-0.1mdv2010.2.i586.rpm\n 606e65e002f946dcf9fa8f7f3950f81d 2010.1/i586/php-mcrypt-5.3.13-0.1mdv2010.2.i586.rpm\n 84e35a42b7861251869a439b0031f225 2010.1/i586/php-mssql-5.3.13-0.1mdv2010.2.i586.rpm\n 95caf9f4d272fdeae006851e482a2461 2010.1/i586/php-mysql-5.3.13-0.1mdv2010.2.i586.rpm\n 5bb6f61f906e8572f66cbbcb0a3a667b 2010.1/i586/php-mysqli-5.3.13-0.1mdv2010.2.i586.rpm\n 28e5bdd198862a80dfea2ab9e86b9678 2010.1/i586/php-mysqlnd-5.3.13-0.1mdv2010.2.i586.rpm\n 802e12a27b7256dbba5b9029e7bbb00b 2010.1/i586/php-odbc-5.3.13-0.1mdv2010.2.i586.rpm\n f3f2b22190a0180e4adddd36ac43b808 2010.1/i586/php-openssl-5.3.13-0.1mdv2010.2.i586.rpm\n 850ed2a02899e7ef950368f1e6936e7b 2010.1/i586/php-pcntl-5.3.13-0.1mdv2010.2.i586.rpm\n 128bc6c67ee8960e29c893a0a210f967 2010.1/i586/php-pdo-5.3.13-0.1mdv2010.2.i586.rpm\n 31d3d8d11a8ec860ff748b4491ed637d 2010.1/i586/php-pdo_dblib-5.3.13-0.1mdv2010.2.i586.rpm\n 840fd711e567a690f46a5aa686a47019 2010.1/i586/php-pdo_mysql-5.3.13-0.1mdv2010.2.i586.rpm\n 6b979eef99f357fc4e283c98c5ef96ea 2010.1/i586/php-pdo_odbc-5.3.13-0.1mdv2010.2.i586.rpm\n 9b5d0ca325bbfcf6b87f74748caceb76 2010.1/i586/php-pdo_pgsql-5.3.13-0.1mdv2010.2.i586.rpm\n 70c688be75e34b79a9a35462570a2ada 2010.1/i586/php-pdo_sqlite-5.3.13-0.1mdv2010.2.i586.rpm\n e67f4f8ded56378452b8a548b126266b 2010.1/i586/php-pgsql-5.3.13-0.1mdv2010.2.i586.rpm\n 4d26258bb774b1d9aff74d3fdc1e3c2c 2010.1/i586/php-phar-5.3.13-0.1mdv2010.2.i586.rpm\n 74bc08429969529762425997772f8a5d 2010.1/i586/php-posix-5.3.13-0.1mdv2010.2.i586.rpm\n e697d56093f50bbde693541d67b7566c 2010.1/i586/php-pspell-5.3.13-0.1mdv2010.2.i586.rpm\n 0fc94be46e664a52fbc9111958cd4146 2010.1/i586/php-readline-5.3.13-0.1mdv2010.2.i586.rpm\n af7e1bb5a2722063cc52af223dc90787 2010.1/i586/php-recode-5.3.13-0.1mdv2010.2.i586.rpm\n fee14325fb3a764988c4e2a69c7938b4 2010.1/i586/php-session-5.3.13-0.1mdv2010.2.i586.rpm\n e89aba4b7dec345be125261046d31b92 2010.1/i586/php-shmop-5.3.13-0.1mdv2010.2.i586.rpm\n 69f2a66fef9892c0405d3a03c72096b2 2010.1/i586/php-snmp-5.3.13-0.1mdv2010.2.i586.rpm\n 4db2b4b3d7670603b5922a122dc975aa 2010.1/i586/php-soap-5.3.13-0.1mdv2010.2.i586.rpm\n e02779584cc1c588d75346f6995ad5a6 2010.1/i586/php-sockets-5.3.13-0.1mdv2010.2.i586.rpm\n aae3b1c32441f481c49f7f38c1c96294 2010.1/i586/php-sqlite3-5.3.13-0.1mdv2010.2.i586.rpm\n b4255e1825f289410b71b6a210229b8e 2010.1/i586/php-sqlite-5.3.13-0.1mdv2010.2.i586.rpm\n dd54ede221fd579f1ebd81be6930010b 2010.1/i586/php-sybase_ct-5.3.13-0.1mdv2010.2.i586.rpm\n 4bdebc41d1b654e904d39c8f89be51a2 2010.1/i586/php-sysvmsg-5.3.13-0.1mdv2010.2.i586.rpm\n 3d485895eca51f5f801323baf1f0f8bf 2010.1/i586/php-sysvsem-5.3.13-0.1mdv2010.2.i586.rpm\n a5c65e02a46da5f9a1be3235565926a3 2010.1/i586/php-sysvshm-5.3.13-0.1mdv2010.2.i586.rpm\n 1a1e6a0a91388e7113f2774bb0f16c01 2010.1/i586/php-tidy-5.3.13-0.1mdv2010.2.i586.rpm\n cf565e35c341273ed2b4378c9f0980c8 2010.1/i586/php-tokenizer-5.3.13-0.1mdv2010.2.i586.rpm\n b1fd12591b6500464a97eb2ae47b2f60 2010.1/i586/php-wddx-5.3.13-0.1mdv2010.2.i586.rpm\n f0f801ce893ad8eb55bb21d010af641a 2010.1/i586/php-xml-5.3.13-0.1mdv2010.2.i586.rpm\n 055873d10551544750bd05555cc63155 2010.1/i586/php-xmlreader-5.3.13-0.1mdv2010.2.i586.rpm\n 69a6e3930ed1b2d1ddac5df5719bc6d6 2010.1/i586/php-xmlrpc-5.3.13-0.1mdv2010.2.i586.rpm\n de7f360c56f74b036ea924d9f7c76b59 2010.1/i586/php-xmlwriter-5.3.13-0.1mdv2010.2.i586.rpm\n 4cbd130cf269dd2769dd084322eaf77a 2010.1/i586/php-xsl-5.3.13-0.1mdv2010.2.i586.rpm\n 1d32b52e968a2bd7c4ff6b640f38ae36 2010.1/i586/php-zip-5.3.13-0.1mdv2010.2.i586.rpm\n 9508241b048c6acc033c16494f797289 2010.1/i586/php-zlib-5.3.13-0.1mdv2010.2.i586.rpm \n cd0e0682df60061148366ab6b10394d2 2010.1/SRPMS/apache-mod_php-5.3.13-0.1mdv2010.2.src.rpm\n f454d177e9bd631df2a4eeca3d33fe38 2010.1/SRPMS/php-5.3.13-0.1mdv2010.2.src.rpm\n 281be8fe2bb8cd404ade445f64c616da 2010.1/SRPMS/php-ini-5.3.13-0.1mdv2010.2.src.rpm\n\n Mandriva Linux 2010.1/X86_64:\n 5c32f90215090901240e661f8e2224a9 2010.1/x86_64/apache-mod_php-5.3.13-0.1mdv2010.2.x86_64.rpm\n c21032781b826fe3a8202eff5b7ef8b5 2010.1/x86_64/lib64php5_common5-5.3.13-0.1mdv2010.2.x86_64.rpm\n a2d0b2b43aa856d5872679d455e56a1e 2010.1/x86_64/php-bcmath-5.3.13-0.1mdv2010.2.x86_64.rpm\n 5421084c1b946cb2c5eeebfed07ac829 2010.1/x86_64/php-bz2-5.3.13-0.1mdv2010.2.x86_64.rpm\n 48aa03dcba36a09689dc6c7f2497741c 2010.1/x86_64/php-calendar-5.3.13-0.1mdv2010.2.x86_64.rpm\n c503b930c9d60cbd4d4ea58d8a6deda7 2010.1/x86_64/php-cgi-5.3.13-0.1mdv2010.2.x86_64.rpm\n 228b72cbf197c817d866d1fe3c7ed6b2 2010.1/x86_64/php-cli-5.3.13-0.1mdv2010.2.x86_64.rpm\n c9435be90a6e5fae1a980109c9bc9aca 2010.1/x86_64/php-ctype-5.3.13-0.1mdv2010.2.x86_64.rpm\n 0eb2e95722b4af3006f560c8441d687f 2010.1/x86_64/php-curl-5.3.13-0.1mdv2010.2.x86_64.rpm\n ccebc661c63d1028540c1212de90bbae 2010.1/x86_64/php-dba-5.3.13-0.1mdv2010.2.x86_64.rpm\n 2edc5f5c47a0ee2bbf001fae9024849f 2010.1/x86_64/php-devel-5.3.13-0.1mdv2010.2.x86_64.rpm\n 3b3eeb211bf45ede0abaae347d8bc745 2010.1/x86_64/php-doc-5.3.13-0.1mdv2010.2.x86_64.rpm\n 29f9a4fcee784caeaa54d88ae6f1fda9 2010.1/x86_64/php-dom-5.3.13-0.1mdv2010.2.x86_64.rpm\n eda0d150731e178912024b0ff6665835 2010.1/x86_64/php-enchant-5.3.13-0.1mdv2010.2.x86_64.rpm\n cf52bd1d68b75ba6841fe6258b9a1f69 2010.1/x86_64/php-exif-5.3.13-0.1mdv2010.2.x86_64.rpm\n 0243226aa4bf036a4054b48966f80cf3 2010.1/x86_64/php-fileinfo-5.3.13-0.1mdv2010.2.x86_64.rpm\n a5bca21277b5c72133340ea059cf0df0 2010.1/x86_64/php-filter-5.3.13-0.1mdv2010.2.x86_64.rpm\n 3c7007006b1d93d8c96e86dcf27ea38b 2010.1/x86_64/php-fpm-5.3.13-0.1mdv2010.2.x86_64.rpm\n f9549d4ed2973e5c1519546e971fd81a 2010.1/x86_64/php-ftp-5.3.13-0.1mdv2010.2.x86_64.rpm\n c7231a7117abab68e8c4d1a3f6a80ccb 2010.1/x86_64/php-gd-5.3.13-0.1mdv2010.2.x86_64.rpm\n 0ca2c9679c082508a4c2b007ec5a8c46 2010.1/x86_64/php-gettext-5.3.13-0.1mdv2010.2.x86_64.rpm\n 7d0de98a757251e874aff11ab76db12b 2010.1/x86_64/php-gmp-5.3.13-0.1mdv2010.2.x86_64.rpm\n 8757a89019988ab9b689c282ae06cf01 2010.1/x86_64/php-hash-5.3.13-0.1mdv2010.2.x86_64.rpm\n 996f5bcb88fc855db3cc4c779897a9ad 2010.1/x86_64/php-iconv-5.3.13-0.1mdv2010.2.x86_64.rpm\n 1580fd0ebb4ff0bd0e3c2a6e8925fc8a 2010.1/x86_64/php-imap-5.3.13-0.1mdv2010.2.x86_64.rpm\n 89a3915683d63a757fa29e53fadf0e1d 2010.1/x86_64/php-ini-5.3.13-0.1mdv2010.2.x86_64.rpm\n 38115fadfb51fdfd10ea14def4d9143d 2010.1/x86_64/php-intl-5.3.13-0.1mdv2010.2.x86_64.rpm\n 06aaaa6c43d85283ba31e079f9e1e0e0 2010.1/x86_64/php-json-5.3.13-0.1mdv2010.2.x86_64.rpm\n b9f6e00a0ac3916b91442ed6c62ad440 2010.1/x86_64/php-ldap-5.3.13-0.1mdv2010.2.x86_64.rpm\n 9b634f67d80ba028247dafe559276859 2010.1/x86_64/php-mbstring-5.3.13-0.1mdv2010.2.x86_64.rpm\n bd39ac4808035578dec2e24a98457b03 2010.1/x86_64/php-mcrypt-5.3.13-0.1mdv2010.2.x86_64.rpm\n 4acc008044469403769de09af155f0d5 2010.1/x86_64/php-mssql-5.3.13-0.1mdv2010.2.x86_64.rpm\n 8d5826fa6ba3dcaf214839a654e74659 2010.1/x86_64/php-mysql-5.3.13-0.1mdv2010.2.x86_64.rpm\n ea0e352e2900b493b9d355257ec99a4e 2010.1/x86_64/php-mysqli-5.3.13-0.1mdv2010.2.x86_64.rpm\n 40b23996dd377b3699ca230f30451e09 2010.1/x86_64/php-mysqlnd-5.3.13-0.1mdv2010.2.x86_64.rpm\n 4a49bad04937598951093dbf1e57eb19 2010.1/x86_64/php-odbc-5.3.13-0.1mdv2010.2.x86_64.rpm\n ef337452c999c609f38511b30424aa95 2010.1/x86_64/php-openssl-5.3.13-0.1mdv2010.2.x86_64.rpm\n 8adda9b3ac67749c4cbbca498fe97042 2010.1/x86_64/php-pcntl-5.3.13-0.1mdv2010.2.x86_64.rpm\n aab08edd87702937cc87e3eea9683e04 2010.1/x86_64/php-pdo-5.3.13-0.1mdv2010.2.x86_64.rpm\n b769d4729112be42057acbecc42784fd 2010.1/x86_64/php-pdo_dblib-5.3.13-0.1mdv2010.2.x86_64.rpm\n 51f45520e81ae006da36c27e9ff23d29 2010.1/x86_64/php-pdo_mysql-5.3.13-0.1mdv2010.2.x86_64.rpm\n 337fef4ac991f694fbc52f1b51292f0e 2010.1/x86_64/php-pdo_odbc-5.3.13-0.1mdv2010.2.x86_64.rpm\n ee046601f134c275c1c5394156868176 2010.1/x86_64/php-pdo_pgsql-5.3.13-0.1mdv2010.2.x86_64.rpm\n f1b25be0d7a2e6948dd6d95776da6f27 2010.1/x86_64/php-pdo_sqlite-5.3.13-0.1mdv2010.2.x86_64.rpm\n c61a1bc81075ebfc94e820984597774b 2010.1/x86_64/php-pgsql-5.3.13-0.1mdv2010.2.x86_64.rpm\n 11bed7992443f01305ad4ce8304e9f07 2010.1/x86_64/php-phar-5.3.13-0.1mdv2010.2.x86_64.rpm\n dd6008750a431325112944e3a5783d0c 2010.1/x86_64/php-posix-5.3.13-0.1mdv2010.2.x86_64.rpm\n f5531db71580b0c17c5796cfd79f4020 2010.1/x86_64/php-pspell-5.3.13-0.1mdv2010.2.x86_64.rpm\n 80c9841836ea5246babb676ce79adb9d 2010.1/x86_64/php-readline-5.3.13-0.1mdv2010.2.x86_64.rpm\n 6271ebd8132c7d94513646d0bbfedf15 2010.1/x86_64/php-recode-5.3.13-0.1mdv2010.2.x86_64.rpm\n 77e395b19c6068c941cc1ee1c89e15c6 2010.1/x86_64/php-session-5.3.13-0.1mdv2010.2.x86_64.rpm\n b310511e16b059f753cef3fbe39a35b0 2010.1/x86_64/php-shmop-5.3.13-0.1mdv2010.2.x86_64.rpm\n 70b99d0120ea8c6018a327996314ab49 2010.1/x86_64/php-snmp-5.3.13-0.1mdv2010.2.x86_64.rpm\n 33f829a30afaeab74203389d8a48a2d9 2010.1/x86_64/php-soap-5.3.13-0.1mdv2010.2.x86_64.rpm\n 64295e56e1c81c3322aa49bd1bf2d838 2010.1/x86_64/php-sockets-5.3.13-0.1mdv2010.2.x86_64.rpm\n 9afd6ba7da1e9ffa58a33c822eeb6a9d 2010.1/x86_64/php-sqlite3-5.3.13-0.1mdv2010.2.x86_64.rpm\n 8f8e7ee68199f5fdb8867b10d8cede5a 2010.1/x86_64/php-sqlite-5.3.13-0.1mdv2010.2.x86_64.rpm\n 84d824d25bcd058301b8a8cac4eece97 2010.1/x86_64/php-sybase_ct-5.3.13-0.1mdv2010.2.x86_64.rpm\n cdd27855aa2b685fba70fea949d0f8f5 2010.1/x86_64/php-sysvmsg-5.3.13-0.1mdv2010.2.x86_64.rpm\n 47714ed1a09513b0fa4016fed1faf374 2010.1/x86_64/php-sysvsem-5.3.13-0.1mdv2010.2.x86_64.rpm\n 878cc21a21bcb9120f0c60d0dc3c848d 2010.1/x86_64/php-sysvshm-5.3.13-0.1mdv2010.2.x86_64.rpm\n ed7017d81df4e68da01f9d790c5e9e75 2010.1/x86_64/php-tidy-5.3.13-0.1mdv2010.2.x86_64.rpm\n e2dbcbefd496f408e56c5072938f62d6 2010.1/x86_64/php-tokenizer-5.3.13-0.1mdv2010.2.x86_64.rpm\n c629479463912ae1d91c4399e5b05f67 2010.1/x86_64/php-wddx-5.3.13-0.1mdv2010.2.x86_64.rpm\n 5a71b4a2a66aa994585f3372f13ad969 2010.1/x86_64/php-xml-5.3.13-0.1mdv2010.2.x86_64.rpm\n 9e99f81386d263bf395a4462ce3333f8 2010.1/x86_64/php-xmlreader-5.3.13-0.1mdv2010.2.x86_64.rpm\n 76c565d3fdcba0133b6c25a914a4fed3 2010.1/x86_64/php-xmlrpc-5.3.13-0.1mdv2010.2.x86_64.rpm\n af3b32c6d60342fb5c7a7c455f647f34 2010.1/x86_64/php-xmlwriter-5.3.13-0.1mdv2010.2.x86_64.rpm\n 31a1efcba8488b85ec31054bea181262 2010.1/x86_64/php-xsl-5.3.13-0.1mdv2010.2.x86_64.rpm\n d3b08c3d48baefa3ee14632b876100fb 2010.1/x86_64/php-zip-5.3.13-0.1mdv2010.2.x86_64.rpm\n a6a3b117484b1bb2e7d449c08fa49b46 2010.1/x86_64/php-zlib-5.3.13-0.1mdv2010.2.x86_64.rpm \n cd0e0682df60061148366ab6b10394d2 2010.1/SRPMS/apache-mod_php-5.3.13-0.1mdv2010.2.src.rpm\n f454d177e9bd631df2a4eeca3d33fe38 2010.1/SRPMS/php-5.3.13-0.1mdv2010.2.src.rpm\n 281be8fe2bb8cd404ade445f64c616da 2010.1/SRPMS/php-ini-5.3.13-0.1mdv2010.2.src.rpm\n\n Mandriva Linux 2011:\n 35cdd956ce62db7548d2626d8a8f7ae8 2011/i586/apache-mod_php-5.3.13-0.1-mdv2011.0.i586.rpm\n dd02a276ddca3ae7ad754e19a41e8ff8 2011/i586/libphp5_common5-5.3.13-0.1-mdv2011.0.i586.rpm\n 7a8feff11aa910f94074c57b54a124d6 2011/i586/php-bcmath-5.3.13-0.1-mdv2011.0.i586.rpm\n 3c70edc391c1c8fb7845f81f3b3f5bac 2011/i586/php-bz2-5.3.13-0.1-mdv2011.0.i586.rpm\n d8020203023aaf02a30b22559d5a67c7 2011/i586/php-calendar-5.3.13-0.1-mdv2011.0.i586.rpm\n e0f010a7d61cf27e13a486ff6e5d6ce4 2011/i586/php-cgi-5.3.13-0.1-mdv2011.0.i586.rpm\n 345ee6e60bc1973f0049ab25f7dc3557 2011/i586/php-cli-5.3.13-0.1-mdv2011.0.i586.rpm\n c4e851c0260ad96797ca56deb2b6f3c7 2011/i586/php-ctype-5.3.13-0.1-mdv2011.0.i586.rpm\n 073d81d6531862861015cf7f53173045 2011/i586/php-curl-5.3.13-0.1-mdv2011.0.i586.rpm\n 1330fd10a3bdd3787913db7795054819 2011/i586/php-dba-5.3.13-0.1-mdv2011.0.i586.rpm\n b6d0fefa9206b7cd3f4c73744c324906 2011/i586/php-devel-5.3.13-0.1-mdv2011.0.i586.rpm\n 32a9567d7a61d6f35654e8d33baec58a 2011/i586/php-doc-5.3.13-0.1-mdv2011.0.i586.rpm\n 149566d373265e732f1ec3140d11cac2 2011/i586/php-dom-5.3.13-0.1-mdv2011.0.i586.rpm\n 6f4b1fe24a35809c93e9489347c448bb 2011/i586/php-enchant-5.3.13-0.1-mdv2011.0.i586.rpm\n 44f27021f7ff8202f5f34a8b0720be5b 2011/i586/php-exif-5.3.13-0.1-mdv2011.0.i586.rpm\n 5d32e3e7dc217fd69b6dc99dffb747f7 2011/i586/php-fileinfo-5.3.13-0.1-mdv2011.0.i586.rpm\n 043c17fad24c3113600799c63c5dde18 2011/i586/php-filter-5.3.13-0.1-mdv2011.0.i586.rpm\n 08c16e8ec2f1c821df8090c38c43809b 2011/i586/php-fpm-5.3.13-0.1-mdv2011.0.i586.rpm\n 209b4baf966b45cb48790e7a020b1aa9 2011/i586/php-ftp-5.3.13-0.1-mdv2011.0.i586.rpm\n eac85767ff89fcf822b2c2cf408b2aca 2011/i586/php-gd-5.3.13-0.1-mdv2011.0.i586.rpm\n 7c7c5ab6370c934b727dac2ad1c9bd33 2011/i586/php-gettext-5.3.13-0.1-mdv2011.0.i586.rpm\n babb1410dd897504ec526243789fd749 2011/i586/php-gmp-5.3.13-0.1-mdv2011.0.i586.rpm\n 63feb83eda18663f3ae28fee522a79c8 