# CVEs published 2013-11-23

60 CVEs were published on November 23, 2013: 0 critical, 0 high. Days are UTC.

- [CVE-2013-4164](https://cve.now/CVE-2013-4164.md): Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 4 (no CVSS)
- [CVE-2013-4509](https://cve.now/CVE-2013-4509.md): The default configuration of IBUS 1.5.4, and possibly 1.5.2 and earlier, when IBus.InputPurpose.PASSWORD is not set and used with GNOME 3, d (no CVSS)
- [CVE-2013-6869](https://cve.now/CVE-2013-6869.md): SQL injection vulnerability in the SRTT\_GET\_COUNT\_BEFORE\_KEY\_RFC function in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2012-0786](https://cve.now/CVE-2012-0786.md): The transform\_save function in transform.c in Augeas before 1.0.0 allows local users to overwrite arbitrary files and obtain sensitive infor (no CVSS)
- [CVE-2012-0787](https://cve.now/CVE-2012-0787.md): The clone\_file function in transfer.c in Augeas before 1.0.0, when copy\_if\_rename\_fails is set and EXDEV or EBUSY is returned by the rename (no CVSS)
- [CVE-2012-6607](https://cve.now/CVE-2012-6607.md): The transform\_save function in transform.c in Augeas before 1.0.0 allows local users to overwrite arbitrary files and obtain sensitive infor (no CVSS)
- [CVE-2013-0221](https://cve.now/CVE-2013-0221.md): The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and cras (no CVSS)
- [CVE-2013-0222](https://cve.now/CVE-2013-0222.md): The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and cras (no CVSS)
- [CVE-2013-0223](https://cve.now/CVE-2013-0223.md): The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and cras (no CVSS)
- [CVE-2013-0860](https://cve.now/CVE-2013-0860.md): The ff\_er\_frame\_end function in libavcodec/error\_resilience.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.1 does not properly verify that a (no CVSS)
- [CVE-2013-0861](https://cve.now/CVE-2013-0861.md): The avcodec\_decode\_audio4 function in libavcodec/utils.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.1 allows remote attackers to trigger me (no CVSS)
- [CVE-2013-0862](https://cve.now/CVE-2013-0862.md): Multiple integer overflows in the process\_frame\_obj function in libavcodec/sanm.c in FFmpeg before 1.1.2 allow remote attackers to have an u (no CVSS)
- [CVE-2013-0863](https://cve.now/CVE-2013-0863.md): Buffer overflow in the rle\_decode function in libavcodec/sanm.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.2 allows remote attackers to hav (no CVSS)
- [CVE-2013-0864](https://cve.now/CVE-2013-0864.md): The gif\_copy\_img\_rect function in libavcodec/gifdec.c in FFmpeg before 1.1.2 performs an incorrect calculation for an "end pointer," which a (no CVSS)
- [CVE-2013-0865](https://cve.now/CVE-2013-0865.md): The vqa\_decode\_chunk function in libavcodec/vqavideo.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.2 allows remote attackers to have an unsp (no CVSS)
- [CVE-2013-0866](https://cve.now/CVE-2013-0866.md): The aac\_decode\_init function in libavcodec/aacdec.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.2 allows remote attackers to have an unspeci (no CVSS)
- [CVE-2013-0867](https://cve.now/CVE-2013-0867.md): The decode\_slice\_header function in libavcodec/h264.c in FFmpeg before 1.1.2 does not properly check when the pixel format changes, which al (no CVSS)
- [CVE-2013-0868](https://cve.now/CVE-2013-0868.md): libavcodec/huffyuvdec.c in FFmpeg before 1.1.2 allows remote attackers to have an unspecified impact via crafted Huffyuv data, related to an (no CVSS)
- [CVE-2013-0869](https://cve.now/CVE-2013-0869.md): The field\_end function in libavcodec/h264.c in FFmpeg before 1.1.2 allows remote attackers to have an unspecified impact via crafted H.264 d (no CVSS)
