# CVEs published 2012-01-06

11 CVEs were published on January 6, 2012: 0 critical, 0 high. Days are UTC.

- [CVE-2011-5054](https://cve.now/CVE-2011-5054.md): kcheckpass passes a user-supplied argument to the pam\_start function, often within a setuid environment, which allows local users to invoke (no CVSS)
- [CVE-2011-5053](https://cve.now/CVE-2011-5053.md): The Wi-Fi Protected Setup (WPS) protocol, when the "external registrar" authentication method is used, does not properly inform clients abou (no CVSS)
- [CVE-2011-4616](https://cve.now/CVE-2011-4616.md): Cross-site scripting (XSS) vulnerability in the HTML-Template-Pro module before 0.9507 for Perl allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2012-0287](https://cve.now/CVE-2012-0287.md): Cross-site scripting (XSS) vulnerability in wp-comments-post.php in WordPress 3.3.x before 3.3.1, when Internet Explorer is used, allows rem (no CVSS)
- [CVE-2011-4108](https://cve.now/CVE-2011-4108.md): The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it (no CVSS)
- [CVE-2011-4109](https://cve.now/CVE-2011-4109.md): Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509\_V\_FLAG\_POLICY\_CHECK is enabled, allows remote attackers to have an unspe (no CVSS)
- [CVE-2011-4576](https://cve.now/CVE-2011-4576.md): The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padd (no CVSS)
- [CVE-2011-4577](https://cve.now/CVE-2011-4577.md): OpenSSL before 0.9.8s and 1.x before 1.0.0f, when RFC 3779 support is enabled, allows remote attackers to cause a denial of service (asserti (no CVSS)
- [CVE-2011-4619](https://cve.now/CVE-2011-4619.md): The Server Gated Cryptography (SGC) implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restart (no CVSS)
- [CVE-2012-0027](https://cve.now/CVE-2012-0027.md): The GOST ENGINE in OpenSSL before 1.0.0f does not properly handle invalid parameters for the GOST block cipher, which allows remote attacker (no CVSS)
- [CVE-2012-0390](https://cve.now/CVE-2012-0390.md): The DTLS implementation in GnuTLS 3.0.10 and earlier executes certain error-handling code only if there is a specific relationship between a (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2012-01-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.