2011/i586/php-hash-5.3.13-0.1-mdv2011.0.i586.rpm\n a8aad04e3c20f9223832632f412c4c69 2011/i586/php-iconv-5.3.13-0.1-mdv2011.0.i586.rpm\n 22f5f2b807af8ea7445e8682f6718ab2 2011/i586/php-imap-5.3.13-0.1-mdv2011.0.i586.rpm\n ff780d80135cc18647edecdde6b77e16 2011/i586/php-ini-5.3.13-0.1-mdv2011.0.i586.rpm\n 10475ddafeeb384ae3afb7f5d2d1afa8 2011/i586/php-intl-5.3.13-0.1-mdv2011.0.i586.rpm\n e3261da452695aed46718ec06a1f17ed 2011/i586/php-json-5.3.13-0.1-mdv2011.0.i586.rpm\n f6238f4f4566582418666333eb797994 2011/i586/php-ldap-5.3.13-0.1-mdv2011.0.i586.rpm\n 9ae1d9fc8320fa272fa56484f425e7d8 2011/i586/php-mbstring-5.3.13-0.1-mdv2011.0.i586.rpm\n 86710277f0bca955ced6610b199fcf16 2011/i586/php-mcrypt-5.3.13-0.1-mdv2011.0.i586.rpm\n a9dad85e7658b897bcd9a3c088a71168 2011/i586/php-mssql-5.3.13-0.1-mdv2011.0.i586.rpm\n 66063a764c3a2b90143c5653c0f1dd2c 2011/i586/php-mysql-5.3.13-0.1-mdv2011.0.i586.rpm\n c7993bdf0b9ceaf4f2fa86dbc558ddfb 2011/i586/php-mysqli-5.3.13-0.1-mdv2011.0.i586.rpm\n afcd3e1e62498bffaa9432c5d5c505f5 2011/i586/php-mysqlnd-5.3.13-0.1-mdv2011.0.i586.rpm\n 21a837c5413d3e89b7747b70b343ff39 2011/i586/php-odbc-5.3.13-0.1-mdv2011.0.i586.rpm\n 9653980157e82a7cc1fcb428e6a11831 2011/i586/php-openssl-5.3.13-0.1-mdv2011.0.i586.rpm\n 2a7283323df15b449a0911147e4e120a 2011/i586/php-pcntl-5.3.13-0.1-mdv2011.0.i586.rpm\n 5943398e22f4b3aab9fb741e7b6a8014 2011/i586/php-pdo-5.3.13-0.1-mdv2011.0.i586.rpm\n 4a8632f0605a849c61148479c3dce11c 2011/i586/php-pdo_dblib-5.3.13-0.1-mdv2011.0.i586.rpm\n 90bfc85fce2cf88d5cc7e9d383bac674 2011/i586/php-pdo_mysql-5.3.13-0.1-mdv2011.0.i586.rpm\n 13a2e35fe9389ceff1bd86915d4fbb45 2011/i586/php-pdo_odbc-5.3.13-0.1-mdv2011.0.i586.rpm\n bd5ac6d3de510f5648e0796262ee0284 2011/i586/php-pdo_pgsql-5.3.13-0.1-mdv2011.0.i586.rpm\n c8a144f194b2e263d30d42549ef72df7 2011/i586/php-pdo_sqlite-5.3.13-0.1-mdv2011.0.i586.rpm\n 9fc72c845adc2c8b526ccda1045e95cb 2011/i586/php-pgsql-5.3.13-0.1-mdv2011.0.i586.rpm\n ceed9de56ba7babbb1103c0505360ae8 2011/i586/php-phar-5.3.13-0.1-mdv2011.0.i586.rpm\n 99df22a88e7ec65277c5f1d67946b674 2011/i586/php-posix-5.3.13-0.1-mdv2011.0.i586.rpm\n 2a7c90e39eaed912fd8ef49d5edcf3b0 2011/i586/php-pspell-5.3.13-0.1-mdv2011.0.i586.rpm\n b4f54f67b9372e1bef78b6a40a756d31 2011/i586/php-readline-5.3.13-0.1-mdv2011.0.i586.rpm\n c3ab166b9fc83521a75c13dff80f3a56 2011/i586/php-recode-5.3.13-0.1-mdv2011.0.i586.rpm\n a6c67fe24586ad45656a0e11906e7bb3 2011/i586/php-session-5.3.13-0.1-mdv2011.0.i586.rpm\n 39dd1f3c8218f0537aad8f03aa96b833 2011/i586/php-shmop-5.3.13-0.1-mdv2011.0.i586.rpm\n 7d516b28e8f45f06883657d93d152c31 2011/i586/php-snmp-5.3.13-0.1-mdv2011.0.i586.rpm\n 511c2eadd6584227584704adf97150e9 2011/i586/php-soap-5.3.13-0.1-mdv2011.0.i586.rpm\n d2bb4858eb41257b9e3c72b385b55fed 2011/i586/php-sockets-5.3.13-0.1-mdv2011.0.i586.rpm\n ef20af5ac9def94fc4db18e4e9ef80f3 2011/i586/php-sqlite3-5.3.13-0.1-mdv2011.0.i586.rpm\n d87d2f151f37050dd9f3d1fb66cc5be6 2011/i586/php-sqlite-5.3.13-0.1-mdv2011.0.i586.rpm\n 1214cb4bc37c7fb285dd6c2f00411904 2011/i586/php-sybase_ct-5.3.13-0.1-mdv2011.0.i586.rpm\n 1bd2a3a7f3408e7e304190e4145cec7f 2011/i586/php-sysvmsg-5.3.13-0.1-mdv2011.0.i586.rpm\n 602e9fbc2dd26d526709da1fbb5f43a3 2011/i586/php-sysvsem-5.3.13-0.1-mdv2011.0.i586.rpm\n 1f4d61a55c51175890bf3fe8da58178b 2011/i586/php-sysvshm-5.3.13-0.1-mdv2011.0.i586.rpm\n 7f81e3126928fd1e48e61a04e978e549 2011/i586/php-tidy-5.3.13-0.1-mdv2011.0.i586.rpm\n a2ea94863a07932b8cc8adfaf9984801 2011/i586/php-tokenizer-5.3.13-0.1-mdv2011.0.i586.rpm\n 7ca9553c6d0280546bc198cf7e349fd0 2011/i586/php-wddx-5.3.13-0.1-mdv2011.0.i586.rpm\n 2657cd50ab3d1ed89c40dd022b18a78a 2011/i586/php-xml-5.3.13-0.1-mdv2011.0.i586.rpm\n 4484a28aa070a5507ca51b7b6ccd9c4f 2011/i586/php-xmlreader-5.3.13-0.1-mdv2011.0.i586.rpm\n fb655f70ba8fd02cb283c685fb32198d 2011/i586/php-xmlrpc-5.3.13-0.1-mdv2011.0.i586.rpm\n 595eb1d07062b9ea1cbfa4db0c858b24 2011/i586/php-xmlwriter-5.3.13-0.1-mdv2011.0.i586.rpm\n 13c04bf3f0134e29372d595589f59193 2011/i586/php-xsl-5.3.13-0.1-mdv2011.0.i586.rpm\n 0a98ea3d088772271f96eeb7a5f23ba2 2011/i586/php-zip-5.3.13-0.1-mdv2011.0.i586.rpm\n e5242f7e29696cf3f9a80eb65ac97184 2011/i586/php-zlib-5.3.13-0.1-mdv2011.0.i586.rpm \n 43577b68968398f3e83bbb150c2ba4dd 2011/SRPMS/apache-mod_php-5.3.13-0.1.src.rpm\n 75c0847b9bfff7a4ecf5f5097e39b5e0 2011/SRPMS/php-5.3.13-0.1.src.rpm\n daa6819e438adce22445ffb6f25c10f0 2011/SRPMS/php-ini-5.3.13-0.1.src.rpm\n\n Mandriva Linux 2011/X86_64:\n 6f1b882d07cd219f673c90396542719e 2011/x86_64/apache-mod_php-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 11c80f46a5669769a85ef8f391d07a70 2011/x86_64/lib64php5_common5-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 7e4e71c5b17031412c13ea2d9b2477c5 2011/x86_64/php-bcmath-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 528be2af28cf1a4843850e1b565c3898 2011/x86_64/php-bz2-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 39b482e7037283b454056f4882d5917b 2011/x86_64/php-calendar-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 9829b1d862405439321b3ecbfb4c7ea1 2011/x86_64/php-cgi-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 5e705973df7b6c201fabeb2c75d3a74a 2011/x86_64/php-cli-5.3.13-0.1-mdv2011.0.x86_64.rpm\n eb3b69da40fb3992024aa0a9fea15a8d 2011/x86_64/php-ctype-5.3.13-0.1-mdv2011.0.x86_64.rpm\n a7fd1763425d19677b6adc88a835770f 2011/x86_64/php-curl-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 0a4712efbe6fd4e1d2590842f620982c 2011/x86_64/php-dba-5.3.13-0.1-mdv2011.0.x86_64.rpm\n ca749d3257f0bb0595a6495816d17c29 2011/x86_64/php-devel-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 56a0d712c402bcddcaba739f35ea07a6 2011/x86_64/php-doc-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 2a6cf45b3a94ae3e571e3dbcbbc08804 2011/x86_64/php-dom-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 0f109c681babe75db077f8d9af926f85 2011/x86_64/php-enchant-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 7d419c4fd0f8180bb777b4b198dbf192 2011/x86_64/php-exif-5.3.13-0.1-mdv2011.0.x86_64.rpm\n befa5de9e5e4a3a2ab04a4899a0c654e 2011/x86_64/php-fileinfo-5.3.13-0.1-mdv2011.0.x86_64.rpm\n ef19b2adb8544747b6dbc673d5b758cd 2011/x86_64/php-filter-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 42952a220d307fab9e88012a0db43ecd 2011/x86_64/php-fpm-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 40c04426bafdec1b7ac6efd7e80112e3 2011/x86_64/php-ftp-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 4fb018ed2383c082d45e4b75a346d588 2011/x86_64/php-gd-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 7237c26a2db73c6a115fc4e035ecb0f2 2011/x86_64/php-gettext-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 1a474b43b899509ba9516fa042fe1ddd 2011/x86_64/php-gmp-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 28e8e4748273a5ccaeb65b54d666402f 2011/x86_64/php-hash-5.3.13-0.1-mdv2011.0.x86_64.rpm\n d3f5e9dfc04ce0ad319884c2501529c4 2011/x86_64/php-iconv-5.3.13-0.1-mdv2011.0.x86_64.rpm\n c166f30d0bab63ab66c91fdc7f23109e 2011/x86_64/php-imap-5.3.13-0.1-mdv2011.0.x86_64.rpm\n c2a6c0df9bdb831fa633b00afe1656ca 2011/x86_64/php-ini-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 8ef06e0d3bc50c6af030273db341f33f 2011/x86_64/php-intl-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 5e59fb195dd577622ba638e6f61301ce 2011/x86_64/php-json-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 51d4d134118097c396fd9ae22658fd95 2011/x86_64/php-ldap-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 43089444e735a7fb955f4b2073a89b8e 2011/x86_64/php-mbstring-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 67cb0bb2abf2ac499616a9f6b67e42a4 2011/x86_64/php-mcrypt-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 6167541236c972e1b3ca07ab4e3aa435 2011/x86_64/php-mssql-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 8169e0c8a9121ed5b088e50f729a08f2 2011/x86_64/php-mysql-5.3.13-0.1-mdv2011.0.x86_64.rpm\n a9f88ce7ae03e6c9614bbbe77badd211 2011/x86_64/php-mysqli-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 09ffa27ee341ea0f316c001302dc6b4f 2011/x86_64/php-mysqlnd-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 52eca2dca4ad432fdb9ca2a42f8af637 2011/x86_64/php-odbc-5.3.13-0.1-mdv2011.0.x86_64.rpm\n f6e46b6f5ad8a961cbfde8b8e767054a 2011/x86_64/php-openssl-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 3dd5efd7a83830669edf081f84a6ddd0 2011/x86_64/php-pcntl-5.3.13-0.1-mdv2011.0.x86_64.rpm\n f000fb58640165fa93eb8939c88f51b9 2011/x86_64/php-pdo-5.3.13-0.1-mdv2011.0.x86_64.rpm\n e91e95bb78ee4ccc6edc8a676cf83331 2011/x86_64/php-pdo_dblib-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 82ca0b0fa4daa2d13d351f57cac4b1ad 2011/x86_64/php-pdo_mysql-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 2a2e4cf2e7b3d6c718072e34bbf1f4d5 2011/x86_64/php-pdo_odbc-5.3.13-0.1-mdv2011.0.x86_64.rpm\n bae3bd360ca8da31e3444555b1ba5984 2011/x86_64/php-pdo_pgsql-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 265ffe4fec20f1a276a4ae598f897097 2011/x86_64/php-pdo_sqlite-5.3.13-0.1-mdv2011.0.x86_64.rpm\n de5791ef4c4f09caf289efcc2946bd40 2011/x86_64/php-pgsql-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 3e5a5c8d71d73d792f6a9c5d1d1ff0e0 2011/x86_64/php-phar-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 1b106b0000d8cf09217a8c6066a08abe 2011/x86_64/php-posix-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 4142e252a6e80033b49966678333d4fc 2011/x86_64/php-pspell-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 2eaa627598b484e870a745dfce89561c 2011/x86_64/php-readline-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 16aa5e0d0038dad164fd251584267b25 2011/x86_64/php-recode-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 1f2221028312e63a8fe0153b0f37268d 2011/x86_64/php-session-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 08339bda25dfc15853d8f4f3093906b5 2011/x86_64/php-shmop-5.3.13-0.1-mdv2011.0.x86_64.rpm\n af74d89511d56956fd18f47588c8134a 2011/x86_64/php-snmp-5.3.13-0.1-mdv2011.0.x86_64.rpm\n a60760ee2c728bcd933f7f129918e20f 2011/x86_64/php-soap-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 23edc8e373f493137a741d3f5b8a776f 2011/x86_64/php-sockets-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 0ee3559a3748ba690ee5c4f99a324b1e 2011/x86_64/php-sqlite3-5.3.13-0.1-mdv2011.0.x86_64.rpm\n a4b3e977bffee9f122cb6e9582edb3f1 2011/x86_64/php-sqlite-5.3.13-0.1-mdv2011.0.x86_64.rpm\n edcf9dd12733f50cc808a336b26e0fe2 2011/x86_64/php-sybase_ct-5.3.13-0.1-mdv2011.0.x86_64.rpm\n d6cd75e157f0b6b026444a1407cf90a7 2011/x86_64/php-sysvmsg-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 0c283bd1ae67f256a6e776f35e36b30c 2011/x86_64/php-sysvsem-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 85f7cb718011e2ff913ce142a12a6343 2011/x86_64/php-sysvshm-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 63b205689a9cb3929379ce8c6415fecc 2011/x86_64/php-tidy-5.3.13-0.1-mdv2011.0.x86_64.rpm\n addd08fffff1581bfa703aeba53c5566 2011/x86_64/php-tokenizer-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 138500dc24f46346ae847fc2f56ca7a7 2011/x86_64/php-wddx-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 27801c8421becc9030eb1e2e06342efe 2011/x86_64/php-xml-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 1fefd162d7a627212ccca1ecda6ccdf2 2011/x86_64/php-xmlreader-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 2e6d1bbc2319425bfe20b189f4fe4b79 2011/x86_64/php-xmlrpc-5.3.13-0.1-mdv2011.0.x86_64.rpm\n 421888369bc51fcfcb7a0fcedb23e3e4 2011/x86_64/php-xmlwriter-5.3.13-0.1-mdv2011.0.x86_64.rpm\n f5d79e3adf80fadf2f185db98ec3b142 2011/x86_64/php-xsl-5.3.13-0.1-mdv2011.0.x86_64.rpm\n e126fa1b8d8f0a7c18bae56a00345299 2011/x86_64/php-zip-5.3.13-0.1-mdv2011.0.x86_64.rpm\n a8492adb1cc9cd92d2771d151161ac2e 2011/x86_64/php-zlib-5.3.13-0.1-mdv2011.0.x86_64.rpm \n 43577b68968398f3e83bbb150c2ba4dd 2011/SRPMS/apache-mod_php-5.3.13-0.1.src.rpm\n 75c0847b9bfff7a4ecf5f5097e39b5e0 2011/SRPMS/php-5.3.13-0.1.src.rpm\n daa6819e438adce22445ffb6f25c10f0 2011/SRPMS/php-ini-5.3.13-0.1.src.rpm\n _______________________________________________________________________\n\n To upgrade automatically use MandrivaUpdate or urpmi. The verification\n of md5 checksums and GPG signatures is performed automatically for you. \n\n All packages are signed by Mandriva for security. You can obtain the\n GPG public key of the Mandriva Security Team by executing:\n\n gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98\n\n You can view other update advisories for Mandriva Linux at:\n\n http://www.mandriva.com/security/advisories\n\n If you want to report vulnerabilities, please contact\n\n security_(at)_mandriva.com\n _______________________________________________________________________\n\n Type Bits/KeyID Date User ID\n pub 1024D/22458A98 2000-07-10 Mandriva Security Team\n \u003csecurity*mandriva.com\u003e\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.11 (GNU/Linux)\n\niD8DBQFPq4WAmqjQ0CJFipgRAihWAKCc3667vbSD/ihxb7LB9g9x2C+bnQCg89XH\nJTVUFGYH3hR84ZM7EV65I9g=\n=hQaF\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nFull-Disclosure - We believe in it. \nCharter: http://lists.grok.org.uk/full-disclosure-charter.html\nHosted and sponsored by Secunia - http://secunia.com/\n. ============================================================================\nUbuntu Security Notice USN-1481-1\nJune 19, 2012\n\nphp5 vulnerabilities\n============================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 12.04 LTS\n- Ubuntu 11.10\n- Ubuntu 11.04\n- Ubuntu 10.04 LTS\n- Ubuntu 8.04 LTS\n\nSummary:\n\nSeveral security issues were fixed in PHP. \n\nSoftware Description:\n- php5: HTML-embedded scripting language interpreter\n\nDetails:\n\nIt was discovered that PHP incorrectly handled certain Tidy::diagnose\noperations on invalid objects. A remote attacker could use this flaw to\ncause PHP to crash, leading to a denial of service. (CVE-2012-0781)\n\nIt was discovered that PHP incorrectly handled certain multi-file upload\nfilenames. A remote attacker could use this flaw to cause a denial of\nservice, or to perform a directory traversal attack. (CVE-2012-1172)\n\nRubin Xu and Joseph Bonneau discovered that PHP incorrectly handled certain\nUnicode characters in passwords passed to the crypt() function. A remote\nattacker could possibly use this flaw to bypass authentication. \n(CVE-2012-2143)\n\nIt was discovered that a Debian/Ubuntu specific patch caused PHP to\nincorrectly handle empty salt strings. A remote attacker could possibly use\nthis flaw to bypass authentication. This issue only affected Ubuntu 10.04\nLTS and Ubuntu 11.04. (CVE-2012-2317)\n\nIt was discovered that PHP, when used as a stand alone CGI processor\nfor the Apache Web Server, did not properly parse and filter query\nstrings. Configurations using mod_php5 and FastCGI were not vulnerable. \n(CVE-2012-2335, CVE-2012-2336)\n\nAlexander Gavrun discovered that the PHP Phar extension incorrectly handled\ncertain malformed TAR files. \n(CVE-2012-2386)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 12.04 LTS:\n php5 5.3.10-1ubuntu3.2\n\nUbuntu 11.10:\n php5 5.3.6-13ubuntu3.8\n\nUbuntu 11.04:\n php5 5.3.5-1ubuntu7.10\n\nUbuntu 10.04 LTS:\n php5 5.3.2-1ubuntu4.17\n\nUbuntu 8.04 LTS:\n php5 5.2.4-2ubuntu5.25\n\nIn general, a standard system update will make all the necessary changes. \n\nReferences:\n http://www.ubuntu.com/usn/usn-1481-1\n CVE-2012-0781, CVE-2012-1172, CVE-2012-2143, CVE-2012-2317,\n CVE-2012-2335, CVE-2012-2336, CVE-2012-2386\n\nPackage Information:\n https://launchpad.net/ubuntu/+source/php5/5.3.10-1ubuntu3.2\n https://launchpad.net/ubuntu/+source/php5/5.3.6-13ubuntu3.8\n https://launchpad.net/ubuntu/+source/php5/5.3.5-1ubuntu7.10\n https://launchpad.net/ubuntu/+source/php5/5.3.2-1ubuntu4.17\n https://launchpad.net/ubuntu/+source/php5/5.2.4-2ubuntu5.25\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2012-2335"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002394"
},
{
"db": "BID",
"id": "53388"
},
{
"db": "PACKETSTORM",
"id": "123310"
},
{
"db": "PACKETSTORM",
"id": "116800"
},
{
"db": "PACKETSTORM",
"id": "112598"
},
{
"db": "PACKETSTORM",
"id": "122468"
},
{
"db": "PACKETSTORM",
"id": "112597"
},
{
"db": "PACKETSTORM",
"id": "113885"
},
{
"db": "PACKETSTORM",
"id": "122482"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2012-2335",
"trust": 3.4
},
{
"db": "CERT/CC",
"id": "VU#520827",
"trust": 2.7
},
{
"db": "SECUNIA",
"id": "49014",
"trust": 1.6
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002394",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201205-208",
"trust": 0.6
},
{
"db": "JUNIPER",
"id": "JSA10658",
"trust": 0.3
},
{
"db": "CERT/CC",
"id": "VU#673343",
"trust": 0.3
},
{
"db": "BID",
"id": "53388",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "123310",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "116800",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "112598",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "122468",
"trust": 0.1
},
{
"db": "OPENWALL",
"id": "OSS-SECURITY/2012/05/09/9",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "112597",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "113885",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "122482",
"trust": 0.1
}
],
"sources": [
{
"db": "BID",
"id": "53388"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002394"
},
{
"db": "PACKETSTORM",
"id": "123310"
},
{
"db": "PACKETSTORM",
"id": "116800"
},
{
"db": "PACKETSTORM",
"id": "112598"
},
{
"db": "PACKETSTORM",
"id": "122468"
},
{
"db": "PACKETSTORM",
"id": "112597"
},
{
"db": "PACKETSTORM",
"id": "113885"
},
{
"db": "PACKETSTORM",
"id": "122482"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-208"
},
{
"db": "NVD",
"id": "CVE-2012-2335"
}
]
},
"id": "VAR-201205-0311",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.47077376
},
"last_update_date": "2025-04-14T20:09:49.379000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "SUSE-SU-2012:0840",
"trust": 0.8,
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00003.html"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.php.net"
},
{
"title": "PHP 5.4.3",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=43186"
},
{
"title": "PHP 5.4.3",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=43185"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-002394"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-208"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-264",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-002394"
},
{
"db": "NVD",
"id": "CVE-2012-2335"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.7,
"url": "http://www.kb.cert.org/vuls/id/520827"
},
{
"trust": 2.2,
"url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c03839862"
},
{
"trust": 2.0,
"url": "http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/"
},
{
"trust": 1.7,
"url": "https://bugs.php.net/bug.php?id=61910"
},
{
"trust": 1.6,
"url": "http://git.php.net/?p=php-src.git%3ba=blob%3bf=sapi/cgi/cgi_main.c%3bh=a7ac26f0#l1569"
},
{
"trust": 1.6,
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00004.html"
},
{
"trust": 1.6,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75652"
},
{
"trust": 1.6,
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00003.html"
},
{
"trust": 1.6,
"url": "http://www.php.net/archive/2012.php#id2012-05-06-1"
},
{
"trust": 1.6,
"url": "http://secunia.com/advisories/49014"
},
{
"trust": 1.0,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-2335"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnvu520827/index.html"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-2335"
},
{
"trust": 0.7,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2335"
},
{
"trust": 0.7,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2336"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2311"
},
{
"trust": 0.3,
"url": "http://alerts.hp.com/r?2.1.3kt.2zr.xg7ek.hmj%2asm..t.a4jy.6o9k.bw89mq%5f%5fdmtsfto0"
},
{
"trust": 0.3,
"url": "http://www-01.ibm.com/software/lotus/products/foundations/start/"
},
{
"trust": 0.3,
"url": "http://kb.parallels.com/en/113818"
},
{
"trust": 0.3,
"url": "kb.parallels.com/en/116241"
},
{
"trust": 0.3,
"url": "https://community.rapid7.com/thread/5174"
},
{
"trust": 0.3,
"url": "http://www.php.net/"
},
{
"trust": 0.3,
"url": "http://seclists.org/fulldisclosure/2013/jun/21"
},
{
"trust": 0.3,
"url": "http://ompldr.org/vzgxxaq"
},
{
"trust": 0.3,
"url": "http://kb.juniper.net/infocenter/index?page=content\u0026id=jsa10658\u0026cat=sirt_1\u0026actp=list"
},
{
"trust": 0.3,
"url": "https://downloads.avaya.com/css/p8/documents/100162699"
},
{
"trust": 0.3,
"url": "https://downloads.avaya.com/css/p8/documents/100165255"
},
{
"trust": 0.3,
"url": "http://www.h-online.com/security/news/item/critical-open-hole-in-php-creates-risks-update-1567532.html"
},
{
"trust": 0.3,
"url": "http://h20000.www2.hp.com/bizsupport/techsupport/document.jsp?objectid=c03360041"
},
{
"trust": 0.3,
"url": "http://www.php.net/archive/2012.php#id2012-05-03-1"
},
{
"trust": 0.3,
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21620314"
},
{
"trust": 0.3,
"url": "http://www.turbolinux.co.jp/security-e/2012/tlsa-2012-14.txt"
},
{
"trust": 0.3,
"url": "http://www.kb.cert.org/vuls/id/673343"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2358"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2357"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2362"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2361"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2364"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2363"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2359"
},
{
"trust": 0.3,
"url": "http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2329"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-3389"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2356"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2110"
},
{
"trust": 0.3,
"url": "http://h18013.www1.hp.com/products/servers/management/agents/index.html"
},
{
"trust": 0.3,
"url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/"
},
{
"trust": 0.3,
"url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secbullarchive/"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0883"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2355"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2360"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-1172"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-1823"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-5217"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0788"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-4885"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0831"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2143"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0830"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-3379"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-4566"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2386"
},
{
"trust": 0.2,
"url": "http://secunia.com/"
},
{
"trust": 0.2,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-1823"
},
{
"trust": 0.2,
"url": "http://lists.grok.org.uk/full-disclosure-charter.html"
},
{
"trust": 0.2,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-2336"
},
{
"trust": 0.2,
"url": "http://www.mandriva.com/security/"
},
{
"trust": 0.2,
"url": "http://www.mandriva.com/security/advisories"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-4821"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2688"
},
{
"trust": 0.1,
"url": "http://security.gentoo.org/glsa/glsa-201209-03.xml"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0057"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-4566"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-2688"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1398"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-0789"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-1398"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-0831"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-2336"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-2335"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-0057"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-3450"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-3450"
},
{
"trust": 0.1,
"url": "http://creativecommons.org/licenses/by-sa/2.5"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-0830"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-3379"
},
{
"trust": 0.1,
"url": "http://security.gentoo.org/"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-1172"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-4885"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-1823"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-0788"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-2311"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0789"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-3365"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-2143"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-3365"
},
{
"trust": 0.1,
"url": "https://bugs.gentoo.org."
