cvelistv5 - cve-2010-0734

CVE-2010-0734 (GCVE-0-2010-0734)

Vulnerability from cvelistv5

Published

2010-03-19 19:00

Modified

2024-08-07 00:59

Severity ?

CWE

Summary

content_encoding.c in libcurl 7.10.5 through 7.19.7, when zlib is enabled, does not properly restrict the amount of callback data sent to an application that requests automatic decompression, which might allow remote attackers to cause a denial of service (application crash) or have unspecified other impact by sending crafted compressed data to an application that relies on the intended data-length limit.

References

URL

Tags

	http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html	vendor-advisory, x_refsource_APPLE
	http://www.vupen.com/english/advisories/2010/0571	vdb-entry, x_refsource_VUPEN
	http://www.vupen.com/english/advisories/2010/0602	vdb-entry, x_refsource_VUPEN
	http://www.securityfocus.com/archive/1/514490/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://secunia.com/advisories/38843	third-party-advisory, x_refsource_SECUNIA
	http://www.openwall.com/lists/oss-security/2010/03/09/1	mailing-list, x_refsource_MLIST
	http://secunia.com/advisories/38981	third-party-advisory, x_refsource_SECUNIA
	http://www.vupen.com/english/advisories/2010/1481	vdb-entry, x_refsource_VUPEN
	http://www.ubuntu.com/usn/USN-1158-1	vendor-advisory, x_refsource_UBUNTU
	http://curl.haxx.se/docs/adv_20100209.html	x_refsource_CONFIRM
	http://www.vupen.com/english/advisories/2010/0725	vdb-entry, x_refsource_VUPEN
	http://www.debian.org/security/2010/dsa-2023	vendor-advisory, x_refsource_DEBIAN
	http://www.redhat.com/support/errata/RHSA-2010-0329.html	vendor-advisory, x_refsource_REDHAT
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10760	vdb-entry, signature, x_refsource_OVAL
	http://support.apple.com/kb/HT4188	x_refsource_CONFIRM
	https://bugzilla.redhat.com/show_bug.cgi?id=563220	x_refsource_CONFIRM
	http://www.mandriva.com/security/advisories?name=MDVSA-2010:062	vendor-advisory, x_refsource_MANDRIVA
	http://secunia.com/advisories/40220	third-party-advisory, x_refsource_SECUNIA
	http://security.gentoo.org/glsa/glsa-201203-02.xml	vendor-advisory, x_refsource_GENTOO
	http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037143.html	vendor-advisory, x_refsource_FEDORA
	http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036744.html	vendor-advisory, x_refsource_FEDORA
	http://secunia.com/advisories/48256	third-party-advisory, x_refsource_SECUNIA
	http://support.avaya.com/css/P8/documents/100081819	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2010/03/16/11	mailing-list, x_refsource_MLIST
	http://secunia.com/advisories/39087	third-party-advisory, x_refsource_SECUNIA
	http://www.vmware.com/security/advisories/VMSA-2011-0003.html	x_refsource_CONFIRM
	http://secunia.com/advisories/45047	third-party-advisory, x_refsource_SECUNIA
	http://wiki.rpath.com/Advisories:rPSA-2010-0072	x_refsource_CONFIRM
	http://curl.haxx.se/libcurl-contentencoding.patch	x_refsource_CONFIRM
	http://www.securityfocus.com/archive/1/516397/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6756	vdb-entry, signature, x_refsource_OVAL
	http://secunia.com/advisories/39734	third-party-advisory, x_refsource_SECUNIA
	http://curl.haxx.se/docs/security.html#20100209	x_refsource_CONFIRM
	http://www.vupen.com/english/advisories/2010/0660	vdb-entry, x_refsource_VUPEN
	http://www.openwall.com/lists/oss-security/2010/02/09/5	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T00:59:39.012Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "APPLE-SA-2010-06-15-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html"
          },
          {
            "name": "ADV-2010-0571",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2010/0571"
          },
          {
            "name": "ADV-2010-0602",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2010/0602"
          },
          {
            "name": "20101027 rPSA-2010-0072-1 curl",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/514490/100/0/threaded"
          },
          {
            "name": "38843",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/38843"
          },
          {
            "name": "[oss-security] 20100309 Re: CVE Request -- cURL/libCURL 7.20.0",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2010/03/09/1"
          },
          {
            "name": "38981",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/38981"
          },
          {
            "name": "ADV-2010-1481",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2010/1481"
          },
          {
            "name": "USN-1158-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-1158-1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://curl.haxx.se/docs/adv_20100209.html"
          },
          {
            "name": "ADV-2010-0725",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2010/0725"
          },
          {
            "name": "DSA-2023",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2010/dsa-2023"
          },
          {
            "name": "RHSA-2010:0329",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2010-0329.html"
          },
          {
            "name": "oval:org.mitre.oval:def:10760",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10760"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.apple.com/kb/HT4188"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=563220"
          },
          {
            "name": "MDVSA-2010:062",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:062"
          },
          {
            "name": "40220",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/40220"
          },
          {
            "name": "GLSA-201203-02",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-201203-02.xml"
          },
          {
            "name": "FEDORA-2010-2720",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037143.html"
          },
          {
            "name": "FEDORA-2010-2762",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036744.html"
          },
          {
            "name": "48256",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48256"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.avaya.com/css/P8/documents/100081819"
          },
          {
