# CVEs published 2010-12-06 17 CVEs were published on December 6, 2010: 1 critical, 1 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2008-7270](https://cve.now/CVE-2008-7270.md): OpenSSL before 0.9.8j, when SSL\_OP\_NETSCAPE\_REUSE\_CIPHER\_CHANGE\_BUG is enabled, does not prevent modification of the ciphersuite in the sess (no CVSS) - [CVE-2010-4478](https://cve.now/CVE-2010-4478.md): OpenSSH 5.6 and earlier, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remot (CVSS 9.8) - [CVE-2010-4180](https://cve.now/CVE-2010-4180.md): OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL\_OP\_NETSCAPE\_REUSE\_CIPHER\_CHANGE\_BUG is enabled, does not properly prevent modificat (no CVSS) - [CVE-2010-4252](https://cve.now/CVE-2010-4252.md): OpenSSL before 1.0.0c, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote (no CVSS) - [CVE-2010-4294](https://cve.now/CVE-2010-4294.md): The frame decompression functionality in the VMnc media codec in VMware Movie Decoder before 6.5.5 build 328052 and 7.x before 7.1.2 build 3 (no CVSS) - [CVE-2010-4295](https://cve.now/CVE-2010-4295.md): Race condition in the mounting process in vmware-mount in VMware Workstation 7.x before 7.1.2 build 301548 on Linux, VMware Player 3.1.x bef (no CVSS) - [CVE-2010-4296](https://cve.now/CVE-2010-4296.md): vmware-mount in VMware Workstation 7.x before 7.1.2 build 301548 on Linux, VMware Player 3.1.x before 3.1.2 build 301548 on Linux, VMware Se (no CVSS) - [CVE-2010-4297](https://cve.now/CVE-2010-4297.md): The VMware Tools update functionality in VMware Workstation 6.5.x before 6.5.5 build 328052 and 7.x before 7.1.2 build 301548; VMware Player (no CVSS) - [CVE-2010-2639](https://cve.now/CVE-2010-2639.md): IBM WebSphere Commerce Enterprise 7.0 before 7.0.0.2 allows remote attackers to read messages intended for other recipients via vectors invo (no CVSS) - [CVE-2010-2761](https://cve.now/CVE-2010-2761.md): The multipart\_init function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier uses a hardcoded value of the MIME (no CVSS) - [CVE-2010-3066](https://cve.now/CVE-2010-3066.md): The io\_submit\_one function in fs/aio.c in the Linux kernel before 2.6.23 allows local users to cause a denial of service (NULL pointer deref (no CVSS) - [CVE-2010-3449](https://cve.now/CVE-2010-3449.md): Cross-site request forgery (CSRF) vulnerability in Redback before 1.2.4, as used in Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 (no CVSS) - [CVE-2010-3904](https://cve.now/CVE-2010-3904.md): The rds\_page\_copy\_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before (CVSS 7.8, KEV) - [CVE-2010-4408](https://cve.now/CVE-2010-4408.md): Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1 does not require entry of the administrator's (no CVSS, org.apache.archiva:archiva) - [CVE-2010-4409](https://cve.now/CVE-2010-4409.md): Integer overflow in the NumberFormatter::getSymbol (aka numfmt\_get\_symbol) function in PHP 5.3.3 and earlier allows context-dependent attack (no CVSS) - [CVE-2010-4410](https://cve.now/CVE-2010-4410.md): CRLF injection vulnerability in the header function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier allows remo (no CVSS) - [CVE-2010-4411](https://cve.now/CVE-2010-4411.md): Unspecified vulnerability in CGI.pm 3.50 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response spli (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2010-12-06 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.