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-2386"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4566"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-0831"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1148"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4885"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-3182"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1938"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-0830"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-2483"
},
{
"trust": 0.1,
"url": "http://www.mandriva.com/security/advisories?name=mdva-2012:004"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-2202"
},
{
"trust": 0.1,
"url": "http://www.mandriva.com/security/advisories?name=mdvsa-2011:166"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-0788"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-0807"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1148"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1938"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-3267"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-3268"
},
{
"trust": 0.1,
"url": "http://www.mandriva.com/security/advisories?name=mdvsa-2011:165"
},
{
"trust": 0.1,
"url": "http://www.mandriva.com/security/advisories?name=mdvsa-2012:065"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-3182"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-3268"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-2202"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-2483"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1657"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0807"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-1172"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-3379"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-3267"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1657"
},
{
"trust": 0.1,
"url": "http://www.mandriva.com/security/advisories?name=mdvsa-2012:068-1"
},
{
"trust": 0.1,
"url": "http://www.mandriva.com/security/advisories?name=mdvsa-2011:197"
},
{
"trust": 0.1,
"url": "http://www.mandriva.com/security/advisories?name=mdvsa-2011:180"
},
{
"trust": 0.1,
"url": "http://www.mandriva.com/security/advisories?name=mdvsa-2012:068"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-5217"
},
{
"trust": 0.1,
"url": "http://www.openwall.com/lists/oss-security/2012/05/09/9"
},
{
"trust": 0.1,
"url": "http://www.ubuntu.com/usn/usn-1481-1"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/php5/5.3.5-1ubuntu7.10"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/php5/5.3.10-1ubuntu3.2"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0781"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/php5/5.3.6-13ubuntu3.8"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/php5/5.3.2-1ubuntu4.17"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/php5/5.2.4-2ubuntu5.25"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2317"
}
],
"sources": [
{
"db": "BID",
"id": "53388"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002394"
},
{
"db": "PACKETSTORM",
"id": "123310"
},
{
"db": "PACKETSTORM",
"id": "116800"
},
{
"db": "PACKETSTORM",
"id": "112598"
},
{
"db": "PACKETSTORM",
"id": "122468"
},
{
"db": "PACKETSTORM",
"id": "112597"
},
{
"db": "PACKETSTORM",
"id": "113885"
},
{
"db": "PACKETSTORM",
"id": "122482"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-208"
},
{
"db": "NVD",
"id": "CVE-2012-2335"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "BID",
"id": "53388"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002394"
},
{
"db": "PACKETSTORM",
"id": "123310"
},
{
"db": "PACKETSTORM",
"id": "116800"
},
{
"db": "PACKETSTORM",
"id": "112598"
},
{
"db": "PACKETSTORM",
"id": "122468"
},
{
"db": "PACKETSTORM",
"id": "112597"
},
{
"db": "PACKETSTORM",
"id": "113885"
},
{
"db": "PACKETSTORM",
"id": "122482"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-208"
},
{
"db": "NVD",
"id": "CVE-2012-2335"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-05-04T00:00:00",
"db": "BID",
"id": "53388"
},
{
"date": "2012-05-14T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-002394"
},
{
"date": "2013-09-19T22:22:00",
"db": "PACKETSTORM",
"id": "123310"
},
{
"date": "2012-09-24T15:02:14",
"db": "PACKETSTORM",
"id": "116800"
},
{
"date": "2012-05-10T15:28:01",
"db": "PACKETSTORM",
"id": "112598"
},
{
"date": "2013-07-18T18:51:07",
"db": "PACKETSTORM",
"id": "122468"
},
{
"date": "2012-05-10T15:26:54",
"db": "PACKETSTORM",
"id": "112597"
},
{
"date": "2012-06-20T02:58:04",
"db": "PACKETSTORM",
"id": "113885"
},
{
"date": "2013-07-19T19:33:00",
"db": "PACKETSTORM",
"id": "122482"
},
{
"date": "2012-05-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201205-208"
},
{
"date": "2012-05-11T10:15:48.480000",
"db": "NVD",
"id": "CVE-2012-2335"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-04-13T22:15:00",
"db": "BID",
"id": "53388"
},
{
"date": "2012-07-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-002394"
},
{
"date": "2023-02-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201205-208"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2012-2335"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "116800"
},
{
"db": "PACKETSTORM",
"id": "112597"
},
{
"db": "PACKETSTORM",
"id": "113885"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-208"
}
],
"trust": 0.9
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "PHP of php-wrapper.fcgi Vulnerabilities that bypass protection mechanisms",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-002394"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control issues",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201205-208"
}
],
"trust": 0.6
}
}
VAR-201112-0205
Vulnerability from variot - Updated: 2025-04-11 23:20The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive information by reading a page, as demonstrated by smb/user/list and certain other files
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201112-0205",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "plesk panel",
"scope": "eq",
"trust": 1.6,
"vendor": "parallels",
"version": "10.2.0_build20110407.20"
},
{
"model": "plesk panel",
"scope": "eq",
"trust": 0.8,
"vendor": "parallels",
"version": "10.2.0 build 20110407.20"
},
{
"model": "plesk panel 10.2.0 build20110407.20",
"scope": null,
"trust": 0.6,
"vendor": "parallels",
"version": null
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.6,
"vendor": "redhat",
"version": "6"
},
{
"model": "10.2.0 build20110407.20",
"scope": null,
"trust": 0.4,
"vendor": "parallels plesk panel",
"version": null
}
],
"sources": [
{
"db": "IVD",
"id": "4ee542d4-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d77adb1-463f-11e9-9dd2-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5641"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003432"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-303"
},
{
"db": "NVD",
"id": "CVE-2011-4742"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:parallels:parallels_plesk_panel",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003432"
}
]
},
"cve": "CVE-2011-4742",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2011-4742",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2011-5641",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "4ee542d4-2354-11e6-abef-000c29c66e3d",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "7d77adb1-463f-11e9-9dd2-000c29342cb1",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2011-4742",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2011-4742",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2011-5641",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201112-303",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "4ee542d4-2354-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "7d77adb1-463f-11e9-9dd2-000c29342cb1",
"trust": 0.2,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "4ee542d4-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d77adb1-463f-11e9-9dd2-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5641"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003432"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-303"
},
{
"db": "NVD",
"id": "CVE-2011-4742"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive information by reading a page, as demonstrated by smb/user/list and certain other files",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4742"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003432"
},
{
"db": "CNVD",
"id": "CNVD-2011-5641"
},
{
"db": "IVD",
"id": "4ee542d4-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d77adb1-463f-11e9-9dd2-000c29342cb1"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2011-4742",
"trust": 3.4
},
{
"db": "CNVD",
"id": "CNVD-2011-5641",
"trust": 1.0
},
{
"db": "CNNVD",
"id": "CNNVD-201112-303",
"trust": 1.0
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003432",
"trust": 0.8
},
{
"db": "IVD",
"id": "4EE542D4-2354-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "IVD",
"id": "7D77ADB1-463F-11E9-9DD2-000C29342CB1",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "4ee542d4-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d77adb1-463f-11e9-9dd2-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5641"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003432"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-303"
},
{
"db": "NVD",
"id": "CVE-2011-4742"
}
]
},
"id": "VAR-201112-0205",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "4ee542d4-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d77adb1-463f-11e9-9dd2-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5641"
}
],
"trust": 1.73538688
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 1.0
}
],
"sources": [
{
"db": "IVD",
"id": "4ee542d4-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d77adb1-463f-11e9-9dd2-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5641"
}
]
},
"last_update_date": "2025-04-11T23:20:42.790000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Parallels Plesk Panel",
"trust": 0.8,
"url": "http://www.parallels.com/products/plesk/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003432"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-200",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003432"
},
{
"db": "NVD",
"id": "CVE-2011-4742"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72317"
},
{
"trust": 1.6,
"url": "http://xss.cx/examples/plesk-reports/xss-reflected-cross-site-scripting-cwe79-capec86-plesk-parallels-control-panel-version-20110407.20.html"
},
{
"trust": 1.4,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4742"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4742"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5641"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003432"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-303"
},
{
"db": "NVD",
"id": "CVE-2011-4742"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "4ee542d4-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d77adb1-463f-11e9-9dd2-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5641"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003432"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-303"
},
{
"db": "NVD",
"id": "CVE-2011-4742"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-19T00:00:00",
"db": "IVD",
"id": "4ee542d4-2354-11e6-abef-000c29c66e3d"
},
{
"date": "2011-12-19T00:00:00",
"db": "IVD",
"id": "7d77adb1-463f-11e9-9dd2-000c29342cb1"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5641"
},
{
"date": "2011-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003432"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-303"
},
{
"date": "2011-12-16T11:55:10.407000",
"db": "NVD",
"id": "CVE-2011-4742"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5641"
},
{
"date": "2011-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003432"
},
{
"date": "2019-04-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-303"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2011-4742"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201112-303"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Parallels Plesk Panel Information Disclosure Vulnerability",
"sources": [
{
"db": "IVD",
"id": "4ee542d4-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d77adb1-463f-11e9-9dd2-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5641"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-303"
}
],
"trust": 1.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "information disclosure",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201112-303"
}
],
"trust": 0.6
}
}
VAR-201112-0226
Vulnerability from variot - Updated: 2025-04-11 23:20Multiple SQL injection vulnerabilities in the Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by Wizard/Edit/Html and certain other files. As demonstrated in Wizard / Edit / Html and some other documents. Parallels Plesk Small Business Panel is prone to a sql-injection vulnerability
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201112-0226",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "plesk small business panel",
"scope": "eq",
"trust": 3.0,
"vendor": "parallels",
"version": "10.2.0"
},
{
"model": "plesk small business panel",
"scope": "eq",
"trust": 0.3,
"vendor": "parallels",
"version": "10.2"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5623"
},
{
"db": "BID",
"id": "73675"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003450"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-324"
},
{
"db": "NVD",
"id": "CVE-2011-4763"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:parallels:parallels_plesk_small_business_panel",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003450"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Unknown",
"sources": [
{
"db": "BID",
"id": "73675"
}
],
"trust": 0.3
},
"cve": "CVE-2011-4763",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2011-4763",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2011-5623",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2011-4763",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2011-4763",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2011-5623",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201112-324",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5623"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003450"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-324"
},
{
"db": "NVD",
"id": "CVE-2011-4763"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple SQL injection vulnerabilities in the Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by Wizard/Edit/Html and certain other files. As demonstrated in Wizard / Edit / Html and some other documents. Parallels Plesk Small Business Panel is prone to a sql-injection vulnerability",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4763"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003450"
},
{
"db": "CNVD",
"id": "CNVD-2011-5623"
},
{
"db": "BID",
"id": "73675"
}
],
"trust": 2.43
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2011-4763",
"trust": 3.3
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003450",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2011-5623",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201112-324",
"trust": 0.6
},
{
"db": "XF",
"id": "72215",
"trust": 0.3
},
{
"db": "BID",
"id": "73675",
"trust": 0.3
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5623"
},
{
"db": "BID",
"id": "73675"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003450"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-324"
},
{
"db": "NVD",
"id": "CVE-2011-4763"
}
]
},
"id": "VAR-201112-0226",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5623"
}
],
"trust": 1.1859375
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5623"
}
]
},
"last_update_date": "2025-04-11T23:20:42.760000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Parallels Small Business Panel",
"trust": 0.8,
"url": "http://www.parallels.com/products/small-business-panel/documentation/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003450"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-89",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003450"
},
{
"db": "NVD",
"id": "CVE-2011-4763"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.9,
"url": "http://xss.cx/examples/plesk-reports/plesk-10.2.0-site-editor.html"
},
{
"trust": 1.4,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4763"
},
{
"trust": 1.0,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72215"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4763"
},
{
"trust": 0.3,
"url": "http://xforce.iss.net/xforce/xfdb/72215"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5623"
},
{
"db": "BID",
"id": "73675"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003450"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-324"
},
{
"db": "NVD",
"id": "CVE-2011-4763"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2011-5623"
},
{
"db": "BID",
"id": "73675"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003450"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-324"
},
{
"db": "NVD",
"id": "CVE-2011-4763"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5623"
},
{
"date": "2011-12-16T00:00:00",
"db": "BID",
"id": "73675"
},
{
"date": "2011-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003450"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-324"
},
{
"date": "2011-12-16T11:55:11.890000",
"db": "NVD",
"id": "CVE-2011-4763"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5623"
},
{
"date": "2011-12-16T00:00:00",
"db": "BID",
"id": "73675"
},
{
"date": "2011-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003450"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-324"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2011-4763"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201112-324"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Parallels Plesk Small Business Panel of Site Editor In function SQL Injection vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003450"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "SQL injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201112-324"
}
],
"trust": 0.6
}
}
VAR-201112-0247
Vulnerability from variot - Updated: 2025-04-11 23:20The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 includes an RFC 1918 IP address within a web page, which allows remote attackers to obtain potentially sensitive information by reading this page, as demonstrated by smb/user/list-data/items-per-page/ and certain other files
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201112-0247",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "plesk panel",
"scope": "eq",
"trust": 2.4,
"vendor": "parallels",
"version": "10.4.4_build20111103.18"
},
{
"model": "plesk panel",
"scope": "eq",
"trust": 0.6,
"vendor": "parallels",
"version": "10.0"
},
{
"model": "10.4.4 build20111103.18",
"scope": null,
"trust": 0.4,
"vendor": "parallels plesk panel",
"version": null
}
],
"sources": [
{
"db": "IVD",
"id": "4da430ec-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d7515a1-463f-11e9-b4a4-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5611"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003463"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-338"
},
{
"db": "NVD",
"id": "CVE-2011-4853"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:parallels:parallels_plesk_panel",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003463"
}
]
},
"cve": "CVE-2011-4853",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2011-4853",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CNVD-2011-5611",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "4da430ec-2354-11e6-abef-000c29c66e3d",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "7d7515a1-463f-11e9-b4a4-000c29342cb1",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2011-4853",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2011-4853",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2011-5611",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201112-338",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "4da430ec-2354-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "7d7515a1-463f-11e9-b4a4-000c29342cb1",
"trust": 0.2,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "4da430ec-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d7515a1-463f-11e9-b4a4-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5611"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003463"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-338"
},
{
"db": "NVD",
"id": "CVE-2011-4853"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 includes an RFC 1918 IP address within a web page, which allows remote attackers to obtain potentially sensitive information by reading this page, as demonstrated by smb/user/list-data/items-per-page/ and certain other files",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4853"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003463"
},
{
"db": "CNVD",
"id": "CNVD-2011-5611"
},
{
"db": "IVD",
"id": "4da430ec-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d7515a1-463f-11e9-b4a4-000c29342cb1"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2011-4853",
"trust": 3.4
},
{
"db": "CNVD",
"id": "CNVD-2011-5611",
"trust": 1.0
},
{
"db": "CNNVD",
"id": "CNNVD-201112-338",
"trust": 1.0
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003463",
"trust": 0.8
},
{
"db": "XF",
"id": "72094",
"trust": 0.6
},
{
"db": "IVD",
"id": "4DA430EC-2354-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "IVD",
"id": "7D7515A1-463F-11E9-B4A4-000C29342CB1",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "4da430ec-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d7515a1-463f-11e9-b4a4-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5611"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003463"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-338"
},
{
"db": "NVD",
"id": "CVE-2011-4853"
}
]
},
"id": "VAR-201112-0247",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "4da430ec-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d7515a1-463f-11e9-b4a4-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5611"
}
],
"trust": 1.47077376
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 1.0
}
],
"sources": [
{
"db": "IVD",
"id": "4da430ec-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d7515a1-463f-11e9-b4a4-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5611"
}
]
},
"last_update_date": "2025-04-11T23:20:42.726000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Parallels Plesk Panel",
"trust": 0.8,
"url": "http://www.parallels.com/products/plesk/"
},
{
"title": "Parallels Plesk Panel Information Disclosure Vulnerability Patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/37444"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5611"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003463"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-200",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003463"
},
{
"db": "NVD",
"id": "CVE-2011-4853"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html"
},
{
"trust": 1.0,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72094"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4853"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4853"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/72094"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5611"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003463"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-338"
},
{
"db": "NVD",
"id": "CVE-2011-4853"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "4da430ec-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d7515a1-463f-11e9-b4a4-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5611"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003463"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-338"
},
{
"db": "NVD",
"id": "CVE-2011-4853"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-19T00:00:00",
"db": "IVD",
"id": "4da430ec-2354-11e6-abef-000c29c66e3d"
},
{
"date": "2011-12-19T00:00:00",
"db": "IVD",
"id": "7d7515a1-463f-11e9-b4a4-000c29342cb1"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5611"
},
{
"date": "2011-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003463"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-338"
},
{
"date": "2011-12-16T11:55:13.313000",
"db": "NVD",
"id": "CVE-2011-4853"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5611"
},
{
"date": "2011-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003463"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-338"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2011-4853"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201112-338"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Parallels Plesk Panel Information Disclosure Vulnerability",
"sources": [
{
"db": "IVD",
"id": "4da430ec-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d7515a1-463f-11e9-b4a4-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5611"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-338"
}
],
"trust": 1.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "information disclosure",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201112-338"
}
],
"trust": 0.6
}
}
VAR-201112-0200
Vulnerability from variot - Updated: 2025-04-11 23:19The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 includes a submitted password within an HTTP response body, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by password handling in client@2/domain@1/odbc/dsn@1/properties/
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201112-0200",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "plesk panel",
"scope": "eq",
"trust": 1.6,
"vendor": "parallels",
"version": "10.2.0_build20110407.20"
},
{
"model": "plesk panel",
"scope": "eq",
"trust": 0.8,
"vendor": "parallels",
"version": "10.2.0 build 20110407.20"
},
{
"model": "plesk panel 10.3.1 build1013110726.09",
"scope": null,