            "name": "[oss-security] 20100316 Re: CVE Request -- cURL/libCURL 7.20.0",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2010/03/16/11"
          },
          {
            "name": "39087",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/39087"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.vmware.com/security/advisories/VMSA-2011-0003.html"
          },
          {
            "name": "45047",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/45047"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://wiki.rpath.com/Advisories:rPSA-2010-0072"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://curl.haxx.se/libcurl-contentencoding.patch"
          },
          {
            "name": "20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/516397/100/0/threaded"
          },
          {
            "name": "oval:org.mitre.oval:def:6756",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6756"
          },
          {
            "name": "39734",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/39734"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://curl.haxx.se/docs/security.html#20100209"
          },
          {
            "name": "ADV-2010-0660",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2010/0660"
          },
          {
            "name": "[oss-security] 20100209 CVE Request -- cURL/libCURL 7.20.0",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2010/02/09/5"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2010-02-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "content_encoding.c in libcurl 7.10.5 through 7.19.7, when zlib is enabled, does not properly restrict the amount of callback data sent to an application that requests automatic decompression, which might allow remote attackers to cause a denial of service (application crash) or have unspecified other impact by sending crafted compressed data to an application that relies on the intended data-length limit."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-10T18:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "APPLE-SA-2010-06-15-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html"
        },
        {
          "name": "ADV-2010-0571",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2010/0571"
        },
        {
          "name": "ADV-2010-0602",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2010/0602"
        },
        {
          "name": "20101027 rPSA-2010-0072-1 curl",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/514490/100/0/threaded"
        },
        {
          "name": "38843",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/38843"
        },
        {
          "name": "[oss-security] 20100309 Re: CVE Request -- cURL/libCURL 7.20.0",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2010/03/09/1"
        },
        {
          "name": "38981",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/38981"
        },
        {
          "name": "ADV-2010-1481",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2010/1481"
        },
        {
          "name": "USN-1158-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-1158-1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://curl.haxx.se/docs/adv_20100209.html"
        },
        {
          "name": "ADV-2010-0725",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2010/0725"
        },
        {
          "name": "DSA-2023",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2010/dsa-2023"
        },
        {
          "name": "RHSA-2010:0329",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2010-0329.html"
        },
        {
          "name": "oval:org.mitre.oval:def:10760",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10760"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.apple.com/kb/HT4188"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=563220"
        },
        {
          "name": "MDVSA-2010:062",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:062"
        },
        {
          "name": "40220",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/40220"
        },
        {
          "name": "GLSA-201203-02",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-201203-02.xml"
        },
        {
          "name": "FEDORA-2010-2720",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037143.html"
        },
        {
          "name": "FEDORA-2010-2762",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036744.html"
        },
        {
          "name": "48256",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48256"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.avaya.com/css/P8/documents/100081819"
        },
        {
          "name": "[oss-security] 20100316 Re: CVE Request -- cURL/libCURL 7.20.0",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2010/03/16/11"
        },
        {
          "name": "39087",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/39087"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.vmware.com/security/advisories/VMSA-2011-0003.html"
        },
        {
          "name": "45047",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/45047"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://wiki.rpath.com/Advisories:rPSA-2010-0072"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://curl.haxx.se/libcurl-contentencoding.patch"
        },
        {
          "name": "20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/516397/100/0/threaded"
        },
        {
          "name": "oval:org.mitre.oval:def:6756",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6756"
        },
        {
          "name": "39734",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/39734"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://curl.haxx.se/docs/security.html#20100209"
        },
        {
          "name": "ADV-2010-0660",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2010/0660"
        },
        {
          "name": "[oss-security] 20100209 CVE Request -- cURL/libCURL 7.20.0",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2010/02/09/5"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2010-0734",
    "datePublished": "2010-03-19T19:00:00.000Z",
    "dateReserved": "2010-02-26T00:00:00.000Z",
    "dateUpdated": "2024-08-07T00:59:39.012Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CERTA-2010-AVI-461

