# CVEs published 2012-07-22

18 CVEs were published on July 22, 2012: 0 critical, 0 high. Days are UTC.

- [CVE-2011-2199](https://cve.now/CVE-2011-2199.md): Buffer overflow in tftp-hpa before 5.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via the utim (no CVSS)
- [CVE-2011-3148](https://cve.now/CVE-2011-3148.md): Stack-based buffer overflow in the \_assemble\_line function in modules/pam\_env/pam\_env.c in Linux-PAM (aka pam) before 1.1.5 allows local use (no CVSS)
- [CVE-2011-3149](https://cve.now/CVE-2011-3149.md): The \_expand\_arg function in the pam\_env module (modules/pam\_env/pam\_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when (no CVSS)
- [CVE-2011-3464](https://cve.now/CVE-2011-3464.md): Off-by-one error in the png\_formatted\_warning function in pngerror.c in libpng 1.5.4 through 1.5.7 might allow remote attackers to cause a d (no CVSS)
- [CVE-2012-2088](https://cve.now/CVE-2012-2088.md): Integer signedness error in the TIFFReadDirectory function in tif\_dirread.c in libtiff 3.9.4 and earlier allows remote attackers to cause a (no CVSS)
- [CVE-2012-2113](https://cve.now/CVE-2012-2113.md): Multiple integer overflows in tiff2pdf in libtiff before 4.0.2 allow remote attackers to cause a denial of service (application crash) or po (no CVSS)
- [CVE-2012-2737](https://cve.now/CVE-2012-2737.md): The user\_change\_icon\_file\_authorized\_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check th (no CVSS)
- [CVE-2012-3383](https://cve.now/CVE-2012-3383.md): The map\_meta\_cap function in wp-includes/capabilities.php in WordPress 3.4.x before 3.4.2, when the multisite feature is enabled, does not p (no CVSS)
- [CVE-2012-3384](https://cve.now/CVE-2012-3384.md): Cross-site request forgery (CSRF) vulnerability in the customizer in WordPress before 3.4.1 allows remote attackers to hijack the authentica (no CVSS)
- [CVE-2012-3385](https://cve.now/CVE-2012-3385.md): WordPress before 3.4.1 does not properly restrict access to post contents such as private or draft posts, which allows remote authors or con (no CVSS)
- [CVE-2012-4045](https://cve.now/CVE-2012-4045.md): Multiple heap-based buffer overflows in bmp.w5s in Winamp before 5.63 build 3235 allow remote attackers to execute arbitrary code via the (1 (no CVSS)
- [CVE-2009-5031](https://cve.now/CVE-2009-5031.md): ModSecurity before 2.5.11 treats request parameter values containing single quotes as files, which allows remote attackers to bypass filteri (no CVSS)
- [CVE-2012-2738](https://cve.now/CVE-2012-2738.md): The VteTerminal in gnome-terminal (vte) before 0.32.2 allows remote authenticated users to cause a denial of service (long loop and CPU cons (no CVSS)
- [CVE-2012-2751](https://cve.now/CVE-2012-2751.md): ModSecurity before 2.6.6, when used with PHP, does not properly handle single quotes not at the beginning of a request parameter value in th (no CVSS)
- [CVE-2012-3356](https://cve.now/CVE-2012-3356.md): The remote SVN views functionality (lib/vclib/svn/svn\_ra.py) in ViewVC before 1.1.15 does not properly perform authorization, which allows r (no CVSS)
- [CVE-2012-3357](https://cve.now/CVE-2012-3357.md): The SVN revision view (lib/vclib/svn/svn\_repos.py) in ViewVC before 1.1.15 does not properly handle log messages when a readable path is cop (no CVSS)
- [CVE-2012-3360](https://cve.now/CVE-2012-3360.md): Directory traversal vulnerability in virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2) and Essex (2012.1), when used over libvirt (no CVSS, nova)
- [CVE-2012-3361](https://cve.now/CVE-2012-3361.md): virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) allows remote authenticated users to overw (no CVSS, nova)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2012-07-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.