"trust": 0.6,
"vendor": "parallels",
"version": null
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.6,
"vendor": "redhat",
"version": "6"
},
{
"model": "10.2.0 build20110407.20",
"scope": null,
"trust": 0.2,
"vendor": "parallels plesk panel",
"version": null
}
],
"sources": [
{
"db": "IVD",
"id": "4ea3a5cc-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5646"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003427"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-298"
},
{
"db": "NVD",
"id": "CVE-2011-4737"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:parallels:parallels_plesk_panel",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003427"
}
]
},
"cve": "CVE-2011-4737",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2011-4737",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2011-5646",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "4ea3a5cc-2354-11e6-abef-000c29c66e3d",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2011-4737",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2011-4737",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2011-5646",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201112-298",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "4ea3a5cc-2354-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "4ea3a5cc-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5646"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003427"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-298"
},
{
"db": "NVD",
"id": "CVE-2011-4737"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 includes a submitted password within an HTTP response body, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by password handling in client@2/domain@1/odbc/dsn@1/properties/",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4737"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003427"
},
{
"db": "CNVD",
"id": "CNVD-2011-5646"
},
{
"db": "IVD",
"id": "4ea3a5cc-2354-11e6-abef-000c29c66e3d"
}
],
"trust": 2.34
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2011-4737",
"trust": 3.2
},
{
"db": "CNVD",
"id": "CNVD-2011-5646",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201112-298",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003427",
"trust": 0.8
},
{
"db": "IVD",
"id": "4EA3A5CC-2354-11E6-ABEF-000C29C66E3D",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "4ea3a5cc-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5646"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003427"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-298"
},
{
"db": "NVD",
"id": "CVE-2011-4737"
}
]
},
"id": "VAR-201112-0200",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "4ea3a5cc-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5646"
}
],
"trust": 1.53538688
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "4ea3a5cc-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5646"
}
]
},
"last_update_date": "2025-04-11T23:19:35.796000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Parallels Plesk Panel",
"trust": 0.8,
"url": "http://www.parallels.com/products/plesk/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003427"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-200",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003427"
},
{
"db": "NVD",
"id": "CVE-2011-4737"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "http://xss.cx/examples/plesk-reports/xss-reflected-cross-site-scripting-cwe79-capec86-plesk-parallels-control-panel-version-20110407.20.html"
},
{
"trust": 1.6,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72322"
},
{
"trust": 1.4,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4737"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4737"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5646"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003427"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-298"
},
{
"db": "NVD",
"id": "CVE-2011-4737"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "4ea3a5cc-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5646"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003427"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-298"
},
{
"db": "NVD",
"id": "CVE-2011-4737"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-19T00:00:00",
"db": "IVD",
"id": "4ea3a5cc-2354-11e6-abef-000c29c66e3d"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5646"
},
{
"date": "2011-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003427"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-298"
},
{
"date": "2011-12-16T11:55:10.017000",
"db": "NVD",
"id": "CVE-2011-4737"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5646"
},
{
"date": "2011-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003427"
},
{
"date": "2019-04-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-298"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2011-4737"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201112-298"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Parallels Plesk Panel Information Disclosure Vulnerability",
"sources": [
{
"db": "IVD",
"id": "4ea3a5cc-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5646"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-298"
}
],
"trust": 1.4
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "information disclosure",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201112-298"
}
],
"trust": 0.6
}
}
VAR-201112-0221
Vulnerability from variot - Updated: 2025-04-11 23:19Parallels Plesk Small Business Panel 10.2.0 receives cleartext password input over HTTP, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by forms in smb/auth and certain other files
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201112-0221",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "plesk small business panel",
"scope": "eq",
"trust": 3.0,
"vendor": "parallels",
"version": "10.2.0"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5627"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003445"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-319"
},
{
"db": "NVD",
"id": "CVE-2011-4758"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:parallels:parallels_plesk_small_business_panel",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003445"
}
]
},
"cve": "CVE-2011-4758",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2011-4758",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2011-5627",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2011-4758",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2011-4758",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2011-5627",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201112-319",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5627"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003445"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-319"
},
{
"db": "NVD",
"id": "CVE-2011-4758"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Parallels Plesk Small Business Panel 10.2.0 receives cleartext password input over HTTP, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by forms in smb/auth and certain other files",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4758"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003445"
},
{
"db": "CNVD",
"id": "CNVD-2011-5627"
}
],
"trust": 2.16
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2011-4758",
"trust": 3.0
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003445",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2011-5627",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201112-319",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5627"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003445"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-319"
},
{
"db": "NVD",
"id": "CVE-2011-4758"
}
]
},
"id": "VAR-201112-0221",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5627"
}
],
"trust": 1.1859375
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5627"
}
]
},
"last_update_date": "2025-04-11T23:19:35.771000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Parallels Plesk Small Business Panel",
"trust": 0.8,
"url": "http://www.parallels.com/products/small-business-panel/documentation/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003445"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-310",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003445"
},
{
"db": "NVD",
"id": "CVE-2011-4758"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "http://xss.cx/examples/plesk-reports/plesk-10.2.0.html"
},
{
"trust": 1.4,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4758"
},
{
"trust": 1.0,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72210"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4758"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5627"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003445"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-319"
},
{
"db": "NVD",
"id": "CVE-2011-4758"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2011-5627"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003445"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-319"
},
{
"db": "NVD",
"id": "CVE-2011-4758"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5627"
},
{
"date": "2011-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003445"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-319"
},
{
"date": "2011-12-16T11:55:11.437000",
"db": "NVD",
"id": "CVE-2011-4758"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5627"
},
{
"date": "2011-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003445"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-319"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2011-4758"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201112-319"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Parallels Plesk Small Business Panel Vulnerability in which important information is obtained",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003445"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "encryption problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201112-319"
}
],
"trust": 0.6
}
}
VAR-201112-0242
Vulnerability from variot - Updated: 2025-04-11 23:19The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 includes a submitted password within an HTTP response body, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by password handling in certain files under client@1/domain@1/backup/local-repository/
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201112-0242",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "plesk panel",
"scope": "eq",
"trust": 2.4,
"vendor": "parallels",
"version": "10.4.4_build20111103.18"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003458"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-333"
},
{
"db": "NVD",
"id": "CVE-2011-4848"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:parallels:parallels_plesk_panel",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003458"
}
]
},
"cve": "CVE-2011-4848",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2011-4848",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2011-4848",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2011-4848",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-201112-333",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003458"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-333"
},
{
"db": "NVD",
"id": "CVE-2011-4848"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 includes a submitted password within an HTTP response body, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by password handling in certain files under client@1/domain@1/backup/local-repository/",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4848"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003458"
}
],
"trust": 1.62
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2011-4848",
"trust": 2.4
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003458",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201112-333",
"trust": 0.6
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003458"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-333"
},
{
"db": "NVD",
"id": "CVE-2011-4848"
}
]
},
"id": "VAR-201112-0242",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.47077376
},
"last_update_date": "2025-04-11T23:19:35.750000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Parallels Plesk Panel",
"trust": 0.8,
"url": "http://www.parallels.com/products/plesk/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003458"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-200",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003458"
},
{
"db": "NVD",
"id": "CVE-2011-4848"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html"
},
{
"trust": 1.0,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72223"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4848"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4848"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003458"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-333"
},
{
"db": "NVD",
"id": "CVE-2011-4848"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003458"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-333"
},
{
"db": "NVD",
"id": "CVE-2011-4848"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003458"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-333"
},
{
"date": "2011-12-16T11:55:12.720000",
"db": "NVD",
"id": "CVE-2011-4848"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003458"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-333"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2011-4848"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201112-333"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Parallels Plesk Panel of Control Panel Vulnerability in which important information is obtained",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003458"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "information disclosure",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201112-333"
}
],
"trust": 0.6
}
}
VAR-201112-0263
Vulnerability from variot - Updated: 2025-04-11 23:19Cross-site scripting (XSS) vulnerability in the Site Editor (aka SiteBuilder) feature in Parallels Plesk Panel 10.4.4_build20111103.18 allows remote attackers to inject arbitrary web script or HTML via the login parameter to preferences.html
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201112-0263",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "plesk panel",
"scope": "eq",
"trust": 2.4,
"vendor": "parallels",
"version": "10.4.4_build20111103.18"
},
{
"model": "plesk panel",
"scope": "eq",
"trust": 0.6,
"vendor": "parallels",
"version": "10.0"
},
{
"model": "10.4.4 build20111103.18",
"scope": null,
"trust": 0.4,
"vendor": "parallels plesk panel",
"version": null
},
{
"model": "plesk panel build20111103",
"scope": "eq",
"trust": 0.3,
"vendor": "parallels",
"version": "10.4.4"
}
],
"sources": [
{
"db": "IVD",
"id": "4dbebbba-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d74a071-463f-11e9-9015-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5616"
},
{
"db": "BID",
"id": "73532"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003456"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-331"
},
{
"db": "NVD",
"id": "CVE-2011-4777"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:parallels:parallels_plesk_panel",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003456"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Unknown",
"sources": [
{
"db": "BID",
"id": "73532"
}
],
"trust": 0.3
},
"cve": "CVE-2011-4777",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "CVE-2011-4777",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "CNVD-2011-5616",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "4dbebbba-2354-11e6-abef-000c29c66e3d",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "7d74a071-463f-11e9-9015-000c29342cb1",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2011-4777",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2011-4777",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2011-5616",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201112-331",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "4dbebbba-2354-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "7d74a071-463f-11e9-9015-000c29342cb1",
"trust": 0.2,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "4dbebbba-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d74a071-463f-11e9-9015-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5616"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003456"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-331"
},
{
"db": "NVD",
"id": "CVE-2011-4777"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site scripting (XSS) vulnerability in the Site Editor (aka SiteBuilder) feature in Parallels Plesk Panel 10.4.4_build20111103.18 allows remote attackers to inject arbitrary web script or HTML via the login parameter to preferences.html",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4777"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003456"
},
{
"db": "CNVD",
"id": "CNVD-2011-5616"
},
{
"db": "BID",
"id": "73532"
},
{
"db": "IVD",
"id": "4dbebbba-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d74a071-463f-11e9-9015-000c29342cb1"
}
],
"trust": 2.79
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2011-4777",
"trust": 3.7
},
{
"db": "CNVD",
"id": "CNVD-2011-5616",
"trust": 1.0
},
{
"db": "CNNVD",
"id": "CNNVD-201112-331",
"trust": 1.0
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003456",
"trust": 0.8
},
{
"db": "BID",
"id": "73532",
"trust": 0.3
},
{
"db": "IVD",
"id": "4DBEBBBA-2354-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "IVD",
"id": "7D74A071-463F-11E9-9015-000C29342CB1",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "4dbebbba-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d74a071-463f-11e9-9015-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5616"
},
{
"db": "BID",
"id": "73532"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003456"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-331"
},
{
"db": "NVD",
"id": "CVE-2011-4777"
}
]
},
"id": "VAR-201112-0263",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "4dbebbba-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d74a071-463f-11e9-9015-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5616"
}
],
"trust": 1.47077376
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 1.0
}
],
"sources": [
{
"db": "IVD",
"id": "4dbebbba-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d74a071-463f-11e9-9015-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5616"
}
]
},
"last_update_date": "2025-04-11T23:19:35.713000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Parallels Plesk Panel",
"trust": 0.8,
"url": "http://www.parallels.com/products/plesk/"
},
{
"title": "Patch for Parallels Plesk Panel \\342\\200\\230login\\342\\200\\231 parameter cross-site scripting vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/37449"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5616"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003456"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003456"
},
{
"db": "NVD",
"id": "CVE-2011-4777"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4777"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4777"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5616"
},
{
"db": "BID",
"id": "73532"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003456"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-331"
},
{
"db": "NVD",
"id": "CVE-2011-4777"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "4dbebbba-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d74a071-463f-11e9-9015-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5616"
},
{
"db": "BID",
"id": "73532"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003456"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-331"
},
{
"db": "NVD",
"id": "CVE-2011-4777"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-19T00:00:00",
"db": "IVD",
"id": "4dbebbba-2354-11e6-abef-000c29c66e3d"
},
{
"date": "2011-12-19T00:00:00",
"db": "IVD",
"id": "7d74a071-463f-11e9-9015-000c29342cb1"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5616"
},
{
"date": "2011-12-16T00:00:00",
"db": "BID",
"id": "73532"
},
{
"date": "2011-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003456"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-331"
},
{
"date": "2011-12-16T11:55:12.580000",
"db": "NVD",
"id": "CVE-2011-4777"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5616"
},
{
"date": "2011-12-16T00:00:00",
"db": "BID",
"id": "73532"
},
{
"date": "2011-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003456"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-331"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2011-4777"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201112-331"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Parallels Plesk Panel of Site Editor Cross-site scripting vulnerability in functionality",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003456"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201112-331"
}
],
"trust": 0.6
}
}
VAR-201112-0203
Vulnerability from variot - Updated: 2025-04-11 23:18The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 generates web pages containing external links in response to GET requests with query strings for smb/app/search-data/catalogId/marketplace and certain other files, which makes it easier for remote attackers to obtain sensitive information by reading (1) web-server access logs or (2) web-server Referer logs, related to a "cross-domain Referer leakage" issue. There is a vulnerability in Parallels Plesk Panel 10.2.0 build 20110407.20
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201112-0203",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "plesk panel",
"scope": "eq",
"trust": 1.6,
"vendor": "parallels",
"version": "10.2.0_build20110407.20"
},
{
"model": "plesk panel",
"scope": "eq",
"trust": 0.8,
"vendor": "parallels",
"version": "10.2.0 build 20110407.20"
},
{
"model": "plesk panel 10.3.1 build1013110726.09",
"scope": null,
"trust": 0.6,
"vendor": "parallels",
"version": null
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.6,
"vendor": "redhat",
"version": "6"
},
{
"model": "10.2.0 build20110407.20",
"scope": null,
"trust": 0.4,
"vendor": "parallels plesk panel",
"version": null
}
],
"sources": [
{
"db": "IVD",
"id": "4ef99a4a-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d77d4c1-463f-11e9-8629-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5643"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003430"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-301"
},
{
"db": "NVD",
"id": "CVE-2011-4740"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:parallels:parallels_plesk_panel",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003430"
}
]
},
"cve": "CVE-2011-4740",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2011-4740",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CNVD-2011-5643",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "4ef99a4a-2354-11e6-abef-000c29c66e3d",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "7d77d4c1-463f-11e9-8629-000c29342cb1",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2011-4740",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2011-4740",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2011-5643",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201112-301",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "4ef99a4a-2354-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "7d77d4c1-463f-11e9-8629-000c29342cb1",
"trust": 0.2,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "4ef99a4a-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d77d4c1-463f-11e9-8629-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5643"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003430"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-301"
},
{
"db": "NVD",
"id": "CVE-2011-4740"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 generates web pages containing external links in response to GET requests with query strings for smb/app/search-data/catalogId/marketplace and certain other files, which makes it easier for remote attackers to obtain sensitive information by reading (1) web-server access logs or (2) web-server Referer logs, related to a \"cross-domain Referer leakage\" issue. There is a vulnerability in Parallels Plesk Panel 10.2.0 build 20110407.20",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4740"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003430"
},
{
"db": "CNVD",
"id": "CNVD-2011-5643"
},
{
"db": "IVD",
"id": "4ef99a4a-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d77d4c1-463f-11e9-8629-000c29342cb1"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2011-4740",
"trust": 3.4
},
{
"db": "CNVD",
"id": "CNVD-2011-5643",
"trust": 1.0
},
{
"db": "CNNVD",
"id": "CNNVD-201112-301",
"trust": 1.0
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003430",
"trust": 0.8
},
{
"db": "IVD",
"id": "4EF99A4A-2354-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "IVD",
"id": "7D77D4C1-463F-11E9-8629-000C29342CB1",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "4ef99a4a-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d77d4c1-463f-11e9-8629-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5643"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003430"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-301"
},
{
"db": "NVD",
"id": "CVE-2011-4740"
}
]
},
"id": "VAR-201112-0203",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "4ef99a4a-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d77d4c1-463f-11e9-8629-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5643"
}
],
"trust": 1.73538688
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 1.0
}
],
"sources": [
{
"db": "IVD",