Vulnerability from certfr_avis

De nombreuses vulnérabilités affectant différents logiciels inclus dans VMware ESX Console OS ont été corrigées.

Description

Plusieurs logiciels vulnérables inclus dans VMware ESX Console OS ont été mis à jour par l'éditeur :

le composant NSS_db est mis à jour pour corriger une vulnérabilité permettant à un utilisateur malveillant d'accéder à des données confidentielles (CVE-2010-0826) ;
une mise à jour du composant OpenLDAP corrige un erreur dans la gestion du Common Name d'un certificat X.509, qui permet une attaque du type « homme au milieu » (CVE-2009-3767) ;
la bibliothèque libcurl est mise à jour afin de corriger une vulnérabilité permettant à un attaquant d'effectuer à distance un déni de service par arrêt inopiné (CVE-2010-0734) ;
le logiciel sudo est mis à jour pour corriger une erreur concernant la gestion d'une variable d'environnement permettant à un utilisateur malveillant d'élever ses privilèges (CVE-2010-1646) ;
une mise à jour groupée des composants OpenSSL, GnuTLS, NSS et NSPR corrige différentes vulnérabilités permettant entre autres un déni de service et l'élévation de privilèges (CVE-2009-3555, CVE-2009-2409, CVE-2009-3245 et CVE-2010-0433).

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

VMware ESX 4.0 Console OS (COS).

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité VMSA-2010-0015 du 30 septembre 2010

