# CVEs published 2013-10-09

43 CVEs were published on October 9, 2013: 0 critical, 3 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2012-4412](https://cve.now/CVE-2012-4412.md): Integer overflow in string/strcoll\_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-dependent attackers to caus (no CVSS)
- [CVE-2012-4424](https://cve.now/CVE-2012-4424.md): Stack-based buffer overflow in string/strcoll\_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-dependent attack (no CVSS)
- [CVE-2013-0736](https://cve.now/CVE-2013-0736.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Mingle Forum plugin 1.0.34 and possibly earlier for WordPress allow remote (no CVSS)
- [CVE-2013-2207](https://cve.now/CVE-2013-2207.md): pt\_chown in GNU C Library (aka glibc or libc6) before 2.18 does not properly check permissions for tty files, which allows local users to ch (no CVSS)
- [CVE-2013-4237](https://cve.now/CVE-2013-4237.md): sysdeps/posix/readdir\_r.c in the GNU C Library (aka glibc or libc6) 2.18 and earlier allows context-dependent attackers to cause a denial of (no CVSS)
- [CVE-2013-4332](https://cve.now/CVE-2013-4332.md): Multiple integer overflows in malloc/malloc.c in the GNU C Library (aka glibc or libc6) 2.18 and earlier allow context-dependent attackers t (no CVSS)
- [CVE-2013-4356](https://cve.now/CVE-2013-4356.md): Xen 4.3.x writes hypervisor mappings to certain shadow pagetables when live migration is performed on hosts with more than 5TB of RAM, which (no CVSS)
- [CVE-2013-4379](https://cve.now/CVE-2013-4379.md): The Make Meeting Scheduler module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to bypass intended access restrictions for a pol (no CVSS)
- [CVE-2013-2099](https://cve.now/CVE-2013-2099.md): Algorithmic complexity vulnerability in the ssl.match\_hostname function in Python 3.2.x, 3.3.x, and earlier, and unspecified versions of pyt (no CVSS)
- [CVE-2013-3128](https://cve.now/CVE-2013-3128.md): The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, (no CVSS)
- [CVE-2013-3195](https://cve.now/CVE-2013-3195.md): The DSA\_InsertItem function in Comctl32.dll in the Windows common control library in Microsoft Windows XP SP2, Windows Server 2003 SP2, Wind (no CVSS)
- [CVE-2013-3200](https://cve.now/CVE-2013-3200.md): The USB drivers in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2 (no CVSS)
- [CVE-2013-3860](https://cve.now/CVE-2013-3860.md): Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 does not properly parse a DTD during XML digital-signature validation, whi (no CVSS)
- [CVE-2013-3861](https://cve.now/CVE-2013-3861.md): Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 allows remote attackers to cause a denial of service (application crash or (no CVSS)
- [CVE-2013-3871](https://cve.now/CVE-2013-3871.md): Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2013-3872](https://cve.now/CVE-2013-3872.md): Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf (no CVSS)
- [CVE-2013-3873](https://cve.now/CVE-2013-3873.md): Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf (no CVSS)
- [CVE-2013-3874](https://cve.now/CVE-2013-3874.md): Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft (no CVSS)
- [CVE-2013-3875](https://cve.now/CVE-2013-3875.md): Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a (no CVSS)
- [CVE-2013-3879](https://cve.now/CVE-2013-3879.md): Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows (no CVSS)
- [CVE-2013-3880](https://cve.now/CVE-2013-3880.md): The App Container feature in the kernel-mode drivers in Microsoft Windows 8, Windows Server 2012, and Windows RT allows remote attackers to (no CVSS)
- [CVE-2013-3881](https://cve.now/CVE-2013-3881.md): win32k.sys in the kernel-mode drivers in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to gain privileges via a (no CVSS)
- [CVE-2013-3882](https://cve.now/CVE-2013-3882.md): Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf (no CVSS)
- [CVE-2013-3885](https://cve.now/CVE-2013-3885.md): Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf (no CVSS)
- [CVE-2013-3886](https://cve.now/CVE-2013-3886.md): Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (no CVSS)
- [CVE-2013-3888](https://cve.now/CVE-2013-3888.md): dxgkrnl.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local us (CVSS 8.4)
- [CVE-2013-3889](https://cve.now/CVE-2013-3889.md): Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office for Mac 2011; Ex (no CVSS)
- [CVE-2013-3890](https://cve.now/CVE-2013-3890.md): Microsoft Excel 2007 SP3, Excel Viewer, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Off (no CVSS)
- [CVE-2013-3891](https://cve.now/CVE-2013-3891.md): Microsoft Word 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Memory Corruption Vulnerabilit (no CVSS)
- [CVE-2013-3892](https://cve.now/CVE-2013-3892.md): Microsoft Word 2007 SP3 and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document, ak (no CVSS)
- [CVE-2013-3894](https://cve.now/CVE-2013-3894.md): The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, (CVSS 8.1)
- [CVE-2013-3895](https://cve.now/CVE-2013-3895.md): Microsoft SharePoint Server 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to conduct clickjacking attacks via a crafted web page, ak (no CVSS)
- [CVE-2013-3896](https://cve.now/CVE-2013-3896.md): Microsoft Silverlight 5 before 5.1.20913.0 does not properly validate pointers during access to Silverlight elements, which allows remote at (CVSS 5.5, KEV)
- [CVE-2013-3897](https://cve.now/CVE-2013-3897.md): Use-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers (CVSS 8.8, KEV)
- [CVE-2013-4256](https://cve.now/CVE-2013-4256.md): Multiple stack-based and heap-based buffer overflows in Network Audio System (NAS) 1.9.3 allow local users to cause a denial of service (cra (no CVSS)
- [CVE-2013-4258](https://cve.now/CVE-2013-4258.md): Format string vulnerability in the osLogMsg function in server/os/aulog.c in Network Audio System (NAS) 1.9.3 allows remote attackers to cau (no CVSS)
- [CVE-2013-4284](https://cve.now/CVE-2013-4284.md): Cumin, as used in Red Hat Enterprise MRG 2.4, allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafte (no CVSS)
- [CVE-2013-4384](https://cve.now/CVE-2013-4384.md): Cross-site scripting (XSS) vulnerability in Google Site Search module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.10 for Drupal allows r (no CVSS)
- [CVE-2013-4385](https://cve.now/CVE-2013-4385.md): Buffer overflow in the "read-string!" procedure in the "extras" unit in CHICKEN stable before 4.8.0.5 and development snapshots before 4.8.3 (no CVSS)
- [CVE-2013-5325](https://cve.now/CVE-2013-5325.md): Adobe Reader and Acrobat 11.x before 11.0.05 on Windows allow remote attackers to execute arbitrary JavaScript code in a javascript: URL via (no CVSS)
- [CVE-2013-5327](https://cve.now/CVE-2013-5327.md): MDBMS.dll in Adobe RoboHelp 10 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified v (no CVSS)
- [CVE-2013-5576](https://cve.now/CVE-2013-5576.md): administrator/components/com\_media/helpers/media.php in the media manager in Joomla! 2.5.x before 2.5.14 and 3.x before 3.1.5 allows remote (no CVSS)
- [CVE-2013-5967](https://cve.now/CVE-2013-5967.md): Multiple SQL injection vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 4.3 and earlier allow remote attack (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2013-10-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.