"id": "4ef99a4a-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d77d4c1-463f-11e9-8629-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5643"
}
]
},
"last_update_date": "2025-04-11T23:18:58.832000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Parallels Plesk Panel",
"trust": 0.8,
"url": "http://www.parallels.com/products/plesk/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003430"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-200",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003430"
},
{
"db": "NVD",
"id": "CVE-2011-4740"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "http://xss.cx/examples/plesk-reports/xss-reflected-cross-site-scripting-cwe79-capec86-plesk-parallels-control-panel-version-20110407.20.html"
},
{
"trust": 1.6,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72319"
},
{
"trust": 1.4,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4740"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4740"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5643"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003430"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-301"
},
{
"db": "NVD",
"id": "CVE-2011-4740"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "4ef99a4a-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d77d4c1-463f-11e9-8629-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5643"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003430"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-301"
},
{
"db": "NVD",
"id": "CVE-2011-4740"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-19T00:00:00",
"db": "IVD",
"id": "4ef99a4a-2354-11e6-abef-000c29c66e3d"
},
{
"date": "2011-12-19T00:00:00",
"db": "IVD",
"id": "7d77d4c1-463f-11e9-8629-000c29342cb1"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5643"
},
{
"date": "2011-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003430"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-301"
},
{
"date": "2011-12-16T11:55:10.313000",
"db": "NVD",
"id": "CVE-2011-4740"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5643"
},
{
"date": "2011-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003430"
},
{
"date": "2019-04-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-301"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2011-4740"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201112-301"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Parallels Plesk Panel Information Disclosure Vulnerability",
"sources": [
{
"db": "IVD",
"id": "4ef99a4a-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d77d4c1-463f-11e9-8629-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5643"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-301"
}
],
"trust": 1.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "information disclosure",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201112-301"
}
],
"trust": 0.6
}
}
VAR-201112-0224
Vulnerability from variot - Updated: 2025-04-11 23:18Parallels Plesk Small Business Panel 10.2.0 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving domains/sitebuilder_edit.php and certain other files. NOTE: it is possible that only clients, not the SmarterStats product, could be affected by this issue
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201112-0224",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "plesk small business panel",
"scope": "eq",
"trust": 3.0,
"vendor": "parallels",
"version": "10.2.0"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5625"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003448"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-322"
},
{
"db": "NVD",
"id": "CVE-2011-4761"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:parallels:parallels_plesk_small_business_panel",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003448"
}
]
},
"cve": "CVE-2011-4761",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2011-4761",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2011-5625",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2011-4761",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2011-4761",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2011-5625",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201112-322",
"trust": 0.6,
"value": "CRITICAL"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5625"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003448"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-322"
},
{
"db": "NVD",
"id": "CVE-2011-4761"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Parallels Plesk Small Business Panel 10.2.0 omits the Content-Type header\u0027s charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving domains/sitebuilder_edit.php and certain other files. NOTE: it is possible that only clients, not the SmarterStats product, could be affected by this issue",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4761"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003448"
},
{
"db": "CNVD",
"id": "CNVD-2011-5625"
}
],
"trust": 2.16
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2011-4761",
"trust": 3.0
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003448",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2011-5625",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201112-322",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5625"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003448"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-322"
},
{
"db": "NVD",
"id": "CVE-2011-4761"
}
]
},
"id": "VAR-201112-0224",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5625"
}
],
"trust": 1.1859375
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5625"
}
]
},
"last_update_date": "2025-04-11T23:18:58.806000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Parallels Small Business Panel",
"trust": 0.8,
"url": "http://www.parallels.com/products/small-business-panel/documentation/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003448"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
},
{
"problemtype": "CWE-DesignError",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003448"
},
{
"db": "NVD",
"id": "CVE-2011-4761"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "http://xss.cx/examples/plesk-reports/plesk-10.2.0.html"
},
{
"trust": 1.4,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4761"
},
{
"trust": 1.0,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72213"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4761"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5625"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003448"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-322"
},
{
"db": "NVD",
"id": "CVE-2011-4761"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2011-5625"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003448"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-322"
},
{
"db": "NVD",
"id": "CVE-2011-4761"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5625"
},
{
"date": "2011-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003448"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-322"
},
{
"date": "2011-12-16T11:55:11.703000",
"db": "NVD",
"id": "CVE-2011-4761"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5625"
},
{
"date": "2011-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003448"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-322"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2011-4761"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201112-322"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Parallels Plesk Small Business Panel Design Error Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5625"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-322"
}
],
"trust": 1.2
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "design error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201112-322"
}
],
"trust": 0.6
}
}
VAR-201112-0245
Vulnerability from variot - Updated: 2025-04-11 23:18The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms in server/google-tools/ and certain other files. There is a vulnerability in Parallels Plesk Panel 10.4.4_build20111103.18, and the Control Panel is not disabled. The AutoComplete function generates a password form field
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201112-0245",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "plesk panel",
"scope": "eq",
"trust": 2.4,
"vendor": "parallels",
"version": "10.4.4_build20111103.18"
},
{
"model": "plesk panel",
"scope": "eq",
"trust": 0.6,
"vendor": "parallels",
"version": "10.0"
},
{
"model": "10.4.4 build20111103.18",
"scope": null,
"trust": 0.4,
"vendor": "parallels plesk panel",
"version": null
}
],
"sources": [
{
"db": "IVD",
"id": "4d2803dc-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d74c782-463f-11e9-ab3d-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5613"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003461"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-336"
},
{
"db": "NVD",
"id": "CVE-2011-4851"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:parallels:parallels_plesk_panel",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003461"
}
]
},
"cve": "CVE-2011-4851",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "CVE-2011-4851",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "CNVD-2011-5613",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "4d2803dc-2354-11e6-abef-000c29c66e3d",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "7d74c782-463f-11e9-ab3d-000c29342cb1",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2011-4851",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2011-4851",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2011-5613",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201112-336",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "IVD",
"id": "4d2803dc-2354-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "CRITICAL"
},
{
"author": "IVD",
"id": "7d74c782-463f-11e9-ab3d-000c29342cb1",
"trust": 0.2,
"value": "CRITICAL"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "4d2803dc-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d74c782-463f-11e9-ab3d-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5613"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003461"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-336"
},
{
"db": "NVD",
"id": "CVE-2011-4851"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms in server/google-tools/ and certain other files. There is a vulnerability in Parallels Plesk Panel 10.4.4_build20111103.18, and the Control Panel is not disabled. The AutoComplete function generates a password form field",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4851"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003461"
},
{
"db": "CNVD",
"id": "CNVD-2011-5613"
},
{
"db": "IVD",
"id": "4d2803dc-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d74c782-463f-11e9-ab3d-000c29342cb1"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2011-4851",
"trust": 3.4
},
{
"db": "CNVD",
"id": "CNVD-2011-5613",
"trust": 1.0
},
{
"db": "CNNVD",
"id": "CNNVD-201112-336",
"trust": 1.0
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003461",
"trust": 0.8
},
{
"db": "XF",
"id": "72226",
"trust": 0.6
},
{
"db": "IVD",
"id": "4D2803DC-2354-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "IVD",
"id": "7D74C782-463F-11E9-AB3D-000C29342CB1",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "4d2803dc-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d74c782-463f-11e9-ab3d-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5613"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003461"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-336"
},
{
"db": "NVD",
"id": "CVE-2011-4851"
}
]
},
"id": "VAR-201112-0245",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "4d2803dc-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d74c782-463f-11e9-ab3d-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5613"
}
],
"trust": 1.47077376
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 1.0
}
],
"sources": [
{
"db": "IVD",
"id": "4d2803dc-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d74c782-463f-11e9-ab3d-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5613"
}
]
},
"last_update_date": "2025-04-11T23:18:58.771000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Parallels Plesk Panel",
"trust": 0.8,
"url": "http://www.parallels.com/products/plesk/"
},
{
"title": "Patch for Parallels Plesk Panel Trust Management Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/37446"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5613"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003461"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-255",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003461"
},
{
"db": "NVD",
"id": "CVE-2011-4851"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html"
},
{
"trust": 1.0,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72226"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4851"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4851"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/72226"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5613"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003461"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-336"
},
{
"db": "NVD",
"id": "CVE-2011-4851"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "4d2803dc-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d74c782-463f-11e9-ab3d-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5613"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003461"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-336"
},
{
"db": "NVD",
"id": "CVE-2011-4851"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-19T00:00:00",
"db": "IVD",
"id": "4d2803dc-2354-11e6-abef-000c29c66e3d"
},
{
"date": "2011-12-19T00:00:00",
"db": "IVD",
"id": "7d74c782-463f-11e9-ab3d-000c29342cb1"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5613"
},
{
"date": "2011-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003461"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-336"
},
{
"date": "2011-12-16T11:55:13.127000",
"db": "NVD",
"id": "CVE-2011-4851"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5613"
},
{
"date": "2011-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003461"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-336"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2011-4851"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201112-336"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Parallels Plesk Panel Trust Management Vulnerability",
"sources": [
{
"db": "IVD",
"id": "4d2803dc-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d74c782-463f-11e9-ab3d-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5613"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-336"
}
],
"trust": 1.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Trust management",
"sources": [
{
"db": "IVD",
"id": "4d2803dc-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d74c782-463f-11e9-ab3d-000c29342cb1"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-336"
}
],
"trust": 1.0
}
}
VAR-201112-0190
Vulnerability from variot - Updated: 2025-04-11 23:17The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 does not properly validate string data that is intended for storage in an XML document, which allows remote attackers to cause a denial of service (parsing error) or possibly have unspecified other impact via a crafted REST URL parameter, as demonstrated by parameters to admin/ and certain other files. Parallels Plesk Panel is prone to a denial-of-service vulnerability
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201112-0190",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "plesk panel",
"scope": "eq",
"trust": 2.4,
"vendor": "parallels",
"version": "10.2.0_build1011110331.18"
},
{
"model": "plesk panel 10.2.0 build1011110331.18",
"scope": null,
"trust": 0.6,
"vendor": "parallels",
"version": null
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.6,
"vendor": "redhat",
"version": "6"
},
{
"model": "plesk panel build10111103",
"scope": "eq",
"trust": 0.3,
"vendor": "parallels",
"version": "10.2.0"
},
{
"model": "10.2.0 build1011110331.18",
"scope": null,
"trust": 0.2,
"vendor": "parallels plesk panel",
"version": null
}
],
"sources": [
{
"db": "IVD",
"id": "4fd6e2c4-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5653"
},
{
"db": "BID",
"id": "78372"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003417"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-288"
},
{
"db": "NVD",
"id": "CVE-2011-4727"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:parallels:parallels_plesk_panel",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003417"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Unknown",
"sources": [
{
"db": "BID",
"id": "78372"
}
],
"trust": 0.3
},
"cve": "CVE-2011-4727",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2011-4727",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2011-5653",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "4fd6e2c4-2354-11e6-abef-000c29c66e3d",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2011-4727",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2011-4727",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2011-5653",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201112-288",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "IVD",
"id": "4fd6e2c4-2354-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "CRITICAL"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "4fd6e2c4-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5653"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003417"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-288"
},
{
"db": "NVD",
"id": "CVE-2011-4727"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 does not properly validate string data that is intended for storage in an XML document, which allows remote attackers to cause a denial of service (parsing error) or possibly have unspecified other impact via a crafted REST URL parameter, as demonstrated by parameters to admin/ and certain other files. Parallels Plesk Panel is prone to a denial-of-service vulnerability",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4727"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003417"
},
{
"db": "CNVD",
"id": "CNVD-2011-5653"
},
{
"db": "BID",
"id": "78372"
},
{
"db": "IVD",
"id": "4fd6e2c4-2354-11e6-abef-000c29c66e3d"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2011-4727",
"trust": 3.5
},
{
"db": "CNVD",
"id": "CNVD-2011-5653",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201112-288",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003417",
"trust": 0.8
},
{
"db": "XF",
"id": "72332",
"trust": 0.3
},
{
"db": "BID",
"id": "78372",
"trust": 0.3
},
{
"db": "IVD",
"id": "4FD6E2C4-2354-11E6-ABEF-000C29C66E3D",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "4fd6e2c4-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5653"
},
{
"db": "BID",
"id": "78372"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003417"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-288"
},
{
"db": "NVD",
"id": "CVE-2011-4727"
}
]
},
"id": "VAR-201112-0190",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "4fd6e2c4-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5653"
}
],
"trust": 1.53538688
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "4fd6e2c4-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5653"
}
]
},
"last_update_date": "2025-04-11T23:17:20.730000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Parallels Plesk Panel",
"trust": 0.8,
"url": "http://www.parallels.com/products/plesk/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003417"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-20",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003417"
},
{
"db": "NVD",
"id": "CVE-2011-4727"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.9,
"url": "http://xss.cx/examples/plesk-reports/plesk-redhat-el6-psa-10.2.0-build-1011110331.18-xss-sqli-cwe79-cwe89-javascript-injection-exception-example-poc-report-paros-burp-suite-pro-1.4.1.html"
},
{
"trust": 1.6,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72332"
},
{
"trust": 1.4,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4727"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4727"
},
{
"trust": 0.3,
"url": "http://xforce.iss.net/xforce/xfdb/72332"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5653"
},
{
"db": "BID",
"id": "78372"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003417"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-288"
},
{
"db": "NVD",
"id": "CVE-2011-4727"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "4fd6e2c4-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5653"
},
{
"db": "BID",
"id": "78372"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003417"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-288"
},
{
"db": "NVD",
"id": "CVE-2011-4727"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-19T00:00:00",
"db": "IVD",
"id": "4fd6e2c4-2354-11e6-abef-000c29c66e3d"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5653"
},
{
"date": "2011-12-16T00:00:00",
"db": "BID",
"id": "78372"
},
{
"date": "2011-12-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003417"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-288"
},
{
"date": "2011-12-16T11:55:06.953000",
"db": "NVD",
"id": "CVE-2011-4727"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5653"
},
{
"date": "2011-12-16T00:00:00",
"db": "BID",
"id": "78372"
},
{
"date": "2011-12-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003417"
},
{
"date": "2019-04-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-288"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2011-4727"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201112-288"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Parallels Plesk Panel Input validation vulnerability",
"sources": [
{
"db": "IVD",
"id": "4fd6e2c4-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5653"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-288"
}
],
"trust": 1.4
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Input validation error",
"sources": [
{
"db": "IVD",
"id": "4fd6e2c4-2354-11e6-abef-000c29c66e3d"
},
{
"db": "BID",
"id": "78372"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-288"
}
],
"trust": 1.1
}
}
VAR-201112-0211
Vulnerability from variot - Updated: 2025-04-11 23:17The billing system for Parallels Plesk Panel 10.3.1_build1013110726.09 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive information by reading a page, as demonstrated by js/ajax/core/ajax.inc.js and certain other files
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201112-0211",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "plesk panel",
"scope": "eq",
"trust": 1.6,
"vendor": "parallels",
"version": "10.3.1_build1013110726.09"
},
{
"model": "plesk panel",
"scope": "eq",
"trust": 0.8,
"vendor": "parallels",
"version": "10.3.1 build1013110726.09"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003438"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-309"
},
{
"db": "NVD",
"id": "CVE-2011-4748"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:parallels:parallels_plesk_panel",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003438"
}
]
},
"cve": "CVE-2011-4748",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2011-4748",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2011-4748",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2011-4748",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-201112-309",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003438"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-309"
},
{
"db": "NVD",
"id": "CVE-2011-4748"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The billing system for Parallels Plesk Panel 10.3.1_build1013110726.09 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive information by reading a page, as demonstrated by js/ajax/core/ajax.inc.js and certain other files",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4748"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003438"
}
],
"trust": 1.62
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2011-4748",
"trust": 2.4
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003438",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201112-309",
"trust": 0.6
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003438"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-309"
},
{
"db": "NVD",
"id": "CVE-2011-4748"
}
]
},
"id": "VAR-201112-0211",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.47077376
},
"last_update_date": "2025-04-11T23:17:20.708000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Parallels Plesk Panel",
"trust": 0.8,
"url": "http://www.parallels.com/products/plesk/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003438"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-200",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003438"
},
{
"db": "NVD",
"id": "CVE-2011-4748"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "http://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build1013110726.09%20os_redhat.el6-billing-system-plugin-javascript-injection-example-poc-report.html"
},
{
"trust": 1.6,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72261"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4748"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4748"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003438"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-309"
},
{
"db": "NVD",
"id": "CVE-2011-4748"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003438"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-309"
},
{
"db": "NVD",
"id": "CVE-2011-4748"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003438"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-309"
},
{
"date": "2011-12-16T11:55:10.783000",
"db": "NVD",