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cp\u003eVMware ESX 4.0 Console OS (COS).\u003c/p\u003e",
  "content": "## Description\n\nPlusieurs logiciels vuln\u00e9rables inclus dans VMware ESX Console OS ont\n\u00e9t\u00e9 mis \u00e0 jour par l\u0027\u00e9diteur :\n\n-   le composant NSS_db est mis \u00e0 jour pour corriger une vuln\u00e9rabilit\u00e9\n    permettant \u00e0 un utilisateur malveillant d\u0027acc\u00e9der \u00e0 des donn\u00e9es\n    confidentielles (CVE-2010-0826) ;\n-   une mise \u00e0 jour du composant OpenLDAP corrige un erreur dans la\n    gestion du Common Name d\u0027un certificat X.509, qui permet une attaque\n    du type \u00ab homme au milieu \u00bb (CVE-2009-3767) ;\n-   la biblioth\u00e8que libcurl est mise \u00e0 jour afin de corriger une\n    vuln\u00e9rabilit\u00e9 permettant \u00e0 un attaquant d\u0027effectuer \u00e0 distance un\n    d\u00e9ni de service par arr\u00eat inopin\u00e9 (CVE-2010-0734) ;\n-   le logiciel sudo est mis \u00e0 jour pour corriger une erreur concernant\n    la gestion d\u0027une variable d\u0027environnement permettant \u00e0 un\n    utilisateur malveillant d\u0027\u00e9lever ses privil\u00e8ges (CVE-2010-1646) ;\n-   une mise \u00e0 jour group\u00e9e des composants OpenSSL, GnuTLS, NSS et NSPR\n    corrige diff\u00e9rentes vuln\u00e9rabilit\u00e9s permettant entre autres un d\u00e9ni\n    de service et l\u0027\u00e9l\u00e9vation de privil\u00e8ges (CVE-2009-3555,\n    CVE-2009-2409, CVE-2009-3245 et CVE-2010-0433).\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2010-0433",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0433"
    },
    {
      "name": "CVE-2010-0826",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0826"
    },
    {
      "name": "CVE-2010-0734",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0734"
    },
    {
      "name": "CVE-2009-3767",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3767"
    },
    {
      "name": "CVE-2010-1646",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-1646"
    },
    {
      "name": "CVE-2009-3555",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3555"
    },
    {
      "name": "CVE-2009-3245",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3245"
    },
    {
      "name": "CVE-2009-2409",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-2409"
    }
  ],
  "initial_release_date": "2010-10-01T00:00:00",
  "last_revision_date": "2010-10-01T00:00:00",
  "links": [],
  "reference": "CERTA-2010-AVI-461",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2010-10-01T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De nombreuses vuln\u00e9rabilit\u00e9s affectant diff\u00e9rents logiciels inclus dans\n\u003cspan class=\"textit\"\u003eVMware ESX Console OS\u003c/span\u003e ont \u00e9t\u00e9 corrig\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans VMware ESX Server",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 VMSA-2010-0015 du 30 septembre 2010",
      "url": "http://lists.vmware.com/pipermail/security-announce/2010/000106.html"
    }
  ]
}

CERTA-2010-AVI-265

Vulnerability from certfr_avis

De multiples vulnérabilité ont été découvertes dans Mac OS X. L'exploitation de ces vulnérabilités permet de réaliser un grand nombre d'actions malveillantes.

Description

Ces vulnérabilités touchent de nombreux logiciels faisant partis du système Mac OS X. Elles permettent à une personne malveillante de réaliser un grand nombre d'actions malveillantes, dont l'exécution de code arbitraire à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Mac OS X 10.6 (Snow Leopard) versions antérieures à 10.6.4.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité Apple du 15 juin 2010	None	vendor-advisory
Bulletin de sécurité Apple HT4188 du 15 juin 2010 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cp\u003eMac OS X 10.6 (Snow Leopard) versions  ant\u00e9rieures \u00e0 10.6.4.\u003c/p\u003e",
  "content": "## Description\n\nCes vuln\u00e9rabilit\u00e9s touchent de nombreux logiciels faisant partis du\nsyst\u00e8me Mac OS X. Elles permettent \u00e0 une personne malveillante de\nr\u00e9aliser un grand nombre d\u0027actions malveillantes, dont l\u0027ex\u00e9cution de\ncode arbitraire \u00e0 distance.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2009-1578",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1578"
    },
    {
      "name": "CVE-2010-0540",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0540"
    },
    {
      "name": "CVE-2010-1380",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-1380"
    },
    {
      "name": "CVE-2010-0734",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0734"
    },
    {
      "name": "CVE-2010-0283",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0283"
    },
    {
      "name": "CVE-2010-1374",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-1374"
    },
    {
      "name": "CVE-2009-1580",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1580"
    },
    {
      "name": "CVE-2010-0543",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0543"
    },
    {
      "name": "CVE-2010-0546",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0546"
    },
    {
      "name": "CVE-2010-0545",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0545"
    },
    {
      "name": "CVE-2009-1581",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1581"
    },
    {
      "name": "CVE-2010-1748",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-1748"
    },
    {
      "name": "CVE-2009-1579",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1579"
    },
    {
      "name": "CVE-2009-2964",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-2964"
    },
    {
      "name": "CVE-2010-0186",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0186"
    },
    {
      "name": "CVE-2010-0302",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0302"
    },
    {
      "name": "CVE-2010-1320",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-1320"
    },
    {
      "name": "CVE-2010-1379",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-1379"
    },
    {
      "name": "CVE-2010-1382",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-1382"
    },
    {
      "name": "CVE-2010-1377",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-1377"
    },
    {
      "name": "CVE-2010-0541",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0541"
    },
    {
      "name": "CVE-2010-1375",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-1375"
    },
    {
      "name": "CVE-2010-0187",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0187"
    },
    {
      "name": "CVE-2010-1376",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-1376"
    },
    {
      "name": "CVE-2010-1411",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-1411"
    },
    {
      "name": "CVE-2010-1381",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-1381"
    },
    {
      "name": "CVE-2010-1373",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-1373"
    },
    {
      "name": "CVE-2009-4212",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-4212"
    },
    {
      "name": "CVE-2009-1382",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1382"
    }
  ],
  "initial_release_date": "2010-06-16T00:00:00",
  "last_revision_date": "2010-06-16T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Apple HT4188 du 15 juin 2010 :",
      "url": "http://support.apple.com/kb/HT4188"
    }
  ],
  "reference": "CERTA-2010-AVI-265",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2010-06-16T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9 ont \u00e9t\u00e9 d\u00e9couvertes dans Mac OS X.\nL\u0027exploitation de ces vuln\u00e9rabilit\u00e9s permet de r\u00e9aliser un grand nombre\nd\u0027actions malveillantes.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Apple Mac OS X",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apple du 15 juin 2010",
      "url": null
    }
  ]
}

