# CVEs published 2012-11-21

45 CVEs were published on November 21, 2012: 0 critical, 0 high. Days are UTC.

- [CVE-2012-3512](https://cve.now/CVE-2012-3512.md): Munin before 2.0.6 stores plugin state files that run as root in the same group-writable directory as non-root plugins, which allows local u (no CVSS)
- [CVE-2012-3513](https://cve.now/CVE-2012-3513.md): munin-cgi-graph in Munin before 2.0.6, when running as a CGI module under Apache, allows remote attackers to load new configurations and cre (no CVSS)
- [CVE-2012-4409](https://cve.now/CVE-2012-4409.md): Stack-based buffer overflow in the check\_file\_head function in extra.c in mcrypt 2.6.8 and earlier allows user-assisted remote attackers to (no CVSS)
- [CVE-2012-4426](https://cve.now/CVE-2012-4426.md): Multiple format string vulnerabilities in mcrypt 2.6.8 and earlier might allow user-assisted remote attackers to cause a denial of service ( (no CVSS)
- [CVE-2012-4527](https://cve.now/CVE-2012-4527.md): Stack-based buffer overflow in mcrypt 2.6.8 and earlier allows user-assisted remote attackers to cause a denial of service (crash) and possi (no CVSS)
- [CVE-2012-4535](https://cve.now/CVE-2012-4535.md): Xen 3.4 through 4.2, and possibly earlier versions, allows local guest OS administrators to cause a denial of service (Xen infinite loop and (no CVSS)
- [CVE-2012-4536](https://cve.now/CVE-2012-4536.md): The (1) domain\_pirq\_to\_emuirq and (2) physdev\_unmap\_pirq functions in Xen 2.2 allows local guest OS administrators to cause a denial of serv (no CVSS)
- [CVE-2012-4537](https://cve.now/CVE-2012-4537.md): Xen 3.4 through 4.2, and possibly earlier versions, does not properly synchronize the p2m and m2p tables when the set\_p2m\_entry function fai (no CVSS)
- [CVE-2012-4539](https://cve.now/CVE-2012-4539.md): Xen 4.0 through 4.2, when running 32-bit x86 PV guests on 64-bit hypervisors, allows local guest OS administrators to cause a denial of serv (no CVSS)
- [CVE-2012-5526](https://cve.now/CVE-2012-5526.md): CGI.pm module before 3.63 for Perl does not properly escape newlines in (1) Set-Cookie or (2) P3P headers, which might allow remote attacker (no CVSS)
- [CVE-2012-4201](https://cve.now/CVE-2012-4201.md): The evalInSandbox implementation in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 1 (no CVSS)
- [CVE-2012-4202](https://cve.now/CVE-2012-4202.md): Heap-based buffer overflow in the image::RasterImage::DrawFrameTo function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, (no CVSS)
- [CVE-2012-4203](https://cve.now/CVE-2012-4203.md): The New Tab page in Mozilla Firefox before 17.0 uses a privileged context for execution of JavaScript code by bookmarklets, which allows use (no CVSS)
- [CVE-2012-4204](https://cve.now/CVE-2012-4204.md): The str\_unescape function in the JavaScript engine in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 allows (no CVSS)
- [CVE-2012-4205](https://cve.now/CVE-2012-4205.md): Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 assign the system principal, rather than the sandbox princip (no CVSS)
- [CVE-2012-4206](https://cve.now/CVE-2012-4206.md): Untrusted search path vulnerability in the installer in Mozilla Firefox before 17.0 and Firefox ESR 10.x before 10.0.11 on Windows allows lo (no CVSS)
- [CVE-2012-4207](https://cve.now/CVE-2012-4207.md): The HZ-GB-2312 character-set implementation in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunde (no CVSS)
- [CVE-2012-4208](https://cve.now/CVE-2012-4208.md): The XrayWrapper implementation in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 does not consider the comp (no CVSS)
- [CVE-2012-4209](https://cve.now/CVE-2012-4209.md): Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey be (no CVSS)
- [CVE-2012-4210](https://cve.now/CVE-2012-4210.md): The Style Inspector in Mozilla Firefox before 17.0 and Firefox ESR 10.x before 10.0.11 does not properly restrict the context of HTML markup (no CVSS)
- [CVE-2012-4212](https://cve.now/CVE-2012-4212.md): Use-after-free vulnerability in the XPCWrappedNative::Mark function in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey b (no CVSS)
- [CVE-2012-4213](https://cve.now/CVE-2012-4213.md): Use-after-free vulnerability in the nsEditor::FindNextLeafNode function in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonk (no CVSS)
