# CVEs published 2013-12-09

46 CVEs were published on December 9, 2013: 0 critical, 0 high. Days are UTC.

- [CVE-2013-2929](https://cve.now/CVE-2013-2929.md): The Linux kernel before 3.12.2 does not properly use the get\_dumpable function, which allows local users to bypass intended ptrace… (no CVSS)
- [CVE-2013-2930](https://cve.now/CVE-2013-2930.md): The perf\_trace\_event\_perm function in kernel/trace/trace\_event\_perf.c in the Linux kernel before 3.12.2 does not properly restrict access… (no CVSS)
- [CVE-2013-4270](https://cve.now/CVE-2013-4270.md): The net\_ctl\_permissions function in net/sysctl\_net.c in the Linux kernel before 3.11.5 does not properly determine uid and gid values… (no CVSS)
- [CVE-2013-6180](https://cve.now/CVE-2013-6180.md): EMC RSA Security Analytics (SA) 10.x before 10.3, and RSA NetWitness NextGen 9.8, does not ensure that SA Core requests originate from the… (no CVSS)
- [CVE-2013-6427](https://cve.now/CVE-2013-6427.md): upgrade.py in the hp-upgrade service in HP Linux Imaging and Printing (HPLIP) 3.x through 3.13.11 launches a program from an http URL… (no CVSS)
- [CVE-2013-6431](https://cve.now/CVE-2013-6431.md): The fib6\_add function in net/ipv6/ip6\_fib.c in the Linux kernel before 3.11.5 does not properly implement error-code encoding, which… (no CVSS)
- [CVE-2013-6432](https://cve.now/CVE-2013-6432.md): The ping\_recvmsg function in net/ipv4/ping.c in the Linux kernel before 3.12.4 does not properly interact with read system calls on ping… (no CVSS)
- [CVE-2013-7026](https://cve.now/CVE-2013-7026.md): Multiple race conditions in ipc/shm.c in the Linux kernel before 3.12.2 allow local users to cause a denial of service (use-after-free and… (no CVSS)
- [CVE-2013-7027](https://cve.now/CVE-2013-7027.md): The ieee80211\_radiotap\_iterator\_init function in net/wireless/radiotap.c in the Linux kernel before 3.11.7 does not check whether a frame… (no CVSS)
- [CVE-2013-3929](https://cve.now/CVE-2013-3929.md): Cross-site scripting (XSS) vulnerability in admin/editevent.php in CMS Made Simple (CMSMS) 1.11.9 allows remote authenticated users with… (no CVSS)
- [CVE-2013-5354](https://cve.now/CVE-2013-5354.md): Multiple SQL injection vulnerabilities in Sharetronix 3.1.1 allow remote attackers to execute arbitrary SQL commands via the (1)… (no CVSS)
- [CVE-2013-5355](https://cve.now/CVE-2013-5355.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Sharetronix 3.1.1 allow remote attackers to hijack the authentication of… (no CVSS)
- [CVE-2013-6039](https://cve.now/CVE-2013-6039.md): Multiple cross-site scripting (XSS) vulnerabilities in NagiosQL 3.2 SP2 allow remote attackers to inject arbitrary web script or HTML via… (no CVSS)
- [CVE-2013-6985](https://cve.now/CVE-2013-6985.md): SQL injection vulnerability in m\_worklog/log\_searchday.jsp in Enorth Webpublisher CMS, possibly 5.0 and earlier, allows remote attackers… (no CVSS)
- [CVE-2011-3934](https://cve.now/CVE-2011-3934.md): Double free vulnerability in the vp3\_update\_thread\_context function in libavcodec/vp3.c in FFmpeg before 0.10 allows remote attackers to… (no CVSS)
- [CVE-2011-3935](https://cve.now/CVE-2011-3935.md): The codec\_get\_buffer function in ffmpeg.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via vectors related… (no CVSS)
- [CVE-2011-3941](https://cve.now/CVE-2011-3941.md): The decode\_mb function in libavcodec/error\_resilience.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via… (no CVSS)
- [CVE-2011-3944](https://cve.now/CVE-2011-3944.md): The smacker\_decode\_header\_tree function in libavcodec/smacker.c in FFmpeg before 0.10 allows remote attackers to have an unspecified… (no CVSS)
- [CVE-2011-3946](https://cve.now/CVE-2011-3946.md): The ff\_h264\_decode\_sei function in libavcodec/h264\_sei.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via… (no CVSS)
- [CVE-2011-3949](https://cve.now/CVE-2011-3949.md): The dirac\_unpack\_idwt\_params function in libavcodec/diracdec.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact… (no CVSS)
- [CVE-2011-3950](https://cve.now/CVE-2011-3950.md): The dirac\_decode\_data\_unit function in libavcodec/diracdec.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact… (no CVSS)
- [CVE-2011-4351](https://cve.now/CVE-2011-4351.md): Buffer overflow in FFmpeg before 0.5.6, 0.6.x before 0.6.4, 0.7.x before 0.7.8, and 0.8.x before 0.8.8 allows remote attackers to execute… (no CVSS)
- [CVE-2013-1349](https://cve.now/CVE-2013-1349.md): Eval injection vulnerability in ajax.php in openSIS 4.5 through 5.2 allows remote attackers to execute arbitrary PHP code via the modname… (no CVSS)