CERTA-2012-AVI-218

Vulnerability from certfr_avis

De multiples vulnérabilités ont été corrigées dans HP System Management Homepage. Leur exploitation permet, entre autres, d'exécuter du code arbitraire à distance et de réaliser des dénis de service.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

HP System Management Homepage versions antérieures à 7.0.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité HP c03280632 du 16 avril 2012

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003e\u003cSPAN class=\"textit\"\u003eHP System Management Homepage\u003c/SPAN\u003e  versions ant\u00e9rieures \u00e0 7.0.\u003c/P\u003e",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2011-2202",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-2202"
    },
    {
      "name": "CVE-2011-0195",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-0195"
    },
    {
      "name": "CVE-2011-3192",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-3192"
    },
    {
      "name": "CVE-2011-2483",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-2483"
    },
    {
      "name": "CVE-2011-3348",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-3348"
    },
    {
      "name": "CVE-2011-3210",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-3210"
    },
    {
      "name": "CVE-2011-1471",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-1471"
    },
    {
      "name": "CVE-2010-1623",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-1623"
    },
    {
      "name": "CVE-2011-3182",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-3182"
    },
    {
      "name": "CVE-2010-0734",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0734"
    },
    {
      "name": "CVE-2010-2791",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-2791"
    },
    {
      "name": "CVE-2011-3268",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-3268"
    },
    {
      "name": "CVE-2012-0135",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-0135"
    },
    {
      "name": "CVE-2011-1153",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-1153"
    },
    {
      "name": "CVE-2010-4645",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-4645"
    },
    {
      "name": "CVE-2010-2068",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-2068"
    },
    {
      "name": "CVE-2010-1452",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-1452"
    },
    {
      "name": "CVE-2011-3267",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-3267"
    },
    {
      "name": "CVE-2010-4409",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-4409"
    },
    {
      "name": "CVE-2011-1148",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-1148"
    },
    {
      "name": "CVE-2011-1467",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-1467"
    },
    {
      "name": "CVE-2011-3368",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-3368"
    },
    {
      "name": "CVE-2012-1993",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-1993"
    },
    {
      "name": "CVE-2011-2192",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-2192"
    },
    {
      "name": "CVE-2011-3207",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-3207"
    },
    {
      "name": "CVE-2011-1470",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-1470"
    },
    {
      "name": "CVE-2011-1464",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-1464"
    },
    {
      "name": "CVE-2011-3639",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-3639"
    },
    {
      "name": "CVE-2009-0037",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-0037"
    },
    {
      "name": "CVE-2010-3436",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-3436"
    },
    {
      "name": "CVE-2011-4317",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-4317"
    },
    {
      "name": "CVE-2011-1945",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-1945"
    },
    {
      "name": "CVE-2011-1928",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-1928"
    },
    {
      "name": "CVE-2011-3846",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-3846"
    },
    {
      "name": "CVE-2011-0014",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-0014"
    },
    {
      "name": "CVE-2011-0419",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-0419"
    },
    {
      "name": "CVE-2011-1468",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-1468"
    },
    {
      "name": "CVE-2011-1938",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-1938"
    },
    {
      "name": "CVE-2011-3189",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-3189"
    }
  ],
  "initial_release_date": "2012-04-18T00:00:00",
  "last_revision_date": "2012-04-18T00:00:00",
  "links": [],
  "reference": "CERTA-2012-AVI-218",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2012-04-18T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eHP System Management Homepage\u003c/span\u003e. Leur exploitation\npermet, entre autres, d\u0027ex\u00e9cuter du code arbitraire \u00e0 distance et de\nr\u00e9aliser des d\u00e9nis de service.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans HP System Management Homepage",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 HP c03280632 du 16 avril 2012",
      "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03280632"
    }
  ]
}