"id": "CVE-2011-4748"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003438"
},
{
"date": "2019-04-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-309"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2011-4748"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201112-309"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Parallels Plesk Panel of billing system Vulnerability in which important information is obtained",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003438"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "information disclosure",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201112-309"
}
],
"trust": 0.6
}
}
VAR-201112-0207
Vulnerability from variot - Updated: 2025-04-11 23:16The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving smb/admin-home/featured-applications/ and certain other files. NOTE: it is possible that only clients, not the Plesk product, could be affected by this issue. A remote attacker could exploit an interpretation conflict involving smb/admin-home/featured-applications/ and some other file to cause an unexplained impact
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201112-0207",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "plesk panel",
"scope": "eq",
"trust": 1.6,
"vendor": "parallels",
"version": "10.2.0_build20110407.20"
},
{
"model": "plesk panel",
"scope": "eq",
"trust": 0.8,
"vendor": "parallels",
"version": "10.2.0 build 20110407.20"
},
{
"model": "plesk panel 10.2.0 build20110407.20",
"scope": null,
"trust": 0.6,
"vendor": "parallels",
"version": null
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.6,
"vendor": "redhat",
"version": "6"
},
{
"model": "10.2.0 build20110407.20",
"scope": null,
"trust": 0.4,
"vendor": "parallels plesk panel",
"version": null
}
],
"sources": [
{
"db": "IVD",
"id": "4f1fd322-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d77adb0-463f-11e9-ac68-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5640"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003434"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-305"
},
{
"db": "NVD",
"id": "CVE-2011-4744"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:parallels:parallels_plesk_panel",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003434"
}
]
},
"cve": "CVE-2011-4744",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2011-4744",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2011-5640",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "4f1fd322-2354-11e6-abef-000c29c66e3d",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "7d77adb0-463f-11e9-ac68-000c29342cb1",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2011-4744",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2011-4744",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2011-5640",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201112-305",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "IVD",
"id": "4f1fd322-2354-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "CRITICAL"
},
{
"author": "IVD",
"id": "7d77adb0-463f-11e9-ac68-000c29342cb1",
"trust": 0.2,
"value": "CRITICAL"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "4f1fd322-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d77adb0-463f-11e9-ac68-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5640"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003434"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-305"
},
{
"db": "NVD",
"id": "CVE-2011-4744"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving smb/admin-home/featured-applications/ and certain other files. NOTE: it is possible that only clients, not the Plesk product, could be affected by this issue. A remote attacker could exploit an interpretation conflict involving smb/admin-home/featured-applications/ and some other file to cause an unexplained impact",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4744"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003434"
},
{
"db": "CNVD",
"id": "CNVD-2011-5640"
},
{
"db": "IVD",
"id": "4f1fd322-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d77adb0-463f-11e9-ac68-000c29342cb1"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2011-4744",
"trust": 3.4
},
{
"db": "CNVD",
"id": "CNVD-2011-5640",
"trust": 1.0
},
{
"db": "CNNVD",
"id": "CNNVD-201112-305",
"trust": 1.0
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003434",
"trust": 0.8
},
{
"db": "IVD",
"id": "4F1FD322-2354-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "IVD",
"id": "7D77ADB0-463F-11E9-AC68-000C29342CB1",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "4f1fd322-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d77adb0-463f-11e9-ac68-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5640"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003434"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-305"
},
{
"db": "NVD",
"id": "CVE-2011-4744"
}
]
},
"id": "VAR-201112-0207",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "4f1fd322-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d77adb0-463f-11e9-ac68-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5640"
}
],
"trust": 1.73538688
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 1.0
}
],
"sources": [
{
"db": "IVD",
"id": "4f1fd322-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d77adb0-463f-11e9-ac68-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5640"
}
]
},
"last_update_date": "2025-04-11T23:16:46.003000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Parallels Plesk Panel",
"trust": 0.8,
"url": "http://www.parallels.com/products/plesk/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003434"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
},
{
"problemtype": "CWE-DesignError",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003434"
},
{
"db": "NVD",
"id": "CVE-2011-4744"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72315"
},
{
"trust": 1.6,
"url": "http://xss.cx/examples/plesk-reports/xss-reflected-cross-site-scripting-cwe79-capec86-plesk-parallels-control-panel-version-20110407.20.html"
},
{
"trust": 1.4,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4744"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4744"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5640"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003434"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-305"
},
{
"db": "NVD",
"id": "CVE-2011-4744"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "4f1fd322-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d77adb0-463f-11e9-ac68-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5640"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003434"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-305"
},
{
"db": "NVD",
"id": "CVE-2011-4744"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-19T00:00:00",
"db": "IVD",
"id": "4f1fd322-2354-11e6-abef-000c29c66e3d"
},
{
"date": "2011-12-19T00:00:00",
"db": "IVD",
"id": "7d77adb0-463f-11e9-ac68-000c29342cb1"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5640"
},
{
"date": "2011-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003434"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-305"
},
{
"date": "2011-12-16T11:55:10.563000",
"db": "NVD",
"id": "CVE-2011-4744"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5640"
},
{
"date": "2011-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003434"
},
{
"date": "2019-04-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-305"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2011-4744"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201112-305"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Parallels Plesk Panel Design Error Vulnerability",
"sources": [
{
"db": "IVD",
"id": "4f1fd322-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d77adb0-463f-11e9-ac68-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2011-5640"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-305"
}
],
"trust": 1.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "IVD",
"id": "4f1fd322-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d77adb0-463f-11e9-ac68-000c29342cb1"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-305"
}
],
"trust": 1.0
}
}
VAR-201112-0249
Vulnerability from variot - Updated: 2025-04-11 23:16The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving admin/customer-service-plan/list/reset-search/true/ and certain other files. NOTE: it is possible that only clients, not the Plesk product, could be affected by this issue. There is a vulnerability in Parallels Plesk Panel 10.4.4_build20111103.18. A remote attacker can cause an unexplained impact by exploiting an interpretation conflict that includes admin/customer-service-plan/list/reset-search/true/ and some other file
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201112-0249",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "plesk panel",
"scope": "eq",
"trust": 2.4,
"vendor": "parallels",
"version": "10.4.4_build20111103.18"
},
{
"model": "plesk panel",
"scope": "eq",
"trust": 0.6,
"vendor": "parallels",
"version": "10.0"
},
{
"model": "10.4.4 build20111103.18",
"scope": null,
"trust": 0.2,
"vendor": "parallels plesk panel",
"version": null
}
],
"sources": [
{
"db": "IVD",
"id": "4d89c87e-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5609"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003465"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-340"
},
{
"db": "NVD",
"id": "CVE-2011-4855"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:parallels:parallels_plesk_panel",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003465"
}
]
},
"cve": "CVE-2011-4855",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "CVE-2011-4855",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "CNVD-2011-5609",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "4d89c87e-2354-11e6-abef-000c29c66e3d",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2011-4855",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2011-4855",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2011-5609",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201112-340",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "IVD",
"id": "4d89c87e-2354-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "CRITICAL"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "4d89c87e-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5609"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003465"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-340"
},
{
"db": "NVD",
"id": "CVE-2011-4855"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 omits the Content-Type header\u0027s charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving admin/customer-service-plan/list/reset-search/true/ and certain other files. NOTE: it is possible that only clients, not the Plesk product, could be affected by this issue. There is a vulnerability in Parallels Plesk Panel 10.4.4_build20111103.18. A remote attacker can cause an unexplained impact by exploiting an interpretation conflict that includes admin/customer-service-plan/list/reset-search/true/ and some other file",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4855"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003465"
},
{
"db": "CNVD",
"id": "CNVD-2011-5609"
},
{
"db": "IVD",
"id": "4d89c87e-2354-11e6-abef-000c29c66e3d"
}
],
"trust": 2.34
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2011-4855",
"trust": 3.2
},
{
"db": "CNVD",
"id": "CNVD-2011-5609",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201112-340",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003465",
"trust": 0.8
},
{
"db": "XF",
"id": "72092",
"trust": 0.6
},
{
"db": "IVD",
"id": "4D89C87E-2354-11E6-ABEF-000C29C66E3D",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "4d89c87e-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5609"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003465"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-340"
},
{
"db": "NVD",
"id": "CVE-2011-4855"
}
]
},
"id": "VAR-201112-0249",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "4d89c87e-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5609"
}
],
"trust": 1.27077376
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "4d89c87e-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5609"
}
]
},
"last_update_date": "2025-04-11T23:16:45.973000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Parallels Plesk Panel",
"trust": 0.8,
"url": "http://www.parallels.com/products/plesk"
},
{
"title": "Parallels Plesk Panel design error vulnerability patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/37442"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5609"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003465"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
},
{
"problemtype": "CWE-DesignError",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003465"
},
{
"db": "NVD",
"id": "CVE-2011-4855"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html"
},
{
"trust": 1.0,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72092"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4855"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4855"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/72092"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5609"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003465"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-340"
},
{
"db": "NVD",
"id": "CVE-2011-4855"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "4d89c87e-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5609"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003465"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-340"
},
{
"db": "NVD",
"id": "CVE-2011-4855"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-19T00:00:00",
"db": "IVD",
"id": "4d89c87e-2354-11e6-abef-000c29c66e3d"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5609"
},
{
"date": "2011-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003465"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-340"
},
{
"date": "2011-12-16T11:55:13.610000",
"db": "NVD",
"id": "CVE-2011-4855"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5609"
},
{
"date": "2011-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003465"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-340"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2011-4855"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201112-340"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Parallels Plesk Panel Design Error Vulnerability",
"sources": [
{
"db": "IVD",
"id": "4d89c87e-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5609"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-340"
}
],
"trust": 1.4
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Design error",
"sources": [
{
"db": "IVD",
"id": "4d89c87e-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-340"
}
],
"trust": 0.8
}
}
VAR-201112-0192
Vulnerability from variot - Updated: 2025-04-11 23:15The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by cookies used by login_up.php3 and certain other files
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201112-0192",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "plesk panel",
"scope": "eq",
"trust": 2.4,
"vendor": "parallels",
"version": "10.2.0_build1011110331.18"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003419"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-290"
},
{
"db": "NVD",
"id": "CVE-2011-4729"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:parallels:parallels_plesk_panel",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003419"
}
]
},
"cve": "CVE-2011-4729",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2011-4729",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2011-4729",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2011-4729",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-201112-290",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003419"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-290"
},
{
"db": "NVD",
"id": "CVE-2011-4729"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by cookies used by login_up.php3 and certain other files",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4729"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003419"
}
],
"trust": 1.62
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2011-4729",
"trust": 2.4
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003419",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201112-290",
"trust": 0.6
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003419"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-290"
},
{
"db": "NVD",
"id": "CVE-2011-4729"
}
]
},
"id": "VAR-201112-0192",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.47077376
},
"last_update_date": "2025-04-11T23:15:35.235000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Parallels Plesk Panel",
"trust": 0.8,
"url": "http://www.parallels.com/products/plesk/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003419"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
},
{
"problemtype": "CWE-DesignError",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003419"
},
{
"db": "NVD",
"id": "CVE-2011-4729"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "http://xss.cx/examples/plesk-reports/plesk-redhat-el6-psa-10.2.0-build-1011110331.18-xss-sqli-cwe79-cwe89-javascript-injection-exception-example-poc-report-paros-burp-suite-pro-1.4.1.html"
},
{
"trust": 1.6,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72330"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4729"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4729"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003419"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-290"
},
{
"db": "NVD",
"id": "CVE-2011-4729"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003419"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-290"
},
{
"db": "NVD",
"id": "CVE-2011-4729"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003419"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-290"
},
{
"date": "2011-12-16T11:55:07.453000",
"db": "NVD",
"id": "CVE-2011-4729"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003419"
},
{
"date": "2019-04-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-290"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2011-4729"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201112-290"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Parallels Plesk Panel of Server Administration Panel Vulnerability in which important information is obtained",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003419"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201112-290"
}
],
"trust": 0.6
}
}
VAR-201112-0195
Vulnerability from variot - Updated: 2025-04-11 23:14The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving account/power-mode-logout and certain other files. NOTE: it is possible that only clients, not the Plesk product, could be affected by this issue. A remote attacker could exploit an interpretation conflict involving account/power-mode-logout and some other file to cause an unexplained impact
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201112-0195",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "plesk panel",
"scope": "eq",
"trust": 2.4,
"vendor": "parallels",
"version": "10.2.0_build1011110331.18"
},
{
"model": "plesk panel 10.2.0 build1011110331.18",
"scope": null,
"trust": 0.6,
"vendor": "parallels",
"version": null
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.6,
"vendor": "redhat",
"version": "6"
},
{
"model": "10.2.0 build1011110331.18",
"scope": null,
"trust": 0.4,
"vendor": "parallels plesk panel",
"version": null
}
],
"sources": [
{
"db": "IVD",
"id": "7d795b60-463f-11e9-8168-000c29342cb1"
},
{
"db": "IVD",
"id": "4faf60f0-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5650"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003422"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-293"
},
{
"db": "NVD",
"id": "CVE-2011-4732"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:parallels:parallels_plesk_panel",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003422"
}
]
},
"cve": "CVE-2011-4732",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2011-4732",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2011-5650",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "7d795b60-463f-11e9-8168-000c29342cb1",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "4faf60f0-2354-11e6-abef-000c29c66e3d",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2011-4732",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2011-4732",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2011-5650",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201112-293",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "IVD",
"id": "7d795b60-463f-11e9-8168-000c29342cb1",
"trust": 0.2,
"value": "CRITICAL"
},
{
"author": "IVD",
"id": "4faf60f0-2354-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "CRITICAL"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "7d795b60-463f-11e9-8168-000c29342cb1"
},
{
"db": "IVD",
"id": "4faf60f0-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5650"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003422"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-293"
},
{
"db": "NVD",
"id": "CVE-2011-4732"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 omits the Content-Type header\u0027s charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving account/power-mode-logout and certain other files. NOTE: it is possible that only clients, not the Plesk product, could be affected by this issue. A remote attacker could exploit an interpretation conflict involving account/power-mode-logout and some other file to cause an unexplained impact",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4732"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003422"
},
{
"db": "CNVD",
"id": "CNVD-2011-5650"
},
{
"db": "IVD",
"id": "7d795b60-463f-11e9-8168-000c29342cb1"
},
{
"db": "IVD",
"id": "4faf60f0-2354-11e6-abef-000c29c66e3d"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2011-4732",
"trust": 3.4
},
{
"db": "CNVD",
"id": "CNVD-2011-5650",
"trust": 1.0
},
{
"db": "CNNVD",
"id": "CNNVD-201112-293",
"trust": 1.0
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003422",
"trust": 0.8
},
{
"db": "IVD",
"id": "7D795B60-463F-11E9-8168-000C29342CB1",
"trust": 0.2
},
{
"db": "IVD",
"id": "4FAF60F0-2354-11E6-ABEF-000C29C66E3D",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "7d795b60-463f-11e9-8168-000c29342cb1"
},
{
"db": "IVD",
"id": "4faf60f0-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5650"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003422"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-293"
},
{
"db": "NVD",
"id": "CVE-2011-4732"
}
]
},
"id": "VAR-201112-0195",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "7d795b60-463f-11e9-8168-000c29342cb1"
},
{
"db": "IVD",
"id": "4faf60f0-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5650"
}
],
"trust": 1.73538688
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 1.0
}
],
"sources": [
{
"db": "IVD",
"id": "7d795b60-463f-11e9-8168-000c29342cb1"
},
{
"db": "IVD",
"id": "4faf60f0-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5650"
}
]
},
"last_update_date": "2025-04-11T23:14:51.898000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Parallels Plesk Panel",
"trust": 0.8,
"url": "http://www.parallels.com/products/plesk/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003422"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
},
{
"problemtype": "CWE-DesignError",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003422"
},
{
"db": "NVD",
"id": "CVE-2011-4732"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "http://xss.cx/examples/plesk-reports/plesk-redhat-el6-psa-10.2.0-build-1011110331.18-xss-sqli-cwe79-cwe89-javascript-injection-exception-example-poc-report-paros-burp-suite-pro-1.4.1.html"
},
{
"trust": 1.6,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72327"
},
{
"trust": 1.4,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4732"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4732"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5650"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003422"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-293"
},
{
"db": "NVD",
"id": "CVE-2011-4732"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "7d795b60-463f-11e9-8168-000c29342cb1"
},
{
"db": "IVD",
"id": "4faf60f0-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5650"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003422"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-293"
},
{
"db": "NVD",
"id": "CVE-2011-4732"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-19T00:00:00",
"db": "IVD",
"id": "7d795b60-463f-11e9-8168-000c29342cb1"
},
{
"date": "2011-12-19T00:00:00",
"db": "IVD",
"id": "4faf60f0-2354-11e6-abef-000c29c66e3d"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5650"
},
{
"date": "2011-12-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003422"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-293"
},
{
"date": "2011-12-16T11:55:09.673000",
"db": "NVD",
"id": "CVE-2011-4732"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5650"
},
{
"date": "2011-12-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003422"
},
{
"date": "2019-04-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-293"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2011-4732"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201112-293"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Parallels Plesk Panel Design Error Vulnerability",
"sources": [
{
"db": "IVD",
"id": "7d795b60-463f-11e9-8168-000c29342cb1"
},
{
"db": "IVD",
"id": "4faf60f0-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5650"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-293"
}
],
"trust": 1.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "IVD",
