# CVEs published 2013-12-09

46 CVEs were published on December 9, 2013: 0 critical, 0 high. Days are UTC.

- [CVE-2013-2929](https://cve.now/CVE-2013-2929.md): The Linux kernel before 3.12.2 does not properly use the get\_dumpable function, which allows local users to bypass intended ptrace restricti (no CVSS)
- [CVE-2013-2930](https://cve.now/CVE-2013-2930.md): The perf\_trace\_event\_perm function in kernel/trace/trace\_event\_perf.c in the Linux kernel before 3.12.2 does not properly restrict access to (no CVSS)
- [CVE-2013-4270](https://cve.now/CVE-2013-4270.md): The net\_ctl\_permissions function in net/sysctl\_net.c in the Linux kernel before 3.11.5 does not properly determine uid and gid values, which (no CVSS)
- [CVE-2013-6180](https://cve.now/CVE-2013-6180.md): EMC RSA Security Analytics (SA) 10.x before 10.3, and RSA NetWitness NextGen 9.8, does not ensure that SA Core requests originate from the S (no CVSS)
- [CVE-2013-6427](https://cve.now/CVE-2013-6427.md): upgrade.py in the hp-upgrade service in HP Linux Imaging and Printing (HPLIP) 3.x through 3.13.11 launches a program from an http URL, which (no CVSS)
- [CVE-2013-6431](https://cve.now/CVE-2013-6431.md): The fib6\_add function in net/ipv6/ip6\_fib.c in the Linux kernel before 3.11.5 does not properly implement error-code encoding, which allows (no CVSS)
- [CVE-2013-6432](https://cve.now/CVE-2013-6432.md): The ping\_recvmsg function in net/ipv4/ping.c in the Linux kernel before 3.12.4 does not properly interact with read system calls on ping soc (no CVSS)
- [CVE-2013-7026](https://cve.now/CVE-2013-7026.md): Multiple race conditions in ipc/shm.c in the Linux kernel before 3.12.2 allow local users to cause a denial of service (use-after-free and s (no CVSS)
- [CVE-2013-7027](https://cve.now/CVE-2013-7027.md): The ieee80211\_radiotap\_iterator\_init function in net/wireless/radiotap.c in the Linux kernel before 3.11.7 does not check whether a frame co (no CVSS)
- [CVE-2013-3929](https://cve.now/CVE-2013-3929.md): Cross-site scripting (XSS) vulnerability in admin/editevent.php in CMS Made Simple (CMSMS) 1.11.9 allows remote authenticated users with the (no CVSS)
- [CVE-2013-5354](https://cve.now/CVE-2013-5354.md): Multiple SQL injection vulnerabilities in Sharetronix 3.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) fb\_user\_id (no CVSS)
- [CVE-2013-5355](https://cve.now/CVE-2013-5355.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Sharetronix 3.1.1 allow remote attackers to hijack the authentication of admin (no CVSS)
- [CVE-2013-6039](https://cve.now/CVE-2013-6039.md): Multiple cross-site scripting (XSS) vulnerabilities in NagiosQL 3.2 SP2 allow remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2013-6985](https://cve.now/CVE-2013-6985.md): SQL injection vulnerability in m\_worklog/log\_searchday.jsp in Enorth Webpublisher CMS, possibly 5.0 and earlier, allows remote attackers to (no CVSS)
- [CVE-2011-3934](https://cve.now/CVE-2011-3934.md): Double free vulnerability in the vp3\_update\_thread\_context function in libavcodec/vp3.c in FFmpeg before 0.10 allows remote attackers to hav (no CVSS)
- [CVE-2011-3935](https://cve.now/CVE-2011-3935.md): The codec\_get\_buffer function in ffmpeg.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via vectors related to (no CVSS)
- [CVE-2011-3941](https://cve.now/CVE-2011-3941.md): The decode\_mb function in libavcodec/error\_resilience.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via vect (no CVSS)
- [CVE-2011-3944](https://cve.now/CVE-2011-3944.md): The smacker\_decode\_header\_tree function in libavcodec/smacker.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact (no CVSS)
- [CVE-2011-3946](https://cve.now/CVE-2011-3946.md): The ff\_h264\_decode\_sei function in libavcodec/h264\_sei.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via cra (no CVSS)
- [CVE-2011-3949](https://cve.now/CVE-2011-3949.md): The dirac\_unpack\_idwt\_params function in libavcodec/diracdec.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact v (no CVSS)
- [CVE-2011-3950](https://cve.now/CVE-2011-3950.md): The dirac\_decode\_data\_unit function in libavcodec/diracdec.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via (no CVSS)
- [CVE-2011-4351](https://cve.now/CVE-2011-4351.md): Buffer overflow in FFmpeg before 0.5.6, 0.6.x before 0.6.4, 0.7.x before 0.7.8, and 0.8.x before 0.8.8 allows remote attackers to execute ar (no CVSS)
- [CVE-2013-1349](https://cve.now/CVE-2013-1349.md): Eval injection vulnerability in ajax.php in openSIS 4.5 through 5.2 allows remote attackers to execute arbitrary PHP code via the modname pa (no CVSS)
