# CVEs published 2014-02-06

48 CVEs were published on February 6, 2014: 0 critical, 1 high. Days are UTC.

- [CVE-2013-2962](https://cve.now/CVE-2013-2962.md): Buffer overflow in the Launcher in IBM WebSphere Transformation Extender 8.4.x before 8.4.0.4 allows local users to cause a denial of servic (no CVSS)
- [CVE-2013-6332](https://cve.now/CVE-2013-6332.md): Unrestricted file upload vulnerability in IBM Algo One UDS 4.7.0 through 5.0.0 allows remote authenticated users to execute arbitrary code b (no CVSS)
- [CVE-2014-0330](https://cve.now/CVE-2014-0330.md): Cross-site scripting (XSS) vulnerability in adminui/user\_list.php on the Dell KACE K1000 management appliance 5.5.90545 allows remote attack (no CVSS)
- [CVE-2014-0822](https://cve.now/CVE-2014-0822.md): The IMAP server in IBM Domino 8.5.x before 8.5.3 FP6 IF1 and 9.0.x before 9.0.1 FP1 allows remote attackers to cause a denial of service (da (no CVSS)
- [CVE-2014-1870](https://cve.now/CVE-2014-1870.md): Opera before 19 on Mac OS X allows user-assisted remote attackers to spoof the address bar via vectors involving a drag-and-drop operation. (no CVSS)
- [CVE-2013-6393](https://cve.now/CVE-2013-6393.md): The yaml\_parser\_scan\_tag\_uri function in scanner.c in LibYAML before 0.1.5 performs an incorrect cast, which allows remote attackers to caus (no CVSS, libyaml)
- [CVE-2014-0038](https://cve.now/CVE-2014-0038.md): The compat\_sys\_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG\_X86\_X32 is enabled, allows local users to ga (no CVSS)
- [CVE-2014-0622](https://cve.now/CVE-2014-0622.md): The web service in EMC Documentum Foundation Services (DFS) 6.5 through 6.7 before 6.7 SP1 P22, 6.7 SP2 before P08, 7.0 before P12, and 7.1 (no CVSS)
- [CVE-2014-0815](https://cve.now/CVE-2014-0815.md): The intent: URL implementation in Opera before 18 on Android allows attackers to read local files by leveraging an interaction error, as dem (no CVSS)
- [CVE-2010-4226](https://cve.now/CVE-2010-4226.md): cpio, as used in build 2007.05.10, 2010.07.28, and possibly other versions, allows remote attackers to overwrite arbitrary files via a symli (CVSS 7.2)
- [CVE-2012-1095](https://cve.now/CVE-2012-1095.md): osc before 0.134 might allow remote OBS repository servers or package maintainers to execute arbitrary commands via a crafted (1) build log (no CVSS)
- [CVE-2013-2038](https://cve.now/CVE-2013-2038.md): The NMEA0183 driver in gpsd before 3.9 allows remote attackers to cause a denial of service (daemon termination) and possibly execute arbitr (no CVSS)
- [CVE-2013-6481](https://cve.now/CVE-2013-6481.md): libpurple/protocols/yahoo/libymsg.c in Pidgin before 2.10.8 allows remote attackers to cause a denial of service (crash) via a Yahoo! P2P me (no CVSS)
- [CVE-2013-6482](https://cve.now/CVE-2013-6482.md): Pidgin before 2.10.8 allows remote MSN servers to cause a denial of service (NULL pointer dereference and crash) via a crafted (1) SOAP resp (no CVSS)
- [CVE-2013-6487](https://cve.now/CVE-2013-6487.md): Integer overflow in libpurple/protocols/gg/lib/http.c in the Gadu-Gadu (gg) parser in Pidgin before 2.10.8 allows remote attackers to have a (no CVSS)
- [CVE-2013-6489](https://cve.now/CVE-2013-6489.md): Integer signedness error in the MXit functionality in Pidgin before 2.10.8 allows remote attackers to cause a denial of service (segmentatio (no CVSS)
- [CVE-2013-6490](https://cve.now/CVE-2013-6490.md): The SIMPLE protocol functionality in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a negative Content-Lengt (no CVSS)
- [CVE-2013-7130](https://cve.now/CVE-2013-7130.md): The i\_create\_images\_and\_backing (aka create\_images\_and\_backing) method in libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and Ic (no CVSS, nova)
- [CVE-2014-1663](https://cve.now/CVE-2014-1663.md): Unspecified vulnerability in Citrix XenMobile Device Manager server (formerly Zenprise Device Manager server) 8.5, 8.6, and MDM 8.0.1 allows (no CVSS)
- [CVE-2012-6152](https://cve.now/CVE-2012-6152.md): The Yahoo! protocol plugin in libpurple in Pidgin before 2.10.8 does not properly validate UTF-8 data, which allows remote attackers to caus (no CVSS)
- [CVE-2013-5983](https://cve.now/CVE-2013-5983.md): Multiple cross-site scripting (XSS) vulnerabilities in GuppY before 4.6.28 allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2013-6477](https://cve.now/CVE-2013-6477.md): Multiple integer signedness errors in libpurple in Pidgin before 2.10.8 allow remote attackers to cause a denial of service (application cra (no CVSS)