- [CVE-2012-4214](https://cve.now/CVE-2012-4214.md): Use-after-free vulnerability in the nsTextEditorState::PrepareEditor function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.1 (no CVSS)
- [CVE-2012-4215](https://cve.now/CVE-2012-4215.md): Use-after-free vulnerability in the nsPlaintextEditor::FireClipboardEvent function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 1 (no CVSS)
- [CVE-2012-4216](https://cve.now/CVE-2012-4216.md): Use-after-free vulnerability in the gfxFont::GetFontEntry function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderb (no CVSS)
- [CVE-2012-4217](https://cve.now/CVE-2012-4217.md): Use-after-free vulnerability in the nsViewManager::ProcessPendingUpdates function in Mozilla Firefox before 17.0, Thunderbird before 17.0, a (no CVSS)
- [CVE-2012-4218](https://cve.now/CVE-2012-4218.md): Use-after-free vulnerability in the BuildTextRunsScanner::BreakSink::SetBreaks function in Mozilla Firefox before 17.0, Thunderbird before 1 (no CVSS)
- [CVE-2012-5471](https://cve.now/CVE-2012-5471.md): The Dropbox Repository File Picker in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allows remote authenticated user (no CVSS, moodle/moodle)
- [CVE-2012-5472](https://cve.now/CVE-2012-5472.md): lib/formslib.php in Moodle 2.2.x before 2.2.6 and 2.3.x before 2.3.3 allows remote authenticated users to bypass intended access restriction (no CVSS)
- [CVE-2012-5473](https://cve.now/CVE-2012-5473.md): The Database activity module in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allows remote authenticated users to r (no CVSS)
- [CVE-2012-5479](https://cve.now/CVE-2012-5479.md): The Portfolio plugin in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allows remote authenticated users to upload an (no CVSS)
- [CVE-2012-5480](https://cve.now/CVE-2012-5480.md): The Database activity module in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allows remote attackers to bypass inte (no CVSS)
- [CVE-2012-5481](https://cve.now/CVE-2012-5481.md): Moodle 2.3.x before 2.3.3 allows remote authenticated users to bypass the moodle/role:manage capability requirement and read all capability (no CVSS)
- [CVE-2012-5829](https://cve.now/CVE-2012-5829.md): Heap-based buffer overflow in the nsWindow::OnExposeEvent function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderb (no CVSS)
- [CVE-2012-5830](https://cve.now/CVE-2012-5830.md): Use-after-free vulnerability in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x (no CVSS)
- [CVE-2012-5833](https://cve.now/CVE-2012-5833.md): The texImage2D implementation in the WebGL subsystem in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17. (no CVSS)
- [CVE-2012-5835](https://cve.now/CVE-2012-5835.md): Integer overflow in the WebGL subsystem in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbir (no CVSS)
- [CVE-2012-5836](https://cve.now/CVE-2012-5836.md): Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 allow remote attackers to execute arbitrary code or cause a (no CVSS)
- [CVE-2012-5837](https://cve.now/CVE-2012-5837.md): The Web Developer Toolbar in Mozilla Firefox before 17.0 executes script with chrome privileges, which allows user-assisted remote attackers (no CVSS)
- [CVE-2012-5838](https://cve.now/CVE-2012-5838.md): The copyTexImage2D implementation in the WebGL subsystem in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 (no CVSS)
- [CVE-2012-5839](https://cve.now/CVE-2012-5839.md): Heap-based buffer overflow in the gfxShapedWord::CompressedGlyph::IsClusterStart function in Mozilla Firefox before 17.0, Firefox ESR 10.x b (no CVSS)
- [CVE-2012-5840](https://cve.now/CVE-2012-5840.md): Use-after-free vulnerability in the nsTextEditorState::PrepareEditor function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.1 (no CVSS)
- [CVE-2012-5841](https://cve.now/CVE-2012-5841.md): Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey be (no CVSS)
- [CVE-2012-5842](https://cve.now/CVE-2012-5842.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird befo (no CVSS)
- [CVE-2012-5843](https://cve.now/CVE-2012-5843.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.1 (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2012-11-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.