CERTA-2010-AVI-138

Vulnerability from certfr_avis

Une vulnérabilité de type débordement de mémoire permet à un utilisateur distant d'effectuer un déni de service.

Description

Une vulnérabilité découverte dans Curl/LibCurl permet de créer un déni de service. La vulnérabilité n'est exploitable que si l'option de décompression automatique à été activée par l'application.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

cURL et LibCurl en versions 7.10.5 à 7.19.7 (inclus)

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité Curl du 9 février 2010	None	vendor-advisory
Bulletin de sécurité cURL du 9 fevrier 2010 :	-	other
Bulletin de sécurité Mandriva MDVSA-2010:062 du 19 mars 2010 :	-	other
Bulletin de sécurité Debian DSA 2023 du 28 mars 2010 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cp\u003ecURL et LibCurl en versions 7.10.5 \u00e0  7.19.7 (inclus)\u003c/p\u003e",
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 d\u00e9couverte dans Curl/LibCurl permet de cr\u00e9er un d\u00e9ni\nde service. La vuln\u00e9rabilit\u00e9 n\u0027est exploitable que si l\u0027option de\nd\u00e9compression automatique \u00e0 \u00e9t\u00e9 activ\u00e9e par l\u0027application.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2010-0734",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0734"
    }
  ],
  "initial_release_date": "2010-03-29T00:00:00",
  "last_revision_date": "2010-03-29T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 cURL du 9 fevrier 2010 :",
      "url": "http://cuCurl.haxx.se/docs/adv_20100209.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Mandriva MDVSA-2010:062 du 19 mars    2010 :",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:062"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Debian DSA 2023 du 28 mars 2010 :",
      "url": "http://www.debian.org/security/2010/dsa-2023"
    }
  ],
  "reference": "CERTA-2010-AVI-138",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2010-03-29T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 de type d\u00e9bordement de m\u00e9moire permet \u00e0 un utilisateur\ndistant d\u0027effectuer un d\u00e9ni de service.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans cURL/LibCurl",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Curl du 9 f\u00e9vrier 2010",
      "url": null
    }
  ]
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2010-0734 (GCVE-0-2010-0734)

Vulnerability from cvelistv5

CERTA-2010-AVI-461

Vulnerability from certfr_avis

Description

Solution

CERTA-2010-AVI-265

Vulnerability from certfr_avis

Description

Solution

CERTA-2012-AVI-218

Vulnerability from certfr_avis

Solution

CERTA-2010-AVI-138

Vulnerability from certfr_avis

Description

Solution

Tags

Sightings

Nomenclature