- [CVE-2013-1058](https://cve.now/CVE-2013-1058.md): maas-import-pxe-files in MAAS before 13.10 does not verify the integrity of downloaded files, which allows remote attackers to modify these (no CVSS)
- [CVE-2013-2561](https://cve.now/CVE-2013-2561.md): OpenFabrics ibutils 1.5.7 allows local users to overwrite arbitrary files via a symlink attack on (1) ibdiagnet.db, (2) ibdiagnet.fdbs, (3) (no CVSS)
- [CVE-2013-4459](https://cve.now/CVE-2013-4459.md): LightDM 1.7.5 through 1.8.3 and 1.9.x before 1.9.2 does not apply the AppArmor profile to the Guest account, which allows local users to byp (no CVSS)
- [CVE-2013-4547](https://cve.now/CVE-2013-4547.md): nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescaped space character i (no CVSS)
- [CVE-2013-6384](https://cve.now/CVE-2013-6384.md): (1) impl\_db2.py and (2) impl\_mongodb.py in OpenStack Ceilometer 2013.2 and earlier, when the logging level is set to INFO, logs the connecti (no CVSS)
- [CVE-2013-6859](https://cve.now/CVE-2013-6859.md): SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3. (no CVSS)
- [CVE-2013-6860](https://cve.now/CVE-2013-6860.md): Unspecified vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15 (no CVSS)
- [CVE-2013-6861](https://cve.now/CVE-2013-6861.md): Unspecified vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 be (no CVSS)
- [CVE-2013-6862](https://cve.now/CVE-2013-6862.md): Unspecified vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15 (no CVSS)
- [CVE-2013-6863](https://cve.now/CVE-2013-6863.md): SAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 (no CVSS)
- [CVE-2013-6864](https://cve.now/CVE-2013-6864.md): Directory traversal vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and (no CVSS)
- [CVE-2013-6865](https://cve.now/CVE-2013-6865.md): SAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 (no CVSS)
- [CVE-2013-6866](https://cve.now/CVE-2013-6866.md): SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows (no CVSS)
- [CVE-2013-6867](https://cve.now/CVE-2013-6867.md): Unspecified vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) 15.7 before 15.7 SP50 or 15.7 SP100 allows remote attackers to caus (no CVSS)
- [CVE-2013-6868](https://cve.now/CVE-2013-6868.md): SAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 (no CVSS)
- [CVE-2013-0872](https://cve.now/CVE-2013-0872.md): The swr\_init function in libswresample/swresample.c in FFmpeg before 1.1.3 allows remote attackers to have an unspecified impact via an inva (no CVSS)
- [CVE-2013-0873](https://cve.now/CVE-2013-0873.md): The read\_header function in libavcodec/shorten.c in FFmpeg before 1.1.3 allows remote attackers to have an unspecified impact via an invalid (no CVSS)
- [CVE-2013-0874](https://cve.now/CVE-2013-0874.md): The (1) doubles2str and (2) shorts2str functions in libavcodec/tiff.c in FFmpeg before 1.1.3 allow remote attackers to have an unspecified i (no CVSS)
- [CVE-2013-0875](https://cve.now/CVE-2013-0875.md): The ff\_add\_png\_paeth\_prediction function in libavcodec/pngdec.c in FFmpeg before 1.1.3 allows remote attackers to have an unspecified impact (no CVSS)
- [CVE-2013-0876](https://cve.now/CVE-2013-0876.md): Multiple integer overflows in the (1) old\_codec37 and (2) old\_codec47 functions in libavcodec/sanm.c in FFmpeg before 1.1.3 allow remote att (no CVSS)
- [CVE-2013-0877](https://cve.now/CVE-2013-0877.md): The old\_codec37 function in libavcodec/sanm.c in FFmpeg before 1.1.3 allows remote attackers to have an unspecified impact via crafted Lucas (no CVSS)
- [CVE-2013-0878](https://cve.now/CVE-2013-0878.md): The advance\_line function in libavcodec/targa.c in FFmpeg before 1.1.3 allows remote attackers to have an unspecified impact via crafted Tar (no CVSS)
- [CVE-2013-2029](https://cve.now/CVE-2013-2029.md): nagios.upgrade\_to\_v3.sh, as distributed by Red Hat and possibly others for Nagios Core 3.4.4, 3.5.1, and earlier, allows local users to over (no CVSS)
