# CVEs published 2012-08-07

20 CVEs were published on August 7, 2012: 0 critical, 0 high. Days are UTC.

- [CVE-2012-4178](https://cve.now/CVE-2012-4178.md): SQL injection vulnerability in spywall/includes/deptUploads\_data.php in Symantec Web Gateway 5.0.3.18 allows remote attackers to execute arb (no CVSS)
- [CVE-2012-0213](https://cve.now/CVE-2012-0213.md): The UnhandledDataStructure function in hwpf/model/UnhandledDataStructure.java in Apache POI 3.8 and earlier allows remote attackers to cause (no CVSS, org.apache.poi:poi · org.apache.poi:poi-scratchpad)
- [CVE-2012-3386](https://cve.now/CVE-2012-3386.md): The "make distcheck" rule in GNU Automake before 1.11.6 and 1.12.x before 1.12.2 grants world-writable permissions to the extraction directo (no CVSS)
- [CVE-2012-3422](https://cve.now/CVE-2012-3422.md): The getFirstInTableInstance function in the IcedTea-Web plugin before 1.2.1 returns an uninitialized pointer when the instance\_to\_id\_map has (no CVSS)
- [CVE-2012-3423](https://cve.now/CVE-2012-3423.md): The IcedTea-Web plugin before 1.2.1 does not properly handle NPVariant NPStrings without NUL terminators, which allows remote attackers to c (no CVSS)
- [CVE-2012-3429](https://cve.now/CVE-2012-3429.md): The dns\_to\_ldap\_dn\_escape function in src/ldap\_convert.c in bind-dyndb-ldap 1.1.0rc1 and earlier does not properly escape distinguished name (no CVSS)
- [CVE-2012-3437](https://cve.now/CVE-2012-3437.md): The Magick\_png\_malloc function in coders/png.c in ImageMagick 6.7.8 and earlier does not use the proper variable type for the allocation siz (no CVSS)
- [CVE-2012-3438](https://cve.now/CVE-2012-3438.md): The Magick\_png\_malloc function in coders/png.c in GraphicsMagick 6.7.8-6 does not use the proper variable type for the allocation size, whic (no CVSS)
- [CVE-2012-3445](https://cve.now/CVE-2012-3445.md): The virTypedParameterArrayClear function in libvirt 0.9.13 does not properly handle virDomain\* API calls with typed parameters, which might (no CVSS)
- [CVE-2012-2652](https://cve.now/CVE-2012-2652.md): The bdrv\_open function in Qemu 1.0 does not properly handle the failure of the mkstemp function, when in snapshot node, which allows local u (no CVSS)
- [CVE-2012-3413](https://cve.now/CVE-2012-3413.md): The HTMLQuoteColorer::process function in messageviewer/htmlquotecolorer.cpp in KDE PIM 4.6 through 4.8 does not disable JavaScript, Java, a (no CVSS)
- [CVE-2012-3449](https://cve.now/CVE-2012-3449.md): Open vSwitch 1.4.2 uses world writable permissions for (1) /var/lib/openvswitch/pki/controllerca/incoming/ and (2) /var/lib/openvswitch/pki/ (no CVSS)
- [CVE-2012-3452](https://cve.now/CVE-2012-3452.md): gnome-screensaver 3.4.x before 3.4.4 and 3.5.x before 3.5.4, when multiple screens are used, only locks the screen with the active focus, wh (no CVSS)
- [CVE-2012-3453](https://cve.now/CVE-2012-3453.md): logol 1.5.0 uses world writable permissions for the /var/lib/logol/results directory, which allows local users to delete or overwrite arbitr (no CVSS)
- [CVE-2012-3454](https://cve.now/CVE-2012-3454.md): eXtplorer 2.1.0b6 uses world writable permissions for the /var/lib/extplorer/ftp\_tmp directory, which allows local users to delete or overwr (no CVSS)
- [CVE-2012-4177](https://cve.now/CVE-2012-4177.md): The web browser plugin for Ubisoft Uplay PC before 2.0.4 allows remote attackers to execute arbitrary programs via the -orbit\_exe\_path comma (no CVSS)
- [CVE-2012-2022](https://cve.now/CVE-2012-2022.md): Multiple cross-site scripting (XSS) vulnerabilities in HP Network Node Manager i (NNMi) 8.x, 9.0x, 9.1x, and 9.20 allow remote attackers to (no CVSS)
- [CVE-2012-2317](https://cve.now/CVE-2012-2317.md): The Debian php\_crypt\_revamped.patch patch for PHP 5.3.x, as used in the php5 package before 5.3.3-7+squeeze4 in Debian GNU/Linux squeeze, th (no CVSS)
- [CVE-2012-2648](https://cve.now/CVE-2012-2648.md): Cross-site scripting (XSS) vulnerability in the GoodReader app 3.16 and earlier for iOS on the iPad, and 3.15.1 and earlier for iOS on the i (no CVSS)
- [CVE-2012-4005](https://cve.now/CVE-2012-4005.md): The NHN Japan NAVER LINE application before 2.5.5 for Android does not properly handle implicit intents, which allows remote attackers to ob (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2012-08-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.