# CVEs published 2013-12-07

53 CVEs were published on December 7, 2013: 0 critical, 0 high. Days are UTC.

- [CVE-2012-6612](https://cve.now/CVE-2012-6612.md): The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before 4.1 allows remote attackers to have an unspecified i (no CVSS, org.apache.solr:solr-core)
- [CVE-2013-0844](https://cve.now/CVE-2013-0844.md): Off-by-one error in the adpcm\_decode\_frame function in libavcodec/adpcm.c in FFmpeg before 1.0.4 allows remote attackers to have an unspecif (no CVSS)
- [CVE-2013-0845](https://cve.now/CVE-2013-0845.md): libavcodec/alsdec.c in FFmpeg before 1.0.4 allows remote attackers to have an unspecified impact via a crafted block length, which triggers (no CVSS)
- [CVE-2013-0846](https://cve.now/CVE-2013-0846.md): Array index error in the qdm2\_decode\_super\_block function in libavcodec/qdm2.c in FFmpeg before 1.1 allows remote attackers to have an unspe (no CVSS)
- [CVE-2013-0847](https://cve.now/CVE-2013-0847.md): The ff\_id3v2\_parse function in libavformat/id3v2.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via ID3v2 head (no CVSS)
- [CVE-2013-0848](https://cve.now/CVE-2013-0848.md): The decode\_init function in libavcodec/huffyuv.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a crafted wi (no CVSS)
- [CVE-2013-0849](https://cve.now/CVE-2013-0849.md): The roq\_decode\_init function in libavcodec/roqvideodec.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a cr (no CVSS)
- [CVE-2013-0850](https://cve.now/CVE-2013-0850.md): The decode\_slice\_header function in libavcodec/h264.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted (no CVSS)
- [CVE-2013-0851](https://cve.now/CVE-2013-0851.md): The decode\_frame function in libavcodec/eamad.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted Elect (no CVSS)
- [CVE-2013-0852](https://cve.now/CVE-2013-0852.md): The parse\_picture\_segment function in libavcodec/pgssubdec.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via (no CVSS)
- [CVE-2013-0853](https://cve.now/CVE-2013-0853.md): The wavpack\_decode\_frame function in libavcodec/wavpack.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via cra (no CVSS)
- [CVE-2013-0854](https://cve.now/CVE-2013-0854.md): The mjpeg\_decode\_scan\_progressive\_ac function in libavcodec/mjpegdec.c in FFmpeg before 1.1 allows remote attackers to have an unspecified i (no CVSS)
- [CVE-2013-0855](https://cve.now/CVE-2013-0855.md): Integer overflow in the alac\_decode\_close function in libavcodec/alac.c in FFmpeg before 1.1 allows remote attackers to have an unspecified (no CVSS)
- [CVE-2013-0856](https://cve.now/CVE-2013-0856.md): The lpc\_prediction function in libavcodec/alac.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted Appl (no CVSS)
- [CVE-2013-0857](https://cve.now/CVE-2013-0857.md): The decode\_frame\_ilbm function in libavcodec/iff.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a crafted (no CVSS)
- [CVE-2013-0858](https://cve.now/CVE-2013-0858.md): The atrac3\_decode\_init function in libavcodec/atrac3.c in FFmpeg before 1.0.4 allows remote attackers to have an unspecified impact via ATRA (no CVSS)
- [CVE-2013-0859](https://cve.now/CVE-2013-0859.md): The add\_doubles\_metadata function in libavcodec/tiff.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a nega (no CVSS)
- [CVE-2013-6385](https://cve.now/CVE-2013-6385.md): The form API in Drupal 6.x before 6.29 and 7.x before 7.24, when used with unspecified third-party modules, performs form validation even wh (no CVSS)
- [CVE-2013-6386](https://cve.now/CVE-2013-6386.md): Drupal 6.x before 6.29 and 7.x before 7.24 uses the PHP mt\_rand function to generate random numbers, which uses predictable seeds and allows (no CVSS)
- [CVE-2013-6389](https://cve.now/CVE-2013-6389.md): Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.24 allows remote attackers to redirect users to arbitrary web sites (no CVSS, drupal/drupal)
- [CVE-2013-7000](https://cve.now/CVE-2013-7000.md): The Multimedia Messaging Centre (MMSC) in NowSMS Now SMS & MMS Gateway 2013.09.26 allows remote attackers to cause a denial of service via a (no CVSS)
- [CVE-2013-7001](https://cve.now/CVE-2013-7001.md): The Multimedia Messaging Centre (MMSC) in NowSMS Now SMS & MMS Gateway before 2013.11.15 allows remote attackers to cause a denial of servic (no CVSS)
- [CVE-2013-4171](https://cve.now/CVE-2013-4171.md): Multiple cross-site scripting (XSS) vulnerabilities in Apache Roller before 5.0.2 allow remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2013-4212](https://cve.now/CVE-2013-4212.md): Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expre (no CVSS)
- [CVE-2013-4445](https://cve.now/CVE-2013-4445.md): The json rendering functionality in the Context module 6.x-2.x before 6.x-3.2 and 7.x-3.x before 7.x-3.0 for Drupal uses Drupal's token sche (no CVSS)
- [CVE-2013-4446](https://cve.now/CVE-2013-4446.md): The \_json\_decode function in plugins/context\_reaction\_block.inc in the Context module 6.x-2.x before 6.x-3.2 and 7.x-3.x before 7.x-3.0 for (no CVSS)
- [CVE-2013-4478](https://cve.now/CVE-2013-4478.md): Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the filenam (no CVSS, sup)
