Security Bulletin: Multiple Vulnerabilities Have Been Identified In IBM Security Secret Server

Summary Multiple vulnerabilities identified on IBM Security Secret Server have been addressed in the release 10.7.000059. Vulnerability Details CVEID: CVE-2012-5662 DESCRIPTION: x3270 before 3.3.12ga12 does not verify that the server hostname matches a domain name in the subject's Common Name CN ...

CVE-2012-5340

SumatraPDF 2.1.1/MuPDF 1.0 allows remote attackers to cause an Integer Overflow in the lexnumber function via a corrupt PDF file...

CVE-2012-5389

NULL Pointer Dereference in PowerTCP WebServer for ActiveX 1.9.2 and earlier allows remote attackers to cause a denial of service application crash via a crafted HTTP request...

UBUNTU-CVE-2012-5340

SumatraPDF 2.1.1/MuPDF 1.0 allows remote attackers to cause an Integer Overflow in the lexnumber function via a corrupt PDF file...

CVE-2012-6649

The CVE-2012-6649 affects WordPress WP GPX Maps Plugin 1.1.21 and is caused by an improper/unrestricted file upload, enabling remote attackers to execute arbitrary PHP code on the server. Impact: remote code execution with web‑server context; vulnerability is tied to the wp-gpx-maps plugin. Remed...

CVE-2012-6663

CVE-2012-6663 affects General Electric D20ME/D20M RTUs. The available connected documentation confirms a vulnerability where device configurations are accessible via TFTP and reveal plaintext usernames and passwords due to improper configuration. The exploitation path is evidenced by the Metasplo...

CVE-2012-4606

Citrix XenServer is affected by a Local Privilege Escalation vulnerability (CVE-2012-4606) in multiple releases: 4.1, 6.0, 5.6 SP2, 5.6 FP1, 5.6, 5.5, 5.0, and 5.0 Update 3. The flaw enables local users with access to a guest OS to gain elevated privileges on the host. Exploitation details or exa...

CVE-2012-5340

SumatraPDF 2.1.1/MuPDF 1.0 allows remote attackers to cause an Integer Overflow in the lexnumber function via a corrupt PDF file...

CVE-2012-5340

CVE-2012-5340 affects SumatraPDF 2.1.1 and MuPDF 1.0, where a vulnerability in the lex_number() function can cause a Integer Overflow when processing a crafted PDF. The issue is confirmed across multiple sources (NVD/OSV Debian/Ubuntu/CVE records) and is triggered by corrupt PDF files. Exploitati...

CVE-2012-5389

The CVE-2012-5389 entry corresponds to a NULL pointer dereference in PowerTCP WebServer for ActiveX (DartWebserver.Dll)

CVE-2012-5626

EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat JBoss Operations Network 3.1; Red Hat JBoss Portal 4 and 5; Red Hat JBoss SOA Platform 4.2, 4.3, and 5; in Red Hat JBoss Enterprise Web Server 1 ignores roles specified using the @RunAs annotation...

CVE-2012-6083

Freeciv before 2.3.3 allows remote attackers to cause a denial of service via a crafted packet...

CVE-2012-5626

EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat JBoss Operations Network 3.1; Red Hat JBoss Portal 4 and 5; Red Hat JBoss SOA Platform 4.2, 4.3, and 5; in Red Hat JBoss Enterprise Web Server 1 ignores roles specified using the @RunAs annotation...

CVE-2012-6083

CVE-2012-6083 affects Freeciv prior to 2.3.3. A crafted packet can remotely cause a denial of service. The available connected sources confirm the impact as network-based with no user interaction required. The only remediation mentioned in the references is upgrading to Freeciv 2.3.3 or later; no...

CVE-2012-5698

BabyGekko before 1.2.4 has SQL injection...

UBUNTU-CVE-2012-5867

HT Editor 2.0.20 has a Remote Stack Buffer Overflow Vulnerability...

CVE-2012-4981

CVE-2012-4981 affects Toshiba ConfigFree 8.0.38 (Windows) and is triggered via the CF7 file format. The CF7 parser contains a vulnerability in the runApp field that allows an attacker to execute arbitrary commands with the privileges of the currently logged-in user by convincing a user to downloa...

CVE-2012-5698

BabyGekko before 1.2.4 has SQL injection...

CVE-2012-5698

CVE-2012-5698 (BabyGekko) has concrete details: multiple vulnerabilities in 1.2.x families. SQL Injection in admin/index.php when app=users (keyword) and login CSRF possibility, plus SQL injection via admin/index.php (query) and remote-authenticated user vectors; Local File Inclusion (CVE-2012-56...

CVE-2012-5699

CVE-2012-5699 affects BabyGekko prior to 1.2.4, with multiple vulnerabilities including PHP File Inclusion (LFI via index.php, app parameter), SQL Injection (CSRF-enabled in admin/index.php with app=users or similar), and XSS (in admin/index.php and templates). Root cause: insufficient input vali...