- [CVE-2013-1953](https://cve.now/CVE-2013-1953.md): Integer underflow in the input\_bmp\_reader function in input-bmp.c in AutoTrace 0.31.1 allows context-dependent attackers to have an… (no CVSS)
- [CVE-2013-4376](https://cve.now/CVE-2013-4376.md): The setgid wrapper libx2go-server-db-sqlite3-wrapper.c in X2Go Server before 4.0.0.2 allows remote attackers to execute arbitrary code via… (no CVSS)
- [CVE-2013-4400](https://cve.now/CVE-2013-4400.md): virt-login-shell in libvirt 1.1.2 through 1.1.3 allows local users to overwrite arbitrary files and possibly gain privileges via… (no CVSS)
- [CVE-2013-6171](https://cve.now/CVE-2013-6171.md): checkpassword-reply in Dovecot before 2.2.7 performs setuid operations to a user who is authenticating, which allows local users to bypass… (no CVSS)
- [CVE-2013-6404](https://cve.now/CVE-2013-6404.md): Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows… (no CVSS)
- [CVE-2013-7008](https://cve.now/CVE-2013-7008.md): The decode\_slice\_header function in libavcodec/h264.c in FFmpeg before 2.1 incorrectly relies on a certain droppable field, which allows… (no CVSS)
- [CVE-2013-7009](https://cve.now/CVE-2013-7009.md): The rpza\_decode\_stream function in libavcodec/rpza.c in FFmpeg before 2.1 does not properly maintain a pointer to pixel data, which allows… (no CVSS)
- [CVE-2013-7010](https://cve.now/CVE-2013-7010.md): Multiple integer signedness errors in libavcodec/dsputil.c in FFmpeg before 2.1 allow remote attackers to cause a denial of service… (no CVSS)
- [CVE-2013-7011](https://cve.now/CVE-2013-7011.md): The read\_header function in libavcodec/ffv1dec.c in FFmpeg before 2.1 does not prevent changes to global parameters, which allows remote… (no CVSS)
- [CVE-2013-7012](https://cve.now/CVE-2013-7012.md): The get\_siz function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not prevent attempts to use non-zero image offsets, which… (no CVSS)
- [CVE-2013-7013](https://cve.now/CVE-2013-7013.md): The g2m\_init\_buffers function in libavcodec/g2meet.c in FFmpeg before 2.1 uses an incorrect ordering of arithmetic operations, which… (no CVSS)
- [CVE-2013-7014](https://cve.now/CVE-2013-7014.md): Integer signedness error in the add\_bytes\_l2\_c function in libavcodec/pngdsp.c in FFmpeg before 2.1 allows remote attackers to cause a… (no CVSS)
- [CVE-2013-7015](https://cve.now/CVE-2013-7015.md): The flashsv\_decode\_frame function in libavcodec/flashsv.c in FFmpeg before 2.1 does not properly validate a certain height value, which… (no CVSS)
- [CVE-2013-7016](https://cve.now/CVE-2013-7016.md): The get\_siz function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not ensure the expected sample separation, which allows remote… (no CVSS)
- [CVE-2013-7017](https://cve.now/CVE-2013-7017.md): libavcodec/jpeg2000.c in FFmpeg before 2.1 allows remote attackers to cause a denial of service (invalid pointer dereference) or possibly… (no CVSS)
- [CVE-2013-7018](https://cve.now/CVE-2013-7018.md): libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not ensure the use of valid code-block dimension values, which allows remote attackers… (no CVSS)
- [CVE-2013-7019](https://cve.now/CVE-2013-7019.md): The get\_cox function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not properly validate the reduction factor, which allows remote… (no CVSS)
- [CVE-2013-7020](https://cve.now/CVE-2013-7020.md): The read\_header function in libavcodec/ffv1dec.c in FFmpeg before 2.1 does not properly enforce certain bit-count and colorspace… (no CVSS)
- [CVE-2013-7021](https://cve.now/CVE-2013-7021.md): The filter\_frame function in libavfilter/vf\_fps.c in FFmpeg before 2.1 does not properly ensure the availability of FIFO content, which… (no CVSS)
- [CVE-2013-7022](https://cve.now/CVE-2013-7022.md): The g2m\_init\_buffers function in libavcodec/g2meet.c in FFmpeg before 2.1 does not properly allocate memory for tiles, which allows remote… (no CVSS)
- [CVE-2013-7023](https://cve.now/CVE-2013-7023.md): The ff\_combine\_frame function in libavcodec/parser.c in FFmpeg before 2.1 does not properly handle certain memory-allocation errors, which… (no CVSS)
- [CVE-2013-7024](https://cve.now/CVE-2013-7024.md): The jpeg2000\_decode\_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not consider the component number in certain… (no CVSS)
- [CVE-2013-7025](https://cve.now/CVE-2013-7025.md): Multiple cross-site scripting (XSS) vulnerabilities in ematStaticAlertTypes.jsp in the Alert Settings section in Dell SonicWALL Global… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2013-12-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.