- [CVE-2013-4479](https://cve.now/CVE-2013-4479.md): lib/sup/message\_chunks.rb in Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell (no CVSS, sup)
- [CVE-2013-4505](https://cve.now/CVE-2013-4505.md): The is\_this\_legal function in mod\_dontdothat for Apache Subversion 1.4.0 through 1.7.13 and 1.8.0 through 1.8.4 allows remote attackers to b (no CVSS)
- [CVE-2013-4558](https://cve.now/CVE-2013-4558.md): The get\_parent\_resource function in repos.c in mod\_dav\_svn Apache HTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1 through (no CVSS)
- [CVE-2013-6050](https://cve.now/CVE-2013-6050.md): Integer overflow in Links before 2.8 allows remote attackers to cause a denial of service (crash) via crafted HTML tables. (no CVSS)
- [CVE-2013-6397](https://cve.now/CVE-2013-6397.md): Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (no CVSS, org.apache.solr:solr-core)
- [CVE-2013-6407](https://cve.now/CVE-2013-6407.md): The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an (no CVSS, org.apache.solr:solr-core)
- [CVE-2013-6408](https://cve.now/CVE-2013-6408.md): The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers (no CVSS, org.apache.solr:solr-core)
- [CVE-2013-6409](https://cve.now/CVE-2013-6409.md): Debian adequate before 0.8.1, when run by root with the --user option, allows local users to hijack the tty and possibly gain privileges via (no CVSS)
- [CVE-2013-6410](https://cve.now/CVE-2013-6410.md): nbd-server in Network Block Device (nbd) before 3.5 does not properly check IP addresses, which might allow remote attackers to bypass inten (no CVSS)
- [CVE-2013-5455](https://cve.now/CVE-2013-5455.md): IBM SmartCloud Provisioning 2.1 before FP3 IF0001 allows remote authenticated users to modify virtual-system deployment via deployer.virtual (no CVSS)
- [CVE-2013-6707](https://cve.now/CVE-2013-6707.md): Memory leak in the connection-manager implementation in Cisco Adaptive Security Appliance (ASA) Software 9.1(.3) and earlier allows remote a (no CVSS)
- [CVE-2013-6999](https://cve.now/CVE-2013-6999.md): The IsHandleEntrySecure function in win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2008 SP2 does not properly validate th (no CVSS)
- [CVE-2013-4491](https://cve.now/CVE-2013-4491.md): Cross-site scripting (XSS) vulnerability in actionpack/lib/action\_view/helpers/translation\_helper.rb in the internationalization component i (no CVSS, actionpack)
- [CVE-2013-4492](https://cve.now/CVE-2013-4492.md): Cross-site scripting (XSS) vulnerability in exceptions.rb in the i18n gem before 0.6.6 for Ruby allows remote attackers to inject arbitrary (no CVSS, i18n)
- [CVE-2013-6414](https://cve.now/CVE-2013-6414.md): actionpack/lib/action\_view/lookup\_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers (no CVSS, actionpack)
- [CVE-2013-6415](https://cve.now/CVE-2013-6415.md): Cross-site scripting (XSS) vulnerability in the number\_to\_currency helper in actionpack/lib/action\_view/helpers/number\_helper.rb in Ruby on (no CVSS, actionpack)
- [CVE-2013-6416](https://cve.now/CVE-2013-6416.md): Cross-site scripting (XSS) vulnerability in the simple\_format helper in actionpack/lib/action\_view/helpers/text\_helper.rb in Ruby on Rails 4 (no CVSS, actionpack)
- [CVE-2013-6417](https://cve.now/CVE-2013-6417.md): actionpack/lib/action\_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in (no CVSS, actionpack)
- [CVE-2013-6634](https://cve.now/CVE-2013-6634.md): The OneClickSigninHelper::ShowInfoBarIfPossible function in browser/ui/sync/one\_click\_signin\_helper.cc in Google Chrome before 31.0.1650.63 (no CVSS)
- [CVE-2013-6635](https://cve.now/CVE-2013-6635.md): Use-after-free vulnerability in the editing implementation in Blink, as used in Google Chrome before 31.0.1650.63, allows remote attackers t (no CVSS)
- [CVE-2013-6636](https://cve.now/CVE-2013-6636.md): The FrameLoader::notifyIfInitialDocumentAccessed function in core/loader/FrameLoader.cpp in Blink, as used in Google Chrome before 31.0.1650 (no CVSS)
- [CVE-2013-6637](https://cve.now/CVE-2013-6637.md): Multiple unspecified vulnerabilities in Google Chrome before 31.0.1650.63 allow attackers to cause a denial of service or possibly have othe (no CVSS)
- [CVE-2013-6638](https://cve.now/CVE-2013-6638.md): Multiple buffer overflows in runtime.cc in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allow remote attackers (no CVSS)
- [CVE-2013-6639](https://cve.now/CVE-2013-6639.md): The DehoistArrayIndex function in hydrogen-dehoist.cc (aka hydrogen.cc) in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0. (no CVSS)
- [CVE-2013-6640](https://cve.now/CVE-2013-6640.md): The DehoistArrayIndex function in hydrogen-dehoist.cc (aka hydrogen.cc) in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0. (no CVSS)
- [CVE-2013-6920](https://cve.now/CVE-2013-6920.md): Siemens SINAMICS S/G controllers with firmware before 4.6.11 do not require authentication for FTP and TELNET sessions, which allows remote (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2013-12-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.