ESA-2014-180: EMC Documentum Web Development Kit Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-180: EMC Documentum Web Development Kit Multiple Vulnerabilities EMC Identifier: ESA-2014-180 CVE Identifier: CVE-2014-4635, CVE-2014-4636, CVE-2014-4637, CVE-2014-4638, CVE-2014-4639 Severity Rating: See below for individual scores for each...

CVE-2014-9191

CVE-2014-9191 is an improper input validation vulnerability in CodeWrights HART DTM libraries used by multiple vendors (ABB, Emerson, Honeywell, Magnetrol, Pepperl+Fuchs, etc.). A specially crafted response on the 4–20 mA loop can trigger a buffer overflow, causing the HART DTM component to crash...

CVE-2014-4638

EMC Documentum Web Development Kit WDK before 6.8 allows remote attackers to conduct frame-injection attacks and obtain sensitive information via unspecified vectors...

Design/Logic Flaw

EMC Documentum Web Development Kit WDK before 6.8 allows remote attackers to conduct frame-injection attacks and obtain sensitive information via unspecified vectors...

CVE-2014-4638

EMC Documentum Web Development Kit (WDK) prior to version 6.8 contains a frame-injection vulnerability (CVE-2014-4638). The issue can allow remote attackers to induce the user to load an attacker-controlled page in a frame and potentially harvest sensitive information, with the documented base CV...

CVE-2014-4638

EMC Documentum Web Development Kit WDK before 6.8 allows remote attackers to conduct frame-injection attacks and obtain sensitive information via unspecified vectors...

Asterisk chan_iax2 IAX2 Control Frame LAGR Denial of Service - Ver2 (CVE-2007-3763)

A denial-of-service vulnerability has been reported in Asterisk AsteriskNOW, Asterisk Appliance Developer Kit and Asterisk S800i Appliance. Successful exploitation of this vulnerability would allow a remote attacker to create a denial of service condition on the affected system...

CVE-2011-1796

Use-after-free vulnerability in the FrameView::calculateScrollbarModesForLayout function in page/FrameView.cpp in WebCore in WebKit in Google Chrome before 11.0.696.65 allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via crafted...

CVE-2011-1796

Use-after-free vulnerability in the FrameView::calculateScrollbarModesForLayout function in page/FrameView.cpp in WebCore in WebKit in Google Chrome before 11.0.696.65 allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via crafted...

CVE-2011-1796

CVE-2011-1796 is a use-after-free in WebKit’s FrameView.cpp (WebCore) affecting Google Chrome up to version 11.0.696.65. The flaw allows a remote attacker to crash the browser (DoS) or potentially cause other impact via crafted JavaScript that calls removeChild while interacting with a FRAME elem...

DEBIAN-CVE-2014-9374

Double free vulnerability in the WebSocket Server reshttpwebsocket module in Asterisk Open Source 11.x before 11.14.2, 12.x before 12.7.2, and 13.x before 13.0.2 and Certified Asterisk 11.6 before 11.6-cert9 allows remote attackers to cause a denial of service crash by sending a zero length frame...

DEBIAN-CVE-2014-9318

The rawdecode function in libavcodec/rawdec.c in FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service out-of-bounds heap access and possibly have other unspecified impact via a crafted .cine file that triggers the avpicturegetsize...

Design/Logic Flaw

The rawdecode function in libavcodec/rawdec.c in FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service out-of-bounds heap access and possibly have other unspecified impact via a crafted .cine file that triggers the avpicturegetsize...

PT-2014-1846 · X.Org +5 · Xorg-X11-Server-Debuginfo +14

Name of the Vulnerable Software and Affected Versions: xorg-x11-server-Xdmx version 1.15.0 xorg-x11-server-debuginfo versions 1.1.1 through 1.15.0 xorg-x11-server-Xnest version 1.15.0 xorg-x11-server-Xephyr version 1.15.0 xorg-x11-server-source version 1.15.0 xorg-x11-server-Xvfb version 1.15.0...

Qemu: information leakage when guest sets high resolution

An information leak flaw was found in the way QEMU's VGA emulator accessed frame buffer memory for high resolution displays. A privileged guest user could use this flaw to leak memory contents of the host to the guest by setting the display to use a high resolution in the guest...

chromium-browser: Use-after-free in blink

Multiple use-after-free vulnerabilities in modules/screenorientation/ScreenOrientationController.cpp in Blink, as used in Google Chrome before 39.0.2171.65, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger improper handling of ...

CVE-2014-8768

Multiple Integer underflows in the geonetprint function in tcpdump 4.5.0 through 4.6.2, when in verbose mode, allow remote attackers to cause a denial of service segmentation fault and crash via a crafted length value in a Geonet frame...

DEBIAN-CVE-2014-8768

Multiple Integer underflows in the geonetprint function in tcpdump 4.5.0 through 4.6.2, when in verbose mode, allow remote attackers to cause a denial of service segmentation fault and crash via a crafted length value in a Geonet frame...

DEBIAN-CVE-2014-8767

Integer underflow in the olsrprint function in tcpdump 3.9.6 through 4.6.2, when in verbose mode, allows remote attackers to cause a denial of service crash via a crafted length value in an OLSR frame...

CVE-2014-8767

Integer underflow in the olsrprint function in tcpdump 3.9.6 through 4.6.2, when in verbose mode, allows remote attackers to cause a denial of service crash via a crafted length value in an OLSR frame...