- [CVE-2013-4214](https://cve.now/CVE-2013-4214.md): rss-newsfeed.php in Nagios Core 3.4.4, 3.5.1, and earlier, when MAGPIE\_CACHE\_ON is set to 1, allows local users to overwrite arbitrary files (no CVSS)
- [CVE-2013-4263](https://cve.now/CVE-2013-4263.md): libavfilter in FFmpeg before 2.0.1 has unspecified impact and remote vectors related to a crafted "plane," which triggers an out-of-bounds h (no CVSS)
- [CVE-2013-4264](https://cve.now/CVE-2013-4264.md): The kempf\_decode\_tile function in libavcodec/g2meet.c in FFmpeg before 2.0.1 allows remote attackers to cause a denial of service (out-of-bo (no CVSS)
- [CVE-2013-4265](https://cve.now/CVE-2013-4265.md): The av\_reallocp\_array function in libavutil/mem.c in FFmpeg before 2.0.1 has an unspecified impact and remote vectors related to a "wrong re (no CVSS)
- [CVE-2013-4354](https://cve.now/CVE-2013-4354.md): The API before 2.1 in OpenStack Image Registry and Delivery Service (Glance) makes it easier for local users to inject images into arbitrary (no CVSS)
- [CVE-2013-6858](https://cve.now/CVE-2013-6858.md): Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard (Horizon) 2013.2 and earlier allow local users to inject arbitrar (no CVSS)
- [CVE-2010-3443](https://cve.now/CVE-2010-3443.md): ctcphandler.cpp in Quassel before 0.6.3 and 0.7.x before 0.7.1 allows remote attackers to cause a denial of service (unresponsive IRC) via m (no CVSS)
- [CVE-2013-0281](https://cve.now/CVE-2013-0281.md): Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management is enabled, does not limit the duration of (no CVSS)
- [CVE-2013-1813](https://cve.now/CVE-2013-1813.md): util-linux/mdev.c in BusyBox before 1.21.0 uses 0777 permissions for parent directories when creating nested directories under /dev/, which (no CVSS)
- [CVE-2013-4473](https://cve.now/CVE-2013-4473.md): Stack-based buffer overflow in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.2 allows remote attackers to cause a (no CVSS)
- [CVE-2013-4474](https://cve.now/CVE-2013-4474.md): Format string vulnerability in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.3 allows remote attackers to cause a (no CVSS)
- [CVE-2013-4481](https://cve.now/CVE-2013-4481.md): Race condition in Luci 0.26.0 creates /var/lib/luci/etc/luci.ini with world-readable permissions before restricting the permissions, which a (no CVSS)
- [CVE-2013-4482](https://cve.now/CVE-2013-4482.md): Untrusted search path vulnerability in python-paste-script (aka paster) in Luci 0.26.0, when started using the initscript, allows local user (no CVSS)
- [CVE-2013-4485](https://cve.now/CVE-2013-4485.md): 389 Directory Server 1.2.11.15 (aka Red Hat Directory Server before 8.2.11-14) allows remote authenticated users to cause a denial of servic (no CVSS)
- [CVE-2013-4545](https://cve.now/CVE-2013-4545.md): cURL and libcurl 7.18.0 through 7.32.0, when built with OpenSSL, disables the certificate CN and SAN name field verification (CURLOPT\_SSL\_VE (no CVSS)
- [CVE-2013-4589](https://cve.now/CVE-2013-4589.md): The ExportAlphaQuantumType function in export.c in GraphicsMagick before 1.3.18 might allow remote attackers to cause a denial of service (c (no CVSS)
- [CVE-2013-6375](https://cve.now/CVE-2013-6375.md): Xen 4.2.x and 4.3.x, when using Intel VT-d for PCI passthrough, does not properly flush the TLB after clearing a present translation table e (no CVSS)
- [CVE-2013-4407](https://cve.now/CVE-2013-4407.md): HTTP::Body::Multipart in the HTTP-Body module for Perl (1.07 through 1.22, before 1.23) uses the part of the uploaded file's name after the (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2013-11-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.