# CVEs published 2014-01-07

12 CVEs were published on January 7, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2011-1166](https://cve.now/CVE-2011-1166.md): Xen, possibly before 4.0.2, allows local 64-bit PV guests to cause a denial of service (host crash) by specifying user mode execution withou (no CVSS)
- [CVE-2011-1763](https://cve.now/CVE-2011-1763.md): The get\_free\_port function in Xen allows local authenticated DomU users to cause a denial of service or possibly gain privileges via unspeci (no CVSS)
- [CVE-2011-1780](https://cve.now/CVE-2011-1780.md): The instruction emulation in Xen 3.0.3 allows local SMP guest users to cause a denial of service (host crash) by replacing the instruction t (no CVSS)
- [CVE-2011-1936](https://cve.now/CVE-2011-1936.md): Xen, when using x86 Intel processors and the VMX virtualization extension is enabled, does not properly handle cpuid instruction emulation w (no CVSS)
- [CVE-2013-6436](https://cve.now/CVE-2013-6436.md): The lxcDomainGetMemoryParameters method in lxc/lxc\_driver.c in libvirt 1.0.5 through 1.2.0 does not properly check the status of LXC guests (no CVSS)
- [CVE-2013-4969](https://cve.now/CVE-2013-4969.md): Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitr (no CVSS)
- [CVE-2013-6419](https://cve.now/CVE-2013-6419.md): Interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1 does not validate the instance ID of the tenant making (no CVSS, nova)
- [CVE-2013-6480](https://cve.now/CVE-2013-6480.md): Libcloud 0.12.3 through 0.13.2 does not set the scrub\_data parameter for the destroy DigitalOcean API, which allows local users to obtain se (no CVSS, apache-libcloud)
- [CVE-2013-4564](https://cve.now/CVE-2013-4564.md): Libreswan 3.6 allows remote attackers to cause a denial of service (crash) via a small length value and (1) no version or (2) an invalid maj (no CVSS)
- [CVE-2013-6881](https://cve.now/CVE-2013-6881.md): CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allows remote attackers to execute arbitrary commands via shell metacharacte (no CVSS)
- [CVE-2013-6884](https://cve.now/CVE-2013-6884.md): The write-blocker in CRU Ditto Forensic FieldStation with firmware before 2013Oct15a has a default "ditto" username and password, which allo (no CVSS)
- [CVE-2013-6888](https://cve.now/CVE-2013-6888.md): Uscan in devscripts before 2.13.9 allows remote attackers to execute arbitrary code via a crafted tarball. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-01-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.