- [CVE-2013-6478](https://cve.now/CVE-2013-6478.md): gtkimhtml.c in Pidgin before 2.10.8 does not properly interact with underlying library support for wide Pango layouts, which allows user-ass (no CVSS)
- [CVE-2013-6479](https://cve.now/CVE-2013-6479.md): util.c in libpurple in Pidgin before 2.10.8 does not properly allocate memory for HTTP responses that are inconsistent with the Content-Leng (no CVSS)
- [CVE-2013-6483](https://cve.now/CVE-2013-6483.md): The XMPP protocol plugin in libpurple in Pidgin before 2.10.8 does not properly determine whether the from address in an iq reply is consist (no CVSS)
- [CVE-2013-6484](https://cve.now/CVE-2013-6484.md): The STUN protocol implementation in libpurple in Pidgin before 2.10.8 allows remote STUN servers to cause a denial of service (out-of-bounds (no CVSS)
- [CVE-2013-6485](https://cve.now/CVE-2013-6485.md): Buffer overflow in util.c in libpurple in Pidgin before 2.10.8 allows remote HTTP servers to cause a denial of service (application crash) o (no CVSS)
- [CVE-2013-6486](https://cve.now/CVE-2013-6486.md): gtkutils.c in Pidgin before 2.10.8 on Windows allows user-assisted remote attackers to execute arbitrary programs via a message containing a (no CVSS)
- [CVE-2013-7319](https://cve.now/CVE-2013-7319.md): Cross-site scripting (XSS) vulnerability in the Download Manager plugin before 2.5.9 for WordPress allows remote attackers to inject arbitra (no CVSS)
- [CVE-2013-7320](https://cve.now/CVE-2013-7320.md): Cross-site request forgery (CSRF) vulnerability in D-Link DAP-2253 Access Point (Rev. (no CVSS)
- [CVE-2013-7321](https://cve.now/CVE-2013-7321.md): Cross-site scripting (XSS) vulnerability in D-Link DAP-2253 Access Point (Rev. (no CVSS)
- [CVE-2014-0020](https://cve.now/CVE-2014-0020.md): The IRC protocol plugin in libpurple in Pidgin before 2.10.8 does not validate argument counts, which allows remote IRC servers to cause a d (no CVSS)
- [CVE-2013-4463](https://cve.now/CVE-2013-4463.md): OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly verify the virtual size of a QCOW2 image, which allows local users to (no CVSS, nova)
- [CVE-2014-1477](https://cve.now/CVE-2014-1477.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before (no CVSS)
- [CVE-2014-1478](https://cve.now/CVE-2014-1478.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allow remote attackers t (no CVSS)
- [CVE-2014-1479](https://cve.now/CVE-2014-1479.md): The System Only Wrapper (SOW) implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaM (no CVSS)
- [CVE-2014-1480](https://cve.now/CVE-2014-1480.md): The file-download implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 does not properly restrict the timing of button se (no CVSS)
- [CVE-2014-1481](https://cve.now/CVE-2014-1481.md): Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow remote attackers to bypa (no CVSS)
- [CVE-2014-1482](https://cve.now/CVE-2014-1482.md): RasterImage.cpp in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not pr (no CVSS)
- [CVE-2014-1483](https://cve.now/CVE-2014-1483.md): Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allow remote attackers to bypass the Same Origin Policy and obtain sensitive informati (no CVSS)
- [CVE-2014-1484](https://cve.now/CVE-2014-1484.md): Mozilla Firefox before 27.0 on Android 4.2 and earlier creates system-log entries containing profile paths, which allows attackers to obtain (no CVSS)
- [CVE-2014-1485](https://cve.now/CVE-2014-1485.md): The Content Security Policy (CSP) implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 operates on XSLT stylesheets accor (no CVSS)
- [CVE-2014-1486](https://cve.now/CVE-2014-1486.md): Use-after-free vulnerability in the imgRequestProxy function in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird befor (no CVSS)
- [CVE-2014-1487](https://cve.now/CVE-2014-1487.md): The Web workers implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2 (no CVSS)
- [CVE-2014-1488](https://cve.now/CVE-2014-1488.md): The Web workers implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allows remote attackers to execute arbitrary code vi (no CVSS)
- [CVE-2014-1489](https://cve.now/CVE-2014-1489.md): Mozilla Firefox before 27.0 does not properly restrict access to about:home buttons by script on other pages, which allows user-assisted rem (no CVSS)
- [CVE-2014-1490](https://cve.now/CVE-2014-1490.md): Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x (no CVSS)
- [CVE-2014-1491](https://cve.now/CVE-2014-1491.md): Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird bef (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-02-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.