- [CVE-2013-1953](https://cve.now/CVE-2013-1953.md): Integer underflow in the input\_bmp\_reader function in input-bmp.c in AutoTrace 0.31.1 allows context-dependent attackers to have an unspecif (no CVSS)
- [CVE-2013-4376](https://cve.now/CVE-2013-4376.md): The setgid wrapper libx2go-server-db-sqlite3-wrapper.c in X2Go Server before 4.0.0.2 allows remote attackers to execute arbitrary code via u (no CVSS)
- [CVE-2013-4400](https://cve.now/CVE-2013-4400.md): virt-login-shell in libvirt 1.1.2 through 1.1.3 allows local users to overwrite arbitrary files and possibly gain privileges via unspecified (no CVSS)
- [CVE-2013-6171](https://cve.now/CVE-2013-6171.md): checkpassword-reply in Dovecot before 2.2.7 performs setuid operations to a user who is authenticating, which allows local users to bypass a (no CVSS)
- [CVE-2013-6404](https://cve.now/CVE-2013-6404.md): Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows rem (no CVSS)
- [CVE-2013-7008](https://cve.now/CVE-2013-7008.md): The decode\_slice\_header function in libavcodec/h264.c in FFmpeg before 2.1 incorrectly relies on a certain droppable field, which allows rem (no CVSS)
- [CVE-2013-7009](https://cve.now/CVE-2013-7009.md): The rpza\_decode\_stream function in libavcodec/rpza.c in FFmpeg before 2.1 does not properly maintain a pointer to pixel data, which allows r (no CVSS)
- [CVE-2013-7010](https://cve.now/CVE-2013-7010.md): Multiple integer signedness errors in libavcodec/dsputil.c in FFmpeg before 2.1 allow remote attackers to cause a denial of service (out-of- (no CVSS)
- [CVE-2013-7011](https://cve.now/CVE-2013-7011.md): The read\_header function in libavcodec/ffv1dec.c in FFmpeg before 2.1 does not prevent changes to global parameters, which allows remote att (no CVSS)
- [CVE-2013-7012](https://cve.now/CVE-2013-7012.md): The get\_siz function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not prevent attempts to use non-zero image offsets, which allows (no CVSS)
- [CVE-2013-7013](https://cve.now/CVE-2013-7013.md): The g2m\_init\_buffers function in libavcodec/g2meet.c in FFmpeg before 2.1 uses an incorrect ordering of arithmetic operations, which allows (no CVSS)
- [CVE-2013-7014](https://cve.now/CVE-2013-7014.md): Integer signedness error in the add\_bytes\_l2\_c function in libavcodec/pngdsp.c in FFmpeg before 2.1 allows remote attackers to cause a denia (no CVSS)
- [CVE-2013-7015](https://cve.now/CVE-2013-7015.md): The flashsv\_decode\_frame function in libavcodec/flashsv.c in FFmpeg before 2.1 does not properly validate a certain height value, which allo (no CVSS)
- [CVE-2013-7016](https://cve.now/CVE-2013-7016.md): The get\_siz function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not ensure the expected sample separation, which allows remote at (no CVSS)
- [CVE-2013-7017](https://cve.now/CVE-2013-7017.md): libavcodec/jpeg2000.c in FFmpeg before 2.1 allows remote attackers to cause a denial of service (invalid pointer dereference) or possibly ha (no CVSS)
- [CVE-2013-7018](https://cve.now/CVE-2013-7018.md): libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not ensure the use of valid code-block dimension values, which allows remote attackers to (no CVSS)
- [CVE-2013-7019](https://cve.now/CVE-2013-7019.md): The get\_cox function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not properly validate the reduction factor, which allows remote a (no CVSS)
- [CVE-2013-7020](https://cve.now/CVE-2013-7020.md): The read\_header function in libavcodec/ffv1dec.c in FFmpeg before 2.1 does not properly enforce certain bit-count and colorspace constraints (no CVSS)
- [CVE-2013-7021](https://cve.now/CVE-2013-7021.md): The filter\_frame function in libavfilter/vf\_fps.c in FFmpeg before 2.1 does not properly ensure the availability of FIFO content, which allo (no CVSS)
- [CVE-2013-7022](https://cve.now/CVE-2013-7022.md): The g2m\_init\_buffers function in libavcodec/g2meet.c in FFmpeg before 2.1 does not properly allocate memory for tiles, which allows remote a (no CVSS)
- [CVE-2013-7023](https://cve.now/CVE-2013-7023.md): The ff\_combine\_frame function in libavcodec/parser.c in FFmpeg before 2.1 does not properly handle certain memory-allocation errors, which a (no CVSS)
- [CVE-2013-7024](https://cve.now/CVE-2013-7024.md): The jpeg2000\_decode\_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not consider the component number in certain calcula (no CVSS)
- [CVE-2013-7025](https://cve.now/CVE-2013-7025.md): Multiple cross-site scripting (XSS) vulnerabilities in ematStaticAlertTypes.jsp in the Alert Settings section in Dell SonicWALL Global Manag (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2013-12-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.