"id": "7d795b60-463f-11e9-8168-000c29342cb1"
},
{
"db": "IVD",
"id": "4faf60f0-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-293"
}
],
"trust": 1.0
}
}
VAR-201112-0216
Vulnerability from variot - Updated: 2025-04-11 23:14Multiple SQL injection vulnerabilities in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by domains/sitebuilder_edit.php and certain other files
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201112-0216",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "plesk small business panel",
"scope": "eq",
"trust": 3.0,
"vendor": "parallels",
"version": "10.2.0"
},
{
"model": "plesk small business panel",
"scope": "eq",
"trust": 0.3,
"vendor": "parallels",
"version": "10.2"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5632"
},
{
"db": "BID",
"id": "73626"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003440"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-314"
},
{
"db": "NVD",
"id": "CVE-2011-4753"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:parallels:parallels_plesk_small_business_panel",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003440"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Unknown",
"sources": [
{
"db": "BID",
"id": "73626"
}
],
"trust": 0.3
},
"cve": "CVE-2011-4753",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2011-4753",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2011-5632",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2011-4753",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2011-4753",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2011-5632",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201112-314",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5632"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003440"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-314"
},
{
"db": "NVD",
"id": "CVE-2011-4753"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple SQL injection vulnerabilities in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by domains/sitebuilder_edit.php and certain other files",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4753"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003440"
},
{
"db": "CNVD",
"id": "CNVD-2011-5632"
},
{
"db": "BID",
"id": "73626"
}
],
"trust": 2.43
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2011-4753",
"trust": 3.3
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003440",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2011-5632",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201112-314",
"trust": 0.6
},
{
"db": "XF",
"id": "72205",
"trust": 0.3
},
{
"db": "BID",
"id": "73626",
"trust": 0.3
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5632"
},
{
"db": "BID",
"id": "73626"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003440"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-314"
},
{
"db": "NVD",
"id": "CVE-2011-4753"
}
]
},
"id": "VAR-201112-0216",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5632"
}
],
"trust": 1.1859375
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5632"
}
]
},
"last_update_date": "2025-04-11T23:14:51.867000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Parallels Plesk Small Business Panel",
"trust": 0.8,
"url": "http://www.parallels.com/products/small-business-panel/documentation/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003440"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-89",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003440"
},
{
"db": "NVD",
"id": "CVE-2011-4753"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.9,
"url": "http://xss.cx/examples/plesk-reports/plesk-10.2.0.html"
},
{
"trust": 1.4,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4753"
},
{
"trust": 1.0,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72205"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4753"
},
{
"trust": 0.3,
"url": "http://xforce.iss.net/xforce/xfdb/72205"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5632"
},
{
"db": "BID",
"id": "73626"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003440"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-314"
},
{
"db": "NVD",
"id": "CVE-2011-4753"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2011-5632"
},
{
"db": "BID",
"id": "73626"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003440"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-314"
},
{
"db": "NVD",
"id": "CVE-2011-4753"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5632"
},
{
"date": "2011-12-16T00:00:00",
"db": "BID",
"id": "73626"
},
{
"date": "2011-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003440"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-314"
},
{
"date": "2011-12-16T11:55:11.157000",
"db": "NVD",
"id": "CVE-2011-4753"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5632"
},
{
"date": "2011-12-16T00:00:00",
"db": "BID",
"id": "73626"
},
{
"date": "2011-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003440"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-314"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2011-4753"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201112-314"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Parallels Plesk Small Business Panel SQL Injection Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5632"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-314"
}
],
"trust": 1.2
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "SQL injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201112-314"
}
],
"trust": 0.6
}
}
VAR-201112-0258
Vulnerability from variot - Updated: 2025-04-11 23:14The Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by cookies used by Wizard/Edit/Modules/ImageGallery/MultiImagesUpload and certain other files
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201112-0258",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "plesk small business panel",
"scope": "eq",
"trust": 2.4,
"vendor": "parallels",
"version": "10.2.0"
},
{
"model": "plesk panel",
"scope": "eq",
"trust": 0.6,
"vendor": "parallels",
"version": "10.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "parallels plesk small business panel",
"version": "10.2.0"
}
],
"sources": [
{
"db": "IVD",
"id": "7d71ba40-463f-11e9-8a16-000c29342cb1"
},
{
"db": "IVD",
"id": "4db1400c-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5621"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003452"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-326"
},
{
"db": "NVD",
"id": "CVE-2011-4765"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:parallels:parallels_plesk_small_business_panel",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003452"
}
]
},
"cve": "CVE-2011-4765",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2011-4765",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CNVD-2011-5621",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "7d71ba40-463f-11e9-8a16-000c29342cb1",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "4db1400c-2354-11e6-abef-000c29c66e3d",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2011-4765",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2011-4765",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2011-5621",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201112-326",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "7d71ba40-463f-11e9-8a16-000c29342cb1",
"trust": 0.2,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "4db1400c-2354-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "7d71ba40-463f-11e9-8a16-000c29342cb1"
},
{
"db": "IVD",
"id": "4db1400c-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5621"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003452"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-326"
},
{
"db": "NVD",
"id": "CVE-2011-4765"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by cookies used by Wizard/Edit/Modules/ImageGallery/MultiImagesUpload and certain other files",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4765"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003452"
},
{
"db": "CNVD",
"id": "CNVD-2011-5621"
},
{
"db": "IVD",
"id": "7d71ba40-463f-11e9-8a16-000c29342cb1"
},
{
"db": "IVD",
"id": "4db1400c-2354-11e6-abef-000c29c66e3d"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2011-4765",
"trust": 3.4
},
{
"db": "CNVD",
"id": "CNVD-2011-5621",
"trust": 1.0
},
{
"db": "CNNVD",
"id": "CNNVD-201112-326",
"trust": 1.0
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003452",
"trust": 0.8
},
{
"db": "XF",
"id": "72217",
"trust": 0.6
},
{
"db": "IVD",
"id": "7D71BA40-463F-11E9-8A16-000C29342CB1",
"trust": 0.2
},
{
"db": "IVD",
"id": "4DB1400C-2354-11E6-ABEF-000C29C66E3D",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "7d71ba40-463f-11e9-8a16-000c29342cb1"
},
{
"db": "IVD",
"id": "4db1400c-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5621"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003452"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-326"
},
{
"db": "NVD",
"id": "CVE-2011-4765"
}
]
},
"id": "VAR-201112-0258",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "7d71ba40-463f-11e9-8a16-000c29342cb1"
},
{
"db": "IVD",
"id": "4db1400c-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5621"
}
],
"trust": 1.52835563
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 1.0
}
],
"sources": [
{
"db": "IVD",
"id": "7d71ba40-463f-11e9-8a16-000c29342cb1"
},
{
"db": "IVD",
"id": "4db1400c-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5621"
}
]
},
"last_update_date": "2025-04-11T23:14:51.833000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Parallels Plesk Panel",
"trust": 0.8,
"url": "http://www.parallels.com/products/plesk/"
},
{
"title": "Patch for Parallels Plesk Small Business Panel Information Disclosure Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/37454"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5621"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003452"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-200",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003452"
},
{
"db": "NVD",
"id": "CVE-2011-4765"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "http://xss.cx/examples/plesk-reports/plesk-10.2.0-site-editor.html"
},
{
"trust": 1.0,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72217"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4765"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4765"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/72217"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5621"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003452"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-326"
},
{
"db": "NVD",
"id": "CVE-2011-4765"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "7d71ba40-463f-11e9-8a16-000c29342cb1"
},
{
"db": "IVD",
"id": "4db1400c-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5621"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003452"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-326"
},
{
"db": "NVD",
"id": "CVE-2011-4765"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-19T00:00:00",
"db": "IVD",
"id": "7d71ba40-463f-11e9-8a16-000c29342cb1"
},
{
"date": "2011-12-19T00:00:00",
"db": "IVD",
"id": "4db1400c-2354-11e6-abef-000c29c66e3d"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5621"
},
{
"date": "2011-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003452"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-326"
},
{
"date": "2011-12-16T11:55:12.110000",
"db": "NVD",
"id": "CVE-2011-4765"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-12-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5621"
},
{
"date": "2011-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003452"
},
{
"date": "2011-12-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201112-326"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2011-4765"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201112-326"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Parallels Plesk Small Business Panel Information Disclosure Vulnerability",
"sources": [
{
"db": "IVD",
"id": "7d71ba40-463f-11e9-8a16-000c29342cb1"
},
{
"db": "IVD",
"id": "4db1400c-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-5621"
},
{
"db": "CNNVD",
"id": "CNNVD-201112-326"
}
],
"trust": 1.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "information disclosure",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201112-326"
}
],
"trust": 0.6
}
}
CVE-2025-31359 (GCVE-0-2025-31359)
Vulnerability from nvd – Published: 2025-06-03 09:43 – Updated: 2025-06-03 13:27- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
| Vendor | Product | Version | |
|---|---|---|---|
| Parallels | Parallels Desktop for Mac |
Affected:
20.2.2 (55879)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-06-03T11:03:08.458Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2160"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-31359",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-03T13:27:22.807674Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T13:27:26.786Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2025-2160"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Parallels Desktop for Mac",
"vendor": "Parallels",
"versions": [
{
"status": "affected",
"version": "20.2.2 (55879)"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by KPC of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A directory traversal vulnerability exists in the PVMP package unpacking functionality of Parallels Desktop for Mac version 20.2.2 (55879). This vulnerability can be exploited by an attacker to write to arbitrary files, potentially leading to privilege escalation."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T09:43:25.931Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2025-2160",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2025-2160"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2025-31359",
"datePublished": "2025-06-03T09:43:25.931Z",
"dateReserved": "2025-03-28T15:54:45.505Z",
"dateUpdated": "2025-06-03T13:27:26.786Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-54189 (GCVE-0-2024-54189)
Vulnerability from nvd – Published: 2025-06-03 09:43 – Updated: 2025-06-03 13:19- CWE-62 - UNIX Hard Link
| Vendor | Product | Version | |
|---|---|---|---|
| Parallels | Parallels Desktop for Mac |
Affected:
version 20.1.1 (55740)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-06-03T11:03:07.503Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2124"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-54189",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-03T13:19:44.951627Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T13:19:52.966Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2124"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Parallels Desktop for Mac",
"vendor": "Parallels",
"versions": [
{
"status": "affected",
"version": "version 20.1.1 (55740)"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by KPC of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is taken, a root service writes to a file owned by a normal user. By using a hard link, an attacker can write to an arbitrary file, potentially leading to privilege escalation."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-62",
"description": "CWE-62: UNIX Hard Link",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T09:43:27.168Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2124",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2124"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2024-54189",
"datePublished": "2025-06-03T09:43:27.168Z",
"dateReserved": "2024-12-05T15:34:29.663Z",
"dateUpdated": "2025-06-03T13:19:52.966Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-52561 (GCVE-0-2024-52561)
Vulnerability from nvd – Published: 2025-06-03 09:43 – Updated: 2025-06-03 13:18- CWE-708 - Incorrect Ownership Assignment
| Vendor | Product | Version | |
|---|---|---|---|
| Parallels | Parallels Desktop for Mac |
Affected:
version 20.1.1 (55740)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-06-03T11:03:06.569Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2123"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-52561",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-03T13:18:54.071719Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T13:18:56.981Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2123"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Parallels Desktop for Mac",
"vendor": "Parallels",
"versions": [
{
"status": "affected",
"version": "version 20.1.1 (55740)"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by KPC of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is deleted, a root service verifies and modifies the ownership of the snapshot files. By using a symlink, an attacker can change the ownership of files owned by root to a lower-privilege user, potentially leading to privilege escalation."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-708",
"description": "CWE-708: Incorrect Ownership Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T09:43:27.726Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2123",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2123"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2024-52561",
"datePublished": "2025-06-03T09:43:27.726Z",
"dateReserved": "2024-12-05T15:34:25.357Z",
"dateUpdated": "2025-06-03T13:18:56.981Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-36486 (GCVE-0-2024-36486)
Vulnerability from nvd – Published: 2025-06-03 09:43 – Updated: 2025-06-03 13:22- CWE-62 - UNIX Hard Link
| Vendor | Product | Version | |
|---|---|---|---|
| Parallels | Parallels Desktop for Mac |
Affected:
version 20.1.1 (55740)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-06-03T11:03:05.592Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2126"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-36486",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-03T13:22:10.357632Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T13:22:13.518Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2126"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Parallels Desktop for Mac",
"vendor": "Parallels",
"versions": [
{
"status": "affected",
"version": "version 20.1.1 (55740)"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by KPC of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 (55740). When an archived virtual machine is restored, the prl_vmarchiver tool decompresses the file and writes the content back to its original location using root privileges. An attacker can exploit this process by using a hard link to write to an arbitrary file, potentially resulting in privilege escalation."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-62",
"description": "CWE-62: UNIX Hard Link",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T09:43:26.596Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2126",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2126"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2024-36486",
"datePublished": "2025-06-03T09:43:26.596Z",
"dateReserved": "2024-12-09T19:55:30.980Z",
"dateUpdated": "2025-06-03T13:22:13.518Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-52561 (GCVE-0-2024-52561)
Vulnerability from cvelistv5 – Published: 2025-06-03 09:43 – Updated: 2025-06-03 13:18- CWE-708 - Incorrect Ownership Assignment
| Vendor | Product | Version | |
|---|---|---|---|
| Parallels | Parallels Desktop for Mac |
Affected:
version 20.1.1 (55740)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-06-03T11:03:06.569Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2123"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-52561",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-03T13:18:54.071719Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T13:18:56.981Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2123"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Parallels Desktop for Mac",
"vendor": "Parallels",
"versions": [
{
"status": "affected",
"version": "version 20.1.1 (55740)"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by KPC of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is deleted, a root service verifies and modifies the ownership of the snapshot files. By using a symlink, an attacker can change the ownership of files owned by root to a lower-privilege user, potentially leading to privilege escalation."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-708",
"description": "CWE-708: Incorrect Ownership Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T09:43:27.726Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2123",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2123"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2024-52561",
"datePublished": "2025-06-03T09:43:27.726Z",
"dateReserved": "2024-12-05T15:34:25.357Z",
"dateUpdated": "2025-06-03T13:18:56.981Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-54189 (GCVE-0-2024-54189)
Vulnerability from cvelistv5 – Published: 2025-06-03 09:43 – Updated: 2025-06-03 13:19- CWE-62 - UNIX Hard Link
| Vendor | Product | Version | |
|---|---|---|---|
| Parallels | Parallels Desktop for Mac |
Affected:
version 20.1.1 (55740)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-06-03T11:03:07.503Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2124"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-54189",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-03T13:19:44.951627Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T13:19:52.966Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2124"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Parallels Desktop for Mac",
"vendor": "Parallels",
"versions": [
{
"status": "affected",
"version": "version 20.1.1 (55740)"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by KPC of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is taken, a root service writes to a file owned by a normal user. By using a hard link, an attacker can write to an arbitrary file, potentially leading to privilege escalation."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-62",
"description": "CWE-62: UNIX Hard Link",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T09:43:27.168Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2124",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2124"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2024-54189",
"datePublished": "2025-06-03T09:43:27.168Z",
"dateReserved": "2024-12-05T15:34:29.663Z",
"dateUpdated": "2025-06-03T13:19:52.966Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-36486 (GCVE-0-2024-36486)
Vulnerability from cvelistv5 – Published: 2025-06-03 09:43 – Updated: 2025-06-03 13:22- CWE-62 - UNIX Hard Link
| Vendor | Product | Version | |
|---|---|---|---|
| Parallels | Parallels Desktop for Mac |
Affected:
version 20.1.1 (55740)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-06-03T11:03:05.592Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2126"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-36486",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-03T13:22:10.357632Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T13:22:13.518Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2126"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Parallels Desktop for Mac",
"vendor": "Parallels",
"versions": [
{
"status": "affected",
"version": "version 20.1.1 (55740)"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by KPC of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 (55740). When an archived virtual machine is restored, the prl_vmarchiver tool decompresses the file and writes the content back to its original location using root privileges. An attacker can exploit this process by using a hard link to write to an arbitrary file, potentially resulting in privilege escalation."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-62",
"description": "CWE-62: UNIX Hard Link",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T09:43:26.596Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2126",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2126"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2024-36486",
"datePublished": "2025-06-03T09:43:26.596Z",
"dateReserved": "2024-12-09T19:55:30.980Z",
"dateUpdated": "2025-06-03T13:22:13.518Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-31359 (GCVE-0-2025-31359)
Vulnerability from cvelistv5 – Published: 2025-06-03 09:43 – Updated: 2025-06-03 13:27- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
| Vendor | Product | Version | |
|---|---|---|---|
| Parallels | Parallels Desktop for Mac |
Affected:
20.2.2 (55879)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-06-03T11:03:08.458Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2160"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-31359",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-03T13:27:22.807674Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T13:27:26.786Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2025-2160"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Parallels Desktop for Mac",
"vendor": "Parallels",
"versions": [
{
"status": "affected",
"version": "20.2.2 (55879)"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by KPC of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A directory traversal vulnerability exists in the PVMP package unpacking functionality of Parallels Desktop for Mac version 20.2.2 (55879). This vulnerability can be exploited by an attacker to write to arbitrary files, potentially leading to privilege escalation."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T09:43:25.931Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2025-2160",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2025-2160"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2025-31359",
"datePublished": "2025-06-03T09:43:25.931Z",
"dateReserved": "2025-03-28T15:54:45.505Z",
"dateUpdated": "2025-06-03T13:27:26.786Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}